Privacy and cookie policy
Last updated 16 October 2026
This policy explains what personal information SurfList collects, why we collect it, who we share it with and the choices you have. It covers surflist.co.uk and the emails we send and receive.
Who we are
SurfList is a directory of UK surf businesses run by Edmund Meredith-Yates trading as LocalBoom, a sole trader, of 45 Orchid Vale, Kingsteignton, Newton Abbot, Devon TQ12 3YS. We are the data controller for the personal information described here.
For anything about your data, email contact@surflist.co.uk.
The information we collect
Business listings
Our directory lists surf schools, shops, camps, coaches, shapers, repairers and brands. To start the directory we gathered publicly available business information from Google Maps, using a data provider called Outscraper, and from businesses' own websites and other public sources. This includes the business name, address, phone number, website, opening hours, map location and public rating. For sole traders and small businesses, some of this (such as a name or mobile number) may be personal information.
When a business owner claims or updates a listing, they may also give us a description, photos, opening hours, social media links and contact details.
Claiming or updating a listing
To claim, update or upgrade a listing, you email us. We receive your name, email address and anything else you include, and we may contact the business by email or phone to check that you are entitled to manage the listing. We keep a record of how and when the listing was verified.
Payments
Paid listings are paid for through a secure Stripe payment link. Stripe collects your card details directly; we never see or store your full card number. We receive your name, email address, billing details, what you bought and the payment status.
Emails and enquiries
If you email us, we receive the message, your name and email address, and anything else included in the message.
Using the website
If you accept analytics cookies, Google Analytics collects information about how you use the site, such as pages viewed, approximate location (town or region), device and browser type, and how you arrived. If you reject them, Google Analytics is not loaded.
Our hosting provider, Cloudflare, processes technical information such as IP addresses to deliver the site and protect it from attacks.
How we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Publish business listings so people can find surf businesses | Legitimate interests: running a useful public directory of businesses that already advertise publicly |
| Check and act on requests to claim, update or remove a listing | Legitimate interests: keeping listings accurate and making sure only the business can change them |
| Reply to emails | Legitimate interests: responding to people who contact us |
| Take payment for paid listings and keep financial records | Contract, and legal obligation (tax and accounting rules) |
| Measure how the website is used with Google Analytics | Consent, which you can withdraw at any time |
| Keep the website secure and working | Legitimate interests |
We do not sell personal information, and we do not send marketing emails without your permission.
If your business is listed
You can ask us to correct your listing, remove personal details from it, or remove it entirely. Email listing@surflist.co.uk with the business name and town. You can also object to us listing your business at any time, and we will remove it unless we have a compelling reason not to.
Who we share it with
We use these service providers, who only process information on our instructions:
- Cloudflare: website hosting, security and email forwarding
- Supabase: our listings database (data stored in London, UK)
- Stripe: payments
- Google: Google Analytics (only with your consent) and email (Gmail)
- Outscraper: collecting public business information from Google Maps
Listing information is public on the website by design. We may also share information if the law requires it, or to protect our rights, our users or the public.
International transfers
Some of our providers are based in, or use staff and systems in, the United States and other countries. Where personal information leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum to protect it.
How long we keep it
- Listings: while the directory runs, or until you ask us to remove them
- Records of how a listing was claimed or verified: while the listing exists, then 12 months
- Payment and accounting records: 6 years, as UK tax rules require
- Emails and enquiries: up to 2 years
- Google Analytics data: 14 months, then deleted automatically
- Raw data collected from Google Maps: while the related listing exists
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete your information
- ask us to restrict how we use it
- object to us using it, including for listings
- ask for information you gave us in a portable format
- withdraw consent at any time, for example to analytics cookies
To use any of these rights, email contact@surflist.co.uk. We will reply within one month. If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
Cookies
Cookies are small files stored on your device. We use as few as possible. Analytics cookies are only set if you accept them, and you can change your choice at any time using cookie settings.
| Name | Set by | Purpose | How long | Type |
|---|---|---|---|---|
surflist-cookie-consent | SurfList (stored in your browser) | Remembers whether you accepted or rejected analytics cookies | Until you clear it | Strictly necessary |
_ga | Google Analytics | Distinguishes visitors so we can count them | 2 years | Analytics (consent) |
_ga_SRB7SHC7QP | Google Analytics | Keeps track of your visit (session) | 2 years | Analytics (consent) |
Security cookies, such as __cf_bm | Cloudflare | Protects the site from bots and attacks | Up to 30 minutes | Strictly necessary |
When you pay for a listing, Stripe's payment page sets its own cookies for fraud prevention. SeeStripe's privacy policy. Google explains how it uses information from Google Analytics at policies.google.com.
Changes to this policy
We will update this page if the way we use personal information changes, and change the date at the top. We plan to add online listing management; this policy will be updated before it goes live. If a change is significant, we will tell business owners who have claimed a listing by email.
Contact
Questions about this policy or your information: contact@surflist.co.uk.