Translation for information only. The original text is in Spanish and, in case of doubt or discrepancy, the Spanish version prevails. See the Spanish version
Who processes your data
- Controller: César Comeche Ramos
- Tax ID (NIF): 07259858T
- Address: Carrer Jaume Vidal i Alcover 2B, 43005 Tarragona
- Contact email: contacto@buceo.app
What data we process
- Account data: first name, surname(s), email address, phone number, password (stored encrypted) and, if your account is a personal one, your date of birth.
- If your account is a personal one: your certifications (agency, certification and level), specialities, diving insurance with its expiry date (or, if you tick it, that you will take out day insurance with the centre) and the documents you upload to prove them.
- If your account is a personal one, also your health declaration (your answers to the official questionnaire, your date of birth and your signature) and, if your answers require it, your medical certificate.
- If you are a centre: the data you publish (name, address, contact details, description, location, certifying agencies, logos and photos) and your dives.
- Place requests, their status and the centres’ document reviews.
- The email notifications we send you (to which address and when).
- Essential technical data: IP address (to limit sign-in attempts and protect the website; the IP is not stored, only an irreversible fingerprint that is deleted within a day) and technical server logs.
- The language you view the website in, stored in a cookie so you don’t have to choose it every time.
Your location: if you press «Use my location» on the dive list, your browser asks for your permission and, if you give it, works out on your own device which area with dives is closest to you. Your position is not sent to buceo.app or stored; only the chosen area appears in the page address. We never ask for it unless you press that button.
The data each form asks for is necessary for that step: without it we can’t create the account or process the place request. The rest is optional.
What for and on what legal basis
- Providing the service you ask for when you sign up (creating your account, publishing dives, requesting a place and managing it): performance of the terms of use you accept.
- Letting the centre whose dives you request a place on check your requirements and documents, decide and contact you: this is part of the service you request when you ask for a place.
- Sending you the service’s email notifications (confirming your account, changing your password, place accepted or declined, changes to or cancellation of a dive, reminder the day before; and to centres, new requests and a summary of pending ones): performance of the terms of use. We don’t send advertising.
- Checking that you are an adult with your date of birth and using it in your health declaration: performance of the terms of use, which only admit people aged 18 or over.
- Storing your health declaration and medical certificate and showing them to the centres where you request a place: your explicit consent (see Health data).
- Protecting the website against abuse (attempt limits): legitimate interest in the security of the service.
- Knowing how the website is used in order to improve it (anonymous statistics): with cookies, only with your consent; without cookies, legitimate interest. See the cookie policy.
The website doesn’t let you request a place unless you have, valid on the day of the dive, diving insurance (or you have ticked that you’ll take out day insurance with the centre) and the health declaration (plus the medical certificate, if your declaration requires it), because they are mandatory. The other requirements (certification, depth, specialities) only give you a warning. The person who accepts or declines each request is always someone from the centre: the website doesn’t make that decision for you.
Health data
Spanish Royal Decree 550/2020 requires dive centres to ask each person, before diving, for a self-declaration about their health using the official questionnaire in its annex I. If any answer points to a health problem, diving is only allowed with a medical check-up that must be renewed every year. So that you don’t have to fill it in at every centre, you can sign it once on buceo.app:
- We store your answers, your date of birth (the official form asks for it), your name and your drawn signature, the date and time you signed and whether your answers require a medical certificate. If they do, we also store the medical certificate you upload and the date of the check-up; until you add it, your declaration remains «medical check-up pending».
- This is health data (a special category of data). We only process it with your explicit consent, which you give when you sign (art. 9.2.a GDPR), and only so that the centres where you request a place can comply with the Royal Decree.
- It can be seen only by the centre whose dives you have requested a place on, which may also download it (for example, the PDF of the declaration) to comply with the Royal Decree. From then on, the centre is responsible for keeping it secure. We don’t use it for anything else, analyse it or share it.
- The declaration is valid for one year from when you sign it, and the medical certificate for one year from the check-up. After that you need to sign a new one or upload another certificate.
- You can withdraw your consent whenever you like by deleting the declaration and certificate from your profile, or by deleting your account. If you have requested a place on a dive that hasn’t happened yet, you must withdraw that request first. Without a valid declaration you won’t be able to request a place through the website, but you can still make arrangements directly with the centre.
- The website only checks whether you have answered «yes» to any question (except the one about age) and, if so, asks you for a medical certificate. It gives no medical opinion. With your answers it generates the official form as a PDF, which you can view and download, as can the centres where you request a place.
Who can see your data
buceo.app is an intermediary between people who dive and centres: the centres organise the dives and deal directly with their customers on payments, cancellations and complaints.
- If your account is a personal one, your name, phone number, email, level, certifications, specialities, insurance (or whether you’ll take it out with the centre), documents, health declaration and medical certificate can be seen only by the centre whose dives you have requested a place on, which can view them on the website and download them. Nobody else (neither other accounts nor other centres) can see them.
- Documents are kept in private storage and can only be opened with temporary 5-minute links.
- When you request a place, the centre receives that data and uses it as a controller to manage your request and the dive (for example, to call you or for the day’s insurance). You can also exercise your rights with the centre.
- What the centre records on the website about your request (whether it accepts it or whether your documents are valid) is stored by us on the centre’s behalf, only to provide it with the service.
- If you are a centre, your profile data and your dives are public: that’s why you publish them.
- Providers that deliver the service on our behalf, under data processing agreements:
- Supabase (database, accounts and files), with servers in Ireland (European Union).
- Vercel (web server), with servers in Dublin (European Union).
- Resend (sending emails), which receives your address and the content of each notification.
- PostHog (usage statistics), with servers in the European Union. It doesn’t receive your name, your email or what you type on the website.
All four are US companies; if they access data from there, they do so with the safeguards of the GDPR (EU-US Data Privacy Framework or the European Commission’s standard contractual clauses). - Maps: each centre’s page shows an OpenStreetMap map. To draw it, your browser requests the images from the servers of the OpenStreetMap Foundation (United Kingdom, a country with a level of protection recognised by the EU), which receive your IP address. They don’t use cookies.
We don’t sell or share your data with third parties or use it for advertising.
How long we keep it
- For as long as your account is open. You can change or delete your documents, health declarations and medical certificates whenever you like. To delete them, if you have requested a place on a dive that hasn’t happened yet, you must withdraw that request first.
- If you don’t use your account for 3 years, we will notify you by email and, if you don’t sign in within the following 30 days, we will delete it along with all its data.
- When you delete your account, your data, documents and requests are deleted. We only keep a record without personal data (that an account was deleted and of what type) and whatever the law requires us to keep.
- The internal history of changes (for example, that a request was accepted), which we use to send notifications, is deleted after 90 days.
- Technical server and email logs are deleted automatically by our providers after a short period.
Cookies
We use the cookies needed to keep you signed in and remember your language and, only if you accept them, PostHog statistics cookies. We don’t use advertising cookies. Full details, and how to change your choice, in the cookie policy.
Your rights
You can access your data, correct it, delete it, take it with you (portability), restrict its processing or object to it. From My account you can download your data and delete your account; you correct your data and documents from your profile. A signed health declaration can’t be changed: if something changes, sign a new one (and delete the old one if you wish). Your date of birth can’t be changed on the website: if it’s wrong, write to us. For any other request, write to contacto@buceo.app. If you believe we haven’t handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Minimum age
buceo.app is for adults only: you must be at least 18 to create a personal account. That’s why we ask for your date of birth when you sign up (we use it to check this and to fill in your health declaration). If you are under 18, you can’t use the website: your legal guardian can arrange the dive directly with the centre.