Privacy policy

1. Who is responsible

BOMBA is an independent surf magazine and brand based in Malta. Contact team@bombasurf.com for privacy questions or rights requests.

Registered legal name: bombasurf. Registered business address: 45, Triq Is Salvatur, Sliema, Malta, Europe. Review any applicable registration and disclosure requirements before adopting this policy.

2. Information we handle

Contact enquiries include the name, email address, enquiry topic and message you choose to send. Do not include passwords, payment-card details or sensitive personal information in the contact form.

Shopping uses a cart/session identifier and selected products. Orders involve customer contact details, delivery and billing information, items, amounts, payment references and fulfilment status. Stripe handles payment-card information; the site does not store complete card numbers.

Operational logs can include IP addresses, requested pages, referring pages, timestamps and security or error information. The contact form uses abuse-prevention controls. Public editorial pages may identify authors, interviewees and credited contributors.

3. Purposes and lawful bases

We use necessary cart, checkout and order information to take steps at your request and fulfil purchases (GDPR Article 6(1)(b)). We retain records required by applicable accounting, tax or consumer law (Article 6(1)(c)).

Handling general enquiries, maintaining site security, preventing spam and resolving faults relies on legitimate interests (Article 6(1)(f)), balanced against your rights. A commercial enquiry may also concern pre-contractual steps you request.

Optional analytics, advertising cookies and any optional marketing messages rely on consent where required (Article 6(1)(a)). A contact enquiry is not a newsletter signup.

4. Cookies and your choices

Essential storage supports carts, sessions, security and remembering your privacy choices. Google Analytics and the Meta Pixel are optional and remain off unless you give the relevant consent through the privacy controls.

Use Cookie settings in the footer to review or withdraw your choice. Withdrawal applies to future optional tracking and does not invalidate processing that was lawful before withdrawal. Your browser can also remove existing cookies.

YouTube videos and social links are third-party services. Playing an embedded video or visiting those services can share technical information with them. Privacy-enhanced YouTube embeds reduce pre-play tracking but do not mean the service receives no data.

5. Newsletters and wave alerts

If an email newsletter, wave-alert or cart-reminder service is offered and you choose to subscribe, the relevant address and preferences are used for that stated purpose. Marketing consent must be separate from making a purchase or sending an enquiry, and messages must provide a way to unsubscribe.

The existing wave-alert signup is not currently connected to an active subscription backend. This draft does not represent that alert delivery is operating. Any launch needs confirmed opt-in, retention and unsubscribe arrangements.

6. Service providers and sharing

Replit provides application hosting and database/storage services for site operation, which can process technical logs and information stored by the application.

Stripe processes payment and checkout information. Printify and its production/delivery partners receive information needed to fulfil applicable print-on-demand orders, including delivery details and ordered items. Some products are fulfilled directly by BOMBA.

Resend is used for transactional email, including submitted contact enquiries and applicable order messages. It receives the email content and addressing information needed for delivery.

Google Analytics and Meta receive technical and interaction information only when their optional tracking is enabled with the relevant consent. Google/YouTube receives information associated with embedded-video use.

Editorial tooling also uses services such as Google Gemini and Arvow for newsroom tasks. These are not a promise that visitor enquiries or order details are submitted to AI. Owner review required: confirm the full processor list, contracts, data flows and any additional services before adopting this policy.

7. Transfers, retention and security

Some providers may process information outside Malta or the EEA. Where required, transfers must rely on a valid adequacy decision or appropriate safeguards such as Standard Contractual Clauses. Ask team@bombasurf.com about applicable safeguards; the operator must verify each provider arrangement.

We keep enquiries only as long as needed to handle them and any related dispute. Order and accounting records must be kept for the period required by applicable law. Technical logs, consent records and subscription information should follow documented, proportionate retention periods. Owner review required: confirm the actual periods and deletion arrangements; no automatic deletion schedule is promised by this draft.

The site uses access controls and transport security, but no internet service can guarantee absolute security. Do not send sensitive information through public forms.

8. Your rights and complaints

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing, and may withdraw consent. Email team@bombasurf.com. We may need proportionate information to verify a request and must respond within the applicable GDPR time limits.

You can complain to Malta's Information and Data Protection Commissioner (idpc.org.mt) or another competent EU supervisory authority. Your statutory rights are not limited by this draft.

9. Children and policy changes

The site is not designed to collect children's personal information for marketing. If a child's information has been supplied without appropriate permission, contact us so it can be assessed and handled lawfully.

Updates will be shown on this page. Material changes that need renewed consent must not be applied merely by changing the policy text. This page is a review draft, not legal advice or confirmation of legal compliance.