Applicable to the Santa Cruz Seaside Company family of brands and websites
Effective Date: August 27, 2026. Last Updated: August 27, 2026. Version 2026.1.
Santa Cruz Seaside Company and its related entities own and operate the Santa Cruz Beach Boardwalk, the Boardwalk Bowl, Chardonnay Sailing Charters, and the Inns of Santa Cruz (the Sea & Sand Inn, the Carousel Beach Inn, and the Edgewater Beach Inn). This is the one Privacy Policy for all of them, and the same Policy is posted on each of our websites.
This Privacy Policy explains how Santa Cruz Seaside Company, a California Corporation, and its related entities (collectively, the Company, we, us, or our) collect, use, disclose, and otherwise process personal information of California residents through the websites that link to this Policy and, as described in this Policy, through certain related offline interactions (such as ticket, pass, and reservation transactions and on-premises security operations). The websites currently include beachboardwalk.com (including its memories, news, dipper, blog, and all subdomains), chardonnay.com, boardwalkbowl.com, seaandsandinn.com, carouselbeachinn.com, edgewaterbeachinn.com, innsofsc.com, and shop.beachboardwalk.com (the Sites). It describes the rights California residents have under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the CCPA), and how to exercise them.
This Policy does not apply to personal information we collect from employees, applicants, or independent contractors in their workforce capacity. That information is addressed in our separate Workplace Privacy Notice.
This Policy also does not apply to information handled by independently operated third-party websites or services after you leave the Sites. The advertising, analytics, and chat technologies embedded in the Sites are covered by this Policy as described below.
In the preceding twelve months, we have collected the following categories of personal information, using the category labels the CCPA defines (Cal. Civ. Code § 1798.140(v)):
| Category | Examples of what we collect | Sources | Disclosed for a business purpose to | Sold or shared? |
|---|---|---|---|---|
| Identifiers | Name, postal address, email address, telephone number, ZIP code, date of birth (for season pass holders), IP address, device identifiers (including on guest Wi-Fi), and online identifiers | You; your devices, automatically; travel booking platforms | Service providers (ticketing and e-commerce, payment processing, property management and reservations, email and text delivery, website services); travel booking platforms at your direction (see “Reservations Made Through Travel Booking Platforms”) | Online identifiers are shared with advertising partners (see Sale and Sharing below; the disclosure may also constitute a “sale” as the CCPA defines it); other identifiers are not sold or shared |
| Customer records | Billing information and payment card number for a purchase or reservation | You; travel booking platforms | Payment processors; ticketing and reservation service providers; travel booking platforms at your direction | No |
| Commercial information | Purchases, orders, ticket and season pass records, reservation and stay records, donation records | You; travel booking platforms | Service providers; travel booking platforms at your direction | No |
| Internet or other electronic network activity | Pages visited, interactions with the Sites, session activity, content you enter into interactive features (such as the on-Site chat); guest Wi-Fi connection details | Your devices, automatically | Analytics providers | Website session and online activity are shared with advertising partners (a disclosure that may also constitute a “sale” as the CCPA defines it). Guest Wi-Fi connection details are used to operate the network and are not sold or shared. |
| Geolocation data (non-precise) | General location inferred from your IP address; we do not collect precise geolocation through the Sites | Your devices, automatically | Analytics providers | Shared with advertising partners together with the online activity above |
| Audio, electronic, or visual information | Photos and stories you submit (for example, Boardwalk Memories), season pass photos; video from on-premises security cameras | You; our premises systems | Service providers | No |
We do not collect categories not listed above through the Sites. The CCPA excludes certain information from its scope, including deidentified or aggregated data and information governed by certain federal or California sector laws.
Stated as the two lists the CCPA requires:
Sensitive personal information is a defined subset of personal information (Cal. Civ. Code § 1798.140(ae); 11 CCR § 7001). Through the Sites, we intentionally collect two categories. First, account login credentials (your username in combination with your password) when you create an account such as a newsletter or Boardwalk Memories account; we use those credentials only to maintain and secure your account. Second, because California treats the personal information of a consumer a business actually knows is under 16 as sensitive, the name and date of birth collected for a minor season pass holder are sensitive personal information; we use them only to administer the pass. We do not collect precise geolocation, biometric information, or government identifiers through the Sites or our guest Wi-Fi, and payment card numbers are collected without the card security code. We do not use or disclose sensitive personal information for purposes other than those the CCPA regulations permit without offering a right to limit (11 CCR § 7027(m)), we do not sell or share it, and we do not use it to infer characteristics about you (Cal. Civ. Code § 1798.121).
We collect personal information directly from you, online and in person (for example, when you make a purchase or reservation online, at a ticket window or box office, or at a front desk; create an account; enter a contest; contact us; or use an interactive feature); automatically from your devices as you use the Sites (through cookies and similar technologies); and from third parties.
Other third-party sources. The third parties we receive information from include our affiliated brands and entities; business partners such as ticket resellers, group and event organizers, travel and booking platforms, and promoters; publicly available sources; and, where permitted by law, commercial data providers that supplement or update our records.
Travel booking platforms. When you reserve a room at one of our lodging properties through a third-party travel booking platform such as Booking.com or Expedia, you provide your information to that platform, and the platform transmits your reservation to us. We receive the information the platform sends, which generally includes your name, your reservation details, a telephone number, in some cases a postal address, and payment information for your reservation. We generally do not receive the email address you gave the platform. Instead, the platform typically issues a forwarding address specific to your reservation, and messages we send about your stay reach you through that platform.
We use personal information for the following business and commercial purposes:
We will not use personal information we collected for purposes materially different from those described above without first providing you notice.
We may combine information we collect from you across our brands, Sites, and on-premises systems and from the sources described above, and use it for the purposes described in this Policy. We may also deidentify or aggregate personal information and use or disclose the result for any purpose. Where we do, we take reasonable measures to ensure the information cannot be associated with you, we publicly commit to maintain and use it only in deidentified form and not to attempt to reidentify it, and we contractually require any recipient to do the same.
We disclose personal information to service providers and contractors that perform services for us under written contracts that restrict their use of the information to performing those services, and to other recipients as needed for the purposes described in this Policy or as required by law. The categories of recipients are:
| Recipient category | Personal information categories | Purpose |
|---|---|---|
| Ticketing, e-commerce, and point-of-sale providers | Identifiers; customer records; commercial information | Online ticket, pass, and merchandise sales; order fulfillment |
| Payment processors | Identifiers; customer records | Processing card payments |
| Property management and reservation systems | Identifiers; customer records; commercial information | Managing lodging reservations and stays |
| Email, text, and marketing platforms | Identifiers | Sending the messages described in this Policy |
| Website, analytics, and technology providers | Identifiers (online); internet activity | Operating, securing, analyzing, and improving the Sites |
| Virtual assistant (chat) provider | Identifiers (email address, if you request follow-up); internet or other electronic network activity (chat content you enter) | Operating the on-Site chat feature |
We share personal information among our brands and related entities for the purposes described in this Policy. We may also disclose personal information in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, to the parties involved and their advisors, subject to this Policy.
You can reserve a room at our lodging properties directly with us or through a third-party travel booking platform such as Booking.com or Expedia. When you book through a platform, you provide your information to that platform under that platform’s own privacy notice, and the platform sends your reservation to us.
We receive your reservation information from the platform, including payment information for your reservation. We send reservation and stay information back to the platform in order to confirm, modify, or cancel your booking, to obtain payment for your stay, and to administer our commercial arrangement with that platform, which includes reporting cancellations and no-shows. We make these disclosures at your direction, to carry out the reservation you chose to make through the platform; the platform is not our service provider. The platform collects information directly from you and is independently responsible for its own use of that information under its own privacy policy. We do not control the platform’s practices, and this Policy does not cover them.
The CCPA defines “sell” and “share” broadly. “Share” includes disclosing personal information to a third party for cross-context behavioral advertising, whether or not for money (Cal. Civ. Code § 1798.140(ad), (ah)). We do not sell personal information for money. The Sites use third-party advertising and analytics technologies that transmit online identifiers and browsing activity to advertising partners, including Meta, Google, Amazon, Snap, Nextdoor, Spotify, and The Trade Desk. These advertising partners also collect online identifiers and activity directly through technologies embedded in the Sites. These disclosures are treated as “sharing” (and may be treated as a “sale”) under the CCPA. We share this information for the purpose of delivering and measuring advertising to you based on your activity across different websites and online services.
You have the right to opt out of the sale and sharing of your personal information. To opt out, use the “Do Not Sell or Share My Personal Information” link in the footer of each Site, which takes you to an opt-out request form, or use any of the methods in “How to Exercise Your Rights” below (Cal. Civ. Code § 1798.135).
The Sites are general-audience and are not directed to children under 13. We do not knowingly collect personal information online directly from a child under 13. If we learn that we have collected personal information online directly from a child under 13, we will delete it. A parent or guardian who believes a child under 13 has provided personal information may contact us using the methods below (15 U.S.C. §§ 6501-6506; 16 CFR Part 312).
When you buy a season pass for a minor, we collect the pass holder’s first name, last name, and date of birth to administer the pass; our web store does not accept a phone number or email address for a minor pass holder. Marketing email and text sign-ups are limited to persons 18 or older.
We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. We do not sell or share the personal information of a consumer we know to be under 16 without the opt-in consent the CCPA requires: the consumer’s own affirmative authorization at ages 13 to 15, or a parent’s or guardian’s for a child under 13 (Cal. Civ. Code § 1798.120(c)). A parent or guardian may exercise any of the rights described in this Policy on behalf of their minor child using the methods in “How to Exercise Your Rights” below.
The Sites use cookies and similar technologies for functionality, analytics, and advertising. Your browser settings allow you to block or delete cookies, and you may opt out of the sharing of your information for advertising at any time through the “Do Not Sell or Share My Personal Information” link in the footer of each Site or the request methods below.
The beachboardwalk.com site offers a virtual assistant (chat) feature powered by a third-party provider. You can use the chat without providing contact information; if you ask for a follow-up from a live agent, we collect the email address you provide (and any additional addresses you ask us to include) to respond. Conversations you enter may be processed by the provider to answer your questions and improve the feature. The provider retains conversations under its own terms for as long as needed to operate and improve the feature. Please do not include sensitive personal information in chat messages. We do not use the virtual assistant or any other automated decision-making technology to make decisions that produce legal or similarly significant effects about you.
We operate video-only security cameras in and around our premises for security, safety, and loss-prevention purposes. Footage is retained for approximately 30 days unless it is needed for an investigation, a claim, or a legal obligation, after which it is deleted or overwritten in the ordinary course.
When you connect to the free guest Wi-Fi we offer at our properties, our Technical Services team, which operates and controls the network, handles and may retain in connection logs the device and connection details needed to run it, such as your device identifier (MAC address), IP address, connection time, and data volume. Our guest Wi-Fi does not collect personal information at sign-in: the public Wi-Fi uses a captive portal that collects no data, and our other guest networks are password-protected with no sign-in page. We use this connection information only to provide and secure the network, to manage capacity, and to prevent abuse. We do not use guest Wi-Fi to identify your location on our premises, and we do not analyze guest location from Wi-Fi data. Any network-traffic analysis we may conduct is done only in aggregate, deidentified form that does not identify you.
During online checkout you can choose to receive recurring marketing and promotional messages from Santa Cruz Seaside Company, which operates the Santa Cruz Beach Boardwalk and its other brands and properties, by email and by text message. This opt-in is optional, is limited to persons 18 or older, and is never a condition of any purchase. If you opt in, we collect and keep your email address, your mobile phone number, and a record of your consent (such as the date, time, and source of your opt-in) so that we can send the messages you asked for and honor your choices. Texts may be sent using automated technology; message frequency varies, and message and data rates may apply. You can stop marketing texts at any time by replying STOP to any message (reply HELP for help); replying STOP stops marketing texts from all of our brands. You can stop marketing emails by using the unsubscribe link in any email we send; opting out of one channel does not opt you out of the other. We use service providers to deliver these messages on our behalf; they are not permitted to use your contact information for their own purposes. We keep your contact information for marketing purposes until you opt out or ask us to delete it.
Opting out of marketing messages does not stop operational messages relating to a purchase or reservation, such as confirmations, pre-arrival information, and updates that affect your visit (for example, changes in ride availability or weather closures).
Subject to certain exceptions, California residents have the following rights under the CCPA:
You may submit a request by:
Opt-out preference signals. We are implementing automatic recognition of opt-out preference signals, such as the Global Privacy Control (GPC), through consent tooling being deployed across the Sites. Until that tooling is live, a browser signal cannot be processed automatically. To opt out of the sale or sharing of your personal information now, use the “Do Not Sell or Share My Personal Information” link (which takes you to an opt-out request form) or any of the request methods above, and we will act on your request within 15 business days (sooner where feasible) and confirm to you when it has been processed. We do not require you to verify your identity to opt out of sale or sharing. Once the tooling is live, we will treat an opt-out preference signal as a valid request to opt out of sale and sharing for the browser or device that sends it.
The Sites do not respond to “Do Not Track” browser signals, which are distinct from the opt-out preference signals described above (Cal. Bus. & Prof. Code § 22575).
Verification and authorized agents. We will verify your identity before responding to a request to know, delete, or correct, using information we can reasonably match to our records, such as your name, email address, telephone number, and, where relevant, details of a recent purchase or reservation; we may deny a request we cannot verify. Requests to opt out of sale or sharing are never identity-verified. An authorized agent may submit a request with your signed written permission (11 CCR §§ 7060-7063).
Information older than 12 months. Because we retain some personal information for longer than 12 months, a request to know may cover information going back to January 1, 2022; tell us the period you want when you submit your request (11 CCR § 7020(e)).
Timing. We will confirm receipt of a request to know, delete, or correct within 10 business days and respond within 45 calendar days, with a single 45-day extension where reasonably necessary (Cal. Civ. Code § 1798.130(a)(2); 11 CCR § 7021). We will act on a request to opt out of sale or sharing as soon as feasible and within 15 business days (11 CCR § 7026).
California residents may request information about our disclosure of personal information to third parties for those third parties’ direct marketing purposes (Cal. Civ. Code § 1798.83). We do not knowingly disclose personal information to third parties for those third parties’ own direct marketing purposes. If our practices change, we will update this section and provide a method for you to opt out. To make a request or confirm our current practices, contact us at the address below.
If we offer a program that provides a different price, rate, or level of service in connection with our collection, retention, sale, or sharing of personal information, we will describe the material terms in a Notice of Financial Incentive and obtain your opt-in consent to participate (Cal. Civ. Code § 1798.125(b); 11 CCR § 7016).
Residents of certain other states may have privacy rights under their own state laws. Where such a law applies to us, we respond to rights requests as that law requires. To exercise a right, use the methods above and identify your state of residence.
We retain each category of personal information for as long as reasonably necessary for the purposes described in this Policy, and then delete or deidentify it, unless a longer period is required by law (Cal. Civ. Code § 1798.100(a)(3)). In particular:
We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information, consistent with the nature of the information and the risks involved (Cal. Civ. Code § 1798.81.5). These safeguards include encryption of data transmitted through the Sites, access controls that limit access to personal information to personnel who need it for the purposes described in this Policy, and use of PCI DSS-compliant payment processors. No method of transmission or storage is completely secure.
We may update this Policy from time to time. We will post the updated Policy with a new “Last Updated” date and, where the change is material, provide additional notice. This Policy is posted on each of our Sites; if the posted copies ever differ, the copy with the most recent “Last Updated” date governs.
Santa Cruz Seaside Company
Attn: Privacy Rights/Tech Services
400 Beach Street Santa Cruz, CA 95060
(800) 609-0320
mail@scseaside.com
We provide this notice at or before the point at which we collect your personal information (Cal. Civ. Code § 1798.100(a); 11 CCR § 7012).
| Category collected | Purposes | Sold or shared? | How long we keep it |
|---|---|---|---|
| Identifiers (name, contact information, date of birth for season pass holders, online identifiers, device identifiers on guest Wi-Fi) | Fulfill purchases, reservations, and orders; accounts and customer service; season pass, membership, and loyalty programs; operational messages; marketing for any of our brands (texts where you opted in); personalization; research and product development; security; legal compliance | Online identifiers are shared with advertising partners (and may be “sales” as the CCPA defines them); other identifiers are not sold or shared | For our business, accounting, and legal purposes; marketing contact information until you opt out or request deletion; account information while your account is active |
| Customer records (billing and payment card information, collected without the card security code) | Payment processing | No | Card details are not stored on Company-managed servers; reservation payment data only as long as needed to service the stay |
| Commercial information (purchases, orders, reservations) | Fulfill and service your transactions; season pass, membership, and loyalty programs; personalization and recommendations; research, analytics, and product development | No | For our business, accounting, and legal purposes |
| Internet or other electronic network activity (including chat content and guest Wi-Fi connection details) | Measure, analyze, and improve the Sites and our marketing; personalization; advertising; operating and securing guest Wi-Fi | Website session and online activity are shared with advertising partners, which also collect online identifiers and activity directly through technologies embedded in the Sites. Guest Wi-Fi connection details are not sold or shared. | Only as long as needed for those purposes |
| Audio, electronic, or visual information (submitted photos, season pass photos, on-premises security cameras) | Display of submissions and use in our marketing under the submission terms; pass administration; ride and attraction photo programs you choose to use; security and safety | No | Submitted photos until you request removal; pass photos with the pass records; camera footage approximately 30 days |
| Sensitive personal information: account login credentials; a known minor pass holder’s name and date of birth | Maintain and secure your account; administer the season pass | No | Credentials while your account is active; minor pass information with the pass records |
You may opt out of sale and sharing through the “Do Not Sell or Share My Personal Information” link on each Site or the request methods in the Policy.
For full details, see our California Consumer Privacy Policy, linked in the footer of the Site you are using.
By signing up, you will be mailed a coupon (during the month of your birthday) for two free games of bowling.
