Privacy Policy

1. Service provider and contacts

SurfCamItalia is the trade name under which an Italian sole proprietorship provides the service; SurfCamItalia is not a company. The holder of the business is the other party to the contract and the controller of personal data.

For support, subscriptions, complaints, withdrawal, requests about personal data and reports of content, write to info@surfcamitalia.it. For communications with legal effect use the PEC address. We answer in Italian or English.

2. Who this notice is for

• Visitors to the website, including those without an account.
• Registered users and subscribers.
• People who appear in the webcam images (surfers, bathers, passers-by), even if they do not use the website.
• People who manage a partner on the website.

The Provider has not appointed a data protection officer (DPO): for any question about personal data use the contacts in section 1.

3. Account data

4. Accounts transferred from the previous website

If you had an account on the previous SurfCamItalia website, the same Provider has transferred to the new website the data needed to continue the service: e-mail, name, profile data, subscription and its dates, identifiers at Stripe, Partner agreements and saved Clips. The protected version of the old password is kept encrypted only to let you sign in the first time and is deleted no later than 90 days after the transfer. We did not transfer the chat history or the sessions of the previous website. The data of the previous website remain with its hosting provider until that website is decommissioned.

Legal basis: ongoing contract and legitimate interest in not interrupting the service (art. 6.1.b and 6.1.f).

5. Access, devices and security

• Sign-in sessions: start date and date of last activity, browser type.
• Authorised devices: type (phone, computer, tablet, TV), a generic name such as “iPhone” and a random credential saved in a cookie. We do not use hardware identifiers, device fingerprints or the IP address to recognise devices.
• Viewing sessions: when you watch LIVE, Replay or Archive we record account, device, webcam, start and end, to apply the limits of the Plan and of the devices.
• IP address: used for a few minutes to limit repeated attempts (sign-ins, registrations, messages) and, in unreadable form (cryptographic hash), for the free LIVE preview; recorded in the servers’ technical logs.
• Visit counting: to count daily visits to Spots and webcams the server calculates a pseudonymous identifier, different every day, without cookies.
• Log of operations relevant to security and administration (for example password change, change of rights, moderation decisions), without IP addresses.
• For staff: two-step verification and trusted devices.

Legal basis: contract (limits of the Plan and of the devices) and legitimate interest in the security of the service and in preventing abuse and fraud (art. 6.1.b and 6.1.f).

6. Subscriptions and payments

We process the Plan, its status, dates, amounts, receipts and the customer and subscription identifiers at Stripe. Full card details are processed only by Stripe; SurfCamItalia does not receive them.

If you exercise withdrawal, including with the online function “Withdraw from the contract here”, we process the request, the contract it refers to, the date and time of receipt and the refund.

To prevent the Weekly Plan from being bought several times by the same person, we keep the e-mail address used for the purchase, in normalised form, even after the account is deleted.

Legal basis: contract; legal, accounting and tax obligations (art. 6.1.c); legitimate interest in preventing abuse of offers (art. 6.1.f).

7. Partner agreements and partners

If you request Partner agreement access we process the request, the chosen partner, the status and the dates. The partner sees the name with which you introduce yourself and the status of the request; it does not see your payments or your activity on the website. For people who manage a partner we process the account data and the operations carried out for the partner. Legal basis: contract.

8. Webcams: LIVE, Replay and Archive

SurfCamItalia’s webcams are installed at premises that host them near the spots and frame mainly the sea and the activity in the water, to show sea conditions. They are not a video surveillance system. The shots are panoramic: people in the water or on the beach usually appear small, but in some cases, for example close to the webcam or to those who know them, they may be recognisable.

• Ordinary Archive retention: 45 days from the day of recording, the same for every webcam. If we set a different period for a webcam, we state it in this notice before applying it. Once the period has passed, the recorded hours are deleted by the periodic clean-up procedure.
• Protected days: individual days of particular interest for documenting the sea, for example an exceptional storm swell, may be excluded from ordinary deletion. Only authorised staff choose them, stating the reason and a review date within three years; the protection and its release are logged with author, date and reason. When the protection is released the day returns to ordinary retention and, if the 45 days have already passed, it is deleted at the next clean-up.
• Earlier recordings: the hours archived before the 45-day retention was introduced, which happened with the move to the new website, are not deleted automatically. They are kept without a pre-set expiry, as a historical archive of sea conditions, until the Provider decides otherwise; if we decide to delete them or to set an expiry, we update this notice.
• Removal requests apply to all the recordings kept, including protected days and earlier recordings: the indicated interval is made not visible at once.
• Clips created by subscribers have their own lifetime, independent of Replay and the Archive.

Purpose: providing information on sea conditions and sports activity at the spots, live and over time; with the Archive, documenting storm swells and the sea conditions of previous days.

Legal basis: legitimate interest of SurfCamItalia and its users in knowing sea conditions (art. 6.1.f). LIVE, Replay and the Archive are reserved, depending on the Plan, to those who subscribe, but the subscription and the acceptance of the Terms concern only the subscribers and are not a consent of the people filmed: for this reason anyone who appears in the images always has the right to object (section 20). The measures we adopt and the procedure to have yourself removed are described in the Webcam notice.

Promotional use: we do not use images in which a person is recognisable for advertising or on our social media channels without that person’s consent.

• Webcam notice

9. Clips

• What we store: the video file (at most 60 seconds), the Spot, the webcam, the interval, the creation date and the daily count of Clips created.
• Visibility: Clips are visible only to you and, for support and moderation, to authorised staff. They become public only if you publish them in the Community (section 11).
• Download: a downloaded Clip is a copy on your device, for which you are responsible (Terms, section 12).
• Retention: Clips have their own lifetime, independent of Replay and the Archive. They remain in your account even after the deletion of the recording they were created from and even after your subscription ends, until you delete them or delete the account, unless they must be removed upon a well-founded request of a person filmed, for breach of the Terms or by law. When you delete a Clip or the account, the Clip disappears immediately from the service; the file is then erased from storage during the next periodic clean-up. After the account is deleted we do not keep the Clips, save for legal obligations.

Legal basis: contract (art. 6.1.b) for you; for the people filmed in the Clip, the legitimate interest described in section 8.

10. Chat, ratings, favourites, Upcoming webcams

• Spot Chat: messages are visible to anyone who opens the Spot page, with your nickname, and remain until you delete the account.
• Ratings and favourites: we show only the average rating, never who voted.
• “Upcoming webcams”: the votes and suggestions you send, with their outcome. Before you sign in, your choices are kept in a technical cookie for 7 days.

Legal basis: contract; legitimate interest in moderation.

11. Community, Wax Point and rewards

Every registered account is part of the Community, when it is active. The following are public, including to people without an account and to search engines: nickname, profile picture if you upload one, level, badges, total WAX, month of registration, posts, published Clips with a preview frame, comments, “likes”, followers and following, position in the leaderboards. The following are never public: e-mail, name, Plan, payments, devices and your personal progress.

Publishing a Clip means making it visible to anyone: before doing so, check that it does not expose recognisable people in a way that could harm them, and in particular minors.

In the Community feed, published Clips start by themselves, without sound, when they are clearly visible on the screen, one at a time; sound starts only when you tap the Clip. A published Clip can therefore be seen also by people scrolling the feed without looking for it. Autoplay can be switched off on each device with the “Autoplay” control of the feed and, unless you switch it back on on that device, it does not start when the device asks to save data or to reduce motion. The choice is saved only in your browser (Cookie Policy).

Wax Point and rewards: we record the activities that earn WAX, the balance, the subscription seniority and reward requests with their outcome. The rewards currently redeemable are additional subscription days and do not require any other data.

Legal basis: contract (the Community is a feature described in the Terms). Retention: until you delete the content or the account.

12. Invitations (“Invite a friend”)

If you register from an invitation link, the code contained in the link reaches our server with the registration page and we link your account to that of the person who invited you. The code is not saved in your browser. The person who invited you sees, on their invitations page, your nickname, the registration date and the status of the invitation, which becomes “valid” when you make your first payment, and receives a notice at that moment. They do not see your e-mail, your Plan or the amounts.

Legal basis: contract (the programme is described in the Wax Point rules).

13. Reports, removal requests and moderation

If you report content or request the removal of images, we process the request, the reason, the references (webcam, date, time, link) and your contact details; if you describe to us how to recognise you in the images, we use the description only to find them. For the person who published reported content we process the content, the decision and the statement of reasons. The person reported does not receive the name of the person who reported.

Legal basis: legal obligations (Regulation (EU) 2022/2065 “DSA”; arts. 12 and 15–22 GDPR; art. 6.1.c) and legitimate interest in the security of the service (art. 6.1.f).

14. E-mails, on-site notifications and push notifications

• Service e-mails (sign-in, password recovery, confirmations and receipts, withdrawal, renewals, failed payments, expiries, Partner agreements): necessary for the contract, cannot be turned off as long as you have an account.
• On-site notifications (“Notifications” area): about what you follow; managed from your preferences.
• Push notifications: only if you turn them on with the “Turn on push notifications” button. We store, encrypted, the technical address provided by the browser to deliver them through the push service of the browser maker (Google, Apple, Mozilla or Microsoft), which receives only an encrypted message. We delete it when you turn them off or when the service declares it expired.
• Promotional communications (offers and news): only if you turn them on with the dedicated box, separate and never pre-ticked, or from your preferences (consent, art. 6.1.a). You can withdraw your consent at any time from your preferences or from the link in every message, without consequences for the service.

15. Messages you write to us

The forms on the Contact page prepare an e-mail in your mail program: the website does not send or store anything. The e-mails you write to us arrive in our mailbox and we keep them for as long as necessary to handle the request and any consequences.

16. Cookies, maps and third-party services

We use only technical cookies and browser storage to make the service work; we do not use third-party profiling, advertising or analytics cookies. The complete list is in the Cookie Policy.

The Spot map loads the map images from OpenFreeMap: to show them to you, your browser connects to their servers, which receive your IP address and the technical data of the request. Payments take place on Stripe’s pages, which use their own cookies. The website’s fonts are served from our servers. Links to social media or partner websites lead to services with their own notices.

• Cookie Policy

17. How long we keep data

18. Who we share data with and transfers outside the EU

The data are processed by the Provider and by authorised and instructed persons. The following categories of suppliers process them on our behalf, as processors (art. 28 GDPR):

• suppliers of servers, databases and storage of recordings and Clips, including Hetzner Online GmbH (Germany);
• suppliers of the servers that receive, transmit and record the webcam videos;
• supplier of the storage space where the encrypted database backups are kept;
• supplier of the service that sends the service e-mails;
• supplier of the Provider’s mailbox;
• hosting provider of the previous website, until it is decommissioned.

The following are instead independent controllers: Stripe Payments Europe, Limited (Ireland), for payments, fraud prevention and its own legal obligations; the push services of browser makers; OpenFreeMap for the maps; partners, as regards what they see of Partner agreement requests. We may disclose data to advisers (for example the accountant) and to the authorities when required by law. We do not sell data and do not use it for third-party advertising.

Transfers outside the EU: the servers and storage provided by Hetzner are located in the European Union. Stripe and the browsers’ push services may process some data in the United States, with the safeguards provided for by the GDPR (EU-US adequacy decision “Data Privacy Framework” for certified companies, or standard contractual clauses). If another supplier were to process data outside the European Union, it would do so only with the safeguards provided for by arts. 44–49 GDPR.

19. Minors

To create an account you must be at least 14 years old (art. 2-quinquies Privacy Code). Purchases are reserved for adults.

Minors may appear in the webcam images. Removal requests concerning minors always take priority and, when in doubt, we remove.

20. Your rights and how to exercise them

You can request access to the data and a copy (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18) and portability of the data you have provided to us (art. 20). You can object at any time to processing based on legitimate interest, including webcam footage (art. 21). You can withdraw a consent at any time, without affecting processing already carried out.

Write to info@surfcamitalia.it or to the PEC address indicated in section 1. We answer within one month; in complex cases the deadline may be extended by two months, and in that case we inform you within the first month (art. 12.3). For a request about webcam images, the webcam, date and approximate time are enough. We ask you for additional information only if it is needed to be sure that the data are yours.

You have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

21. Security, automated decisions and changes

We protect data with encrypted connections, restricted access and two-step verification for staff, passwords stored only in encrypted form, signed and temporary video links, and encrypted backups.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22). Automatic limits and the temporary hiding of reported content are security measures, always open to review by a member of staff.

If this notice changes we publish the new version with its date; if the change is significant we inform you by e-mail.