Privacy policy

Who is responsible for your data

The data controller is Aqua-Mar Team, which runs the PADI dive center in Constanța, Romania. Identification details:

For any request about your personal data, write to us at dtnautilus@yahoo.com. For other questions you can also reach us through the contact form or on our Facebook and Instagram pages.

What data we process

• Contact form data: your name, email address, phone number and message.
• Book & Check-in data, described in the next section.
• The technical data any web server receives when a page is requested (such as IP address, browser type, date and time), used to deliver pages, for security and to prevent abuse.
• Your cookie choice, kept in your browser (see the cookie policy).

The contact form only sends data when you press “Send message”. Nothing you type is recorded before that.

Book & Check-in

When you book a dive and check in online, Aqua-Mar Team processes the following data:

• identification and contact data: name, gender, age, country, city, phone number, WhatsApp number and email address;
• measurements to prepare your equipment: height, weight and shoe size;
• your emergency contact;
• for certified divers: certification details and the equipment requested;
• your answers to the medical questionnaire (health data);
• your electronic signatures on the signed documents;
• records of the consents you gave;
• your marketing preference (the optional question in the form);
• technical data recorded at signing: IP address, browser user agent, and the times of signing and submission.

Purposes: organizing the booked dive, assessing your fitness to dive, participant safety, preparing equipment, contacting you about the booking, and keeping proof of the signed declarations and agreements.

The medical questionnaire is the standard PADI Diver Medical Participant Questionnaire. Your answers are used to assess whether you are fit to dive, in line with PADI training standards, before any diving activity. Aqua-Mar Team instructors review the answers for this purpose only.

If you answer YES to a question that requires it, a medical certificate or a physician's evaluation is required before diving. Without it, participation may be postponed or refused for your safety, and the booking can be rescheduled by phone.

Legal bases under Regulation (EU) 2016/679 (GDPR):

• steps taken at your request before providing the service, and providing the booked service (Article 6(1)(b));
• your explicit consent for health data (Article 9(2)(a)), given through the required consent checkbox in the form;
• legitimate interest and the establishment, exercise or defence of legal claims, for keeping the archived documents (Article 6(1)(f) and Article 9(2)(f));
• your consent for marketing communications (Article 6(1)(a)), optional and withdrawable at any time.

How long we keep the data: booking and check-in data is kept in the online booking system for 30 days after the dive date, then deleted automatically from the database and file storage. Before deletion, the signed documents are exported as PDF and filed in Aqua-Mar Team's own records archive, where they are kept only as long as necessary to establish, exercise or defend legal claims within the applicable statutory limitation periods, and then securely destroyed.

Marketing communications: we send you information about upcoming activities only if you answered “Yes” to the optional question in the form. You can withdraw your consent at any time by contacting Aqua-Mar Team at dtnautilus@yahoo.com; withdrawing does not affect your booking.

The data is not sold, rented or shared with third parties for their own purposes or for marketing. It is processed only by Aqua-Mar Team and by technical service providers acting exclusively on Aqua-Mar Team's behalf as processors (see “Who else receives the data”).

Why we use it, and on what legal basis

• To reply and to discuss the dive, course or trip you are interested in: steps taken at your request before a possible booking (Article 6(1)(b) of Regulation (EU) 2016/679, GDPR) and our legitimate interest in answering messages (Article 6(1)(f)).
• For Book & Check-in: the purposes and legal bases described in the section above.
• For the security of the site and to block automated messages (spam): legitimate interest (Article 6(1)(f)).
• To show the Google map on the contact page: your consent, which you can withdraw at any time (Article 6(1)(a) GDPR and Article 4(5) of Romanian Law no. 506/2004).

We use your data for marketing communications only with your consent, given in Book & Check-in, and we never sell it.

Who else receives the data

• Vercel, the provider that hosts the website, for its technical operation.
• Supabase, the provider of the database and file storage for Book & Check-in, with the data hosted in the European Union (Frankfurt).
• The email provider that delivers contact form messages to us (the site is set up for the Resend service).
• Google, only if you choose to load the map on the contact page. Google then receives your IP address and may use its own cookies, under Google's privacy policy (opens in a new tab).

These technical service providers act exclusively on Aqua-Mar Team's behalf as processors, under contract and with the safeguards required by the GDPR. We do not sell, rent or share the data with third parties for their own purposes or for marketing.

If a provider processes data outside the European Economic Area, the transfer only takes place with the safeguards set out in Chapter V of the GDPR.

Links to Facebook, Instagram, Google Maps, Apple Maps or Waze only open those sites when you click them; each has its own privacy policy.

How long we keep data

We keep messages for as long as we need to reply and to organise the activity you asked about, then delete them.

Book & Check-in data stays in the online booking system for 30 days after the dive date and is then deleted automatically; the signed documents archived as PDF are kept as described in the Book & Check-in section.

The check-in form draft stays only on your device, for up to 7 days, and is deleted once the form is sent.

Your cookie choice stays in your browser for up to 12 months, after which we ask again. You can delete it at any time in your browser settings.

Your rights

• to access your data and receive a copy;
• to have inaccurate data corrected;
• to have your data erased and processing restricted;
• to data portability;
• to object to processing based on legitimate interest;
• to withdraw consent at any time, without affecting processing that took place before.

To use any of them, write to us at dtnautilus@yahoo.com or through the contact form. You can also lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro (opens in a new tab)).

Security

We use appropriate technical and organisational measures to protect data: limited access, validation of everything sent through the forms, protection against automated messages and strict security policies for the site's pages.

Book & Check-in data is transmitted over encrypted connections, and access to bookings is restricted to authorised Aqua-Mar Team staff.

Children

We run programmes for children, but the contact form is meant for adults. For a child, please ask a parent or guardian to write to us.

Changes

When we update this policy we change the date above. Important changes are announced on the site.