Privacy Policy

Black Sand Box is the controller responsible for your personal data. We are based in São Miguel, Azores, Portugal. For any privacy question or request, you can reach us at geral@blacksandbox.pt.

Depending on how you use the site and our services, we may collect:

• Booking details: your name, email address and phone number, provided when you book a lesson or activity.
• Payment information: processed directly by our payment provider, Stripe. We receive confirmation of payment but never see or store your full card details.
• Communications: the content of messages you send us by email or WhatsApp.
• Usage data: anonymous analytics about how the site is used (such as pages viewed and approximate region), collected only if you accept analytics cookies.
• Technical data: your IP address and basic device information, processed by our hosting provider to deliver and secure the site.

We use your personal data for the following purposes, each with a legal basis under the GDPR:

• To manage your booking: sending confirmations and invoices and contacting you about details such as location and times (performance of a contract).
• To process payments (performance of a contract, carried out by Stripe).
• To respond to your enquiries and messages (our legitimate interest in assisting you).
• To understand and improve how the site is used, through analytics (your consent, given via the cookie banner).
• To keep the site secure and operational (our legitimate interest, and compliance with legal obligations).

We use a small number of cookies. One essential cookie remembers your cookie choice. If you consent, we use Google Analytics to understand how the site is used, which sets analytics cookies. You can accept or decline at any time using the “Cookie settings” link in the footer. We do not use advertising or cross-site tracking cookies.

We do not sell your personal data or share it for third-party marketing. We share it only with service providers who process it on our behalf, under appropriate agreements:

• Stripe: secure payment processing.
• Google (Google Analytics): anonymous website usage statistics, only with your consent.
• Cloudflare: website hosting, delivery and security.
• Meta (WhatsApp): where you choose to contact us via WhatsApp.

Some of our providers may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards recognised under the GDPR (such as the European Commission’s standard contractual clauses) to protect your data.

We keep booking and payment records only for as long as necessary to provide our services and to meet our legal and accounting obligations, after which they are deleted or anonymised. Analytics data is retained in aggregated or limited form according to our analytics settings. Messages are kept only as long as needed to handle your enquiry.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data (“right to be forgotten”);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw your consent at any time, where processing is based on consent.

Our services may be enjoyed by children, but bookings and any personal data for participants who are minors must be provided by a parent or guardian. We do not knowingly collect personal data directly from children without such consent.

We take reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Payment data is handled entirely by Stripe using industry-standard security.

We may update this Privacy Policy from time to time. The current version is always the one published on this page, with the “last updated” date shown above.

To exercise any of your rights or to ask a question about this policy, please contact us using the details below. You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

• geral@blacksandbox.pt
• WhatsApp: +351 926 729 232