Privacy Notice

The controller is Aperioristes Technologies Ltd, registered in Cyprus under number HE 367279, registered office Aristoteli Valaoriti 62, Livadia 7060, Larnaca, Cyprus. For anything in this notice, contact info@divingscanner.net.

The Operator is not required to appoint a Data Protection Officer and has not done so. Enquiries sent to the address above are handled by the persons responsible for data protection matters.

When you create an account: your name and email address, and a securely hashed password. If you sign in with Google we receive your name, email address and profile picture from Google — never your Google password.

What you choose to add to your profile: date of birth, phone number, country of residence, the diving qualifications and specialities you declare, and your equipment size. All optional. They exist so a dive centre can prepare the right kit and match you to a suitable dive.

Fitness to dive:a single yes/no declaration — whether you have a condition that needs a doctor’s clearance before diving. We deliberately do not ask which condition, and we store no medical information about you. If you declare that something applies, the dive centre contacts you and has that conversation directly; the answer stays between you and them.

When you book: the details of the booking, your pickup location or accommodation address, who is diving, and the payment status. Card details are handled by the payment provider and do not reach our systems.

Automatically: pages you view, approximate location derived from your IP address, device and browser type, and technical logs. If something crashes, a diagnostic report.

What you send us: messages, enquiries and reviews.

No medical records, and no diagnoses. We do not ask for a diving medical, a medical certificate, or what any condition is — not at sign-up, not on your profile, not when you book. We store no health information about you.

The one question we do ask is a yes/no: whether you need a doctor’s clearance before diving. That answer exists because a dive centre has to know before the boat leaves — but we never ask what lies behind it, and the conversation itself happens directly with the centre. See “Fitness to dive” in clause 2.

The one exception: if you request a refund on medical grounds under the cancellation policy and choose to submit a medical statement, we process it — with your explicit consent, only to assess that request. Send only what shows you couldn’t dive; a diagnosis is not needed and can be redacted.

No certification documents. You tell us the agency and the rating. We store no scans, no card numbers and no uploads. The dive centre inspects the physical card in person.

No advertising profiles and no data sales. We do not sell personal data, and we run no cross-site advertising trackers.

Where processing is founded on legitimate interest, you may object at any time. Processing will cease upon objection unless the Operator demonstrates compelling legitimate grounds which override your interests, rights and freedoms.

The Dive Centre with which you make a booking. For the purpose of supplying the diving, the Dive Centre receives your name, contact particulars, pickup location, party composition, declared qualification and equipment requirements. The Dive Centre acts as an independent controllerin respect of that data: its use, storage and protection thereafter are governed by that Dive Centre’s own privacy practices and are its responsibility and not the Operator’s. Requests concerning data held by a Dive Centre should be directed to it.

Processors acting on the Operator’s instructions, which are bound by written terms and may not use personal data for their own purposes. The categories of recipient are:

Personal data may additionally be disclosed where required by law, where necessary to establish, exercise or defend legal claims, or to an acquirer in connection with a sale or reorganisation of the business. The Operator does not sell personal data and does not disclose it for third-party advertising.

Personal data comprising your account and bookings is stored within the European Union.

Certain analytics and diagnostics processing currently takes place in the United States. Such transfers are made on the basis of the standard contractual clauses adopted by the European Commission under Article 46 GDPR. The Operator intends to relocate that processing within the European Union. Where an identity or mapping provider processes data outside the European Economic Area, the same safeguards apply.

Account data: while your account exists, and deleted when you close it. Booking records and the invoices attached to them: retained for as long as accounting and tax law requires, which in Cyprus is currently six years. Consent records: as long as needed as evidence. A medical statement submitted with a refund request: only as long as needed to assess and evidence that refund, then deleted. Analytics and crash reports: months, not years, on our providers’ retention schedules.

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, provide it in a portable form, or object to processing based on legitimate interest. Much of it you can change yourself in your account settings.

Requests should be submitted to info@divingscanner.net and will be answered within one month of receipt. No fee is payable, and no detriment will result from the exercise of these rights.

If you are unhappy with how we have handled it, you can complain to the Office of the Commissioner for Personal Data Protection (Cyprus) or to the supervisory authority where you live.

A session cookie keeps you signed in; the site cannot work without it, so there is nothing to consent to. Analytics cookies tell us which pages are used.

Session recording is disabled; no replay of your activity on the Platform is captured or retained. The Operator uses no advertising cookies and no cross-site tracking technologies. Diagnostic reporting is configured not to transmit IP addresses, cookies or request contents, and identifiers are removed from the page addresses such reports carry.

The Operator implements appropriate technical and organisational measures, including encryption of data in transit, storage of passwords in hashed form only, and restriction of production database access to authorised personnel. No system can be guaranteed secure. In the event of a personal data breach affecting your rights and freedoms, notification will be made to you and to the competent supervisory authority as required by Articles 33 and 34 GDPR.

Accounts are for people aged 16 and over. We do not knowingly collect data about children. If you believe a child holds an account, tell us and we will remove it.

We will update this notice as the service changes — the next substantial update will be when bookings open. Where a change materially affects you we will tell you rather than quietly amending the page.