Surf Eye Lda. (“Surf Eye”, “we”, “our” or “us”) provides automated video and photo recording, processing and delivery services at participating surf parks and other sports venues.

This Privacy Policy explains how we collect, use, store and share personal data when you:

• are recorded by Surf Eye cameras at a participating venue;
• create or use a Surf Eye account;
• access, claim, purchase or download video or photo content;
• purchase Credits, Packs or Subscriptions;
• use a Surf Eye website or web application;
• contact us for support or exercise your privacy rights; or
• otherwise interact with the Surf Eye service.

The exact configuration of the Surf Eye service may vary between venues.

Additional venue-specific information may be provided where required.

The controller responsible for the personal data described in this Privacy Policy is:

Email: info@surfeye.video

Depending on how you use Surf Eye, we may process the following categories of personal data.

Camera and Content data

This may include:

• video recordings;
• photographs;
• recordings of your sports activity;
• the venue, camera, date and time associated with the recording; and
• limited technical and session-related metadata.

Account data

This may include:

• your name;
• email address;
• account identifier;
• authentication and account information; and
• account preferences.

Session and Album data

This may include:

• the venue you attended;
• the date and time of your Session;
• Albums associated with the Session;
• Content you claim, purchase or retain; and
• information needed to verify or manage access to a particular Session.

Purchase and transaction data

This may include:

• products or services purchased;
• Credits, Packs or Subscriptions;
• transaction references;
• payment status;
• refunds; and
• information required for accounting and administrative purposes.

Payment-card details are processed by our payment-service providers, such as Stripe. Surf Eye does not store full payment-card details within the Surf Eye platform.

Support and privacy-request data

If you contact us, we may process:

• your communications with us;
• information relating to a support request or complaint; and
• information necessary to respond to privacy or deletion requests.

Technical data

When you use our websites or platform, we may also process limited technical information needed to operate, secure and maintain the Service.

Surf Eye uses fixed cameras at participating venues to record defined areas where sports activity takes place.

The footage is processed using automated computer-vision technology to detect, track, edit and organise sports activity into individual clips and Albums.

Within a particular Session, temporary processing may be used to group clips belonging to different participants.

Surf Eye does not use facial recognition, does not create facial templates, does not use biometric identification to identify participants, and does not recognise individuals across separate Sessions.

Temporary Session-specific grouping information is deleted after the relevant processing has been completed.

The continuous video stream is generally processed locally at the venue. Finished clips and limited metadata required for access and delivery may then be transferred to Surf Eye's cloud infrastructure.

Surf Eye cameras may record participants regardless of whether they have created a Surf Eye account or purchased Content.

Recording takes place only in defined areas of participating venues and should be communicated through venue signage, booking or check-in information and other appropriate notices.

A person does not need to purchase Content simply because they have been recorded.

Where technically and operationally possible, Surf Eye and participating venues may also provide mechanisms to suppress or remove Content following a valid objection or deletion request.

At some venues, access to Content is restricted to participants in the relevant Session.

Surf Eye's automated system may create different Albums representing the different participants detected within that Session.

Because the system does not use facial recognition or automatically associate each Album with a participant's civil identity, participants may need to identify and claim the Album that belongs to them.

Depending on the venue configuration, participants in the same Session may be able to view the Albums generated for that Session while identifying their own Content.

Participants are not permitted to intentionally claim, use or download another person's Content.

We process personal data for the following purposes.

Providing the Surf Eye service

We process video and related information in order to:

• record sports activity;
• detect and generate individual clips;
• organise Content into Session Albums;
• provide access to recordings;
• allow users to claim, purchase and retain Content; and
• manage access to the Surf Eye platform.

Where appropriate, this processing is based on our legitimate interests in operating and providing the Surf Eye recording service, balanced against the privacy rights of participants.

Once you create an account, purchase Content or otherwise request Surf Eye services, certain processing is also necessary for the performance of our contract with you.

Managing accounts, purchases and Subscriptions

We process account and transaction information to:

• create and manage your account;
• provide purchased Content;
• administer Credits, Packs and Subscriptions;
• process refunds;
• manage purchases; and
• provide customer support.

This processing is generally necessary for the performance of our contract with you.

Safety, incidents and legal claims

At certain venues, a lower-resolution local copy of Session footage may be temporarily retained for:

• participant safety;
• investigation of accidents or incidents;
• insurance matters; and
• the establishment, exercise or defence of legal claims.

Where applicable, this processing is based on our or the relevant parties' legitimate interests in safety, incident investigation and legal protection.

Security and operation of the Service

We may process personal data to:

• protect accounts and Content;
• detect or investigate misuse;
• maintain the reliability and security of the Service; and
• administer privacy, moderation and deletion requests.

This is based on our legitimate interests in operating a secure and reliable service.

Legal and regulatory obligations

We may process and retain information where necessary to comply with accounting, tax, consumer, regulatory or other legal obligations.

Marketing and promotional use

Where required by applicable law, identifiable Surf Eye Content will only be used publicly for advertising, promotional or social-media purposes where appropriate permission has been obtained.

Public promotional use is separate from the processing required to provide the Surf Eye Service.

Personal data may be accessible to the following categories of recipients where necessary.

Surf Eye personnel

A limited number of authorised Surf Eye personnel may access personal data for purposes such as:

• operating and maintaining the Service;
• customer support;
• technical troubleshooting;
• privacy and moderation requests; and
• legal or compliance matters.

Participating venues

Authorised personnel at participating venues may have limited access to relevant Content, Session information or administration and moderation functionality where required for the operation of the Service.

Other participants in the same Session

Where a Session-restricted gallery is used, verified participants may be able to view the Albums generated for that Session while identifying their own Content.

Service providers

We use service providers to operate Surf Eye, including providers of:

• cloud storage and infrastructure;
• hosting;
• payment processing;
• communications;
• authentication;
• networking; and
• other technical services.

These providers process personal data only to the extent necessary to provide the relevant services and are subject to appropriate contractual and security requirements where required.

Authorities and legal recipients

We may disclose information where required by law or where reasonably necessary for the establishment, exercise or defence of legal claims.

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Unpurchased or unretained Content

Content that has not been purchased, selected or otherwise retained is stored only for a limited period.

Depending on the venue and configuration, this may be up to 30 days, after which the Content is automatically deleted.

Purchased or retained Content

Content that you purchase or choose to retain may remain available through your Surf Eye account while the account remains active or until the Content is deleted, subject to applicable legal, privacy, security and technical requirements.

You should download any Content that you wish to retain permanently.

Account information

Account information is generally retained while your account remains active and may be deleted following account closure, subject to legal retention requirements.

Safety and incident footage

Where local safety footage is retained, it is normally deleted within 30 days unless a particular incident, insurance matter or legal claim requires the relevant footage to be preserved for longer.

Support and privacy requests

Records relating to support, complaints and privacy requests may be retained for as long as reasonably necessary to handle the matter and demonstrate compliance.

Transaction and compliance records

Certain transaction, accounting and compliance information may be retained for the periods required by applicable law.

Surf Eye operates internationally.

Where possible, Surf Eye configures storage and processing infrastructure in or close to the relevant region.

The Surf Eye architecture uses local processing at participating venues and regional cloud infrastructure for finished Content where applicable.

Where personal data protected by European data-protection law is transferred outside the European Economic Area, we use appropriate safeguards where required, such as:

• an applicable adequacy decision;
• Standard Contractual Clauses; or
• another lawful transfer mechanism.

Surf Eye uses technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration.

These measures may include:

• encryption in transit and at rest;
• access and authorisation controls;
• restricted administrative access;
• logging and monitoring;
• separation of identifying information from operational data;
• local-first video processing;
• limited retention periods; and
• automatic deletion of temporary Session-grouping information.

No system can, however, guarantee absolute security.

Depending on the law applicable to you, you may have rights including the right to:

• obtain confirmation of whether we process your personal data;
• access your personal data;
• correct inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• receive certain personal data in a portable format;
• object to certain processing based on legitimate interests; and
• withdraw consent where processing is based on consent.

Where you withdraw consent, this does not affect the lawfulness of processing that took place before withdrawal.

Where you object to processing based on legitimate interests, we will stop the relevant processing unless we have compelling legitimate grounds to continue which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

To exercise your rights, contact: info@surfeye.video

We may need to verify your identity before acting on certain requests.

You also have the right to lodge a complaint with the data-protection authority competent for your location.

For Surf Eye Lda. in Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

If you appear in Surf Eye Content and would like us to review, suppress or delete the relevant Content, contact: info@surfeye.video

Please provide enough information for us to identify the relevant Venue, Session and Content.

Where appropriate, authorised venue personnel may also be able to initiate removal of an Album through Surf Eye's moderation tools.

Certain information may need to be retained where required by law or in connection with an incident, insurance matter or legal claim.

Minors may participate in Sessions and may therefore appear in Surf Eye recordings.

Surf Eye applies additional safeguards where appropriate for children, including controls relating to account management, deletion requests and promotional use.

Users under 16 should have their Surf Eye account created or managed by a parent or legal guardian.

Identifiable Content involving minors will not be used for public promotional purposes where legally required permission has not been obtained.

Surf Eye may publish identifiable Content on its own social-media channels or in promotional materials where appropriate permission has been obtained or another lawful basis applies under applicable law.

If you give permission for promotional use, you may withdraw that permission for future use by contacting: info@surfeye.video

Withdrawal does not make previous lawful use unlawful.

Content already published or shared by third parties may not always be capable of complete removal from third-party platforms.

Surf Eye websites may use cookies or similar technologies where necessary to operate the website and, where applicable, for analytics or other permitted purposes.

Where legally required, non-essential cookies will only be used after the appropriate consent has been obtained.

Further information may be provided through the applicable cookie notice or cookie settings available on the website.

We may update this Privacy Policy from time to time to reflect changes to:

• the Surf Eye Service;
• our technology;
• our processing activities;
• legal or regulatory requirements; or
• the venues and countries in which Surf Eye operates.

The current version will be made available through Surf Eye websites.

Where required by law, we will provide additional notice of material changes.

For questions about this Privacy Policy, the processing of your personal data or the exercise of your privacy rights, contact: info@surfeye.video