Privacy Notice

Diving.Voyage is operated by Marcel Lewandowski, a sole trader registered in Ireland under the business name Webase Global (business name number 675208), with a registered business address at 77 Camden Street Lower, Dublin, D02 XE80, Ireland ("Diving.Voyage", "Webase Global", "we", "us" or "our").

Webase Global is controller for Diving.Voyage accounts, profile choices, security, directory governance, support, moderation, analytics choices and legal compliance. Privacy requests can be submitted through Contact. No data protection officer is currently appointed.

The selected Operator is normally an independent controller for its customer record, service, eligibility, safety, documents, incidents, accounting and legal duties. Diving.Software stores organization-scoped operational records for the Operator. Stripe acts under the roles in its own privacy terms.

• Account identity, email, credentials, verification and preferences.
• Optional diver profile, public fields, experience, certifications, logbook and saved items.
• Participants, services, dates, requirements, prices, payment status and communications.
• Where enabled, emergency, medical/clearance, waiver and incident information.
• Reviews, photos, submissions, reports and moderation records.
• IP address, device/browser, session, security logs, CAPTCHA, cookie choices and analytics identifiers.

• Accounts, requested features and bookings — contract and pre-contract steps.
• Directories, support, moderation and reliable operation — contract and legitimate interests.
• Payments, refunds, fraud and disputes — contract, legal obligation and legitimate interests.
• Tax, sanctions, safety and recordkeeping — legal obligation.
• Emergency information — vital interests and legitimate safety interests.
• Health data — explicit consent or another condition selected by the Operator under local law.
• Marketing and optional analytics — consent where required.

Profiles are private by default. Published fields may be viewed, copied and indexed. When you book, we send the selected Operator only information reasonably needed to create and perform that booking. Optional future profile sync requires a separate choice and can be revoked prospectively.

We otherwise share minimum necessary data with Stripe; hosting, email, CAPTCHA, analytics, map and support providers; advisers; authorities where lawfully required; and emergency responders where necessary. We do not sell personal data.

Where restricted-transfer rules apply, we use an adequacy decision, standard contractual clauses or another lawful safeguard.

Active account data is kept while the account exists. After verified deletion, operational deletion is targeted within 30 days and backups expire within 90 days. Security logs are normally kept 12 months and resolved support records 24 months. Booking, tax, waiver, incident and claim records may be kept for the legally required period. Dormant or fake accounts may be removed after 24 months and 30 days' notice where possible.

Controls include encrypted transport, secure sessions, separated products and credentials, server-to-server integrations, tenant scoping, restricted documents, backups, logging and abuse prevention.

Depending on law, you may request access, correction, deletion, restriction, portability or objection; withdraw consent; and request review of qualifying automated decisions. You may complain to the Irish Data Protection Commission or another competent authority. We may verify identity and retain evidence required by law or claims.

Independent accounts are limited to adults. Minor participant data is used only through a legitimate booking and guardian process and is not used for behavioural advertising.

We may automate availability, calculations, fraud flags and workflow checks, but not final medical-fitness or dive-safety decisions. Material privacy changes will be communicated appropriately.