Data Processing Agreement

Version 2026-10-25 (25 October 2026). Under Article 28 of the EU General Data Protection Regulation (GDPR).

This agreement is between the dive center that uses Dive Base (the "Controller") and Adler Net UG (haftungsbeschränkt) i.L., Courbierestraße 9, 10787 Berlin, Germany, represented by its liquidator Eli Ben Fayershtain, which runs Dive Base (the "Processor"). It applies to all personal data that the Processor processes for the Controller when the Controller uses Dive Base.

How it is concluded. The Controller accepts this agreement in electronic form, either when it signs up (the sign-up wizard asks for it) or in the app under Settings, Business profile, "Data Processing Agreement". The app records the version, the date and the person who accepted it. Article 28(9) GDPR allows this electronic form. A signed copy is available on request from info@divebase.io.

1. Subject matter and duration

1.1 The Processor provides Dive Base, a software service for running a dive center (bookings, scheduling, customers and divers, waivers and safety records, equipment, staff, payments, reports and emails). The Processor processes personal data only to provide this service.

1.2 This agreement runs as long as the Controller uses Dive Base, and after that until all personal data has been deleted or returned under section 10.

2. Nature, purpose, data and data subjects

2.1 Nature and purpose: storing, organising, displaying, sending, exporting and deleting data in Dive Base on the Controller's instructions, so that the Controller can take bookings and payments, run dives and courses safely, manage staff and equipment and communicate with its customers.

2.2 Categories of data subjects: the Controller's customers, divers, students and their guardians; the Controller's staff and freelancers; other people the Controller records (for example emergency contacts).

2.3 Types of personal data: contact and profile data (name, email, phone, date of birth, country, language); booking, cart, voucher, gift card, waitlist and review data; diving data (certifications, card numbers, dive counts, course progress, equipment sizes, weight); waiver data (answers, signatures, time, IP address, user agent, device fingerprint, guardian details); payment status and payment provider references (no card numbers); staff data (roles, qualifications, insurance, work permits, availability, schedules, time off, sick-day reports); notes and messages.

2.4 Special categories (Article 9 GDPR): medical questionnaire results (cleared, needs physician, not cleared; the answers themselves are not stored), incident reports with symptoms and first aid, and sick-day reports of staff.

3. Instructions

3.1 The Processor processes personal data only on documented instructions from the Controller, including for transfers to third countries, unless EU or member state law requires otherwise; in that case the Processor tells the Controller before processing, unless that law forbids it. The Controller's instructions are this agreement and the settings and actions the Controller makes in Dive Base. Further instructions can be given by email to info@divebase.io.

3.2 The Processor tells the Controller without delay if it thinks an instruction breaks the GDPR or other data protection law.

4. Confidentiality

The Processor ensures that everyone authorised to process the personal data is bound to confidentiality or under an appropriate legal duty of confidentiality. Access for support happens only when the Controller asks for help and is logged.

5. Security of processing

The Processor takes the technical and organisational measures in the Annex (Article 32 GDPR). It may change them as long as the level of protection does not go down.

6. Sub-processors

6.1 The Controller gives general authorisation for the sub-processors in the Annex. The Processor informs the Controller at least 30 days before adding or replacing a sub-processor (by email to the account owner or a notice in the app). The Controller can object for good reason within that time; if no solution is found, the Controller can end the contract for the affected service.

6.2 The Processor puts the same data protection duties on each sub-processor by contract and remains responsible for them.

6.3 Payment providers that the Controller connects with its own account (for example Stripe, PayPal, Mollie, Xendit) and mail servers the Controller sets up itself are the Controller's own service providers, not sub-processors of the Processor.

7. Help with data subject requests

Taking into account the nature of the processing, the Processor helps the Controller with appropriate technical and organisational measures to answer requests from data subjects (Articles 12 to 22 GDPR), in particular through the app's functions to view, correct, export and delete data. If a data subject contacts the Processor directly about the Controller's data, the Processor forwards the request to the Controller without delay and does not answer it on its own.

8. Other assistance

The Processor helps the Controller, with the information available to it, to meet its duties on security (Article 32), breach notification (Articles 33 and 34), data protection impact assessments and prior consultation (Articles 35 and 36).

9. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data [to be confirmed by Dive Base: a fixed maximum, for example within 48 hours], with the information it has on the nature of the breach, the data and people affected, the likely consequences and the measures taken or proposed.

10. Deletion and return at the end

10.1 While the contract runs, the Controller can export its data from the app and delete it there.

10.2 When the contract ends, the Processor deletes all of the Controller's personal data, including its database, [to be confirmed by Dive Base: the deletion period after the contract ends], unless EU or member state law requires the Processor to keep it. Before that, the Controller can ask for an export. Encrypted backup copies are deleted on their normal schedule, at the latest 30 days later.

11. Information and audits

The Processor makes available to the Controller all information needed to show that it meets Article 28 GDPR and allows and contributes to audits, including inspections, by the Controller or an auditor it appoints. Audits are announced at least 30 days in advance, take place during normal business hours, must not disturb operations more than necessary and respect the confidentiality of other customers' data. The Processor may first answer with written information or recent reports.

12. Where data is processed

The Processor stores and processes the Controller's data in Germany. Transfers to a third country take place only under Chapter V GDPR (for example the EU-US Data Privacy Framework or the EU Standard Contractual Clauses) and only through the sub-processors listed in the Annex.

13. Liability and final provisions

13.1 Liability follows Article 82 GDPR and the contract for Dive Base.

13.2 If this agreement and other terms conflict on data protection, this agreement prevails.

13.3 German law applies. Place of jurisdiction is Berlin, as far as the law allows.

13.4 If a provision is invalid, the rest stays valid. A new version of this agreement is published at divebase.io/dpa.html with its version date and must be accepted again in the app.

Annex 1: Technical and organisational measures (Article 32 GDPR)

• Encryption: all connections use HTTPS (TLS). Connections between the Processor's servers run over an encrypted private network. Authenticator secrets and payment provider keys are encrypted at rest; passwords are stored as salted Argon2id hashes.
• Access control: each dive center's data is kept in its own database. Users have roles with defined permissions; owners and admins manage them. Sign-in supports passkeys and two-step verification. Repeated sign-in attempts are limited.
• Server access: only the people who run Dive Base, with personal SSH keys; the database accepts connections only from the server itself; servers are reachable for administration only through the private network.
• Separation: one database per dive center; test systems use separate databases and never production data.
• Integrity and logging: an audit log of important changes per workspace; logged support sessions; waivers stored with a content hash for tamper evidence.
• Availability: servers in professional data centers in Germany, automatic security updates, health checks and monitoring. The whole database (and the sign-in signing key) is backed up every night at 02:15 UTC, encrypted with age (public-key encryption) on the database server before it is stored; the private key is kept offline. Backups are kept 14 days on the application server in Nuremberg and 30 days on a second server in Berlin (IONOS, reachable only over the private network, write-only for the backup job), then deleted. Restoring from a backup has been tested.
• Web security: strict Content Security Policy, the operator app cannot be framed by other sites, security headers on all sites.
• Data minimisation: medical questionnaire answers are not stored, only the result; card numbers never reach Dive Base.

Annex 2: Approved sub-processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Server hosting (application, API, database) in Nuremberg, Germany.
• IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Server hosting (website, gateway in front of the app, encrypted backup copies) in Berlin, Germany.
• Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Sending emails from noreply@divebase.io for dive centers that have not set up their own mail server. Possible transfer to the USA under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
• Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. Only where the dive center takes payments through Dive Base's Stripe platform connection: payment processing. Possible transfer to the USA under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.

Questions about this agreement: info@divebase.io. See also our Privacy Policy.