Privacy Policy

Last updated: 28 October 2026

This policy explains how Oceano Diligente, Unipessoal, Lda. ("we") handles personal data under the EU General Data Protection Regulation (GDPR/RGPD) and Portuguese law (Lei n.º 58/2019).

1. Two different roles

2. Data we collect as controller

We do not sell personal data and we do not use it for advertising or profiling. Our website currently uses no analytics or advertising cookies (see Cookies).

3. Data processed for dive centres

This can include identity and contact details, date of birth and age, nationality, certification history, dive logs, emergency contacts, medical questionnaire answers, details of parents or guardians for minors, and payment and booking records. Some of this is health data, which needs particular care. We apply access controls per company, encrypted connections, regular backups and staff access limits. Each dive centre's data is kept separate from other centres' data.

4. Who we share data with

• Hosting, backup and email providers that run the Service for us, under data processing agreements.
• Professional advisers, accountants and authorities where the law requires it.
• Invoicing or payment providers only when a dive centre switches on that integration.

We aim to keep data within the European Economic Area. If any provider transfers data outside it, we rely on an adequacy decision or EU Standard Contractual Clauses.

5. How long we keep it

• Enquiries: up to 24 months after the last contact.
• Customer account and billing records: for the life of the contract, then as long as tax and accounting law requires (generally up to 10 years for invoices).
• Dive centre records: for as long as the dive centre keeps its account, then deleted 30 days after the account is closed, unless you cancel the closure. Administrators can download all of their data at any time. Backups containing deleted data expire within about 7 days. Inactive Free accounts may be archived after 12 months without sign-in, with prior warning by email.
• Security logs: up to 12 months.

6. Your rights

You may ask to access, correct, delete, restrict or port your personal data, and to object to processing based on legitimate interest. Where we rely on consent you can withdraw it at any time. Email info@divecentre.info. We will answer within one month. If you are not satisfied you can complain to the Portuguese data protection authority, the CNPD (www.cnpd.pt), or to your local authority.

7. Children

Dive centres may record data about minors with the consent of a parent or guardian. The dive centre is responsible for that consent. We do not knowingly collect data from children for our own purposes.

8. Security and breaches

We use technical and organisational measures appropriate to the risk. If a breach affects personal data we will notify the affected dive centres and, where required, the CNPD without undue delay.

9. Changes

We will update this page when our practices change and show the date at the top.