Privacy Policy
Let's talk legalese: the fine print that's not as boring as it sounds
Introduction
Effective Date: 01.03.2024
Last updated: 16.08.2026
Jah Shaka Surf Shop, Rua Candido dos Reis 112, 8600-681 Lagos, Portugal ("we", "us", or "our") is the controller of personal data described in this policy. This Privacy Policy explains what we collect when you visit Jahshakasurf.com (our "Website"), why we use it, who processes it, and the choices available to you.
Information We Collect
Personal Data
We do not collect any personal data directly from you unless you voluntarily provide it to us through our contact forms or other means of communication. However, like most websites, we use third-party services, such as Google Analytics, that may collect certain personal data automatically.
Automatically Collected Information
Our hosting and security providers process limited technical information, such as IP address, browser type, request time, and requested page, to deliver and protect the Website. Cookie-based Google Analytics and advertising described below load only after the relevant consent. Cookieless page counts (Vercel Web Analytics) run without cookies and without that consent. Until 6 September 2026, cookieless PostHog product analytics also runs without a cookie click, as described under PostHog. Rejecting optional analytics stops PostHog immediately.
We use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses cookies or other tracking technologies to help us analyze how users interact with and use our Website, compile reports on website activity, and provide other services related to website activity and usage. The information generated by Google Analytics about your use of our Website (including your IP address) may be transmitted to and stored by Google on servers in the United States or other locations. Google may use this information for the purpose of evaluating your use of the Website, compiling reports on website activity for website operators, and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.
Google Analytics loads only after you consent to analytics cookies. You can later withdraw that consent using Cookie Settings in the footer; the Website then stops analytics capture and removes the analytics cookies it can access.
Vercel Web Analytics
We use Vercel Web Analytics, a cookieless traffic-measurement service provided by Vercel Inc., to count page views and unique visitors. It does not set cookies, does not create a persistent identifier in your browser, and does not load Google Analytics, PostHog, or advertising pixels. Because it is cookieless, it runs on public pages without a consent prompt. It is not loaded on the staff admin area. For more information, see Vercel's Web Analytics privacy documentation.
Meta Pixel
We use the Meta Pixel, an analytics and advertising tool provided by Meta Platforms, Inc. ("Meta"). The Meta Pixel uses cookies to track your activity on our Website (such as pages viewed and bookings made) so that we can measure the performance of our Facebook and Instagram advertising, build audiences for future ads, and show you more relevant ads on Meta's platforms. This may involve matching information such as your email address or name, in hashed (encrypted) form, against Meta's own user data to link your visit to a Facebook or Instagram account.
Data collected through the Meta Pixel is processed by Meta in accordance with its own privacy policy and may be transferred to the United States. The Meta Pixel only loads on our Website, and only fires, after you have given consent to marketing cookies via our cookie banner. For more information, see Meta's Privacy Policy and Business Tools Terms.
PostHog
We use PostHog, a product analytics service provided by PostHog Inc., hosted on PostHog Cloud in the EU (Frankfurt). PostHog collects information such as pages viewed, device and browser type, referral source, clicks, booking-funnel events (for example, adding an item to the cart or starting a booking request), and technical details about unexpected browser errors so we can understand which pages and booking flows work, where customers drop off, and where the Website fails. We do not send your name, email address, phone number, form contents, or message contents to PostHog.
Until 6 September 2026, PostHog starts on public pages in a memory-only mode so we can see whether the new Website and booking flow work, where visitors drop off, and where pages fail. It does not set analytics cookies until you accept analytics. After that date, PostHog starts only if you accept analytics. We temporarily use session recording until 21 August 2026 for the same diagnosis. All form fields and text within forms are masked, query strings are removed from recorded URLs, request and response bodies and headers are not recorded, cross-origin frames are excluded, and canvas recording is disabled. Session recording stops automatically after that date unless this policy is updated.
Accepting analytics lets PostHog persist an anonymous identifier in cookies/localStorage so return visits can be joined. Rejecting optional analytics, or withdrawing it later via Cookie Settings, stops event capture and session recording immediately. We use PostHog Cloud EU (Frankfurt), do not create identified person profiles for anonymous visitors, and do not send names, email addresses, phone numbers, or message contents to PostHog. For more information, see PostHog's Privacy Policy.
Bot Protection (Cloudflare Turnstile)
To protect our contact, booking, and newsletter forms from automated abuse, we use Cloudflare Turnstile, a bot-detection service provided by Cloudflare, Inc. Turnstile runs invisibly in the background when you submit a form — there is nothing for you to click or solve.
To confirm that a submission comes from a real person, Turnstile processes limited technical data about your device and browser session, which may include your IP address, browser and device characteristics, and behavioural signals such as mouse and keyboard patterns. It may also set a token or similar identifier in your browser for the duration of the check. This processing is carried out by Cloudflare on our behalf for the sole purpose of distinguishing human visitors from automated traffic, and is not used to build advertising profiles.
Because Turnstile runs invisibly, we are required to point you to Cloudflare's own disclosures. For details of what Cloudflare collects and how it is handled, please see the Cloudflare Turnstile Privacy Addendum and Cloudflare's Privacy Policy.
How We Use Your Information
We use the information we collect, including personal data, to:
- Provide, operate, and maintain our Website.
- Improve, personalize, and expand our Website.
- Understand and analyze how you use our Website.
- Develop new products, services, features, and functionality.
- Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the Website, and for marketing and promotional purposes.
- Send you emails.
Your Rights and Choices
Your Data Protection Rights
Under certain circumstances, you have the following data protection rights:
- Right to access: You have the right to request copies of your personal data. We may charge you a small fee for this service.
- Right to rectification: You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you believe is incomplete.
- Right to erasure: You have the right to request that we erase your personal data, under certain conditions.
- Right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
- Right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
- Right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email: shop@jahshakasurf.com
Cookies and Tracking Technologies
Necessary storage supports security, forms, the shopping cart, and your consent choice. It does not require consent. Vercel Web Analytics and memory-only PostHog also run without a click. Cookie-based analytics storage (Google Analytics and persistent PostHog) and marketing storage (Meta Pixel) remain off unless you choose the corresponding category. Rejecting optional analytics stops PostHog. The homepage review wall is rendered by our server and does not set marketing cookies.
You can reject all optional storage on the first banner layer, choose categories in Settings, or withdraw consent at any time through Cookie Settings in the footer. Rejecting optional cookies does not prevent you from browsing, booking, or contacting us. We keep your consent choice for up to six months before asking again, and we request consent again sooner if the purposes materially change.
Changes to Our Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.
Contact Us
If you have any questions about this Privacy Policy, please contact us:
- By email: shop@jahshakasurf.com
