Privacy Notice

Last updated: 10 September 2026

This page explains what data the wind.surftheologos.com dashboard processes when you visit it, why, and what your rights are under the EU General Data Protection Regulation (GDPR).

Who runs this site

Data controller: Tobias Gottfried, Surf and Kite Theologos, 851 06 Theologos, Rhodos, Greece. For privacy questions or to exercise your rights, contact info@surftheologos.com or +30 224 108 2203.

What we collect ourselves

Our application writes short-lived access logs of every HTTP request. Each log line contains:

• your IP address
• the request method and path (e.g. GET /)
• the response status and timing

Our own application logs do not contain user-agent strings, referrers, cookies, or request bodies. These logs are retained on Render for up to 7 days and are used only to detect abuse, debug errors, and operate the service. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Optional Umami analytics is separate and is described below.

We use no analytics or advertising cookies. For regular visitors, we use this necessary first-party preference cookie:

• theologos_consent (value v2-0 or v2-1) — remembers whether the optional Windguru forecast widget and Umami analytics may load. SameSite=Lax, Secure on HTTPS, expires 6 months after it is written.

Hosting & infrastructure

The site is hosted on Render (Render Services, Inc., USA) as our processor, in Render's Frankfurt (EU) region. Limited US support or subprocessor access may occur. See Render's DPA, security/subprocessor information, privacy policy, and EU-US Data Privacy Framework certification.

Third-party services loaded in your browser

The optional third-party services on the dashboard are Windguru and Umami. Neither loads until you click Accept on the consent banner. Legal basis: your consent (GDPR Art. 6(1)(a) and, where applicable, ePrivacy rules). You can withdraw consent at any time via the Cookie settings link.

• Windguru (windguru.cz, Czech Republic / EU) — forecast widget. When loaded, Windguru may set or read cookies on its own domain. Privacy policy: windguru.cz/help.php?sec=privacy.
• Umami Cloud (Umami Software, Inc., USA; account data region: EU) — cookie-free audience measurement used to understand visits and improve the dashboard. When enabled after consent, Umami processes the page path and title, hostname, referrer, browser language, screen size, browser, operating system, device category and approximate location. URL search parameters are excluded. Umami uses the IP address transiently for location and session calculation but states that it does not store it; sessions are represented by a pseudonymous hash with a rotating salt. The tracker does not perform cross-site tracking and respects your browser's Do Not Track setting. We keep this analytics data while we use Umami for this purpose and delete it if we reset the analytics or delete the website or account from Umami. Although the EU data region is selected, limited access from outside the EEA may occur under Umami's applicable transfer safeguards. See Umami's privacy policy and metric definitions.

Live beach camera

Surf Theologos operates a live camera at Theologos beach. The camera points at the water and the beach to show current surf, kite, and wingfoil conditions. The feed is embedded on this page and also appears on the Surf Theologos live cam and wind page. The camera is wide-angle and primarily captures the water, but it may incidentally record identifiable individuals present at the beach.

• Controller: Surf Theologos (same entity as the operator of this site, see "Who runs this site" above).
• Purpose: showing live wind, wave, and beach conditions to surfers, kiters, wingfoilers, and visitors planning a session at the spot; supporting related on-site rental activities.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)). The camera is intended to show spot conditions, not to monitor individuals.
• Minimisation: the camera uses a sea-focused wide-angle view, although the beach may also be visible. We do not use audio, facial recognition, biometric analysis, manual tracking of individuals, or zoom/following.
• How the stream is delivered: to play the live camera, your browser requests media from restreamer.lefiasco.de. That host is operated by Surf Theologos as part of the same controller environment and is not an independent third-party widget provider.
• Recording and retention: the stream is live to viewers and also recorded on our side for up to 72 hours / three (3) days, after which recordings are automatically deleted. Recordings are kept for this short window so that very recent incidents (safety, equipment loss, accident review) can be checked. If footage needs to be preserved for an accident review, legal claim, insurance matter, police or authority request, or similar, the relevant clip may be kept separately only as long as necessary for that purpose and then deleted. Recordings are not shared with third parties except where required by law or to cooperate with competent authorities.
• Your rights: you may request confirmation, access, objection, or erasure for footage containing you. Email info@surftheologos.com with the approximate date, time, location, and identifying details. Because retention is only 72 hours / 3 days, please contact us promptly.

Your rights

Under GDPR you have the right to: access your personal data, correct it, request its deletion, object to processing based on legitimate interest, restrict processing, and data portability.

You can also lodge a complaint with a data protection supervisory authority in your EU/EEA country of residence, your place of work, or the country where the alleged infringement took place. For reference, our lead authority is the Hellenic Data Protection Authority (HDPA); a full list of EEA authorities is maintained by the European Data Protection Board.

To exercise any of these rights, email info@surftheologos.com.

Withdrawing consent

You can change or withdraw consent at any time using the Cookie settings link in the corner of the dashboard, or by deleting the theologos_consent cookie in your browser. When you reject, the dashboard reloads so that the optional Windguru widget and Umami analytics are removed and no further optional processing occurs.

Changes to this notice

If we change how data is processed, we will update this page and the date at the top.