Data processing agreement
Version 1.0 · 13.09.2026
This agreement applies automatically when you open a centre. You do not have to sign anything separately — but you may, and we will counter-sign. Write to privacy@diveshopmanager.com.
1. Who is who
You — the dive centre — are the controller for everything you enter about your guests and your staff. You decide what is collected and why.
We — Aquatics Global Holdings LLC — are the processor. We hold that data for you and act only on your instructions.
For your own account, your billing data and this website we are the controller; that is covered by the privacy notice, not by this agreement.
2. What we process, and why
| Subject matter | Operating a dive centre: planning dives, guests, courses, staff, equipment, rentals, sales |
|---|---|
| Duration | For as long as your account exists |
| Nature and purpose | Storing, organising, computing and displaying the data you enter, so that the service works |
| Data subjects | Your guests, your staff, your partners' contacts |
| Types of data | Identification and contact data, date of birth, certifications and dive history, equipment sizes, emergency contacts, working time, sales records |
| Special categories | Yes — data concerning health: the dive medical statement |
The special category is deliberately small. The system stores three facts about a medical statement: that it was signed and when, whether any answer was yes, and what a physician said. Which question was answered yes is never asked for and never stored. Each statement carries its own deletion date.
3. Our obligations
- We process personal data only on your documented instructions. Using the service is such an instruction. If we ever believe an instruction breaks data protection law, we will tell you.
- Everyone with access is bound to confidentiality.
- We keep the measures described in Annex II and do not weaken them during the term.
- We help you answer requests from data subjects — in practice you do not need us: access, correction, deletion and export are functions you operate yourself.
- We help you with Articles 32 to 36 as far as the information is ours to give.
- Breach notice without undue delay, and in any case within 48 hours of becoming aware, with what we know: what happened, which data, how many records, what we did.
- At the end: on your choice we delete or return everything. Export is a button; deletion removes the tenant and everything hanging from it.
- We make available what you need to show compliance and allow audits — see clause 6.
4. Sub-processors
You give general authorisation for the sub-processors below. We will announce any change at least 30 days in advance in the product. If you object on reasonable data protection grounds, you may terminate for the remaining period without penalty.
| Who | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting, delivery, server logs | USA |
| Neon Inc. | Database | USA (us-east-1) |
| Resend, Inc. | The three access emails | USA |
Resend, Inc. (United States) sends the three access emails — password reset, password changed, invitation. It receives the recipient address, subject and message text, and reports back whether the message arrived. It is bound by a data processing agreement with the Standard Contractual Clauses. Open and click tracking is switched off.
5. Transfers out of the EU
We are established in the United States and the data is stored there. For that transfer the parties adopt the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Two: controller to processor, which are incorporated into this agreement by reference and are available at eur-lex.europa.eu.
| Clause 7 (docking) | applies |
|---|---|
| Clause 9 (sub-processors) | Option 2, general authorisation, 30 days' notice |
| Clause 11 (redress) | the optional independent dispute body is not used |
| Clause 17 (governing law) | The law of the Republic of Cyprus — the Member State where our Article 27 representative is established |
| Clause 18 (forum) | the courts of that Member State |
| Annexes I, II, III | clauses 2, 4 and Annex II of this agreement |
Where the clauses and this agreement disagree, the clauses win.
6. Audits
You may satisfy yourself that we keep to this agreement. In the first instance we answer in writing and provide what we have. Where that is not enough, an on-site or remote audit may take place once per year, with 30 days' notice, at your cost, by you or an auditor who is not our competitor and who is bound to confidentiality.
Annex II — Technical and organisational measures
Not a catalogue of good intentions. This is what is in the product, and most of it can be checked from outside.
Separation between dive centres
Two independent walls. Every query is limited to one centre in the application, and the database enforces the same limit again by itself (row-level security). The application connects with an account that cannot bypass that rule, never as the database owner — and a health endpoint fails loudly if it ever does.
Access
- Passwords are stored as a hash, never in clear text and never in a log.
- Session cookies are signed; a forged one is refused.
- Rights are data, not code: every action is checked against a permission at one single place.
- Guests and partners get links that expire, not accounts. Only a fingerprint of such a link is stored — never the link itself.
The interface to other systems
Read only. It cannot write, and it never returns dates of birth, equipment sizes or anything concerning health. A revoked or expired key gets the same answer as an invented one: not found.
Deletion
Medical statements carry their own deletion date and a nightly job acts on it, independently of the rest of the guest record. Deleting a centre removes everything belonging to it.
Availability and integrity
- Encrypted in transit (TLS) and at rest by the hosting providers.
- Automated backups with point-in-time recovery, kept by the database provider.
- Every change to the product passes an automated suite before it is deployed: static checks, unit tests, a build, and a walk through the whole application against a live server.
What we do not do
- No analytics, no advertising, no tracker, no third-party script.
- No use of your data to train machine learning models.
- No access to your data for any purpose other than operating the service and helping you when you ask.