Privacy Policy

Introduction

Our non-profit foundation Stichting Surfing Medicine International (hereinafter referred to as: SMI, we, us and our) is committed to the protection of your privacy and the confidentiality of your personal data. This privacy policy (Privacy Policy) explains which personal data are collected and processed, for what purposes this occurs, how long we retain these personal data, what your rights are, and how you can reach us.

This Privacy Policy is drafted in accordance with the General Data Protection Regulation (GDPR), and uses the terms and definitions set out in the GDPR.

Below you will find an overview of all paragraphs of this Privacy Policy

Processing of personal data: categories, purposes and legal bases
Retention periods
Transfer of personal data to third parties
Security
Third party links
Your rights
Cookies
Changes to the Privacy Policy
Questions and contact details

1. Processing of personal data: categories, purposes and legal bases

Personal data are data that can be used to (directly or indirectly) identify a person. SMI collects personal data in various ways, for example when you use our services and products, such as following an online Surf Life Support course or registration for live event. We receive these personal data in principle from you or from third parties we engage with to provide our services and products. Described below are the situations in which SMI collects personal data, for which purposes and based on which legal bases.

1.1 Affiliates with a subscription to Surfingmed

If you register or subscribe on the SMI website as an affiliate individual or organisation, we process the

following categories of personal data:

Contact details: first and last name, (business) email address, postal address, and zip code.
Account details: username and password.
Payment data: payment method (processed via Stripe or PayPal), and billing details.

SMI processes these categories of personal data on the legal bases: necessary for the performance of an agreement or necessary for the legitimate interests pursued by SMI. We process the personal data for the following purposes:

to enter into or execute an agreement to provide our service to subscribed affiliates;
to provide access to the subscribed content on the SMI website;
to invoice the purchased subscription; and
to maintain a business relationship with our affiliates.

If SMI processes personal data based on the legal basis legitimate interest, SMI assesses whether the impact on your interests and rights and freedom overrides SMI’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by SMI, please contact us. Our contact details are listed in paragraph 9 of this Privacy Policy.

1.2 Participants of online courses

If you register for one of our online courses, such as the Surf Life Support online course, we process the following categories of personal data:

Contact details: first and last name and email address.
Payment data: payment method (processed via Stripe or PayPal) and billing details.

SMI processes these categories of personal data on the legal basis: necessary for the performance of an agreement. We process the personal data for the following purposes:

to enter into or execute an agreement to provide our online course to you; and
to provide access to the content of the online course on the Thinkific platform.

1.3 Participants of live events or live courses

If you attend a live event, such as the World Conference Surfing Medicine, or participate in a live course, such as the Advanced Surf Life Support or Basic Surf Life Support course, organised by SMI, we process the following categories of personal data:

Contact details: first and last name, (business) email address, telephone number, postal address, zip code, company name.
Event-related data: attendance, gender, t-shirt size, and catering preferences.
Professional background: profession, prior relevant education and qualifications (for example, ATLS, ACLS, Expedition Medicine, Surf Life Support, Surf Rescue, CPR course, lifeguard qualification), and surfing experience.
Payment data: payment method (processed via Stripe or PayPal) and billing details.

to enter into or execute an agreement to provide you with access to our live event or live course;
to invoice the attended live event or live course; and
to maintain a business relationship with the participants.

1.4 Participants of our research and course evaluations

If you have followed an online or live course provided by SMI, we may invite you to take part in research projects or course-evaluation surveys. In that context, SMI collects and processes the following categories of personal data:

Contact details: first and last name and email address.
Course data: details of the course attended, completion status, and test scores.
Survey responses: answers to evaluation questions, free-text feedback, and any optional demographic information you decide to share (e.g. location of residence, location of surf incidents, home break, age range, surfing experience or medical background).

SMI processes these categories of personal data on the legal bases: consent or necessary for the legitimate interests pursued by SMI. We process the personal data for the following purposes:

to evaluate our courses and teaching methods; and
to conduct research projects relating to surf lifesaving and first-aid education.

Please note that our research results will be anonymised and that no personal data will be included in our (published) research reports. You can withdraw your consent for participating in research projects or course-evaluation surveys at any time by contacting us using the contact details provided in paragraph 9 of this Privacy Policy.

1.5 Receiving the SMI newsletter

Newsletter subscribers register via the SMI website (surfingmed.com) to receive the newsletter, with consent obtained through the "Subscribe Now" button.

If you sign up for the SMI newsletter, we process the following categories of personal data:

Contact details: first and last name and email address.

SMI processes these categories of personal data based on your consent. We process the personal data for the following purposes:

to send newsletters; and
to send offers of courses, events, and other services of SMI.

Under the GDPR, valid consent must be freely given, specific, informed, and unambiguous. To ensure full compliance, subscribers are informed of the following before consenting:

Sender identity – the newsletter is sent by SMI (Surfing Medicine International).
Frequency – the newsletter is sent no more than once per week.
Privacy Policy – subscribers can find full details on how their data is used by reading SMI's Privacy Policy.

You may withdraw your consent to receive our newsletter at any time. Each newsletter contains an unsubscribe link. You may also unsubscribe by contacting us using the contact details provided in paragraph 9 of this Privacy Policy. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

1.6 Visiting our website and contacting SMI

If you visit our website or contact SMI, we process the following categories of personal data:

Contact details: first and last name, email address, postal address, country and company name.
Correspondence: email messages, telephone notes and other communications.
Technical data of the equipment used to visit the website, such as the IP address and timestamp.
Cookies: technical and functional cookies. For more information about cookies, please refer to paragraph 7 of this Privacy Policy.

SMI processes these categories of personal data based on the legal basis: necessary for the legitimate interests pursued by SMI. We process the personal data for the following purposes:

to enable the proper functioning of our website;
to prevent the misuse of our services, and, if necessary, to make it possible to investigate committed offenses; and
to provide law enforcement authorities with the information necessary for criminal prosecution in the event of an attack on our information technology systems (cyber-attack).

If SMI processes personal data based on the legal basis legitimate interest, SMI assesses whether the impact on your interests and rights and freedom overrides SMI’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by SMI, please contact us using the details provided in paragraph 9 of this Privacy Policy

1.7 Using SMI mobile applications

SMI offers two free mobile applications: the Surf First Aid app and the Surf Years Calculator app, available for iOS and Android.

Both apps are designed to function fully offline. All educational content, emergency guides, and calculator functions are stored locally on the user's device. SMI does not collect or receive personal data entered or generated through the use of these apps.

If you download or use the SMI apps, the following technical data may be processed automatically by the relevant app store platform (Apple App Store or Google Play Store), over which SMI has no control:

Technical data: device identifiers, operating system version, download and usage statistics.

For information on how Apple and Google process your personal data in connection with app downloads, please refer to their respective privacy policies.

SMI processes no personal data of its own in connection with the apps. Should this change in future versions of the apps, this Privacy Policy will be updated accordingly, and users will be informed prior to any such update.

If users choose to share app content via a standard web link, this does not involve any collection or transmission of personal data by the app. If the recipient has the app installed, the link opens directly in the app without routing through SMI systems.

If the app is not installed or the link is opened outside the app context, such a share link may open an SMI website. In that case, standard website-side processing may occur in accordance with the website privacy policy.

2. Retention periods

SMI will not retain your personal data for any longer than necessary for the purposes described above. In some cases, SMI is forced to comply with a legal obligation, as a result of which personal data must be retained for a longer period. We may also need to retain some personal data in our files for a longer period if an (expected) dispute or (legal) proceedings are involved.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

If you wish to receive further information about specific retention periods that apply to your personal data, please contact us using the details provided in paragraph 9 of this Privacy Policy.

3. Transfer of personal data to third parties

SMI uses services of the following third parties:

Thinkific to provide our online courses, such as the Surf Life Support online course, to participants.
WordPress and MemberPress to provide our affiliates with access to the subscribed content.
SurveyMonkey to evaluate our courses and conduct research.
Mailchimp to send newsletters.
Eventbrite to register for our live events and courses.
Ninja Forms to register for our live events and courses.

SMI only shares your personal data with these parties when it is necessary. These parties are required to treat your data confidentially and comply with applicable data protection laws and regulations. They are also obliged to implement appropriate measures to protect your data. Where necessary, we have entered into contractual arrangements with these parties to ensure this.

Some of these parties are located outside the European Economic Area (EEA) or store data on servers outside the EEA. The transfer of personal data outside the EEA is only permitted if specific conditions are met.Such transfers, for example to certain service providers, may primarily be legitimized on the basis of an adequacy decision by the European Commission. An adequacy decision confirms that the respective third country provides an adequate level of protection for personal data. For an overview of current adequacy decisions, see Data protection adequacy for non-EU countries.

If your personal data is transferred to a country outside the EEA for which no adequacy decision applies, SMI relies on appropriate transfer mechanisms under the GDPR to ensure an adequate level of protection.

If you wish to receive further information about the transfer mechanisms we use or obtain a copy of the relevant safeguards, please contact us using the details provided in paragraph 9 of this Privacy Policy.

4. Security

SMI has taken appropriate technical and organisational measures to protect your personal data against loss or any other unauthorised use. We restrict access to your personal data to authorised individuals and third parties who require it for legitimate business purposes and who are bound by confidentiality obligations.

5. Third party links and plug-ins

Our website contains links to third-party websites, plug-ins, and applications, including Facebook, Instagram, LinkedIn, Twitter, YouTube, and Jetpack/WordPress. Clicking on these links or enabling these connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. When you leave our website, we encourage you to review the privacy policy of every website you visit.

6. Your rights

You have a number of rights with regard to your personal data and the processing thereof:

the right to a confirmation from SMI that your personal data are being processed or not, and in the event that they are processed, the right to access your personal data and additional information about the processing of your personal data;
the right to rectification of your personal data, for example if your personal data are not accurate;
in certain cases, the right to request SMI to delete your personal data, for example when your personal data is no longer necessary for the purposes for which the personal data are collected and processed, if you withdraw your consent (when consent is the legal basis for processing) or if the personal data are unlawfully processed;
in certain cases, the right to obtain from SMI a restriction on the processing of your personal data, for example because you contest the accuracy of your personal data;
the right to receive, at your request, the personal data that you have made available to SMI in a structured and commonly used electronic format and the right to transfer these personal data to another controller, where the processing is based on your consent or on an agreement;
the right to object to the processing of your personal data on the basis of legitimate interests of SMI. When you object, SMI no longer processes your personal data unless SMI demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or when it is necessary for the establishment, exercise or defence of a right in legal proceedings;
when personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for marketing purposes. In that case, SMI no longer processes your personal data for such purposes;
the right not to have a decision based solely on automatic processing (including profiling), which has legal consequences or affects you in a far-reaching way; and
the right to withdraw your consent at any time (if consent is the basis for the processing). Withdrawal of consent has no retroactive effect. This means that consent no longer applies from the time of withdrawal.

These rights are not absolute. There may be circumstances in which SMI cannot (fully) implement your request as a data subject. As regards requests for the deletion of personal data, it should be taken into account that we will not grant such a request if it is incompatible with the mandatory statutory retention periods of SMI.

If you wish to exercise any of the above rights, please contact us using the contact details mentioned in paragraph 9. The information provided is in principle free of charge. You may exercise these rights at reasonable intervals.

We will respond to your request within one month, unless this is not possible due to the complexity of your request or the number of requests submitted. In such a case, we will inform you no later than within one month and extend our period to respond by a maximum of two months. If a request is granted by us, SMI implements the decision to correct, change, delete and/or transfer the personal data as soon as possible.

In addition to the aforementioned rights, if you are dissatisfied with the way in which we process your personal data, handle your request or any other complaint, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), post office box number 93374, 2509 AJ The Hague, the Netherlands. For more information, please visit the website of the Dutch Data Protection Authority at https://autoriteitpersoonsgegevens.nl.

7. Cookies

A cookie is a small unit of information that is transmitted by your browser when you visit the SMI website. SMI uses cookies on its website to ensure the most efficient use of the site. You can manage your cookie preferences and block cookies through your browser settings. Please note that this may affect the user experience of the website

8. Changes to the privacy policy

We update the Privacy Policy from time to time. We therefore recommend that you consult it regularly so that you are aware of any changes. We will notify you of significant changes to the Privacy Policy, such as changes in the purposes of processing and changes in the way you can exercise your data subject rights. This Privacy Policy was last amended on 23/04/2026.

9. Questions and contact details

If you have any questions about this Privacy Policy, please contact us at privacy@surfingmed.com. Stichting Surfing Medicine International is located in The Hague, the Netherlands. For other queries related to SMI, you can visit our website: www.surfingmed.com.