Privacy Policy
We collect what we need to give you a bed and a surf lesson, and nothing else. No trackers, no data sales, no newsletter you didn't ask for.
What we collect
Booking details
To hold your room or session and to reach you about it.
Name, email, phone number, dates, room or session type, number of guests.
Payment details
To take payment for a booking.
Handled entirely by Razorpay. Card numbers, UPI IDs and bank details never reach our servers and we never see them. We receive only a payment reference and whether it succeeded.
Enquiry messages
To answer your question.
Whatever you type into the contact form, plus your name and email.
Basic server logs
To keep the site up and to spot abuse.
Standard request logs kept by our host. We do not run advertising trackers, and we do not sell or share data with data brokers.
How long we keep it
Specific periods rather than “as long as necessary”, which is the phrase policies use when they mean forever.
| What | How long | Why |
|---|---|---|
| Booking and payment records | 8 years | Indian tax and accounting law requires it. |
| Enquiries that don't become bookings | 12 months | So we recognise you if you come back. |
| Server logs | 90 days | Long enough to investigate a problem, short enough to forget you. |
What you can ask us to do
Email hello@kumasurfvarkala.com and we'll action any of these within 30 days. You don't need to give a reason and there's no charge.
- Ask what we hold about you, and get a copy of it
- Have anything inaccurate corrected
- Have your data deleted, once we no longer need it for tax or legal reasons
- Withdraw consent to marketing at any time. We send very little anyway
- Complain to the Data Protection Board of India, or to your local supervisory authority if you are in the UK or EU
Cookies
Covered separately, and the short version is that there is almost nothing to cover. Read the cookie policy.
Who's responsible for your data
Kuma Surf House, at Sree Eight, near Manthara Temple, Kerala 695313, India, decides what happens to the personal data described here. Under Indian law that makes us the Data Fiduciary; under the GDPR it makes us the Data Controller. Either way, it means the buck stops with us.
To ask us anything about your data, email hello@kumasurfvarkala.com or message +91 99953 38248.
Why we're allowed to hold it
For bookings, because we need it to give you the thing you paid for. We cannot hold a room for someone whose name we don't have.
For enquiries, because you asked us a question and handing us your email was the point.
For payment and accounting records, because Indian tax law requires us to keep them whether either of us wants to or not.
We don't rely on "legitimate interest" to justify marketing at you. If we ever send a newsletter, you'll have opted in first.
Who else sees it
As few people as possible:
- Razorpay, our payment gateway, who process your payment. They receive your card or UPI details directly. Those never touch our servers and we never see them.
- Our website host, who runs the servers this site sits on.
- Booking platforms like Booking.com or Agoda, but only if you booked through them in the first place, in which case their privacy policy also applies.
- Anyone we're legally required to disclose to, which so far is nobody.
What we don't do
We don't sell your data. We don't share it with data brokers. We don't run advertising trackers or retargeting pixels on this site, so you will not be followed around the internet by pictures of surfboards because you looked at our rooms.
We don't use your data to train anything, and we don't build a profile on you beyond remembering that you stayed here and had a good time.
Where your data goes
Our servers and our payment processor are in India. If you're booking from the UK or the EU, that means your data is transferred outside your home jurisdiction, which is unavoidable when you book a room in Kerala from Berlin, and we handle it with the same care either way.
Keeping it safe
The site runs over HTTPS throughout. Payment details are handled entirely by Razorpay under their PCI-DSS compliance, and payment confirmations are verified server-side with a cryptographic signature so a browser claiming a payment succeeded proves nothing on its own.
No system is perfect. If we ever have a breach that puts you at risk, we'll tell you and the Data Protection Board, not quietly hope you don't notice.
Children
This site isn't aimed at children and we don't knowingly collect data from anyone under 18. Kids' surf lessons are booked by a parent or guardian, whose details are the ones we hold.
Changes
If we change how we handle your data we'll update this page and move the date at the top. For anything significant we'll tell you directly rather than relying on you re-reading a policy page.
Who we are
- Trading as
- Kuma Surf House
- Legal entity
- Registration details are being finalised. Ask us and we'll tell you.
- Address
- Sree Eight, near Manthara Temple, Kerala 695313, India
- Phone
- +91 99953 38248
Quickest route to a human is WhatsApp on +91 99953 38248. For anything about a payment, quote the booking reference from your confirmation email.
These terms are governed by Indian law and the courts of Kerala have jurisdiction. Nothing here limits any right you have under applicable consumer law that cannot be limited by agreement. Questions about any of it, ask Kuma Surf directly. We would rather explain it than have you agree to something you did not read.