Privacy Policy

Privacy Statement Surfsignal

This is the privacy statement of Surfsignal, registered with the Chamber of Commerce under number 98743201 and located at Koningin Julianalaan 43 (2252GC) in Voorschoten. This document explains how Surfsignal handles the processing of your personal data. Surfsignal exercises the utmost care when processing your personal data.

Obtaining personal data:

If you use the services of Surfsignal , you yourself provide a number of personal data to Surfsignal , or personal data about you is obtained in the context of the agreement. Personal data is understood to mean all data relating to an identified or identifiable natural person.

Categories of personal data

Surfsignal processes the following categories of personal data:

App users (Free and Super accounts)

SurfSignal only processes the following categories of personal data for regular users of the Application:

• Technical and functional data, including device and installation identification;
• Notification data, including push notification tokens;
• Usage and preference data, including language and region settings;
• Technical log and error data;
• IP address, insofar as technically necessary.
• Subscription data, including the status of a SurfSignal Super subscription and an anonymous subscription identifier, insofar as the User has taken out a subscription.

SurfSignal does not process personal data, contact details, name and address details, payment details, usernames, or passwords of regular app users.

Partners / business users

For Partner accounts, SurfSignal processes the following categories of personal data:

• Personal and contact details, including name, email address, and (optional) telephone number;
• Name and address details;
• Company details, including company name, Chamber of Commerce number, and VAT number;
• Administrative and contractual data.

Calendar access (session planning)

The Application offers an optional feature with which the User can plan sessions and add them to the calendar on their own device. This feature only works after the User has enabled it and has granted the Application access to the calendar via the operating system. This access is based on the User's consent and can be withdrawn at any time via the device settings.

Calendar data is processed exclusively locally on the User's device. The Application reads the list of available calendars so the User can select one, and reads events on planned days solely to find and maintain the events it has created itself. The Application creates, modifies and deletes only its own events, recognisable by the title "SurfSignal", and leaves all other events untouched. Surfsignal does not collect, store or transmit calendar data; no calendar information is sent to Surfsignal or to third parties. The Application only stores on the device which calendar was selected and which events it has created.

Events created by the Application contain information from the Application itself, such as the spot name, the planned times, the spot coordinates, a route link, a link to download the spot and, where applicable, the publicly listed contact details of a partner. Once written to the User's calendar, this content forms part of that calendar and is processed by the User's own calendar provider (for example Google, Apple or Microsoft) under that provider's terms, including synchronisation with that provider's servers and visibility to anyone with whom the User shares the calendar.

Disconnecting the calendar in the Application removes the upcoming events the Application has created; past events remain in the calendar. Events also remain if the Application is removed from the device; the User can delete them via their calendar app.

Device location (map centring)

The Application offers an optional feature with which the User can centre the map on their own surroundings. This feature only works after the User taps the location button on the map and has given the Application access to the location via the operating system. This access is based on the User's consent and can be withdrawn at any time via the settings of the device. The Application never asks for the location when the map is opened, only when the User taps that button.

The Application requests an approximate location only. On Android the Application requests solely approximate access, and on iOS it requests reduced accuracy by default, so the operating system does not supply a precise position. The location is used exclusively to move the map to the surroundings of the User. The Application does not place a spot for the User: the User continues to choose and confirm the location of a spot themselves.

The location is processed exclusively locally on the device of the User. Surfsignal does not collect, store or transmit the location; no location data is sent to Surfsignal or to third parties. The Application stores on the device only the last position the User asked to be shown, and uses it solely to determine where the map opens the next time, and only for as long as the User does not yet have any spots. This data is removed when the Application is removed from the device.

Because no location data is sent to Surfsignal, location is not included in the categories of personal data that Surfsignal processes for app users. The Application does not request access to the location in the background and does not track the movements of the User.

Purpose of processing

The personal data processed by Surfsignal is intended to:

App users

• to enable the technical functioning of the Application;
• send messages and notifications;
• improve performance, stability, and user experience;
• resolving technical problems and errors;
• granting and managing access to paid functionalities (SurfSignal Super).

Partners

• communication and support;
• execution of the agreement;
• administration and invoicing;
• complying with legal obligations.

Payments for subscriptions are made via the Apple App Store and the Google Play Store. SurfSignal does not receive or process any bank, credit card, or other payment details from Users. In order to unlock SurfSignal Super, SurfSignal only receives the subscription status linked to an anonymous subscription identifier. This status is not linked to a name, to contact details or to an account.

Basis for processing

The processing of personal data is only possible on the following grounds: (i) legal obligation, (ii) performance of a contract, (iii) obtained (explicit) consent of the data subjects, and (iv) legitimate interest. Personal data is processed when providing the services of Surfsignal . Surfsignal only processes data that Surfsignal deems necessary for (improving) its services and handles the (personal) data it has collected about you and your use of its services with care. The basis for processing this data is the agreement you have entered into with Surfsignal . Your personal data may also be processed when you visit the website www.surfsignal.com or other web pages if you have given your consent for this.

Necessity of processing

The processing of your personal data is necessary in order to provide the services. The services offered by Surfsignal cannot be fully provided without processing your personal data. If your explicit consent is required for specific purposes relating to personal data, you must give your consent separately.

Automated decision-making

If any automated decision-making takes place, this decision-making is carried out by computer systems and/or computer programs without human intervention. The data subject is responsible for the data he or she provides and that is used at the time of automated decision-making. If the data proves to be incorrect or incomplete, the damage resulting from this is at the expense and risk of the data subject. This also includes the non-performance, late performance, or incorrect performance of the agreement.

Retention period

The personal data processed by Surfsignal is retained in accordance with the relevant laws and regulations. If a longer retention period is required by law or regulation, the personal data will be retained for longer in accordance with these requirements. All (obtained) personal data will not be retained for longer than is strictly necessary.

Processing by third parties

Surfsignal only shares personal data with third parties if this is strictly necessary for the performance of an agreement and to comply with relevant laws and regulations. No personal data is sold. Surfsignal may be subject to a legal obligation to share personal data with third parties. If personal data is shared with third parties, processing agreements will be concluded for this purpose. The third parties with whom personal data is shared are:

• The Payment Provider, for the purpose of executing an agreement. The categories of personal data that are processed are financial data.
• The subscription provider, for the purpose of managing subscriptions and access to SurfSignal Super. The categories of personal data that are processed are technical and subscription data linked to an anonymous identifier.
• The Accountant, for the purpose of executing an agreement. The categories of personal data that are processed are contact and name and address details and financial data.
• Software suppliers, for the purpose of executing the agreement. The categories of personal data that are processed are contact and name and address details.
• Website administrator, for the purpose of performing the agreement. The categories of personal data that are processed are contact and name and address details.
• Third parties engaged for the purpose of performing the agreement. The categories of personal data that are processed are contact details and name and address details.

Security of Personal Data

Surfsignal takes the protection of your personal data seriously and, taking into account the state of the art, implementation costs, as well as the nature, scope, context, and purposes of processing and the varying likelihood and severity of risks to the rights and freedoms of individuals, takes appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

Under 16 years of age?

If you are a minor, i.e. under the age of 16, you may only consent to the processing of your personal data with the consent of one of your parents or legal guardian. It is therefore important that your parent(s) or guardian read this statement. They can also exercise the rights you have with regard to the personal data you leave with us, such as the right to object to the (further) processing of your personal data or the right to access and correct your data.

Rights of data subjects

As a data subject, you have the following rights:

• Right of access; As a data subject, you have the right to obtain confirmation as to whether or not your personal data is being processed and, if so, to obtain access to the processing thereof.
• Right to rectification; You have the right to obtain rectification and completion of inaccurate data.
• Right to erasure; Without unreasonable delay, a data subject must obtain the erasure of personal data concerning him or her.
• Right to restriction of processing; As a data subject, you have the right to restrict the processing of your personal data. To do so, please contact Surfsignal .
• Right to data portability; A data subject has the right to obtain the personal data concerning him or her that he or she has provided to Surfsignal in a structured, commonly used, and machine-readable format in order to transfer this personal data to a third party. A data subject may also instruct Surfsignal to transfer this data directly to a third party.
• Right to object; The data subject has the right at any time to object to the processing of personal data concerning him or her, including profiling based on those provisions, for reasons related to his or her specific situation. Surfsignal will cease processing the personal data unless there are compelling legitimate grounds for the processing that outweigh the interests, freedoms, and rights of the data subject related to the exercise, establishment, or defense of legal claims.

Complaint

If you have a complaint about the way in which Surfsignal handles your personal data, or if you wish to exercise any of the above rights, please contact us via the website or by email at info@surfsignal.com. To ensure that you wish to exercise a right, Surfsignal requests that you send a copy of your ID. You can black out your passport photo and MRZ (strip with numbers at the bottom) to protect your privacy. Surfsignal will respond to your request as soon as possible, but no later than within 4 weeks. You can also submit a complaint to the Dutch Data Protection Authority. This is the competent enforcement authority. You can contact them via this link: https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/tip-ons.

Changes to the Privacy Statement

SurfSignal may amend this Privacy Statement at any time. The most recent version will be made available via the Application and/or the SurfSignal website.

If a change affects the way in which SurfSignal processes personal data, SurfSignal will inform the User of this via a notification in the Application. If necessary, access to (parts of) the Application may be blocked until the User has taken note of and agreed to the amended Privacy Statement.

This version was last adopted on August 29, 2026.

Cookie statement

This is the cookie statement of Surfsignal, registered with the Chamber of Commerce under number 98743201 and located at Koningin Julianalaan 43 (2252GC) in Voorschoten. This document explains how Surfsignal handles cookies and their use.

The use of cookies

Surfsignal uses cookies. A cookie is a simple small file that is sent along with pages from this website and stored by your browser on the hard drive of your computer, mobile phone, smart watch, or tablet. The information stored in it can be sent back to our servers on your next visit.

The use of cookies is very important for the proper functioning of our website, but cookies whose effect you do not immediately see are also very important. Thanks to the (anonymous) input of visitors, we can improve the use of the website and make it more user-friendly.

Types of cookies and purpose

Surfsignal uses technical and functional cookies to optimize the website/application. Cookies are small text files that are sent along when you visit a website to make the user experience of visitors more efficient. Surfsignal may, according to the law, store cookies on your device if these cookies are strictly necessary to use the website. Your consent is required for other types of cookies. We recommend accepting the cookies in order to ensure the user-friendliness of the website. Visitors to the website have the option to check in.

The cookies used by Surfsignal are functional cookies: these cookies ensure that the website works properly. These cookies do not affect privacy, so no consent is required or granted. These cookies are used, for example, to store your browser settings so that our website can be viewed optimally, or to ensure that the website remains accessible (load balancing), but also to prevent other cookies from being placed (no-follow).

With your consent, we place "tracking cookies" on your computer. We use these cookies to keep track of which pages you visit, in order to build up a profile of your online behavior. This profile is not linked to your name, address, email address, etc., but is only used to tailor advertisements to your profile so that they are as relevant to you as possible.

Cookies from Google are also placed on the Surfsignal website for the purposes of Google Analytics. We do not keep track of what you do on the internet. Google Analytics may be required by applicable laws and regulations to provide access to this data. As a result, Surfsignal cannot link information to a natural person. If you have any questions about this, please contact us at info@surfsignal.com.

Use of social media

Surfsignal uses third-party cookies to optimize the website. Some cookies are placed by third-party services that are displayed on the website. Third parties refer to Google Analytics and Social Media (LinkedIn, Meta, Tiktok, Twitter). The use of cookies from other companies (third parties) is subject to the privacy and cookie policies of the companies concerned. When you click on the social media button on the website, a social media cookie is placed. This allows the social media party to recognize your IP address as soon as you share an article from the website. For cookies from social media parties and the data and/or personal data they collect with them, Surfsignal refers you to the privacy and cookie statements of these parties.

Browser settings

If you do not want websites to place cookies on the device you use to view the website, you can adjust your browser settings. Before a cookie is placed, you will receive a warning and you must give your consent for the cookie. If you do not do so, this may result in the website not functioning properly. You can adjust your browser settings so that your browser refuses all cookies, including cookies from third parties. You can also delete cookies that have been placed. To do this, you must adjust your browser settings via preferences and then adjust the privacy settings.

This cookie statement does not apply to third-party websites that are linked to this website. We cannot guarantee that these third parties will handle your personal data in a reliable or secure manner. We recommend that you read the privacy statements of these websites before using them.

Changes to the cookie statement

Surfsignal may change the cookie statement at any time. The most recent version is published on the website. Therefore, always check the website for the most recent version.