Privacy policy

This policy explains how personal data is handled on this website, in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Portuguese Law no. 58/2019.

1. Data controller

Luís Carvalho · Lacrau Surfboards, Portugal. Email: lacrau.surfboards@gmail.com.

2. What data we collect

• Brand requests: name, company, contact, project type, goal, timeline, contact preference, NDA request and any files you choose to send.
• Lacrau orders: name, contact, age, height, weight, stance, surfing habits and the photos or videos you choose to send.
• Technical data: your cookie choice, stored in your browser.

3. Purpose and legal basis

Data is used only to answer your request, prepare a proposal or design your board (pre-contractual steps, art. 6(1)(b) GDPR), and on the basis of your consent (art. 6(1)(a)). Optional analytics run only with consent.

4. How the forms work

When you send a form, your answers are stored in a secure, access-controlled database and used only by the controller to reply to you. Access requires a password and a second verification step. Photos, videos or files you choose to send by email or WhatsApp are kept in the controller's email or WhatsApp account. WhatsApp is operated by Meta Platforms Ireland Ltd. under its own privacy policy.

5. Retention

Requests are kept for as long as needed to reply and follow up, and for a maximum of 24 months after the last contact, unless a contract requires longer retention for legal or tax reasons.

6. Sharing

Data is never sold. It is shared only with service providers needed to run this site and communication tools (hosting, email), under data processing agreements. Brand project information is treated as confidential.

7. Your rights

You can request access, rectification, erasure, restriction, portability or object to processing, and withdraw consent at any time, by writing to lacrau.surfboards@gmail.com. You may also complain to the Portuguese supervisory authority, the CNPD — Comissão Nacional de Proteção de Dados.

8. Minors

Orders for groms (young surfers under 16) must be submitted by a parent or legal guardian.

9. Security

The site is served over HTTPS. Access to received data is limited to the controller.