Last updated: 8 October 2026
The controller for data processing on this website is:
Maloha Ltd operates the eFoil centre FlySurfPro in El Gouna, Egypt.
This policy covers the website www.flysurfpro.com. It does not cover the platforms we link to, such as WhatsApp, Instagram, Facebook or Tripadvisor. Once you follow one of those links, the privacy policy of the respective provider applies.
Where we process data based on your consent, the legal basis is Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.
Where processing is necessary to operate the website safely and reliably, we rely on our legitimate interest under Art. 6(1)(f) GDPR. Where you contact us about a booking or a lesson, we rely on Art. 6(1)(b) GDPR.
This website is hosted by Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA. When you open a page, data is transferred to Webflow servers and to the content delivery network Webflow uses, including your IP address. Submissions from our contact form are stored by Webflow as well.
Additional files are delivered via Amazon CloudFront, a service of Amazon Web Services, Inc.
When you open the website, your browser automatically transmits information that is stored in log files: browser type and version, operating system, the page you came from, host name, time of the request and IP address.
This data is not combined with other sources and is deleted once it is no longer needed to operate and secure the website. Legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a technically sound and secure website.
We use Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, to obtain and document your consent.
Cookiebot sets the cookie CookieConsent, which stores your choice per category, a randomly generated consent ID and the time of consent. Your IP address is transmitted to Cookiebot in anonymised form as proof of consent. The cookie is stored for twelve months.
Legal basis is Art. 6(1)(c) GDPR, our legal obligation to obtain and document consent. You can change or withdraw your choice at any time via Privacy Settings in the footer of this website.
We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It manages the services listed below and makes sure they only load once you have given your consent.
Tag Manager itself sets no cookies and collects no personal data, but your IP address is transmitted to Google when it loads.
With your consent we use Google Analytics 4, a web analytics service of Google Ireland Limited, to understand how visitors use our website. It sets the cookies _ga and _ga_8647DLB9HW.
In addition to page views we record two events of our own: whatsapp_click when you click a WhatsApp button, which stores which button on which page was clicked, and file_download when you open our camp PDF. What you write in WhatsApp afterwards is not visible to us here.
Event data is deleted automatically after 2 months. Data linked to cookies and user identifiers is deleted after 14 months, counted from your last visit.
With your consent we use Google Ads, an advertising service of Google Ireland Limited, to measure which ads led to contact and to show ads to people who have visited our website. It sets the cookie _gcl_au.
With your consent we use the Meta Pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It lets us see whether visitors who clicked an ad on Facebook or Instagram take an action that matters to us, and lets us show them ads. It sets the cookie _fbp.
Recorded are the page view, clicks on buttons together with their labels, in particular our WhatsApp buttons, and the opening of our camp PDF.
Meta also processes this data for its own purposes. For that part we and Meta are joint controllers under Art. 26 GDPR. The essential content of that arrangement is published by Meta at facebook.com/legal/controller_addendum. Meta is responsible for providing you with information and for your rights regarding that processing.
We use Google Consent Mode. If you do not consent, the Google services named above only send signals without cookies and without identifiers, from which Google builds statistical models. No data that identifies you as a person is stored in that case.
Videos from YouTube are embedded on our website. The provider is Google Ireland Limited. When you open a page containing a video, a connection to YouTube servers is established so that the video can be displayed. YouTube learns which of our pages you visited and receives your IP address. If you are logged in to YouTube, it can link this to your profile.
Legal basis is Art. 6(1)(f) GDPR, our legitimate interest in presenting our courses in a way that shows what a session actually looks like.
This website loads fonts from Google servers so that it is displayed consistently across devices. Your IP address is transmitted to Google in the process. Legal basis is Art. 6(1)(f) GDPR.
Our website has buttons that open a chat with us on WhatsApp, a service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland. When you click one, you leave our website and the privacy policy of WhatsApp applies from that point.
Once you write to us, we receive your phone number and the content of your message and process both in order to answer your enquiry. Legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a booking, otherwise Art. 6(1)(f) GDPR. We keep the conversation for as long as we need it to answer you and to document the booking, and delete it once it is no longer needed.
You can write to us using the form on www.flysurfpro.com/contact. We process the details you enter in order to answer your enquiry. Mandatory fields are marked as such, all other details are optional. Submissions are stored by Webflow and are forwarded to our team.
Legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a booking, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries. We delete the data once your enquiry has been dealt with and no statutory retention periods apply.
The PDF about our camp is hosted on Google Drive, a service of Google Ireland Limited. Opening it transmits data to Google, including your IP address.
Our website links to our profiles on Facebook, Instagram and Tripadvisor. These are plain links, not embedded content. No data is transmitted to those providers until you click a link.
Some of the services named above transfer data to the United States, where the level of data protection is not equivalent to that in the European Union and public authorities may access data under certain conditions. These transfers take place on the basis of the EU-US Data Privacy Framework or, where a provider is not certified, on the basis of the standard contractual clauses of the European Commission.
Enquiries and bookings are handled by our team at the centre in El Gouna, so your data is also processed in Egypt. There is no adequacy decision for Egypt. The transfer is based on Art. 49(1)(b) GDPR, because it is necessary in order to answer your enquiry and to perform the contract with you.
You have the right to access the data we hold about you, to have inaccurate data corrected, to erasure, to restriction of processing, to data portability and to object to processing based on our legitimate interest.
Where processing is based on consent, you may withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal. For cookies and tracking you can do this yourself at any time via Privacy Settings in the footer.
For everything else, a message to office@malohaltd.com is enough. We answer within one month.
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus.
We update this policy when the services we use or the legal situation change. The version published on this page applies.