Privacy Policy.

The controller of the personal data processed through this website is Samuel Pulido Villarejo, acting as an individual professional under the trade name Surfingvest, with professional address at Calle Mercedes Formica, 3, 28232 Las Rozas, Madrid, Spain.

Contact for privacy matters: hello@surfingvest.com.

Personal data is processed for the following purposes:

• Managing Contact enquiries.
• Managing Diagnosis submissions.
• Managing Operating Scale-Up submissions.
• Managing Growth Engine submissions.
• Managing Challenge Reflection submissions.
• Preparing and managing Working Sessions.
• Managing Resource access requests.
• Managing Newsletter subscriptions.
• Managing provider, partner and collaboration enquiries.
• Managing CRM records and professional opportunities.
• Maintaining technical security and preventing abuse.
• Keeping evidence of consent and privacy information presented.

Depending on the interaction, the following categories may be processed:

• Identification data (name).
• Professional contact data (work email, role).
• Company and role information.
• Information voluntarily supplied about the business situation.
• Responses to service forms.
• Booking information for working sessions.
• Consent records and consent version.
• Technical logs and security metadata.
• Newsletter subscription status.
• Resource-access records.

The processing relies on proportionate legal bases:

• Steps taken at the request of the interested person before entering a possible professional relationship, for service enquiries and working sessions.
• Legitimate interest in managing professional enquiries, organising business opportunities and maintaining the security of the website.
• Consent, for the Newsletter subscription and any optional marketing communication.
• Compliance with legal obligations, where applicable.

Fields explicitly marked as required are necessary to manage the request. Optional fields help refine the conversation but are not required. If required fields are not provided, the request cannot be managed.

Personal data may be processed with the support of trusted providers, strictly for the purposes described above. Providers currently used or that may intervene include:

• Lovable and its underlying infrastructure providers.
• The managed database infrastructure connected to Lovable.
• Google Workspace.
• Google Calendar.
• Mailchimp, for Newsletter management.
• Attio, for internal CRM management.
• Anti-abuse or captcha providers, where enabled.
• Hosting, security and technical-service providers.
• Professional advisers when legally necessary.

No personal data is sold, rented or exchanged with third parties for their own purposes.

Some providers may process personal data outside the European Economic Area. Where required, appropriate safeguards will be used in line with applicable data protection legislation.

• Enquiries and inactive opportunities: retained only for the period reasonably necessary to manage the enquiry and, as an internal reference, normally no longer than 12 months after the last meaningful interaction, unless a professional relationship begins or a legal obligation requires longer retention.
• Active professional opportunities and client relationships: for the duration of the relationship and applicable legal limitation periods.
• Newsletter: until withdrawal or unsubscribe.
• Consent records: for the time necessary to demonstrate compliance.
• Technical logs: only for the period required for security and incident investigation.
• Resource-access records: for the period necessary to provide access and manage the related professional interaction.

You may exercise the following rights at any time:

• Access.
• Rectification.
• Erasure.
• Restriction of processing.
• Objection.
• Portability where applicable.
• Withdrawal of consent, without affecting the lawfulness of processing based on consent before its withdrawal.
• Lodging a complaint with the competent data protection authority.

Rights can be exercised by writing to hello@surfingvest.com from the address associated with the request. Adequate evidence of identity may be requested when reasonably necessary.

No automated decisions producing legal or similarly significant effects on the interested person are made. Personal data is not sold.

This Privacy Policy may be updated to reflect changes in processing, providers or applicable law. The effective version is the one published at the date of visit.

Privacy matters: hello@surfingvest.com.