Privacy policy

Data controller

The controller of your data is Technical Diving Academy (Technical Diving Academy, SAS au capital de 715 € · RCS Toulon 898 324 827 · Siège social : Le Clos Nadine, 35 chemin de la Ressence, 83100 Toulon), reachable at info@technicaldivingacademy.com or on 06 81 52 01 54.

The club uses the Setpoint booking platform, operated by Quentin LEMAIRE, 11 rue Eugénie, 83400 Hyères, France. Setpoint is the club's processor (GDPR Article 28): it hosts and maintains the platform on the club's behalf and processes your data only on its instructions.

Data we process

Depending on what you do on the site, the club processes:

• Booking: the payer's name, email address and phone number; each participant's name, date of birth and diving level; services, dates and amounts.
• Documents some outings require: medical certificate of no contraindication (CACI), proof of level, insurance certificate.
• Safety: postal address and emergency contact, when the outing asks for them.
• Payment: handled by Stripe; the club never sees your card number.
• Customer account: sign-in email address and the documents you choose to keep there.
• Technical data: server logs and error reports, needed for the site's security and operation.

Purposes and legal bases

• Managing your booking, organising outings and invoicing: performance of the contract (GDPR Art. 6(1)(b)).
• Keeping divers safe (checking the CACI and level, emergency contact, safety sheet): performance of the contract and the club's legitimate interest (Art. 6(1)(b) and 6(1)(f)).
• Keeping accounts and meeting tax obligations: legal obligation (Art. 6(1)(c)).
• Keeping your documents in your customer account for your next bookings: your consent (Art. 6(1)(a) and, for the CACI, Art. 9(2)(a)), which you can withdraw at any time.
• Protecting the site against abuse and fixing errors: legitimate interest (Art. 6(1)(f)).

Medical certificate (CACI)

The CACI is health data (GDPR Article 9). It is only requested when an outing in your booking requires it. Only authorised club staff view it, to check that you can dive; no medical information is extracted from it or recorded, and every viewing is logged.

Without your consent, it is deleted the day after the last outing of your booking. You can choose to keep it in your customer account: this choice, separate from accepting the terms and conditions, is never required to book, and you can withdraw it at any time from your account, which deletes the document.

Recipients and processors

Only authorised club staff can access your data. The following providers act on the club's behalf, each for its own task only:

• Setpoint (Quentin LEMAIRE, France): operating and maintaining the platform.
• Hetzner Online GmbH (Germany): servers and database.
• Cloudflare: document storage (CACI, proofs, invoices) in the European Union, and bot protection of forms (Turnstile).
• Stripe: online payment. Stripe receives the payer's email address and the amount, never the participants' names or documents.
• Resend (servers in Ireland), or the club's email provider: sending emails (confirmations, invoices, reminders).
• Google: sign-in for club staff and, if the club uses it, its calendar (participants' names, payer's email, level and booking number).
• Sentry (servers in the European Union): detecting technical errors; displayed text and form input are masked.
• Umami, installed on Setpoint's servers: anonymous audience measurement, with no cookie and no personal data.

Transfers outside the European Union

The platform and your documents are hosted in the European Union, as are the emails sent through Resend and Sentry's error reports. Stripe and Google are established in the United States: the data they process may be transferred there. Cloudflare, Resend and Sentry also have US parent companies, which may access the data from the United States. These transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

Retention periods

• CACI attached to a booking: deleted the day after the booking's last outing.
• Proof of level attached to a booking: one month after the last outing.
• Address and emergency contact of a booking: deleted the day after the last outing; those kept in your customer account, until you delete them.
• Medical and insurance certificates in your customer account: twelve months after their issue date, or as soon as you withdraw your consent.
• Customer account with no booking or activity for three years: deleted entirely.
• Outing safety sheet: six years after the outing.
• Bookings, invoices and accounting records: ten years, as required by the French Commercial Code.

Cookies

The site only sets the cookies it needs to work: your chosen language and your customer account session. Audience measurement uses no cookie, so no consent is requested. Payment takes place on Stripe's secure page, which applies its own policy.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, to withdraw your consent at any time, and to set instructions for your data after your death. From your customer account, you view, download and delete your documents yourself. For any other request, write to the club at info@technicaldivingacademy.com: it will reply within one month.

For a minor participant, these rights are exercised by their legal guardian.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).