Privacy policy

1. Who is responsible

The controller responsible for processing your personal data on this website is:

Nicolás Lacoste · YOS Experiences
Santiago, Chile
Email: hola@yosexperiences.com

For any question about your data or to exercise your rights, write to hola@yosexperiences.com. We answer within one month at the latest.

2. Summary

• We collect data when you send us a reservation request, a message, a partner proposal or an email, and, only if you say yes, to send you news.
• We use it to answer you, prepare your booking and, with your consent, to keep you informed.
• This website uses no advertising and no social media tracking. With your consent only, we use Google Analytics to understand how the site is used; we also use a cookieless visit counter (Cloudflare Web Analytics). Fonts and images are served from our own server.
• You can ask us at any time what data we hold about you, have it corrected or deleted, and withdraw your consent.

3. What we process, why, and on what legal basis

3.1 Visiting the website

When you open a page, your browser automatically sends technical data to our servers: IP address, date and time, page requested, referring page, browser and operating system. Our hosting and security providers process this data to deliver the site and to protect it against abuse and attacks. We do not combine it with other data or use it to identify you.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). Retention: log files are deleted automatically by our providers after a short period, normally within a few weeks, unless needed to investigate a specific security incident.

3.1a Visit statistics without cookies

Our network provider Cloudflare counts visits to this site with Cloudflare Web Analytics. It does not set cookies, does not use your browser's storage and does not create profiles or follow you across other websites. It records aggregated information such as the page visited, the referring site, the country and the type of device, and loading times. We use it to know which content is useful and to keep the site fast.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding, in an anonymous and aggregated way, how the site is used).

3.1b Google Analytics (only with your consent)

If you click "Accept" in the cookie banner, we use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how visitors use the site: pages viewed, time on page, approximate location (country, city), device, browser and how you arrived (for example from a campaign link). Google Analytics sets cookies on your device and processes this data on Google's servers, which may include servers in the United States (Google is certified under the EU-U.S. Data Privacy Framework). We do not use it for advertising and have switched off data sharing with Google for advertising purposes.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with the "Cookie settings" link at the bottom of every page. Retention: analytics data is kept for 14 months.

3.2 Reservation requests

When you use the "Reserve your spot" form we process: name, email, phone or WhatsApp (optional), the journey you are interested in, preferred month, number of participants, the equipment you will bring and your message. We use this data to check availability, answer you, send you a confirmation email and, if you decide to book, to prepare your contract.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).

3.3 Contact form and emails

When you write to us through the contact form or by email to hola@yosexperiences.com we process your name, email address, the topic and your message, plus any data you choose to include, in order to answer you.

Legal basis: Art. 6(1)(b) GDPR when your message concerns a journey or booking; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

3.4 Partner proposals

If you propose a collaboration through the partners form we process your name, business name, email, activity and message to evaluate and answer your proposal.

Legal basis: Art. 6(1)(b) and (f) GDPR.

3.5 Confirmation emails

After you send a form, our system emails you a short confirmation with a copy of the key details, so you know your request arrived. Legal basis: Art. 6(1)(b) GDPR.

3.6 News by email (only with your consent)

If you tick the optional box "Yes, send me news from YOS Experiences", we will send you occasional emails about new journeys, dates and offers. We use a double opt-in: you first receive an email with a confirmation link, and you are only added once you click it. To be able to prove your consent we record the time of your request and confirmation, your IP address and the text you agreed to.

Legal basis: Art. 6(1)(a) GDPR (your consent); recording the consent is based on Art. 6(1)(c) and (f) GDPR. You can withdraw your consent at any time, without giving reasons, through the link in every email or by writing to hola@yosexperiences.com. Withdrawal does not affect the lawfulness of processing before it. Not ticking the box has no effect on your request or booking.

3.7 Bookings and journeys

If you book a journey, we process the data needed to carry it out: identity and contact details, travel dates, accommodation and, where you share it with us, dietary needs or other information relevant for your participation. We only ask for health-related information if it is necessary for your safety, and only with your explicit consent (Art. 9(2)(a) GDPR).

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for accounting and tax obligations.

3.8 Photos and video during the journeys

Our journeys are about creating images. Photos or videos in which you appear are only published by YOS Experiences (for example on this website or on social media) with your separate consent, which you can withdraw at any time.

4. Who receives your data

We do not sell your data. We share it only with service providers who help us run this website and our communication, and who process it on our behalf and following our instructions:

• Hosting and email server: HostGator (Newfold Digital, Inc.), servers in the United States.
• Security and content delivery network: Cloudflare, Inc., United States, which protects the site against attacks and delivers it faster.
• Visit statistics (only with consent): Google Analytics, Google Ireland Limited.
• Email inbox and request register: Google (Gmail, Google Sheets and Google Apps Script), where we receive your messages and keep an organised list of requests.

If you book a journey, we share the strictly necessary data with the local hosts, accommodation and guides who carry out the programme in Morocco. If you ask about a partner-operated experience (Your Dream Camp or Sueño Surf House), we only pass your request to that partner if you ask us to; from then on the partner processes your data as an independent controller under its own privacy policy.

We may also disclose data to authorities when we are legally required to.

5. Transfers outside the European Union

YOS Experiences is based in Chile, and some of our providers are based in the United States. This means your data is processed outside the EU/EEA:

• United States: Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision. For providers without that certification, transfers are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Chile: there is currently no EU adequacy decision for Chile. We transfer your data to Chile because it is necessary to answer the request you send us and to carry out the steps you ask for before and during a contract (Art. 49(1)(b) GDPR), and, for news emails, on the basis of your consent.
• Morocco: when you book a journey, the data needed to carry it out is shared with local service providers (Art. 49(1)(b) and (c) GDPR).

6. How long we keep your data

• Requests and messages that do not lead to a booking: up to 2 years after our last contact, so we can follow up on your enquiry; then deleted.
• Booking data: for as long as needed to carry out the journey and handle any claims, and afterwards for the periods required by commercial and tax law (in general up to 6 years for accounting records).
• News emails: until you unsubscribe. Proof of your consent is kept for up to 3 years after unsubscribing.
• Unconfirmed news sign-ups: deleted after 30 days.
• Server logs: see section 3.1.

7. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);
• object at any time to processing based on our legitimate interest (Art. 21);
• withdraw your consent at any time with effect for the future (Art. 7(3)).

To exercise these rights, write to hola@yosexperiences.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

8. Do you have to provide your data?

Fields marked as required are needed to answer your request; without them we cannot process it. Everything else is optional. You are never required to subscribe to news emails.

9. No automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Cookies and links to social media

Read our cookie policy to see the few technical cookies this site uses. Links to Instagram or other networks are plain links: no data is sent to those platforms until you click them, after which their own privacy policies apply.

11. Changes

We may update this policy when our services or the law change. The current version always applies and is published on this page.