Into Surf Privacy Statement

Last Updated: 2026-04-29

Into Surf are committed to collecting personal or sensitive data ethically, responsibly, and in line with General Data Protection Regulation (GDPR).

What information we collect, use, and why

Online store customers:

When making a purchase on our online store, we need to collect personal data including your name, billing address, shipping address, phone number and email address, as well as financial information including payment card information, transaction details, payment confirmation and other payment details. This data will only be used for administering your purchase, and will not be used to send you marketing or promotional material unless you have also explicitly provided your consent to receive such material.

Event attendees:

Where our events are ticketed, we need to collect data on the person booking (name and email) in order to allow you access to the event and send you a confirmation of your purchase. This data will only be used for administering your access to the event(s) for which you have booked and will not be used to send you marketing or promotional material unless you have also explicitly provided your consent to receive such material.

Mailing list subscribers:

We offer everybody the opportunity to sign up (consent) to receive marketing and promotional information (e.g. new music, events or merch). When you sign up to our mailing list, we will ask you for your email address. We will only send you communication that is related to Into Surf and we will never use your data to send you marketing messages from third parties. Any communication will include a clear option to unsubscribe (opt out), and you can also unsubscribe at any time by emailing contact@into.surf

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Where we get personal information from

Directly from you.

How long we keep information

We will review all data held on individuals at least every two years and remove data where we no longer have a legitimate reason to keep it.

Where you have withdrawn your consent for us to use your data for a particular purpose (e.g. unsubscribed from a mailing list) we may retain some of your data for up to two years in order to preserve a record of your consent having been withdrawn.

We will never pass on your data to third parties for marketing purposes.

We may sometimes use third-party services to process your data. We will always make sure any third parties we use are reputable, secure, and process your data in accordance with your rights under UK data protection law.

The third party services we use, as well as how we use them, are outlined below:

Shopify – we use Shopify to power our online merch store – Privacy Policy

Data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below:

Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with.
Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure – You have the right to ask us to delete your personal information.
Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.
Your right to object to processing – You have the right to object to the processing of your personal data.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.