Privacy Policy

This Privacy Policy explains how Divera ("we", "us") collects, uses, shares and protects personal data when you use the Divera dashboard for dive centers and the Divera mobile application for divers (the "Service"). It is written with reference to the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

1. Data Controller

For data you submit through the Service, the dive center you book with is generally the data controller, and Divera acts as a data processor on its behalf. For account data of dive-center operators and aggregate technical data, Divera is the data controller. The Service sits under a single data-protection contact: diveradevelopers@gmail.com.

2. Data we collect

2.1 Account data

• Name and email address used to sign in.
• Authentication metadata (hashed credentials, session tokens).
• Operator role, dive-center membership, and preferences (locale, notifications).

2.2 Booking and operational data

• Dive details (date, site, depth, equipment, staff assignment).
• Participant lists and booking status.
• Payment status and amount (we do not store card numbers).

2.3 Diver and document data

• Diver profile (name, date of birth, contact details, emergency contact).
• Certifications and insurance information uploaded by the diver or the dive center.
• Medical-questionnaire answers and self-declarations of fitness to dive.
• Liability waivers, including the typed name of the signer and the captured signature image.
• Identification documents (DNI, NIE, passport) when uploaded for identity-verification purposes.

2.4 Technical data

• Device and browser metadata, IP address, language preference.
• Server logs for security, abuse prevention and debugging. Retention is limited to what is necessary for those purposes.

3. Purposes of processing

• To provide and operate the Service you have asked us for.
• To allow dive centers to manage divers, bookings, equipment and staff.
• To verify identity, certifications, and insurance where required by law or by the dive center's operating procedures.
• To assess medical self-declarations and waivers, in support of the dive center's safety procedures.
• To send transactional communications (booking confirmations, reminders, password resets).
• To secure the Service, prevent fraud and abuse, and meet legal obligations.
• To send dive temperature records, and the photos of your public dives, to BlueDOT for scientific research, without your name, based on our legitimate interest in supporting scientific research (GDPR Art. 6(1)(f)); you can object by switching it off, as described in section 7.

4. Lawful basis

We process personal data on the following bases under GDPR:

• Contract performance — Article 6(1)(b): account management, booking lifecycle, communications necessary to deliver the Service.
• Consent — Article 6(1)(a) and Article 9(2)(a): processing of medical questionnaires and signed waivers, which may contain health data; image consents; any optional marketing communications.
• Legitimate interests — Article 6(1)(f): securing the Service, preventing abuse, and improving product quality, in ways that do not override your rights; and supporting scientific research by sharing dive temperature records, plus the photos of public dives, with BlueDOT, as described in section 7.
• Legal obligation — Article 6(1)(c): keeping records required by tax, accounting, or maritime/diving regulations where applicable.

5. Retention

We keep personal data only as long as needed for the purposes set out above. Indicative retention periods:

• Account data: while your account is active, plus up to 12 months.
• Booking and waiver records: up to 5 years after the dive, in line with civil-liability limitation periods in Spain.
• Identification documents: deleted as soon as the verification purpose is fulfilled, unless a longer period is required by law.
• Server logs: typically 30–90 days.

Specific dive centers may set shorter retention periods in their own privacy notice; the shorter period prevails.

6. Service providers and recipients

We share personal data only with service providers that act on our instructions under written data-processing agreements:

• Supabase — authentication, database, file storage (EU region).
• Resend — transactional email delivery.
• Google Maps — rendering of dive-site maps in the dashboard.

We may transfer personal data outside the European Economic Area only when adequate safeguards (such as the European Commission's Standard Contractual Clauses) are in place. We do not sell personal data and we do not use it for profiling or automated decision-making with legal effects. Separately, for citizen science we share fish sightings with MINKA only if you opt in, and dive temperature records, plus the photos of public dives, with BlueDOT unless you switch it off, as described in section 7.

7. Citizen science and research partners

Divera supports citizen-science and research partnerships. Sharing with MINKA is off by default and happens only when you turn on the share toggle for a sighting. Sharing with BlueDOT is on by default and you can switch it off, as described below.

MINKA (fish sightings). If you choose to share a fish sighting, the photo, species, location, date, depth and behaviour of that sighting are sent to MINKA (operated by the ICM-CSIC in Spain) and published under an open license for scientific research. Sharing is optional and off by default — each sighting is shared only when you turn on the share toggle for it.

BlueDOT("Divers for Ocean Temperature", coordinated by MARUM – Center for Marine Environmental Sciences, University of Bremen, Germany): an open, quality-controlled database of ocean temperature measured by dive computers, used to study ocean warming and marine heatwaves. For every dive that has a location, we send, without your name, username, email or profile: the date and time of the dive; its location (latitude and longitude of the dive site or area); depth and water temperature (the full depth/temperature profile when the dive was imported from a dive computer, otherwise the maximum depth and the water temperature you entered), plus air temperature if you entered it; the dive-computer model, which scientists use to correct sensor error; only when the dive is public ("Everyone"), your dive notes, with @mentions and email addresses removed, and the photos attached to the dive, with location metadata (EXIF) removed; and a random technical identifier per dive, used to avoid duplicates, which does not identify you. BlueDOT uses the photos internally for its research, for example to see water clarity, the seabed and marine life. Photos can show people, including your buddies: only add photos of recognisable people to a public dive if they agree. We never share with BlueDOT your name, username, email, profile, videos, your buddy list, or the notes and photos of dives that are not public (followers-only or private).

BlueDOT:sharing is on by default for new dives. You can switch it off for a single dive with the "Share with BlueDOT" switch in the dive flow, or for all future dives with "Share by default" in Library › Science › BlueDOT. You can also share older dives read from your dive computer; these dives are not added to your logbook, are sent only as scientific temperature records (never photos), and only dives with a location are sent (the GPS position recorded by the computer, or the location you assign to the trip). Legal basis: our legitimate interest in supporting scientific research (GDPR Art. 6(1)(f)), with the safeguards of GDPR Art. 89 (data minimisation; your name and account are never shared). You can object at any time, for every future dive, with the switches above. Records and photos already delivered to BlueDOT become part of a scientific dataset and cannot be withdrawn afterwards; switching sharing off only stops future sharing. BlueDOT is located in the European Union (Germany), so no international data transfer takes place.

Once data has been sent, each partner acts as an independent data controller: it decides how the data is published, used and kept under its own terms and privacy policy, and Divera is not responsible for how the partner uses it. When a partner publishes shared data under an open license (as MINKA does), it may be copied and reused worldwide and cannot be fully recalled; deleting the sighting, the dive or your Divera account does not remove copies already shared. To request removal, contact the partner directly. We may add partners in the future and will list them here; if a partner is outside the European Economic Area, we will use appropriate safeguards for the transfer.

8. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure ("right to be forgotten") when the conditions are met;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw any consent you have given, without affecting the lawfulness of prior processing;
• lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or the supervisory authority of your habitual residence.

To exercise these rights, contact diveradevelopers@gmail.com. We will respond within the period required by law.

9. Cookies and similar technologies

Divera uses only strictly necessary cookies and local-storage items required to operate the Service: authentication tokens issued by our identity provider and a small preference cookie that remembers the language you selected. These are exempt from the consent requirement under the ePrivacy Directive (Article 5(3)) because they are necessary to deliver the service you have requested.

We do not currently load advertising, analytics, or tracking cookies. If that ever changes, we will publish a cookie banner that lets you accept or reject non-essential cookies before they are set, and update this section accordingly.

10. Security

We use industry-standard measures to protect personal data, including encryption in transit (TLS), encryption at rest for sensitive fields, role-based access control, audit logging, and regular review of third-party processors. No system can be guaranteed completely secure; we will notify you of material incidents in line with applicable law.

11. Children

The Service is not intended for unsupervised use by children. Where a minor takes part in a dive, the minor's parent or legal guardian must complete the registration and waiver on their behalf.

12. Contact

Privacy questions, including requests under the GDPR, can be sent to diveradevelopers@gmail.com. While we have not appointed a formal Data Protection Officer under Article 37, this address is monitored as our single point of contact for data-protection matters.