PRIVACY POLICY

Last Updated: March 18 2026

Atlantis Freediving (“we,” “our,” or “us”) is committed to protecting your privacy and ensuring your personal data is handled in a safe and responsible manner. This policy outlines how we collect, use, and protect your information in compliance with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection (LOPDGDD).

1. DATA CONTROLLER

The entity responsible for your personal data is:

2. DATA WE COLLECT

We collect and process the following categories of data:

  • Identity Data: Name, date of birth, gender, and passport/ID number (required for insurance and SSI certification).

  • Contact Data: Email address, phone number, and residential address.

  • Health Data (Special Category): Medical statements or fitness-to-dive forms. This is processed only with your explicit consent to ensure your safety during diving activities.

  • Transactional Data: Details about payments and the specific courses or packages (e.g., Master program, Combo weeks) you have purchased.

  • Technical Data: IP address, browser type, and usage data collected via cookies when you visit our website.

3. WHY WE COLLECT YOUR DATA (LEGAL BASIS)

Under GDPR, we process your data based on the following:

  • Performance of a Contract: To process your booking, provide diving instruction, and arrange accommodation.

  • Legal Obligation: To comply with Spanish laws regarding tourism, insurance, and tax reporting.

  • Explicit Consent: For processing health data and sending marketing newsletters (which you can opt-out of at any time).

  • Vital Interests: In emergency situations during a dive where we may need to provide your health info to medical professionals.

4. DATA SHARING & TRANSFERS

We do not sell your data. We share information only with:

  • Diving Agencies (e.g., SSI): To register your certifications and provide digital manuals.

  • Insurance Providers: To activate your diving insurance coverage.

  • Public Authorities: When required by Spanish law (e.g., Guardia Civil for guest registration).

  • Service Providers: Secure payment processors and IT hosting services.

  • Note: If data is transferred outside the EEA (e.g., to SSI servers in the USA), we ensure Standard Contractual Clauses are in place to protect your data.

5. DATA RETENTION

We keep your personal data only as long as necessary:

  • Booking Records: 5 years (as per Spanish tax and commercial law).

  • Certification Data: May be held longer to verify your diving qualifications in the future.

  • Health Forms: Retained for the duration of your course plus the statutory period for legal liability.

6. YOUR RIGHTS

Under the GDPR, you have the right to:

  • Access your data and receive a copy.

  • Rectify inaccurate or incomplete information.

  • Erase your data (“Right to be Forgotten”) subject to legal retention requirements.

  • Restrict or Object to processing.

  • Data Portability to move your data to another provider.

  • Withdraw Consent at any time for marketing or health data processing.

To exercise these rights, contact us. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

7. COOKIES

Our website uses cookies to improve your experience. You can manage your preferences through your browser settings.

8. SECURITY

We implement technical and organizational security measures, including SSL encryption and secure storage, to prevent unauthorized access or disclosure of your information.

Implementation Steps for You:

  1. Fill in the Blanks: Ensure you add your specific contact email and any missing business details.

  2. Health Data Consent: Ensure that when users submit medical forms, there is a checkbox stating: “I consent to Atlantis Freediving processing my health data for safety and training purposes.”

  3. Placement: Link this policy in your website footer and on your booking/checkout page.

  4. Cookie Banner: Ensure your website has a compliant cookie banner that asks for consent before loading non-essential cookies (like Google Analytics).