1. Controller
The data controller is True Divers Janusz Czachor, ul. Doktora Judyma 5A, 47-232 Kędzierzyn-Koźle, Poland, e-mail info@truedivers.net.
2. Why we process data
- Replying to a message from the contact form — on the basis of our legitimate interest (art. 6(1)(f) GDPR). Data is deleted once the matter is closed.
- Fulfilling a shop order: delivery, invoicing, returns and complaints — on the basis of the contract and legal obligations (art. 6(1)(b) and (c)). Invoice data is kept for 5 years from the end of the tax year.
- Running a club account: member profile, trip sign-ups, club prices — on the basis of the membership agreement (art. 6(1)(b)). Data is kept until the account is deleted.
- Mailing about trips, courses and offers — solely on the basis of consent (art. 6(1)(a)), which can be withdrawn at any time in the club profile. Club membership is not consent to mailing.
3. What data
In the club we collect only what is needed to organise a trip: name, contact details, certification level and agency, certificate number, gear sizes, insurance expiry date and an emergency contact. We do not collect health data.
A club member fills in their own profile and decides which fields beyond their name to complete.
4. Who we share data with
- Stripe — payment processing. Card details go only to Stripe; we never see them.
- Resend — sending e-mail: order confirmations, mailing.
- Supabase — the club database (servers in the European Union, Frankfurt).
- Vercel — website hosting.
- Courier companies — to the extent needed for delivery.
- Our accountant and tax authorities — to the extent required by law.
Centre staff have access to club member profiles in order to prepare trips.
5. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, port it, and object to processing based on legitimate interest. You can withdraw mailing consent in the club profile or by writing to us.
Requests are accepted at the e-mail address above. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).