Privacy Policy
Last updated September 2026
Draft — not yet in force
We are rewriting our terms for long-term rentals off campus. This version is being reviewed and does not yet apply. Ask us on WhatsApp if anything here matters to your rental and we'll tell you exactly what applies today.
This explains what we do with your personal data when you use this site or rent from us. It follows the GDPR (Regulation (EU) 2016/679) and Portuguese data protection law.
The short version
We ask for the least we can: your first name, your email, and — only if you want us to pick a board for you — your height, weight and surf experience. No payment details, because you pay in person. No tracking, no advertising cookies, no analytics.
Who is responsible
The data controller is Gabriele Inama, operating as Ohana Rentals, a sole trader (trabalho independente) in Portugal. Reach us at boards.ohana@gmail.com.
Ohana Rentals also runs an item rental service. That is a separate operation with its own privacy policy — this one covers surf rentals only.
What we collect, and why
When you send a rental request
| Data | Why |
|---|---|
| First name | To know who we are meeting |
| Email address | To reach you if WhatsApp fails |
| Board, duration, start date, wetsuit size, Damage Cover | To prepare the right gear |
| Height, weight, surf experience | Only if you tick “Not sure?” — so we can recommend a board |
| Your comments | Whatever you choose to tell us |
| Reference code and timestamp | So we can both refer to the same request |
Legal basis: taking steps at your request before entering into a contract, and performing that contract (Art. 6(1)(b) GDPR). Height and weight are optional in the sense that you only give them if you want a recommendation — if you pick a board yourself, we never ask.
We do not collect ID documents, passport numbers, student ID numbers, photographs of you, date of birth or nationality for surf rentals. We do not ask for card or bank details at any point, because payment happens in person.
When you tick the updates box
If — and only if — you tick it yourself, we add your email to a list for occasional news about Ohana. The box is never pre-ticked. Legal basis: your consent (Art. 6(1)(a) GDPR). Every message has an unsubscribe link, and you can withdraw at any time by emailing us. Withdrawing does not affect anything we sent before.
When you message us on WhatsApp
Sending your request opens WhatsApp with a message already written, which you send yourself. From there the conversation runs through WhatsApp, operated by Meta, under Meta's own terms and privacy policy. WhatsApp messages are end-to-end encrypted, but Meta still processes metadata about the conversation. If you would rather not use WhatsApp, email us instead and we will arrange everything that way.
When you visit this site
We set no cookies and run no analytics. There is no tracking pixel, no advertising tag and no consent banner, because there is nothing to consent to. Our fonts are served from our own domain, not from Google, so loading a page does not send your IP address to a third party.
While you fill in a request, your browser keeps your choices in its session storage, so they survive a look at our terms or an accidental reload. This stays on your device and is not sent to us until you submit. It is deleted when you close the tab or send the request. Because it only exists to make the booking you asked for work, it needs no consent.
Our hosting provider keeps short-lived server logs, including IP addresses, to deliver the site and defend against attacks and abuse. Legal basis: our legitimate interest in a working, secure site (Art. 6(1)(f) GDPR).
Who else sees your data
We do not sell your data and we do not share it for advertising. We use a small number of service providers, each bound by a data processing agreement:
| Provider | Purpose |
|---|---|
| Airtable (Formagrid Inc., USA) | Stores requests and gear data |
| n8n (self-hosted by us) | Passes requests into Airtable, sends notifications |
| WhatsApp (Meta Platforms Ireland) | The conversation with you |
| Netlify (Netlify, Inc., USA) | Serves this website |
Airtable and Netlify are based in the United States. Those transfers rely on the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. If you would prefer your request not to be stored outside the EU, email or message us instead of using the form and we will handle it manually.
Beyond that, we only pass on data where the law requires it — for example to tax authorities or in response to a lawful order.
How long we keep it
| Data | Kept for |
|---|---|
| Requests that never became a rental | 12 months |
| Rentals, invoices and payment records | 10 years |
| Damage reports and handover photos | 2 years after return |
| Newsletter address | Until you unsubscribe |
| Server logs | Up to 30 days |
The ten years for rental and payment records is not our choice — Portuguese accounting and tax law requires it.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you;
- correct anything that is wrong;
- delete it, where we are not legally required to keep it;
- restrict or object to how we use it;
- send it to you or another provider in a portable format;
- withdraw consent you gave, at any time.
Email boards.ohana@gmail.com and we will answer within one month. If a request is unusually complex we may take up to two months more, and we will tell you why within the first month. We may ask you to confirm who you are before we hand over personal data.
If you think we are handling your data wrongly, you can complain to the Portuguese data protection authority, CNPD (cnpd.pt), or to the authority where you live.
Automated decisions
There are none. Nothing about your rental is decided by a machine. If you ask us to recommend a board, a person reads your height, weight and experience and picks one.
Security
The site runs over HTTPS. Access to the database is limited to the people who run Ohana, and our access keys are held on the server and never sent to your browser. Requests through the form are rate-limited and validated on the server.
Children
This service is for people 18 and over. We do not knowingly collect data from children. If a parent or guardian rents for someone younger, they are the contact and their data is what we hold.
Changes
If we change this policy we update the date at the top. For changes that materially affect you, we tell you directly if we have your email.
Who you are dealing with
Ohana Rentals, operated by Gabriele Inama as a sole trader (trabalho independente) in Portugal.
Email boards.ohana@gmail.com
WhatsApp +351 912 775 503
Portuguese law applies and the courts of Lisbon have jurisdiction. If any clause turns out to be invalid, the rest stays in force.