This policy explains how Arica Surf Experience (also “Maturana Surf Training”) processes the personal data we receive through this website and our contact channels, in accordance with Chile's Personal Data Protection Act No. 21,719 (Ley 21.719).
Data controller
- Controller: Arica Surf Experience — Miguel Maturana, legal representative.
- Address: Sector El Buey, Las Machas, Arica, Región de Arica y Parinacota, Chile.
- Contact for rights and inquiries: miguelmaturanacoach@gmail.com · WhatsApp +56 9 5749 5773.
- Privacy officer: Miguel Maturana — miguelmaturanacoach+privacidad@gmail.com (dedicated channel). We do not have an external data protection officer.
What data we process
This website is informational and has no registration forms or database of its own. We only process the data you voluntarily provide when you contact us via WhatsApp, email, or in person:
Arica Surf Experience is a surf school and does not provide healthcare services. We only ask for physical information to adapt the activity safely.
- Name and contact details (phone, email, or WhatsApp username).
- Dates, times, and number of people to arrange a lesson or service.
- Experience level and preferences to adapt the activity.
- Messages and information you choose to share with us in the conversation.
- If you book for a minor: the minor's name and age, level, and a parent or guardian contact.
- Technical browsing data: IP address, date and time, browser, device, and requested pages, recorded in the server's security logs. Kept for up to 90 days and used only for security and diagnostics.
Sensitive data. We do not request sensitive data through this website. For your safety, we may ask you to declare relevant physical or health conditions (for example, injuries, limitations, or conditions that affect surfing). That data is processed only with your explicit consent and is limited to what is necessary to adapt the activity and prevent risks. If the data subject is an adolescent under sixteen, consent is given by their parent, legal representative, or the person with parental responsibility.
Minors
This website does not collect minors' data or store information about them. When a minor takes lessons, arrangements are made directly with their parent, legal representative, or guardian, and the corresponding authorization is signed in the in-person contract before the activity.
Under Article 16 quáter of Law 21,719, personal data of children and adolescents is processed in accordance with their best interests and progressive autonomy. For children under fourteen, the consent of their parents, legal representatives, or the person with parental responsibility is required. Adolescents are subject to the general rules, except for sensitive data of adolescents under sixteen, which also requires the consent of their parents or legal representatives.
Purposes and legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name and contact details | Responding to inquiries and arranging bookings | Performance of the requested relationship and your consent when you contact us |
| Dates, times, and number of people | Arranging the booking | Performance of the requested relationship |
| Experience level and preferences | Adapting the activity | Performance of the requested relationship |
| Conversation messages | Responding to your inquiry | Your consent |
| Minor's and guardian's data | Arranging participation and authorization | Guardian's consent and the minor's best interests |
| Physical conditions | Adapting the activity and preventing risks | Your explicit consent (sensitive data) |
| Technical browsing data (IP, browser, device) | Site security and diagnostics | Legitimate interest in security |
We do not use your data for third-party advertising or make automated decisions about you.
How long we keep data
- Inquiries that do not become a booking: 12 months from the last contact; then deleted.
- Bookings, lessons, and contracts: 5 years from the last activity; then deleted.
- Guardian authorizations: 5 years from the last activity; then deleted.
- Physical-condition declarations: 5 years from the last activity; then deleted.
- WhatsApp or email conversations: 2 years from the last message, unless they must be kept for a claim.
When the period ends, we delete the data from our channels and backups through secure deletion. If a legal retention obligation applies, we block the data and limit processing to that obligation.
Your rights and how to exercise them
As a data subject, you may exercise the following rights:
- Access: know what data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer necessary.
- Objection: object to a specific processing activity.
- Portability: receive your data in a readable, reusable format.
- Blocking: request temporary suspension of processing in the cases allowed by law.
- Withdrawal of consent: withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise them, email miguelmaturanacoach@gmail.com stating your name and the right you wish to exercise. We will reply in writing within 30 calendar days of receiving your request. If we need to extend it by another 30 days, we will inform you in writing through the same channel you used or by email before the first 30 days expire, stating the reason and the new date.
If you believe we have not responded appropriately, you may file a complaint with the Data Protection Agency (Agencia de Protección de Datos Personales), without prejudice to any other rights granted by law.
Security and incident notification
We apply reasonable measures: role-based access, two-factor authentication on accounts, encryption in transit (HTTPS/TLS), backups, and periodic access reviews. No measure is an absolute guarantee. If we detect a security breach that may affect your rights, we will report it to the Data Protection Agency within 72 hours of becoming aware of it, without prejudice to legal deadlines, and, where applicable, inform you or your representative. If the breach affects sensitive data or data of children under fourteen, notification to data subjects or their representatives will be made in accordance with the law.
Changes and version of this policy
We may update this policy to reflect changes in the service or in applicable regulations. We will publish the current version on this page, with its version number and update date. The published version replaces previous versions from its date.
Contact
Arica Surf Experience · Sector El Buey, Las Machas, Arica, Chile.
WhatsApp +56 9 5749 5773 ·
miguelmaturanacoach@gmail.com