Privacy Policy

Last updated: May 2026

This Privacy Policy explains how Freddy Olander (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit freddyolander.com and bigwaveexperience.com. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese data protection law.

1. What Data We Collect

We may collect the following personal data:

• Contact information — name and email address when you submit a contact form or sign up for our newsletter
• Usage data — pages visited, time spent, browser type, device type, and IP address (anonymised)
• Communication data — messages you send us via contact forms

2. How We Use Your Data

We use your data for the following purposes:

• To respond to your enquiries and booking requests
• To send you newsletters and updates you have subscribed to
• To analyse website traffic and improve our content (via Google Analytics)
• To protect our website against spam and abuse (via Google reCAPTCHA)

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Consent — for newsletter subscriptions and non-essential cookies
• Legitimate interests — for website analytics and security
• Contract — when processing data necessary to fulfil a booking or service request

4. Cookies

Our website uses cookies to improve your experience. Cookies are small text files stored on your device. We use the following types of cookies:

• Necessary cookies — required for the website to function correctly
• Analytics cookies — used by Google Analytics to understand how visitors use our site
• Functional cookies — used to remember your preferences (e.g. cookie consent)

You can manage your cookie preferences at any time via our cookie consent banner. You can also configure your browser to refuse cookies, though this may limit some website functionality.

5. Google Analytics

We use Google Analytics to analyse website traffic. Google Analytics collects anonymised usage data including pages visited, time on site, and device information. IP anonymisation is enabled, meaning your full IP address is never stored.

Google Analytics data is processed by Google LLC (USA). For more information, see Google’s Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on.

6. Google reCAPTCHA

Our contact forms are protected by Google reCAPTCHA v3, which helps us detect and prevent spam. reCAPTCHA collects hardware and software information and sends it to Google for analysis. This processing is based on our legitimate interest in protecting our website from abuse. For more information, see Google’s Privacy Policy.

7. Newsletter — MailerLite

If you subscribe to our newsletter, your name and email address are stored and processed by MailerLite (UAB “MailerLite”, Paupio g. 46, Vilnius, Lithuania). MailerLite is GDPR-compliant and acts as our data processor.

You can unsubscribe at any time by clicking the unsubscribe link in any newsletter email. For more information, see MailerLite’s Privacy Policy.

8. YouTube

Our website embeds videos hosted on YouTube (Google LLC, USA). When you visit a page containing a YouTube video, a connection is established with YouTube servers. If you are logged into your YouTube account, YouTube may associate your visit with your account. For more information, see Google’s Privacy Policy.

9. LinkedIn

We maintain a presence on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit our LinkedIn profile, LinkedIn may collect and process data in accordance with their own privacy policy. For more information, see LinkedIn’s Privacy Policy.

10. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

• Contact form submissions — up to 2 years
• Newsletter subscriber data — until you unsubscribe
• Analytics data — up to 26 months (Google Analytics default)

11. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data
• Right to restriction — request that we limit processing of your data
• Right to data portability — request your data in a portable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at contact@bigwavesurfers.com. We will respond within 30 days.

12. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Our website is served over HTTPS. However, no method of transmission over the internet is completely secure.

13. International Transfers

Some of our service providers (e.g. Google, MailerLite) may process data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The most recent version will always be available on this page with the date of last update shown at the top.

15. Contact & Complaints

If you have any questions about this Privacy Policy or how we handle your data, please contact us at contact@bigwavesurfers.com.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese data protection authority: