Privacy policy
Lapoint Travels Privacy Policy
We at Lapoint care about data protection and your privacy. In this privacy policy, we want to inform you about how we process your personal data and what rights you have when you use our website. Personal data is all information that relates to you, such as name, contact information, payment details, personal ID numbers etc. We mainly process your personal data for the following purposes:
To process your booking request from you directly, a group you are traveling with or via an agent that is processing the booking for you. This includes all requests such as transport, dinner options, surf lesson level and so on.
To market our services
To sign you up to receive newsletters and offers
To answer your questions about our services
To assess your application to join one of our teams
You have several rights according to data protection law. For example, you always have a right to object against marketing at any time. You can also read about how to affect our processing of your personal data – what rights you have.
Do you want to know more? Please read our detailed explanations below. Read more about how, why and for how long a period we process your personal data
What data does Lapoint store on you?
In order to process your purchase, newsletter requests, applications to work or to give you photo memories from your travel with us, Lapoint may have your name, address, tel.no, birth date, nationality, gender, email, ICE name and phone number, passport information, medical conditions if its relevant to your safety on our camps, food preferences, type of package requested, Arrival information, allergies, medicine use, purchase history as well as photos or videos of you. Photo and video material requires a media release form consent from you, and this will also be stored.
Who is responsible for the processing of your personal data?
Lapoint Travels AS, Hoddevika, 6750 Stadlandet (VAT NR. NO 928 620 891), is responsible, in the capacity of controller, for the processing of your personal data when Lapoint processes your data for Lapoint’s own purposes, as further described below.
This policy explains how we process your personal data when you use our website, proceed to travel with us or if you become one of our ambassadors or send in a work application. If you proceed to work for us, we will give you further information in a separate policy about this.
If you have any questions regarding our processing of your personal data – or if you want to exercise any of your rights as described in the section of this policy called “How can you affect our processing of your personal data?” – please do not hesitate to contact us at:dataprotection@lapointcamps.com.
Who provides us with your personal data?
You or your parent or legal guardian have provided all the personal data that we process about you who use our website. We do not contact a 3rd party in order to gather information about you.
Do you have to provide your personal data?
Generally, it is always you who decide what personal data you want to share with us. Nonetheless, some of your personal data is necessary for us to process to be able to carry out our purchase contract and fulfill our commitment to you. This includes information to be able to make an invoice, to identify you upon arrival and so on.
In the case when we act on your request, for instance if you ask for a newsletter or buy a trip from us via our websites or 3rd party certified agents, this applies. If you do not provide us with the necessary information, we will not be able to fulfill our commitments towards you according to your request.
Who can gain access to your personal data?
We do not pass on your personal data to others unless there is a legal basis for this. Examples could typically be to be able to deliver the service you have requested, to execute your purchase contract with us or where we have a legal obligation to share such information with public authorities.
We use data processors to perform certain tasks on our behalf and on our instruction. In such cases we have entered into necessary data protection agreements with providers to ensure the appropriate level of protection of your personal data.
It may be that we use suppliers or process personal data outside the EEA. In such cases, transfer and processing outside the EEA (third countries) will take place in countries approved by the EU Commission or in accordance with a valid legal basis for the transfer of personal data under GDPR Chapter V. If transfer to countries approved by the EU Commission does not occur, transfer will only take place under the guarantees set out in GDPR Article 46(2).
A list of our data processors and the legal basis for transfers to third country providers can be provided on request.
How can you affect our processing of your personal data?
According to data protection legislation, you are entitled to a variety of rights to affect our processing of your personal data. Read more below.
Your rights of data protection with Lapoint:
You have the right to ask for a full enclosure insight on what data we have on you.
You have the right to change and/or request deletion of your personal data we have on you.
You have the right to object to our processing of your personal data.
You have the right to object to marketing from us, such as newsletters, Facebook, and Instagram pictures etc.
The right to object generally is applicable when the processing is based on a balance of legitimate interests. Read more about what this means in the tables below.
When does your rights of Data Protection not apply:
The right to object does not exist if we must store your personal data to comply with other rules and regulations.
If we can show compelling legitimate reasons for the processing that weigh heavier than your interests and fundamental rights, such as a claim against you as a customer, criminal acts, insurance purposes, accident reports etc.
If it is for the purpose of determining, practicing or defending legal claims you do not have a right to object to the processing.
Right to access
You have the right to obtain confirmation as to whether we are processing personal data concerning you. [SM1] You can gain access to the personal data and obtain a copy of the personal data processed by us at any given time.
Right to rectification
You have a right to obtain rectification of any inaccurate personal data concerning you and to ask us to have incomplete personal data completed.
Right to erasure (“the right to be forgotten”)
Under certain circumstances, you have a right to request erasure of your personal data. This is the case for example where the personal data is no longer necessary for the purposes for which they were collected or otherwise processed, or you withdraw your consent on which the processing is based on and where there is no other legal ground for continuance of the processing.
Right to withdraw consent.
You have a right to withdraw a given consent for the processing of your personal data. Your withdrawal will have effect from the time of your withdrawal.
Right to object to processing
You also have a right to request that Lapoint restrict its processing of your personal data. That is the case for example when the accuracy of the personal data is contested by you, or the processing is unlawful, and you oppose the erasure of the personal data and instead request restriction of its use.
Right to data portability
You have a right to ask us to transfer certain parts of your personal data we have about you to another company (data portability) in a structured commonly used, machine-readable and interoperable format.
This right applies to personal data that you have provided us if:
The processing is based on consent or on a contract; and
The processing is carried out by automated means.
In exercising your right to data portability, you have the right to have personal data transmitted directly from Lapoint to another controller, where technically feasible.
Exercise your rights.
To exercise your rights you must contact us, see contact information above. We will respond to your inquiry as soon as possible and normally within 30 days of the request. If it takes longer than one month, you will be notified.
Right to lodge a complaint to a supervisory authority.
If you feel that our processing of personal data is not in accordance with what we have described here or that we are in breach of privacy policy legislation in other ways, you can complain to the EU/EEA member state of your habitual residence, place of work or of an alleged infringement of the applicable data protection laws.
What data, why we process it, and the legal basis behind it
All processing of your personal data is done for the purpose of processing your purchase, sending you newsletters or photos of you, as well as answering your questions and applications. Furthermore, our purpose is to market our services towards you. You can read the details of how we process your personal data in the tables below. We do not collect any excess data that we don’t need to deliver our services and obligations towards you and your Lapoint purchase.
We never save data longer than we need to and only use your personal data for the purposes set out in this policy. After this time, we will safely remove your personal data. The same personal data may be stored in several different places for different purposes. This means that we may delete data from one system when it is no longer needed there, while the same data may continue to be stored in a different system where its purpose is still valid for that specific system. If data is needed after this period for analytical, historical or other legitimate commercial purposes, we will take appropriate steps to anonymise the data so that it no longer constitutes personal data.
The personal data we collect via a booking is stored in our customer database for five years. Personal data is stored as a basis for market and customer analysis, for statistical purposes and in order to provide you with a better booking offer and better customer service.
The personal data is also stored in order to enable us to comply with the legal requirements, such as accountant purposes, with respect to the supervision in place for package tours and in order to ensure that there is documentation of booking in the event of a complaint. In the event of complaints, some data may be saved for as long as it is necessary for us to be able to defend ourselves against legal claims.
We do not share data with any 3rd party publishing tool. We do not resell your data for marketing purposes.
When you use our webpage
For which purpose do we process your personal data?
In order to improve our web pages functionality and to better understand the needs of our customer, we use cookies and pixels to gather customer information.
What personal data do we process?
When you use any of our websites, we collect data about your use of the service in question. Some of this data may be personal data, for example your IP address if it can be linked to individuals.
We also collect information about how you navigate in the relevant service, what searches you make and which products you are interested in. For more information about the type of data collected in connection with the use of our digital services, see our cookie policy here: Cookie Policy
What is our legal basis for processing your personal data?
Your consent
For how long will we store your personal data for this purpose?
We only store your personal information for as long as it is necessary and for the purposes as described more closely in our cookie-policy, you withdraw your consent for such processing and/or you delete the cookie from your browser.
When you are entering our Loyalty Program
For which purpose do we process your personal data?
To follow up on the participants of the Loyalty Program and to make sure the right person collects the right benefits
What personal data do we process?
Name, email address, purchase history, dates of travel
What is our legal basis for processing your personal data?
Necessary for the performance of a contract to which the data subject is a part of
For how long will we store your personal data?
Until you revoke your consent or when you leave the Loyalty program, maximum 5 years
When we send you marketing info about our services
For which purpose do we process your personal data?
To send you newsletters that you have signed up to.
To market our services to you.
What personal data do we process?
Your name, phone number and email address.
In order to determine which marketing is relevant for you, we process information that you have shared with us or that we collect from you when using our website.
What is our legal basis for processing your personal data?
Your consent and our legitimate interest in providing you with relevant communication and offers.
For how long will we store your personal data for this purpose?
Until you withdraw your consent or unsubscribe from our newsletters and marketing.
When we answer your questions on any of our customer channels
For which purpose do we process your personal data?
To answer the questions that you have asked us by email, chat, phone, whatsapp, facebook or instagram, or when filling in any of our forms.
What personal data do we process?
Information that you provide to us when asking questions, such as your name and your question.
If you ask us to call you, we will process your name and phone number.
If you send us an email with your questions, we will process your email address.
When you whatsapp us we will also be able to see your phone number.
If you send us a chat we will only see your alias name given to you by the chat system, your location (city, country) and other information you choose to share with us in the chat.
What is our legal basis for processing your personal data?
Processing is necessary for the performance of our contract, i.e. in order for us to be able to answer your questions as requested and process your order as requested by you.
For how long will we store your personal data?
Normally for 12 months after we have answered your questions by mail, so that you can get back to us with further questions or wanting to move forward with an application.
Normally for 6 months if you have contacted us by phone, chat, whatsapp, instagram or Facebook.
In some events such data might be saved for longer where we have a legitimate interest or it is necessary for us to be able to defend ourselves against any potential legal claims.
When you place a booking on our website
For which purpose do we process your personal data?
In order to be able to process your purchase, create invoice, and send information to the camp destination we gather personal data via our booking system.
What personal data do we process?
Name, address, tlf.nr, country of residence, email, ICE number to family, birth date, gender, passport number to payment responsible person.
Name, email and birth date of people in our travel party.
Arrival time and flight number, necessary medical information like allergies, food preferences etc.
What is our legal basis for processing your personal data?
Processing is necessary for the performance of the contract.
Security reasons (to be able to identify you).
For how long will we store your personal data?
We store data necessary for the performance of the contract and for maintaining customer relations for 5 years.
Data necessary for accounting purposes will be kept for 5 years.
Necessary medical data are stored up to 3 years, however optional medical information is deleted 3 months after departure date.
When you send us an application to become an ambassador
For which purpose do we process your personal data?
To process your interest application to become one of our ambassadors.
What personal data do we process?
Your name, phone number and email address as well as any information you share with us in your application.
What is our legal basis for processing your personal data?
Your consent.
Processing is necessary in order to take steps, at your request, prior to entering into a contract.
For how long will we store your personal data?
Until we have processed your interest application or until 6 months.
When you send us an application to become part of our staff teams
For which purpose do we process your personal data?
To process your interest application to become one of our staff team we need to check your CV with work and study history.
What personal data do we process?
Your name, phone number and email address as well as any information you share with us in your application.
What is our legal basis for processing your personal data?
Your consent.
Processing is necessary in order to take steps, at your request, prior to entering into a legal work contract.
For how long will we store your personal data?
Until we have processed your interest application or until 6 months.
When you send us an application to Youth Camp (under 18 year)
For which purpose do we process your personal data?
To be able to approve your application to join a youth camp, we need to make sure you have read and understood our regulations on the camp, and that your parents have approved your travels.
What personal data do we process?
Travelers name, birth date, gender, phone number, email.
Parents name, address, tlf.no, email, country of residence, birth date.
Signature from traveler and parents/legal guardians on Parent Declaration form.
Photo copy of parents passport or driver's license in order to confirm the signature.
Travelers and parents signature on our media release form.
What is our legal basis for processing your personal data?
Processing is necessary in order to take steps, at your request, prior to entering into a contract.
To make sure the youth travelers have a safe journey and that their parents have approved the booking. Our responsibility when accepting a booking from a person under 18 traveling alone is higher as we need to make sure our guest has understood our regulations.
To comply with our insurance policies for youth camps.
For how long will we store your personal data?
We store data necessary for the performance of the contract and for maintaining customer relations for 5 years.
Data necessary for accounting purposes will be kept for 5 years
Other data such as parent declarations until 3 months after the camp arrival date.
Our processing when you are part of a group/representing a group
For which purpose do we process your personal data?
To process your group trip purchase we need the details for the invoice as well as arrival info in order to accommodate you on arrival.
The invoice needs to show names of all participants.
What personal data do we process?
Travelers name, birth date, gender, phone number, email.
Payment responsible organization or persons name, address, tlf.no, email, country of residence, birth date.
Organizers signature on group trip contracts where approval of sharing data with necessary 3rd party suppliers are given by group trip organizers.
Any other information you decide to give us that you feel is relevant for us to know.
We also process information about you that you share with us when filling out group forms made by a group organizer.
What is our legal basis for processing your personal data?
Processing is necessary for the performance of the contract.
Processing is also necessary to fulfill legal requirements in relation to accounting.
For how long will we store your personal data?
We store data necessary for the performance of the contract and for maintaining customer relations for 5 years.
Data necessary for accounting purposes will be kept for 5 years.
Group trip booking links are kept for 6 months after the trip has been executed.
Group lists are deleted one month after the group has checked out.
When you are booked into one of our camps and ready to arrive
For which purpose do we process your personal data?
To identify you on the airport
To arrange your transport from the airport
To accommodate your food preferences
To find the right surf equipment for you
To report to local authorities when this is required by local laws
What personal data do we process?
Name, email, phone number, gender, arrival time, date, flight number, food preferences, surf level.
Reporting to local authorities:
Bali: Copy of passport is collected by the Police.
Portugal: A form with information about name, home address, passport information, date of birth, resident country and trip information must be filled out and sent to SEF, Serviço de Estrangeiros e Fronteiras. (Mandatory form for all non-Portuguese people that are staying in Portugal).
No other camps are reporting to local authorities.
What is our legal basis for processing your personal data?
Processing is necessary for the performance of the contract.
Processing is necessary to fulfill legal requirements.
Legitimate interest in maintaining the security on camp and in the lessons.
For how long will we store your personal data?
We store data necessary for the performance of the contract and for maintaining customer relations for 5 years.
Data necessary for accounting purposes will be kept for 5 years.
Data involving delivery on camp will be stored for 3 months.
When you sign a media release form
For which purpose do we process your personal data?
We love photography and most of our guests do, we use video as part of our coaching techniques and if this is included in your package, we will film and store your footage in case you return so we can see your development. We also take pictures as part of the service or to sell as a separate service.
In order to use your photos in marketing and to identify you in albums such as on Facebook and Instagram.
What personal data do we process?
Name, birth date, email.
Signature.
What is our legal basis for processing your personal data?
Your consent.
For how long will we store your personal data?
We store this data as long as you have an active customer relation to us, or until you withdraw your consent.
When you are at one of our camps
For which purpose do we process your personal data?
We may use CCTV images to help maintain the safety of anyone working in or visiting our premises and other buildings, and for the prevention, detection and prosecution of criminal offenses. We may also rely on the images to establish, exercise or defend our legal rights. In some of our camp destinations we are also obliged to have this according to local laws.
What personal data do we process?
Photographs/Video footage of you.
What is our legal basis for processing your personal data?
Legitimate interest in maintaining the safety of anyone working in or visiting our premises and other buildings.
In some of our camp destination we are obliged to have this according to local laws
For how long will we store your personal data?
Costa Rica: Within 7 days
Sri Lanka: Within 5 days
Portugal, Ericeira: Within 30 days
Canggu: Within 10 days
No other camp has camera surveillance.
When you fill in a feedback form
For which purpose do we process your personal data?
We do this in order to be able to contact you if we feel that we would like to understand your feedback better.
What personal data do we process?
Name, birth date, email.
If you choose to answer our question form we collect your email address if you choose to provide it. We also collect information about gender, nationality and previous experience with Lapoint.
What is our legal basis for processing your personal data?
Our legitimate interest in the processing of your personal data when you have submitted your feedback to us.
For how long will we store your personal data?
For 1 year.
When you fill in a breach of code of conduct form
For which purpose do we process your personal data?
We use this data to process any reports of breach of code of conduct at any of our camps.
To ensure a safe environment for everyone at our camps.
What personal data do we process?
Name, email.
What is our legal basis for processing your personal data?
Necessary for us to perform contractual and/or legal obligations, or to follow a legitimate interest handling a reported breach of our code of conduct.
For how long will we store your personal data?
Until 3 months after incident for statistical purposes
In some events such data might be saved for longer where we have a legitimate interest, or it is necessary for us to pursue or defend ourselves against legal claims.
When you contact us via social media
For which purpose do we process your personal data?
We are represented on social media platforms such as Instagram and Facebook and you have the option to communicate with us on these channels. We use this data only to process your questions sent to us via these platforms. We strongly recommend you to contact our customer service line for any questions and/requests as our social media platforms are not secured.
What personal data do we process?
Public Social media account information from Facebook
Public Social media account information on Instagram
What is our legal basis for processing your personal data?
Necessary for us to pursue a legitimate interest responding to the contact.
For how long will we store your personal data?
You are responsible for what information you choose to share on our social media platforms, including for messages sent to our staff members. If you wish to delete your activity log on social media, please contact us.
When you enter a contest
For which purpose do we process your personal data?
To follow up on the participants of the contest to make sure the right person collects the price.
What personal data do we process?
Name, email address, phone number, Social Media profile.
What is our legal basis for processing your personal data?
Legitimate interest in performing and administrate such contests
For how long will we store your personal data?
The information provided in connection with the contest will be deleted no later than two years] after the competition/event (including any evaluations) has been completed.
Our processing to develop and improve our business, products and services
For which purpose do we process your personal data?
We also process some of your personal data to develop and improve our business, products, and services.
What personal data do we process?
Your name, phone number, email address and similar information that you have chosen to provide.
Correspondence with customers
Responses in customer surveys
Purchases and user-generated information
What is our legal basis for processing your personal data?
For our use of statistical and analytical cookies, our legal basis is your consent.
For other processing of personal data, we rely on our legitimate interest in being able to evaluate, develop, and improve our services, products, and systems so that we can enhance and provide relevant services to you as a customer.
For how long will we store your personal data?
No longer than 5 years
When you are booked by an agent
For which purpose do we process your personal data?
In order to deliver the service you have purchased via the agent
What personal data do we process?
Name, birth date, gender, email, tel.no, food preferences, medical information provided by you if you see that as a necessity for your own safety on the camp
What is our legal basis for processing your personal data?
Necessary for us to perform contractual and/ legal obligations.
Processing is also necessary to fulfill legal requirements in relation to accounting.
For how long will we store your personal data?
We store data necessary for the performance of the contract and to maintain customer relations for 5 years.
Data necessary for accounting purposes will be kept for 5 years