1. Controller and scope
The controller is Kiteschool Kitebelles Ltd (BRN C23194572), Royal Road, La Gaulette, 1903-02, Mauritius. Contact: hello@kitebelles.com. Data protection contact: dpo@kitebelles.com. This policy covers kitebelles.com, booking enquiries and related communications.
2. Data we collect
- Enquiry data: name, email or phone/WhatsApp, dates, level, requested format and message.
- Booking and service data: agreed services, payments, attendance, equipment, safety information and correspondence.
- Optional analytics/advertising data: online identifiers, page interactions, campaign parameters and approximate location after consent.
- Technical/security data: IP address, request metadata and logs needed to deliver and protect the site.
- Data you send through WhatsApp, email, social platforms or third-party booking channels under those providers’ own terms.
Please do not submit medical or other sensitive data through the general enquiry form. Where health information is genuinely needed for safe participation, it must be collected separately, minimally and with an appropriate lawful basis.
3. Purposes and Lawful bases
- Responding to an enquiry and preparing a booking: steps requested before a contract.
- Delivering lessons, tours, rental or shop services: contract performance.
- Accounting, safety and legal records: legal obligations and legitimate interests.
- Site security, fraud prevention and service reliability: legitimate interests.
- Analytics, advertising storage and embedded maps: consent, which may be withdrawn at any time.
- Direct electronic marketing: only where permitted by law and with a valid opt-in when required.
4. Recipients and processors
Data may be handled by authorised Kitebelles staff and by the providers listed below. We do not sell personal data.
- Cloudflare — site hosting, delivery and security.
- EspoCRM, self-hosted by the operator on a dedicated server in Germany — booking enquiries and customer records.
- Vendure, on the same server — the shop catalogue.
- Telegram — an internal channel that notifies the operator of a new enquiry; the notification contains the name, phone number and email address you submitted.
- Zoho Mail (European data centre) — email to and from hello@, admin@ and dpo@kitebelles.com.
- Google (Tag Manager, Analytics 4, Ads, Maps) — only according to your cookie choice.
- Microsoft (Clarity) and Yandex (Metrica) — traffic analysis, only with Analytics consent; each acts as a separate controller under its own terms.
- Windy — weather widgets, only with External media consent.
- Payment and accounting providers, where a booking proceeds.
EspoCRM receives campaign parameters and Google click identifiers only when Advertising consent is granted; otherwise it receives the enquiry and service context without those advertising identifiers. If you open WhatsApp, Google Maps or social links, the relevant provider receives data directly under its policy.
5. International transfers
Kitebelles is established in Mauritius and several providers process data abroad. Each transfer is made under section 36 of the Mauritius Data Protection Act 2017 and, for visitors in the EU or the UK, under Chapter V of the GDPR.
- Cloudflare — global network including the European Union and the United States, under the standard contractual clauses in Cloudflare's data processing addendum.
- EspoCRM and Vendure — Germany, inside the European Economic Area.
- Zoho Mail — European Union.
- Telegram — Telegram FZ-LLC, United Arab Emirates.
- Google and Microsoft — European Union and the United States.
- Yandex — Russia, a country with no adequacy decision. Metrica loads only after Analytics consent and truncates visitor IP addresses before storage.
- Windy — European Union.
Optional services load only after you consent, and that explicit consent is the basis relied on for their transfers. Withdrawing consent in Cookie settings stops every further optional transfer.
6. Retention
| Record | Period |
|---|---|
| Unsuccessful enquiries | 24 months from the last contact |
| Booking, payment and safety records | 5 years after the transaction, under section 19(4) of the Value Added Tax Act |
| Consent preference on your device | 180 days |
| Advertising attribution on your device | 30 days |
| Google Analytics 4 (stream G-SLYWH03C6S) | 14 months for event and user data, reset on new activity |
| Google Ads, Microsoft Clarity, Yandex Metrica | the retention each provider applies to its own analytics and advertising data |
| Cloudflare logs | up to 7 days |
Data is deleted or anonymised when its purpose and applicable legal retention end.
7. Your rights
Subject to applicable law, you may request access, correction, erasure, restriction or objection; withdraw consent; and ask about transfers and automated decision-making. We do not make booking decisions solely by automated means. Send requests to dpo@kitebelles.com. Identity verification may be required. You may complain to the Mauritius Data Protection Commissioner and, where applicable, your local supervisory authority.
8. Children
Lessons may involve minors, but a person under 16 must not submit personal data or consent to optional processing without a parent or legal guardian. Booking and safety information for minors must be supplied and approved by the responsible adult.
9. Security and breaches
We apply proportionate access, encryption, minimisation and incident-response controls. No online system is risk-free. A qualifying personal data breach will be handled under applicable notification duties, including the Mauritius 72-hour notification rule where applicable.
10. Changes and contact
Material changes will be shown on this page with a new date. Questions and rights requests: dpo@kitebelles.com.