Data Processing Agreement

Version 2, effective 2026-09-08

This agreement is between the dive club using DiveVerse (the Controller) and Bainbridge Services (registration number I25008115), 30 Calodyne Bungalows, St Francois, Mauritius 31726, which provides DiveVerse (the Processor). It forms part of the terms and conditions and is accepted by the person who creates the club, on the club's behalf. It exists to satisfy Article 28(3) of the UK GDPR and of Regulation (EU) 2016/679.

1. What this covers

Everything DiveVerse does with your members' personal data on your instructions. It does not cover data for which DiveVerse is itself the controller, such as your members' sign-in credentials or your club's own subscription billing: that is described in the privacy policy.

2. Subject matter, duration, nature and purpose

Subject matter and purpose. Providing the DiveVerse platform so you can run your club: membership, events and dives, courses, equipment, dive sites, communications, safety records and payments.

Nature of the processing. Collection, storage, organisation, retrieval, display to authorised club members, transmission to the sub-processors listed in section 6, anonymisation and erasure.

Duration. For as long as your club uses DiveVerse, and then for the periods in section 8.

Categories of data subject

• Your club's members, including prospective members who have applied to join
• Members of other clubs who take part in an activity you share with them
• The emergency contacts your members name, who are not themselves users

Categories of personal data

• Identity and contact: name, email address, phone number, date of birth, profile photo
• Diving: qualifications and their certificates, dive and event history, course enrolments and lesson sign-offs, equipment hires
• Insurance: policy details and uploaded documents
• Compliance: signed acceptance of your club's terms, and the electronic signature given for it
• Location: coordinates of dive sites, meeting points and sightings, and a member's own position when they ask the app to find what is nearby
• Communications: messages, posts, comments and photos in your club's chats and feed
• Financial: what a member paid, when, and the payment provider's reference
• Safety: incident reports

Special category data

Health data: medical declaration answers, declared conditions, and uploaded medical certificates. This is processed on the basis of the member's explicit consent, given when they sign the declaration. Because of the risk this carries, it is subject to the additional measures in section 5.

3. Your instructions

DiveVerse processes this data only on your documented instructions, which are: these terms, the settings and configuration you choose in the app and admin console, and any further written instruction you give us. The one exception is where UK or EU law requires us to process it otherwise, in which case we will tell you before doing so unless the law forbids that.

If we think an instruction of yours breaches data protection law, we will tell you.

As Controller you are responsible for having a lawful basis for what you ask us to do, for telling your members what you collect and why, and for the content of your club's own terms and medical questionnaire additions.

4. Confidentiality

Everyone we allow to access this data is bound by a duty of confidentiality and is given access only where their role requires it.

5. Security

We implement the measures required by Article 32, taking account of the risk. In practice:

• All traffic encrypted in transit; data encrypted at rest by our infrastructure provider
• Health data readable only by the member themselves and by your club's administrators and Diving Officers, enforced by the server rather than by hiding buttons in the app
• Every access to a member's health data logged with who, what and when, and available to that member on request
• Medical certificates, electronic signatures, insurance documents and qualification cards stored privately and served only through an authenticated endpoint that checks the requester, never by a public link
• Passwords never stored in readable form
• Least privilege access, and role separation between club administrators, Diving Officers, instructors and members

6. Sub-processors

You give general written authorisation for DiveVerse to use sub-processors. Each is bound by data protection obligations no less protective than these, and DiveVerse remains fully liable to you for their performance.

Map, weather, tide and species services (OpenStreetMap, Nominatim, OpenSeaMap, Esri, Open-Meteo, OpenTopoData, Overpass, TideCheck and iNaturalist) receive coordinates and search terms, not your members' personal data, and are therefore not sub-processors of it.

We will give you at least 30 days' notice by email before adding or replacing a sub-processor, and you may object on reasonable data protection grounds. If we cannot resolve your objection you may terminate and export your data.

7. Helping you meet your own obligations

• Data subject requests. The app gives every member self-service access, export, correction and deletion. Where a member comes to you instead, we will help you respond, at no charge for a reasonable volume of requests.
• Breach notification. We will tell you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting your members, with the information you need for your own Article 33 notification.
• Impact assessments. We will give you the information you reasonably need for a data protection impact assessment or prior consultation.
• Audit. We will make available the information needed to demonstrate compliance with this agreement, and allow an audit once a year on reasonable notice, or after a breach.

8. Retention and deletion

We delete or return your members' data on termination, except where law requires us to keep it. Specific periods, all enforced automatically by the platform:

• Medical declarations, conditions and certificates: deleted 12 months after the member last reviewed them
• Medical access logs: 24 months
• Notifications: 12 months
• Payment and membership records: up to 7 years, pseudonymised on account deletion so the amounts remain without the member's name
• Dive, event, course, equipment and incident records: retained as your club's safety record, with a deleted member's identity replaced by a placeholder
• Uploaded files untouched for 3 years: moved to archive storage, recoverable on request

On termination you can export your club's data before it is removed.

9. International transfers

The Processor, Bainbridge Services, is established in Mauritius, outside the UK and the European Union. Its UK Article 27 representative is Christopher Bainbridge, reachable at app@diveverse.org. An EU representative has not yet been appointed; until then, write to the same address for anything you would otherwise raise with one.

Your members' data is processed in the United States by Google. That transfer relies on Google LLC's certification under the EU-US Data Privacy Framework and its UK extension, and on the Standard Contractual Clauses incorporated into the Google Cloud data processing terms, with the UK International Data Transfer Addendum where the UK GDPR applies. You authorise these transfers by accepting this agreement.

10. Liability and changes

Liability under this agreement is subject to the limits in the terms and conditions, except where data protection law does not allow it to be limited.

We may update this agreement where the law or the service changes. We will notify club administrators, and your continued use after the notice period means acceptance. A club whose recorded acceptance is for an older version can accept the current one from the club settings screen.

Contact

Data protection queries: app@diveverse.org.