Privacy Policy | Twist Surf

Last updated: 26 September 2026

This policy explains how Twist Surf Ltd handles personal data when you visit twistsurf.com, contact us or book a stay at our surf camp in Taghazout, Morocco.

1. Who is responsible for your data

The data controller is Twist Surf Ltd, a company registered in England and Wales (company number 15658336), registered office PO Box 4385, Cardiff, CF14 8LH, United Kingdom. For any privacy question or request, email [email protected].

2. What we collect

Booking details: name, email, phone number, postal address, arrival date, number of travellers, room type, extras, promo code and diet preference.
Messages: what you send us through the contact form, by email or on WhatsApp.
Payment confirmation: when you pay a deposit, PayPal tells us the amount, the date and the name and email on the payment. We never see or store your card details.
Information during your stay: anything you choose to tell us that helps us look after you, such as your surf level, allergies or a medical condition relevant to surfing.
Website data: with your consent, anonymous statistics about how the site is used (see our Cookie Policy), plus technical data such as your IP address that our hosting and security providers process to keep the site running.

3. Why we use it and our legal basis

To answer your questions and prepare a quote: steps you ask us to take before a contract.
To confirm and manage your booking, take your deposit, arrange transfers, meals and lessons: performance of our contract with you.
To prepare meals that suit your diet, and to keep you safe in the water if you tell us about a health condition: your explicit consent, which you can withdraw at any time.
To keep accounting and tax records: our legal obligations.
To keep the website secure and understand, in aggregate, how it is used: our legitimate interests, and your consent for analytics cookies.

We do not sell your data, and we do not send marketing emails unless you have asked to receive them.

4. Who we share it with

Our team at the camp in Taghazout, Morocco, who look after your stay.
PayPal, which processes deposit payments as an independent controller.
Our website hosting, security and email providers, and Google for analytics (only with your consent) and maps.
WhatsApp (Meta), if you choose to contact us there.
Authorities, insurers or emergency services, when the law requires it or to protect someone's vital interests.

5. International transfers

Your stay takes place in Morocco, so your booking details are shared with our team there. This transfer is necessary to provide the holiday you booked. Our service providers may also process data in other countries; where they do, they use safeguards recognised under UK and EU law, such as adequacy decisions or standard contractual clauses.

6. How long we keep it

Booking and payment records are kept for 6 years after your stay, as required for accounting and tax. Enquiries that do not lead to a booking are deleted after 2 years. Health and diet information is deleted at the end of your stay.

7. Your rights

You can ask us for a copy of your data, and to correct, delete or transfer it, to restrict or object to how we use it, or to withdraw a consent you gave. Email [email protected] and we will reply within one month.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in the country where you live.

8. Children, cookies and changes

We only collect data about children under 16 from their parent or guardian as part of a family booking. Our use of cookies is explained in the Cookie Policy. If we change this policy we will update the date at the top of this page.

Read our Cookie Policy