Privacy policy

1. Who is responsible

The controller responsible for processing your personal data on this website is:

Nicolás Lacoste · YOS Experiences
Santiago, Chile
Email: [email protected]

For any question about your data or to exercise your rights, write to [email protected]. We answer within one month at the latest.

2. Summary

• We collect data when you send us a reservation request, a message, a partner proposal or an email, and, only if you say yes, to send you news.
• We use it to answer you, prepare your booking and, with your consent, to keep you informed.
• This website uses no advertising, no social media tracking and no tracking cookies. We only use a cookieless visit counter (Cloudflare Web Analytics). Fonts and images are served from our own server.
• You can ask us at any time what data we hold about you, have it corrected or deleted, and withdraw your consent.

3. What we process, why, and on what legal basis

3.1 Visiting the website

When you open a page, your browser automatically sends technical data to our servers: IP address, date and time, page requested, referring page, browser and operating system. Our hosting and security providers process this data to deliver the site and to protect it against abuse and attacks. We do not combine it with other data or use it to identify you.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). Retention: log files are deleted automatically by our providers after a short period, normally within a few weeks, unless needed to investigate a specific security incident.

3.1a Visit statistics without cookies

Our network provider Cloudflare counts visits to this site with Cloudflare Web Analytics. It does not set cookies, does not use your browser's storage and does not create profiles or follow you across other websites. It records aggregated information such as the page visited, the referring site, the country and the type of device, and loading times. We use it to know which content is useful and to keep the site fast.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding, in an anonymous and aggregated way, how the site is used).

3.2 Reservation requests

When you use the "Reserve your spot" form we process: name, email, phone or WhatsApp (optional), the journey you are interested in, preferred month, number of participants, the equipment you will bring and your message. We use this data to check availability, answer you, send you a confirmation email and, if you decide to book, to prepare your contract.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).

3.3 Contact form and emails

When you write to us through the contact form or by email to [email protected] we process your name, email address, the topic and your message, plus any data you choose to include, in order to answer you.

Legal basis: Art. 6(1)(b) GDPR when your message concerns a journey or booking; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

3.4 Partner proposals

If you propose a collaboration through the partners form we process your name, business name, email, activity and message to evaluate and answer your proposal.

Legal basis: Art. 6(1)(b) and (f) GDPR.

3.5 Confirmation emails

After you send a form, our system emails you a short confirmation with a copy of the key details, so you know your request arrived. Legal basis: Art. 6(1)(b) GDPR.

3.6 News by email (only with your consent)

If you tick the optional box "Yes, send me news from YOS Experiences", we will send you occasional emails about new journeys, dates and offers. We use a double opt-in: you first receive an email with a confirmation link, and you are only added once you click it. To be able to prove your consent we record the time of your request and confirmation, your IP address and the text you agreed to.

Legal basis: Art. 6(1)(a) GDPR (your consent); recording the consent is based on Art. 6(1)(c) and (f) GDPR. You can withdraw your consent at any time, without giving reasons, through the link in every email or by writing to [email protected]. Withdrawal does not affect the lawfulness of processing before it. Not ticking the box has no effect on your request or booking.

3.7 Bookings and journeys

If you book a journey, we process the data needed to carry it out: identity and contact details, travel dates, accommodation and, where you share it with us, dietary needs or other information relevant for your participation. We only ask for health-related information if it is necessary for your safety, and only with your explicit consent (Art. 9(2)(a) GDPR).

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for accounting and tax obligations.

3.8 Photos and video during the journeys

Our journeys are about creating images. Photos or videos in which you appear are only published by YOS Experiences (for example on this website or on social media) with your separate consent, which you can withdraw at any time.

4. Who receives your data

We do not sell your data. We share it only with service providers who help us run this website and our communication, and who process it on our behalf and following our instructions:

• Hosting and email server: HostGator (Newfold Digital, Inc.), servers in the United States.
• Security and content delivery network: Cloudflare, Inc., United States, which protects the site against attacks and delivers it faster.
• Email inbox and request register: Google (Gmail, Google Sheets and Google Apps Script), where we receive your messages and keep an organised list of requests.

If you book a journey, we share the strictly necessary data with the local hosts, accommodation and guides who carry out the programme in Morocco. If you ask about a partner-operated experience (Your Dream Camp or Sueño Surf House), we only pass your request to that partner if you ask us to; from then on the partner processes your data as an independent controller under its own privacy policy.

We may also disclose data to authorities when we are legally required to.

5. Transfers outside the European Union

YOS Experiences is based in Chile, and some of our providers are based in the United States. This means your data is processed outside the EU/EEA:

• United States: Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision. For providers without that certification, transfers are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Chile: there is currently no EU adequacy decision for Chile. We transfer your data to Chile because it is necessary to answer the request you send us and to carry out the steps you ask for before and during a contract (Art. 49(1)(b) GDPR), and, for news emails, on the basis of your consent.
• Morocco: when you book a journey, the data needed to carry it out is shared with local service providers (Art. 49(1)(b) and (c) GDPR).

6. How long we keep your data

• Requests and messages that do not lead to a booking: up to 2 years after our last contact, so we can follow up on your enquiry; then deleted.
• Booking data: for as long as needed to carry out the journey and handle any claims, and afterwards for the periods required by commercial and tax law (in general up to 6 years for accounting records).
• News emails: until you unsubscribe. Proof of your consent is kept for up to 3 years after unsubscribing.
• Unconfirmed news sign-ups: deleted after 30 days.
• Server logs: see section 3.1.

7. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);
• object at any time to processing based on our legitimate interest (Art. 21);
• withdraw your consent at any time with effect for the future (Art. 7(3)).

To exercise these rights, write to [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

8. Do you have to provide your data?

Fields marked as required are needed to answer your request; without them we cannot process it. Everything else is optional. You are never required to subscribe to news emails.

9. No automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Cookies and links to social media

Read our cookie policy to see the few technical cookies this site uses. Links to Instagram or other networks are plain links: no data is sent to those platforms until you click them, after which their own privacy policies apply.

11. Changes

We may update this policy when our services or the law change. The current version always applies and is published on this page.