This policy explains what personal data Scuba Manager handles, why, for how long, who else touches it, and what rights you have. It is written for dive centre owners, staff and instructors, and for the divers whose details a dive centre keeps in Scuba Manager.
Scuba Manager is run by PANCHENKOV & LAHAV Ο.Ε. (a Greek general partnership), trading as Cookie Tech. Promitheos 2, 166 73 Voula, Attica, Greece. VAT EL802636558. General Commercial Registry (ΓΕΜΗ) 179986658000.
Privacy contact: hello@cookie-tech.com
We have not appointed a Data Protection Officer because the law does not require one for our activity. Write to the address above with any privacy question.
Scuba Manager holds two kinds of personal data, and our role is different for each.
We are the controller for data about the people who use Scuba Manager: dive centre managers, staff and instructors with an account, people who contact us, visitors to our website, and billing contacts. This policy covers that data fully.
We are a processor for data a dive centre enters about its own clients (divers): names, contact details, certifications, equipment sizes, bookings, notes, and any medical or waiver flags. For that data the dive centre is the controller. It decides what to collect and why, and it answers its divers' requests. We only process it on the centre's instructions, under our Data Processing Addendum (scuba-manager.com/dpa). If you are a diver, please contact your dive centre first. If you contact us, we will pass your request to the centre.
| Data | Where it comes from |
|---|---|
| Name, email, phone, role, language and unit preferences | You, when you sign up or are invited |
| Dive centre details (name, address, business details) | You |
| Certifications and professional qualifications, profile and job board details (instructors) | You |
| Files you upload (avatar, documents) | You |
| Billing contact, Stripe customer ID, subscription status and plan | You and Stripe. We never see or store your full card number or CVC. |
| Sign-in records, security and audit logs (for example role or billing changes) | Our systems, automatically |
| Messages to us (contact form, email) | You |
| Website usage statistics (pages viewed, device type, approximate location) | Google Analytics, only if you click Accept on the cookie banner |
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Create and run your account, provide the Service, support you | Performance of our contract with your dive centre or with you (6(1)(b)) |
| Take payment, issue invoices, keep accounting records | Contract (6(1)(b)) and legal obligation under Greek tax law (6(1)(c)) |
| Service emails: welcome, account, security and billing notices | Contract (6(1)(b)) |
| Occasional product updates to account holders | Our legitimate interest in telling customers about the Service they use (6(1)(f)). You can opt out in any email. |
| Keep the Service secure, prevent abuse, keep audit logs | Legitimate interest (6(1)(f)) |
| Website analytics | Your consent (6(1)(a)), which you can withdraw any time via "Cookie settings" in the footer |
| Answer legal claims | Legitimate interest (6(1)(f)) |
We do not sell personal data, we do not use it for advertising profiles, and we do not make automated decisions that have legal or similar effects on you.
A dive centre may record medical or waiver flags about its divers. This is sensitive data (GDPR art. 9). The dive centre is responsible for having a lawful basis, usually the diver's explicit consent, and for recording only what it needs. We recommend storing a simple flag (for example "medical form received, cleared") rather than medical details.
We use these providers to run the Service. Each processes data only to provide its service to us, under a data processing agreement. Our terms with dive centres for divers' data are in our Data Processing Addendum.
| Provider | What it does | Data involved | Where | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | All Service data | EU (Frankfurt, Germany, AWS eu-central-1) | Data stored in the EU. Supabase is a US company; any access from outside the EU is covered by its DPA and Standard Contractual Clauses. |
| Lovable (with Cloudflare) | Hosting and delivery of the web app | Technical data such as IP address | Global network | DPA; EU-US Data Privacy Framework or Standard Contractual Clauses |
| Stripe | Subscription payments, invoices, tax calculation | Billing contact, card and payment data, IP address | EU and US | Stripe Payments Europe (Ireland); transfers under the Data Privacy Framework and Standard Contractual Clauses |
| Resend | Sending emails | Name, email address, email content | Sent via AWS eu-west-1 (Ireland); Resend is a US company | DPA; Data Privacy Framework or Standard Contractual Clauses |
| Google (Google Analytics 4) | Website statistics, only after consent | Pseudonymous identifiers, device data, approximate location | EU and US | Google Ireland; Data Privacy Framework and Standard Contractual Clauses |
| Anthropic | AI assistance used by our team for support and maintenance | Data viewed during a support or maintenance task | US | DPA and Data Privacy Framework or Standard Contractual Clauses |
Integrations you choose. If your dive centre connects a booking engine (for example FareHarbor), data flows between Scuba Manager and that provider on your instructions. That provider works for your dive centre under its own terms, not as our sub-processor.
We will update this list before adding a new sub-processor and tell dive centres in advance, as set out in our Data Processing Addendum.
We keep the Service database in the EU. Some providers above are based in, or may access data from, the United States. Where that happens we rely on the EU-US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses.
| Data | How long |
|---|---|
| Account and dive centre data | While the subscription is active. After cancellation or account deletion: 30 days in which you can export, then deleted within a further 30 days. Audit records of deleted items, which may include a copy of the deleted record, are kept for security and dispute purposes. |
| Backup copies | We do not currently guarantee backups. If our database provider holds any backup copy, deleted data may remain in it until it is overwritten. |
| Invoices and billing records | As long as Greek tax and accounting law requires (at least 5 years) |
| Security and audit logs | Currently kept without a fixed end date, for security and dispute purposes. Records of deleted items may include a copy of the deleted record. |
| Messages to us | Up to 24 months after the conversation ends |
| Analytics data | As configured in Google Analytics (we use the shortest practical retention) |
| Divers' data (we are processor) | As the dive centre decides. Deleted when the centre deletes it, or within 60 days after the centre's account ends. |
You can ask us to:
Write to hello@cookie-tech.com. We answer within one month, and tell you if we need more time (up to two further months for complex requests). We may ask you to confirm your identity.
If you are unhappy with our answer, you can complain to the Hellenic Data Protection Authority (www.dpa.gr), or to the authority in the EU country where you live or work.
We use encryption in transit (HTTPS) and at rest, database-level separation between dive centres, role-based access, audit logs of critical actions, and signature-verified payment webhooks from Stripe. Platform API keys are kept in server-side secret storage, never in the app's code. No system is perfectly secure. If a personal-data breach affects you, we will tell you and the authorities as the law requires. For divers' data, we tell the dive centre without undue delay so it can do the same.
Scuba Manager accounts are for adults working in or with dive centres. Dive centres may record details of divers under 18 (for example junior courses). The centre is responsible for any parental consent required.
We will post changes here and update the date at the top. If a change is significant, we will tell account holders by email before it takes effect.