Kata Patek Productions s. r. o.
Budatínska 3230/16A, 851 06 Bratislava, Slovakia
Company ID (IČO): 55828701
Contact: contact@bigwavesurfchannel.com
This policy describes personal-data processing for Big Wave Surf Channel at bigwavesurfchannel.com, including website enquiries and independent editorial work.
2. Data and purposes
Contact enquiries: the form collects your name, email address, subject and message and records submission time. Each submission is stored privately in our website database, with access restricted to authorised administrators. After it is saved, an email notification containing the enquiry is sent to contact@bigwavesurfchannel.com through the email service provided by our website platform, Lovable. Replies are handled through our Google Workspace mailbox. We use this information to handle enquiries, including photography licensing, and follow-up. Email sent directly to the contact address is handled through the same mailbox. Please do not send unnecessary sensitive or third-party confidential information.
Website delivery and security: hosting and infrastructure may process technical information such as IP address, browser information, requested resources, timestamps and errors to deliver, secure and diagnose the website.
Private administration: account and authentication records support Owner sign-in and access control. Visitors do not need an account to read published content.
Editorial work: Stories, documentaries, photographs, footage, captions and credits may identify athletes, contributors and others. Original reporting, filming, contributors and external sources may supply such information. We process it for independent journalistic, editorial and artistic work, taking account of privacy and freedom-of-expression requirements. Publication in a public setting does not by itself remove data-protection obligations.
External media: YouTube, Windy and other embedded providers receive browser requests only when the External Media preference is enabled. They may process IP addresses, device information, referrers and their own cookies or storage under their policies. Ordinary external links take you to the provider when followed. Inter fonts are served through our website asset service, not Google Fonts.
3. Legal bases
We handle enquiries on the basis of steps you request before entering a contract where applicable, or our legitimate interest in responding to enquiries and managing correspondence. Website operation and security serve our legitimate interest in delivering a functioning, secure service. Optional embedded media is enabled through your consent. You may withdraw that choice at any time in Manage Privacy Preferences.
Editorial processing is assessed in its particular context, including applicable GDPR legal bases and Slovak provisions protecting journalistic and artistic expression. We do not treat media status as a blanket exemption or freedom of expression alone as an Article 6 legal basis. Legal obligations or the establishment, exercise or defence of legal claims may require specific processing or retention. Where a different basis or additional condition is required for particular material, it must be assessed for that processing.
4. Recipients and services
Lovable provides the website platform and managed backend for database, authentication and storage. Its service chain includes infrastructure providers described in its current subprocessor information: https://lovable.dev/subprocessors. Access for site management is restricted to authorised administration; the operator may use administrative and AI-assisted tools when managing the project.
BWSC operates under a Lovable Business subscription. Lovable's Data Processing Agreement is incorporated into the applicable Terms of Service and covers processing within its defined scope.
Google/YouTube and Windy receive data when their embedded services are permitted. Other providers can appear through editorial embeds; their own policies govern independent-provider processing. Contact form notification emails are sent through Lovable's email service to the operator's Google Workspace mailbox, where replies and direct email correspondence are handled. Data may also be provided to advisers or authorities where required for a particular matter or by law.
Forecast adapters request fixed surf-location data server-side from sources such as Open-Meteo, MET Norway, IPMA and Instituto Hidrográfico; conditional adapters may use other configured sources. The inspected requests do not forward a visitor's identifier, browser IP address or location to those forecast sources. Forecast sources are not thereby described as personal-data processors for visitors.
5. Processing locations and transfers
The managed database region identified for this project is AWS eu-west-1, Ireland. This does not establish the location of all media, backups, logs, support access or delivery traffic. We do not represent that all processing remains in the European Economic Area. Providers may operate or access information outside it, including in the United States. Applicable provider terms and transfer mechanisms depend on the service and processing involved; no assurance of a particular safeguard for every transfer is given here.
6. Retention
Website contact records are retained for 12 months after the last reliably recorded communication, subject to documented legal holds or other applicable retention obligations. New submissions record their receipt time. Owner-recorded reply dates reflect actual correspondence; editing a record does not automatically pretend a new communication occurred.
Email copies of contact enquiries, replies and direct email correspondence may also exist in the Google Workspace mailbox. These mailbox records are retained only for as long as necessary for the relevant enquiry, contractual relationship, legal obligation or legitimate claim, and are reviewed and deleted through the operator's mailbox procedures. Deleting a website record does not automatically delete its email copy.
A daily retention process deletes eligible expired records in bounded batches. Legacy records are protected pending review of correspondence dates and retention obligations so existing enquiries are not deleted on an unverified date. Documented holds and records awaiting review are excluded from automatic deletion. The Owner must review these exceptions and release them when no longer justified. Large backlogs or service interruption can delay completion.
Owner-only controls also support individual deletion and correction. Deletion logs record action, time and count without retaining the deleted message text or email. Deleting a website record does not delete separate mailbox correspondence, licensing files, provider logs or backup snapshots. Those records require their own necessity and obligation assessment; the contact period is not asserted as their retention period. Editorial material is retained according to its continuing editorial purpose and applicable rights and obligations.
Deleted records may remain in provider backups until those backups expire under the provider's retention procedures. Deletion from the active database does not necessarily remove information immediately from retained backups. If data is restored from a backup, applicable deletion and correction requests must be reapplied before the restored records are used.
7. Security
The website uses encrypted connections and Owner-only access controls for administration and contact records. Public visitors cannot read contact submissions through the application's access policies. No internet transmission or storage system is completely secure; no unverified encryption-at-rest or other technical assurance is claimed.
8. Rights
Depending on the circumstances, you may request access, correction, erasure, restriction, portability, or object to processing. Consent can be withdrawn without affecting earlier lawful processing. Contact contact@bigwavesurfchannel.com. See EU Privacy Rights for applicable limits, identity checks, response times and complaint options.
The competent Slovak supervisory authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), https://dataprotection.gov.sk. You may also complain to another competent EU supervisory authority.
9. Cookies and automated decisions
See the Cookie Policy for browser storage and choices. The application does not include active analytics or marketing tracking, or automated individual decisions producing legal or similarly significant effects. Surf forecasts describe ocean conditions, not decisions about people. Operational provider processing is not excluded by these statements.
10. Updates and contact
The current version will be published on this page. For privacy questions or requests, contact contact@bigwavesurfchannel.com.