Privacy Policy

Version of 25 October 2026. It replaces the version of 13 June 2026.

This policy explains what personal data Dive Base processes, why, on what legal basis, who receives it, how long we keep it and what rights you have. It covers everything Dive Base runs: the website divebase.io, the operator app app.divebase.io, the sign-in service auth.divebase.io, the API api.divebase.io, and the public booking pages of dive centers (book.divebase.io, app.divebase.io/book/… and booking pages embedded on dive centers' own websites).

It is written for the EU General Data Protection Regulation (GDPR, Articles 13 and 14) and the German Federal Data Protection Act (BDSG). Where other privacy laws apply to you (for example the UK GDPR, the Swiss FADP or US state laws), the rights in the section Your rights apply to the extent those laws give them to you.

1. Who is responsible

The controller for the processing described in section 3 is:

  • Adler Net UG (haftungsbeschränkt) i.L., represented by its liquidator Eli Ben Fayershtain
  • Courbierestraße 9, 10787 Berlin, Germany
  • Email: info@divebase.io

Full company details are in the Imprint. We have not appointed a data protection officer because we are not legally required to. Write to info@divebase.io with any privacy question.

2. Two roles: the dive center decides about its divers' data

Dive Base is software that dive centers ("operators") use to run their business. That gives us two different roles:

  • Dive Base is the controller for the website divebase.io, for operator accounts (the people who sign in to the app) and for running, securing and billing the platform. Section 3 describes this.
  • The dive center is the controller for the data of its own customers, divers, students and staff: bookings, waivers, certifications, safety records, payments and so on. Dive Base processes this data only on the dive center's behalf and on its instructions, under a Data Processing Agreement (GDPR Article 28). Section 4 describes this processing so you know what happens to your data, but questions and requests about it should go to the dive center first. Its own legal notice and privacy policy are linked at the bottom of its booking page. If you contact us instead, we pass your request on to the dive center without delay.

3. Processing where Dive Base is the controller

3.1 Visiting divebase.io

When you open the website, our servers process your IP address, the date and time, the page requested, the referring page, and your browser's user agent. We need this to deliver the pages and to keep the servers secure (legitimate interest, Article 6(1)(f) GDPR). These entries are kept in the web server logs for 14 days and then deleted. The same applies to requests to app.divebase.io, api.divebase.io, auth.divebase.io and the booking pages.

The fonts on our pages are served from our own server. No request goes to Google Fonts or another font service.

3.2 Analytics on divebase.io

  • Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia) counts page views without cookies and without storing IP addresses or other personal data. Legal basis: our legitimate interest in knowing how the website is used (Article 6(1)(f) GDPR).
  • Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is loaded only after you accept analytics cookies in the cookie banner. It sets cookies and processes a shortened IP address, device and browser data and your interactions with the site. Data can reach Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Legal basis: your consent (Article 6(1)(a) GDPR and section 25(1) TDDDG). You can withdraw it any time with "Cookie settings" in the website footer.

Details are in the Cookie Policy. The operator app and the booking pages use no analytics.

3.3 Early-access form

If you send the early-access form, we store your work email (required) and, if you give them, your name, dive center, country and message, to answer you and to talk to you about Dive Base (Article 6(1)(b) GDPR, steps before a contract, and Article 6(1)(f) GDPR). We keep this until the conversation is over and you have not become a customer, or until you ask us to delete it.

3.4 Operator accounts (app.divebase.io and auth.divebase.io)

When a dive center signs up, or when an owner or admin invites a team member, we process:

  • first and last name, email address, role in the dive center, and the dive center's name, country and booking address;
  • a password, stored only as a salted hash, never in readable form;
  • for two-step sign-in: the secret of your authenticator app (stored encrypted) or one-time codes sent by email;
  • for passkeys: the public key, credential ID and sign-in counter of your passkey. Your fingerprint, face or device PIN never leave your device; we do not receive them;
  • security data: email verification, invitation and password reset tokens (valid 24 hours or less), an audit log of important changes made in the dive center's workspace, and your IP address, which is used only briefly in memory to limit repeated sign-in attempts and is otherwise kept only in the gateway's request logs (14 days, see section 3.1).

If you were invited by your dive center, we received your name, email and role from the person who invited you (Article 14 GDPR).

Purpose and legal basis: providing the service the dive center signed up for (Article 6(1)(b) GDPR) and keeping accounts and the platform secure (Article 6(1)(f) GDPR). For team members invited by their employer, the processing also serves the employment relationship between them and the dive center.

Support access. When a dive center asks for help, Dive Base staff can open its workspace in a support session. Every support session is logged with who opened it and when.

3.5 Subscriptions and billing

For paid plans we process the dive center's billing contact, plan, invoices and payment status. Card payments for subscriptions are handled by Stripe (Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland); we never see or store full card numbers. Legal basis: the contract (Article 6(1)(b) GDPR) and our legal duty to keep accounting records (Article 6(1)(c) GDPR with section 147 AO and section 257 HGB).

3.6 Emails we send

Account emails (verification, sign-in codes, password reset, invitations) and booking emails that a dive center has not set up its own mail server for are sent from noreply@divebase.io through Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Microsoft processes the recipient address and the message content to deliver the email. Microsoft is certified under the EU-US Data Privacy Framework and bound by the EU Standard Contractual Clauses.

3.7 Cookies and storage in the app and on booking pages

The app uses only what it needs to work: a sign-in cookie (db_session, valid up to 12 hours) and entries in your browser's local storage for your sign-in token, your chosen colour theme and, on booking pages, your chosen language. These are strictly necessary for the service you asked for (section 25(2) no. 2 TDDDG); no consent is needed and none of them is used for tracking. When a booking page shows card payment, Stripe's payment form may set its own fraud-prevention cookies; see section 4.3.

4. Processing for dive centers (Dive Base as processor)

The data below belongs to the dive center you book with or work for. The dive center decides why and how long it is processed; Dive Base stores and processes it for the dive center as described in the Data Processing Agreement. Which of it is collected depends on how the dive center uses Dive Base.

4.1 Divers, students and customers

  • contact and profile data: name, email, phone, date of birth, country, language;
  • bookings, carts, vouchers, gift cards, waitlist entries, reviews you write, and emails about your booking;
  • diving data: certification agency, level, card number and verification status, number of dives, course progress, equipment sizes and weight for rental gear;
  • waivers you sign: your answers (non-medical), your name and signature, and for tamper evidence the time, IP address, user agent and a device fingerprint; for minors also the guardian's name, relationship and signature;
  • health data (special category, Article 9 GDPR): if the dive center uses a medical questionnaire, we do not store your answers. We store only the result (cleared, needs a physician's approval, or not cleared), how many questions were answered yes, and the validity period. If an incident happens during a dive, the dive center may record an incident report with dive details, symptoms, first aid given and outcome;
  • notes the dive center writes about you.

4.2 Dive center staff

Name, contact details, roles, languages, qualifications (diving, first aid, boat licences), insurance policies, work permits, availability, schedules, assignments, time off and sick-day reports that the dive center enters to plan its operations.

4.3 Online payments on booking pages

When you pay a dive center online, the payment is processed by the payment provider the dive center chose (for example Stripe, PayPal, Mollie or Xendit), on the dive center's own account. Card details are entered directly into the provider's secure form and never reach Dive Base servers. We store the payment's status, amount, currency and the provider's reference. Stripe's form is loaded from js.stripe.com and may set cookies to prevent fraud; Stripe's own privacy policy applies to that.

4.4 Legal basis

For this data, the dive center is responsible for having a legal basis, usually the booking or employment contract (Article 6(1)(b) GDPR), legal duties (Article 6(1)(c) GDPR), its legitimate interest in safe diving (Article 6(1)(f) GDPR) and, for health data, your explicit consent (Article 9(2)(a) GDPR). The dive center's own privacy policy, linked on its booking page, tells you more.

5. Who receives data

We never sell personal data and do not use it for advertising. We share it only as far as needed:

  • Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (servers in Nuremberg, Germany: application, API and database); IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (servers in Berlin, Germany: website and the gateway in front of the app, and an encrypted copy of the nightly backups). Connections between our servers run over our own encrypted private network.
  • Email: Microsoft Ireland Operations Limited (section 3.6).
  • Payments: Stripe Payments Europe Limited for subscriptions (section 3.5); on booking pages, the payment provider the dive center chose (section 4.3).
  • Analytics on divebase.io only: Plausible Insights OÜ and, with your consent, Google Ireland Limited (section 3.2).
  • The dive center you book with or work for receives the data it needs for your booking or your work.
  • Authorities and courts, only where the law obliges us.

Our service providers act on our written instructions under data processing agreements.

6. Transfers outside the EU

We host all platform data in Germany. Data can reach the USA only through Google Analytics (with your consent), Microsoft and Stripe. These companies are certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), and the EU Standard Contractual Clauses apply in addition.

7. How long we keep data

  • Web server logs: 14 days.
  • Backups: the whole database is backed up every night, encrypted. Each backup is kept 14 days on the application server in Nuremberg and 30 days on a second server in Berlin, then deleted. Data you or a dive center delete is therefore gone from all backups after 30 days at the latest.
  • Sign-in tokens: up to 12 hours; passkey challenges 5 minutes; email verification, invitation and password reset links 24 hours or less.
  • Operator accounts: as long as the dive center uses Dive Base. An owner or admin can suspend a team member's account at any time.
  • After a dive center's contract ends, its workspace is first archived and then deleted together with all data in it [to be confirmed by Dive Base: the deletion period after the contract ends], unless the dive center has exported or asked us to delete it earlier.
  • Invoices and accounting records: as long as German commercial and tax law requires (up to 10 years, section 147 AO and section 257 HGB).
  • Early-access requests: until the conversation is over or you ask us to delete them.
  • Data we process for a dive center (section 4): as the dive center instructs, and deleted at the end of our contract with the dive center as described in the Data Processing Agreement.

8. Security

All connections use HTTPS (TLS). The database is reachable only from our own servers. Passwords are stored as salted hashes; authenticator secrets and payment provider keys are encrypted at rest. Nightly backups of the database are encrypted (age, public-key encryption) before they leave the database server; the key to read them is kept offline, not on any server. Access to production systems is limited to the people who run Dive Base and uses individual keys. Our pages send a strict Content Security Policy and the operator app cannot be framed by other websites.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Article 15);
  • have wrong data corrected (Article 16);
  • have your data deleted (Article 17);
  • restrict processing (Article 18);
  • receive your data in a portable format (Article 20);
  • object at any time, for reasons arising from your particular situation, to processing based on our legitimate interest (Article 21);
  • withdraw a consent at any time with effect for the future (Article 7(3));
  • complain to a data protection supervisory authority (Article 77). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, www.datenschutz-berlin.de. You can also complain to the authority where you live or work.

Write to info@divebase.io. For data a dive center controls (section 4), the dive center answers your request; we help it.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (Article 22). The medical questionnaire result in section 4.1 follows the questionnaire's fixed rule (any "yes" needs a physician's approval); whether you can dive is decided by the dive center and your physician.

10. Do you have to give us your data?

You do not have to use Dive Base. To open an operator account we need a name, an email and a password; without them we cannot provide the account. What a dive center needs for a booking is up to the dive center.

11. Children

Operator accounts are for adults acting for a dive center. Bookings and waivers for minors are made by a parent or guardian through the dive center.

12. Changes to this policy

When this policy changes, we publish the new version here with its date and keep earlier versions available. The previous version is the version of 13 June 2026.

13. How to contact us

Email info@divebase.io, or write to Adler Net UG (haftungsbeschränkt) i.L., Courbierestraße 9, 10787 Berlin, Germany.

Back to home