1. Controller and scope
The controller is [LEGAL NAME], [REGISTERED ADDRESS], Mauritius. Contact: [email protected]. Data protection contact: [DATA PROTECTION CONTACT]. This policy covers kitebelles.com, booking enquiries and related communications.
2. Data we collect
- Enquiry data: name, email or phone/WhatsApp, dates, level, requested format and message.
- Booking and service data: agreed services, payments, attendance, equipment, safety information and correspondence.
- Optional analytics/advertising data: online identifiers, page interactions, campaign parameters and approximate location after consent.
- Technical/security data: IP address, request metadata and logs needed to deliver and protect the site.
- Data you send through WhatsApp, email, social platforms or third-party booking channels under those providers’ own terms.
Please do not submit medical or other sensitive data through the general enquiry form. Where health information is genuinely needed for safe participation, it must be collected separately, minimally and with an appropriate lawful basis.
3. Purposes and Lawful bases
- Responding to an enquiry and preparing a booking: steps requested before a contract.
- Delivering lessons, tours, rental or shop services: contract performance.
- Accounting, safety and legal records: legal obligations and legitimate interests.
- Site security, fraud prevention and service reliability: legitimate interests.
- Analytics, advertising storage and embedded maps: consent, which may be withdrawn at any time.
- Direct electronic marketing: only where permitted by law and with a valid opt-in when required.
4. Recipients and processors
Data may be handled by authorised Kitebelles staff and contracted providers including Cloudflare (hosting, delivery and security), the operator’s EspoCRM service, email/communications providers, payment/accounting providers where a booking proceeds, and Google services only according to your cookie choice. If you open WhatsApp, Google Maps or social links, the relevant provider receives data directly under its policy. We do not sell personal data.
5. International transfers
Some providers may process data outside Mauritius or your country. Before publication, the operator must document provider locations and safeguards under section 36 of the Mauritius Data Protection Act 2017 and, where applicable, GDPR/UK GDPR transfer rules: [TRANSFER MECHANISMS AND PROVIDER LOCATIONS TO BE COMPLETED].
6. Retention
| Record | Period |
|---|---|
| Unsuccessful enquiries | [ENQUIRY RETENTION PERIOD] |
| Booking, payment and safety records | [CONTRACT / LEGAL RETENTION PERIOD] |
| Consent preference on your device | 180 days |
| Google analytics/advertising data | [GA4 / GOOGLE ADS RETENTION SETTINGS] |
| Cloudflare security logs | [CLOUDFLARE LOG RETENTION] |
Data is deleted or anonymised when its purpose and applicable legal retention end.
7. Your rights
Subject to applicable law, you may request access, correction, erasure, restriction or objection; withdraw consent; and ask about transfers and automated decision-making. We do not make booking decisions solely by automated means. Send requests to [DATA PROTECTION CONTACT]. Identity verification may be required. You may complain to the Mauritius Data Protection Commissioner and, where applicable, your local supervisory authority.
8. Children
Lessons may involve minors, but a person under 16 must not submit personal data or consent to optional processing without a parent or legal guardian. Booking and safety information for minors must be supplied and approved by the responsible adult.
9. Security and breaches
We apply proportionate access, encryption, minimisation and incident-response controls. No online system is risk-free. A qualifying personal data breach will be handled under applicable notification duties, including the Mauritius 72-hour notification rule where applicable.
10. Changes and contact
Material changes will be shown on this page with a new date. Questions and rights requests: [DATA PROTECTION CONTACT / EMAIL].