Last updated: 18 October 2026
This policy explains what personal data I collect through divegency.com and the trips I help you book, why I collect it, and what your rights are.
1. Who is the data controller
The controller of your personal data is Oskar [Surname], [correspondence address], operating under the name DiveGency. For anything related to your data, contact: [email protected].
2. What data I collect and why
- Contact and trip enquiries — when you email or message me, I process your name, email address, phone number (if you provide it) and the content of your message, so I can reply and prepare a trip proposal. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
- Booking a trip — if you decide to go, I process the data the operator needs for the booking (e.g. full name, date of birth, passport number, diving certification, information needed to dive safely). Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and, for health information, your explicit consent (Art. 9(2)(a) GDPR).
- Accounting — I keep invoice and accounting data because tax law requires it (Art. 6(1)(c) GDPR).
- Running and securing the website — the server automatically logs technical data such as your IP address, browser type and time of visit. Legal basis: my legitimate interest in keeping the site working and secure (Art. 6(1)(f) GDPR).
3. Who I share data with
- Trip operators (liveaboard boats, dive centres) with whom I book your place — only what the booking requires. The operator organises the trip and is a separate controller of your data.
- Hosting and email provider — WEBD.pl, whose servers run this website and my mailbox.
- Cloudflare, Inc. — a service that speeds up and protects the website; site traffic passes through it.
- Google — the site’s fonts are loaded from Google Fonts, so Google receives your IP address.
- My accountant — for accounting documents.
Some of these companies (Cloudflare, Google) are based in the USA. Transfers rely on the EU Standard Contractual Clauses or the European Commission’s adequacy decision (EU-US Data Privacy Framework). Trips also take place outside the European Union (e.g. Egypt, Thailand, Indonesia) — I pass the data needed for the booking to the local operator because it is necessary to perform the contract (Art. 49(1)(b) GDPR).
4. How long I keep data
- enquiries that did not lead to a booking — up to 12 months from our last contact,
- booking data — for the duration of the trip and until legal claims become time-barred,
- accounting documents — for the period required by tax law (usually 5 years),
- server logs — for the period set by the hosting provider.
5. Cookies
This website does not use advertising or analytics cookies. It only uses cookies needed for it to work: remembering your chosen language (PL/EN) and, for people logged in to the site’s admin panel, the login session. Cloudflare may set technical security cookies. You can delete or block cookies in your browser settings.
6. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time — this does not affect the lawfulness of processing before withdrawal. To exercise your rights, write to [email protected].
You also have the right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your country of residence.
7. Do I have to provide data
Providing data is voluntary, but without it I cannot answer your enquiry or book a trip. I do not make automated decisions about you or use profiling.
8. Changes to this policy
I may update this policy, for example when I add new features to the website. The current version is always available on this page.