Privacy Policy
We collect what we need to give you a bed and a surf lesson. Analytics and ad measurement switch off in one tap, and in Europe they stay off until you say yes. No data sales, no newsletter you didn't ask for.
What we collect
Booking details
To hold your room or session and to reach you about it.
Name, email, phone number, dates, room or session type, number of guests.
Payment details
To take payment for a booking.
We don't take card payments on this site at the moment. When you pay us by UPI, or another way we agree with you, your own bank or app handles it, and we see what any payee sees: the amount, the payment reference and the name or UPI ID it came from, which we keep with your booking record.
Enquiry messages
To answer your question.
Whatever you type into the contact form, plus your name and email.
Basic server logs
To keep the site up and to spot abuse.
Standard request logs kept by our host. We do not sell or share data with data brokers.
Visit and ad measurement
Opt-out, or opt-in in Europe.
Google Analytics counts which pages get read. Meta's pixel tells Meta this browser visited and whether you viewed a room or camp, sent an enquiry or tapped WhatsApp, so our Instagram and Facebook ads can reach you and we can see whether they work. We never pass either of them your name, email, number or anything you type.
How long we keep it
Specific periods rather than “as long as necessary”, which is the phrase policies use when they mean forever.
| What | How long | Why |
|---|---|---|
| Booking and payment records | 8 years | Indian tax and accounting law requires it. |
| Enquiries that don't become bookings | 12 months | So we recognise you if you come back. |
| Server logs | 90 days | Long enough to investigate a problem, short enough to forget you. |
What you can ask us to do
Email hello@kumasurfvarkala.com and we'll action any of these within 30 days. You don't need to give a reason and there's no charge.
- Ask what we hold about you, and get a copy of it
- Have anything inaccurate corrected
- Have your data deleted, once we no longer need it for tax or legal reasons
- Withdraw consent to marketing at any time. We send very little anyway
- Complain to the Data Protection Board of India, or to your local supervisory authority if you are in the UK or EU
Cookies
Covered separately. The short version: one small cookie remembers which consent rules apply where you are, and two optional ones switch off in one tap (in Europe they stay off until you accept). Read the cookie policy.
Who's responsible for your data
Cleetus Jaya Hareesh, trading as Kuma Surf House, at Sree Eight, near Manthara Temple, Edava, Varkala, Kerala 695311, India, decides what happens to the personal data described here. Under Indian law that makes us the Data Fiduciary; under the GDPR it makes us the Data Controller. Either way, it means the buck stops with us.
To ask us anything about your data, email hello@kumasurfvarkala.com or message +91 99953 38248.
Why we're allowed to hold it
For bookings, because we need it to give you the thing you paid for. We cannot hold a room for someone whose name we don't have.
For enquiries, because you asked us a question and handing us your email was the point.
For payment and accounting records, because Indian tax law requires us to keep them whether either of us wants to or not.
For analytics and ad measurement: in Europe, because you said yes on the cookie banner; everywhere else, because the banner told you and you left them on. Either way, one tap turns them off, on the banner or from the cookie policy page.
We don't rely on "legitimate interest" to justify marketing at you. If we ever send a newsletter, you'll have opted in first.
Who else sees it
As few people as possible:
- Your own bank or UPI app, when you pay us. We don't take card payments on this site at the moment; we share a UPI QR code or another way to pay directly, and we see only what any payee sees.
- Our website host, who runs the servers this site sits on.
- Our email providers (Google's Gmail and Hostinger Mail), which carry what you send through the contact and enquiry forms (your name, email, phone number and message) to our inbox.
- Google and Meta, through the two tags the cookie banner describes, unless you turn them off (in Europe, only once you accept them). Google Analytics sees which pages were read. Meta sees that this browser visited and whether you viewed a room, sent an enquiry or tapped WhatsApp. Neither gets your name, email, number or messages from us.
- Google, whose Gemini model writes SALO's replies, receives what you type into that chat so it can answer. The name and contact you give SALO come to us, not to Google.
- Booking platforms like Booking.com or Agoda, but only if you booked through them in the first place, in which case their privacy policy also applies.
- Anyone we're legally required to disclose to, which so far is nobody.
What we don't do
We don't sell your data. We don't share it with data brokers. We do use Meta's pixel to see whether our Instagram and Facebook ads work, and to show them to people who have visited. One tap turns it off, and in Europe it stays off unless you say yes. Turn it off and you will not be followed around the internet by pictures of surfboards because you looked at our rooms.
We don't use your data to train anything, and we don't build a profile on you beyond remembering that you stayed here and had a good time.
Where your data goes
Our servers are in India. If you're booking from the UK or the EU, that means your data is transferred outside your home jurisdiction, which is unavoidable when you book a room in Kerala from Berlin, and we handle it with the same care either way.
Google and Meta process what they receive in the US and elsewhere, under their own transfer safeguards. For the two cookie-banner tags, that stops the moment you turn them off.
Keeping it safe
The site runs over HTTPS throughout. No card or bank details are entered on this site: payments go through your own bank or UPI app, and we confirm a booking only once the payment has actually reached us.
No system is perfect. If we ever have a breach that puts you at risk, we'll tell you and the Data Protection Board, not quietly hope you don't notice.
Children
This site isn't aimed at children and we don't knowingly collect data from anyone under 18. Kids' surf lessons are booked by a parent or guardian, whose details are the ones we hold.
Changes
If we change how we handle your data we'll update this page and move the date at the top. For anything significant we'll tell you directly rather than relying on you re-reading a policy page.
Who we are
- Trading as
- Kuma Surf House
- Legal entity
- Cleetus Jaya Hareesh
- Entity type
- Proprietorship
- GSTIN
- 32ATRPH9587K1ZU
- Licence
- Edava Grama Panchayat enterprise licence BFIF01-G010102-00007-2026, valid to 12 February 2031
- Address
- Sree Eight, near Manthara Temple, Edava, Varkala, Kerala 695311, India
- Phone
- +91 99953 38248
Quickest route to a human is WhatsApp on +91 99953 38248. For anything about a payment, quote your booking dates and the payment reference from your UPI app.
These terms are governed by Indian law and the courts of Kerala have jurisdiction. Nothing here limits any right you have under applicable consumer law that cannot be limited by agreement. Questions about any of it, ask Kuma Surf directly. We would rather explain it than have you agree to something you did not read.