Privacy notice

How Surf Buddy handles partner data

Version: 2026-09-29-1 · Last updated: 29 September 2026

1. Controller and contact

Daniel Witt, Hochhorst 2, 24229 Schwedeneck, Germany, is the controller for personal data processed through the Partner Workspace. Phone: +49 4308 1834753. Questions and data-protection requests can be sent to partners@surfbuddyapp.com or contact@surfbuddyapp.com. No data protection officer has been appointed because the current statutory appointment conditions are not expected to apply.

2. Scope

This notice supplements the Surf Buddy Community Privacy Notice for adults who apply for or use coach, organizer, content, brand, finance or organization capabilities. The same person may use one Surf Buddy account for both contexts; the workspace adds roles and business records rather than creating another identity.

3. Data categories

• Account and access: name, email addresses and verification, password hash or linked Apple identity, account status, registration/invitation links, memberships, roles, permission overrides, recent-authentication evidence and session/security records.
• Application and organization: selected partner focus, application message and status, business name, address, contacts, ownership, team, capabilities, business verification and approval/rejection evidence.
• Public coach and event information: display profile, biography, qualifications, image variants and rights attestations, locations, event descriptions and dates, co-coaches, organizer information and external booking URL.
• Agreements and content: offers, questionnaire answers, approved document versions/hashes, acceptance evidence, termination, rights evidence, product assignments, countries/languages and content-delivery status.
• Finance and tax: App Store Connect sales reports, correction/import records, revenue schedules, statements, tax classification and evidence, invoices, payment status, payout destination and change history.
• Communications, moderation and audit: emails and notices, reports, decisions, administrator actions, IP address, hashed user-agent, timestamps, error/security events and support messages you send.

Please do not upload participant lists, customer health records, identity documents or other unnecessary sensitive data. The Partner Workspace does not give coaches access to surfers’ private sessions, GPS tracks, HealthKit data or private notes.

4. Sources

Data comes from you, organization owners and invited team members; Surf Buddy administrators reviewing applications and content; Apple when App Store Connect reports are imported or Sign in with Apple is used; and technical systems that create security, delivery and audit evidence.

5. Purposes and legal bases

We process partner data to verify and administer applications, identities, organizations and permissions; negotiate and perform agreements; publish approved profiles and events; document content rights; import and reconcile sales; calculate remuneration; process invoices and payouts; meet tax, accounting and other legal duties; answer requests; prevent abuse; secure the service; and establish, exercise or defend claims.

The expected legal bases are steps requested before a contract and performance of a contract (Art. 6(1)(b) GDPR); compliance with legal obligations (Art. 6(1)(c)); and legitimate interests in operating a secure, accountable B2B service, checking authority and quality, documenting rights, moderating public content and promoting approved Surf Buddy offerings (Art. 6(1)(f)). Consent applies only where expressly requested for an optional purpose (Art. 6(1)(a)). The final legal allocation and balancing assessments require legal confirmation before Production launch.

6. Required data and consequences

Fields marked as required are necessary to review an application, grant access, publish requested content, conclude an agreement or meet finance/tax duties. Without them, Surf Buddy may be unable to approve a capability, publish an item, offer an agreement or make a payment. Registration alone does not create an entitlement to approval or compensation.

7. Public information

Only deliberately approved fields are public: the linked public surfer profile, separate public coach/organization profile, approved images and published event summaries/booking links. They may be delivered through the Surf Buddy website/API and as one-way copies in Public CloudKit and can be viewed worldwide. Test-workspace content is excluded.

Legal names used only for contracts, private addresses, emails, memberships, permissions, applications, questionnaire answers, tax status, invoices, payout data, sales reports and audit/security information are not public.

8. Recipients and service providers

• manitu GmbH, Germany: hosting, MariaDB, file storage, logs and operational email. A data-processing agreement should be maintained.
• Apple: Sign in with Apple, Public CloudKit delivery and App Store Connect sales/report data. Apple’s own terms and privacy information apply.
• Banks or Wise: only where selected and necessary to execute or receive a partner payment.
• Tax/accounting and legal advisers; public authorities: only where necessary for professional advice, compliance, audits, binding requests or claims.
• Authorized organization members: can access records within their organization according to assigned roles. Sensitive payout, tax, legal and finance data uses additional permissions.

The workspace does not use advertising or analytics tracking. The final provider register, processing agreements and international-transfer safeguards must be verified before Production launch.

9. International processing

Manitu hosting is located in Germany. Apple and Wise operate internationally and may process information outside the European Economic Area under their applicable safeguards. Public profiles and events are intentionally available worldwide. The exact providers used for each module and their current transfer mechanisms must be confirmed during legal review.

10. Retention

• Unverified accounts without an organization are scheduled for automated deletion seven days after creation.
• Expired sessions, password-reset and invitation material are removed under their security schedules.
• Rejected applications are locked and later deleted or anonymized after a legally approved dispute period.
• Public profile/event data is withdrawn when publication ends, subject to a limited claims/moderation buffer and durable public-removal processing.
• Agreements, rights evidence, sales reports, statements, invoices, payments, tax classifications and required audit evidence are restricted and retained for applicable statutory and limitation periods.
• Encrypted backups follow a rolling schedule currently designed as 7 daily, 8 weekly and 12 monthly copies. Deleted data can remain in inaccessible backup generations until expiry.

The executable account-closure manifest anonymizes the account while preserving only record classes that the approved retention decision requires. Exact periods for rejected applications, security/moderation records and individual business documents require legal approval before Production launch.

11. Account closure

A closure request removes public and optional account data where possible, revokes access and restricts retained evidence. It does not erase records that Surf Buddy must keep for tax, accounting, contractual, intellectual-property, moderation, security or legal-claims purposes. Organization ownership may require transfer before closure can be completed. Retained rows resolve only to an anonymized account tombstone and are not available for ordinary profile or community use.

12. Your rights

Subject to statutory conditions, you can request access, correction, deletion, restriction, portability and information about recipients; object to processing based on legitimate interests; and withdraw consent prospectively. We may need to verify identity and organization authority before acting on a request.

You may lodge a complaint with the Landesbeauftragte für Datenschutz Schleswig-Holstein, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, mail@datenschutzzentrum.de, www.datenschutzzentrum.de, or another competent supervisory authority.

13. Automated decisions

No decision producing legal or similarly significant effects is currently made solely by automated processing. Automated validation, rate-limit and workflow rules can reject incomplete or inconsistent submissions; application, publication, moderation, tax and agreement decisions involve human review.

14. Cookies and security

The Partner Workspace uses only session, CSRF and security storage required for sign-in and the requested service. It does not use analytics or marketing cookies. Access controls, MFA for administrators, recent-authentication checks, scoped permissions, encryption, audit records, file validation, backups and security monitoring protect the service. No system is risk-free.

15. Changes

This notice will be updated when processing, providers or law changes. Material changes will be communicated through the workspace or another suitable channel. Terms acceptances retain their exact version and document hash; a privacy notice acknowledgement is recorded in the applicable account context.