Privacy Policy

DiveBubble (“DiveBubble”, “we”, “us”) is operated by:

• Legal name: NP Platforms, a Danish sole proprietorship
• CVR: 44888548
• Address: Martha Christensens Vej 29, 6. tv., 2300 Copenhagen S, Denmark
• Email: support@divebubble.io
• Website: divebubble.io

NP Platforms is the data controller for the personal data described in this Privacy Policy under the EU General Data Protection Regulation (“GDPR”).

This policy applies to the DiveBubble mobile and web app, the DiveBubble Business workspace, and related pages on divebubble.io.

Account data

When you create an account using Google or Apple, we may receive:

• an authentication identifier
• your name
• your email address and its verification status
• your profile photo, where provided by the authentication provider

We also maintain authentication sessions needed to keep you signed in and protect your account.

Profile data

You may add information to your DiveBubble profile, including:

• a profile photo
• a bio
• your city
• languages
• diving certifications and certification numbers
• diving experience and number of dives
• equipment you own or rent

Most profile information is private to you. People who participate in the same Bubble as you, including relevant dive center staff, may see your name, profile photo, certification level, number of dives, bio, languages, and the year you joined DiveBubble. Certification numbers are visible only to you unless you choose to disclose them separately.

Location

With your permission, DiveBubble may use your device's location to determine your city and show relevant trips. Precise location is not stored by DiveBubble for this purpose. You may enter or change your city manually, and DiveBubble does not access your location in the background.

Trips and Bubbles

When you create or participate in a trip, we process information such as:

• trip name, location and description
• dates, times and meeting place
• trip photos
• required certification level and diving experience
• expected depth and number of available places
• trip membership and organiser information
• booking codes for dive center trips
• messages sent within the trip's Bubble

Published trip information may appear in Explore, including to people who are not signed in. Participant information, Bubble messages, transport coordination and restricted trip content are visible only to authorised participants and, for dive center trips, relevant dive center staff. Dive center staff may access messages within Bubbles connected to their dive center for trip coordination and management.

Transport data

If you offer or request transport, we may process:

• number of available or requested places
• vehicle type
• an optional meeting location
• your participation in a transport arrangement

Transport information is visible only to members of the relevant Bubble and applicable dive center staff.

DiveBubble Business data

If you use DiveBubble Business, we may process:

• your name and email address
• your staff membership and role
• the dive center's name, logo, description and location
• agency affiliation and business contact details
• trips and Bubbles managed through the workspace

Information relating solely to a company is not always personal data, but this policy applies where business information identifies a person.

Technical data

We process limited technical information needed to operate and secure DiveBubble, including authentication sessions and application or server error logs. Our infrastructure providers may process IP addresses, request timestamps and related network information when delivering and protecting the service.

We process personal data for the following purposes and legal bases:

Performance of our contract

We process data necessary to:

• create and maintain your account
• provide your profile
• display and manage trips
• allow you to join Bubbles
• deliver chat and transport features
• provide DiveBubble Business

The legal basis is GDPR Article 6(1)(b).

Legitimate interests

We process limited data where necessary to:

• secure and maintain DiveBubble
• diagnose technical problems
• prevent misuse
• enforce our Terms
• respond to complaints and legal claims

The legal basis is GDPR Article 6(1)(f). Our legitimate interests are operating a reliable service and protecting DiveBubble and its users.

Consent

With your permission, we may access your device's location to determine your city. You can withdraw this permission through your device settings and enter your city manually. The legal basis is GDPR Article 6(1)(a).

Legal obligations

We may process or retain information where required by applicable law or a binding request from a competent authority. The legal basis is GDPR Article 6(1)(c).

Depending on how you use DiveBubble, personal data may be visible to:

• members of a Bubble you join
• the organiser of a trip
• relevant staff of a dive center organising the trip
• people viewing trip information published in Explore
• service providers helping us operate DiveBubble

Dive centers are responsible for personal data they collect and use independently outside DiveBubble, including information used for external bookings, payments or customer administration. Their own privacy policies may apply to that processing.

We use a limited number of providers to operate DiveBubble:

• DigitalOcean — EU hosting, database and file storage
• Cloudflare — DNS, network delivery and security
• Vercel — hosting for the DiveBubble Business workspace and divebubble.io website
• Google — Google Sign-In and Firebase Cloud Messaging (push notifications)
• Apple — Sign in with Apple and Apple platform services
• Resend — delivery of sign-in codes and account emails

Centrifugo is self-hosted within our infrastructure and is used to deliver realtime messages. These providers process information only as needed to provide their services and subject to their applicable data protection terms.

We do not sell personal data and do not share it for third-party advertising.

We primarily host DiveBubble data in the European Union.

Some providers, including Google, Apple, Vercel and Cloudflare, may process limited information outside the European Economic Area. Where required, such transfers are protected by an applicable adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism.

You may contact us for more information about the safeguards applicable to your data.

We retain personal data only for as long as reasonably necessary to:

• provide DiveBubble
• maintain trip and conversation history
• protect the service
• resolve disputes
• meet legal obligations

You can delete your account through the app or request deletion by contacting support@divebubble.io.

When an account is deleted, we delete or anonymise associated personal data without undue delay unless continued retention is necessary for legal, security or dispute-resolution purposes.

Some messages may remain in anonymised form where necessary to preserve a conversation for other Bubble participants. Residual copies may remain temporarily in system backups until those backups are overwritten or deleted.

Deleting the DiveBubble app from your device does not by itself delete your account.

Under the GDPR, you may have the right to:

• access your personal data
• correct inaccurate or incomplete data
• request deletion
• restrict certain processing
• object to processing based on legitimate interests
• receive certain data in a portable format
• withdraw consent at any time where processing is based on consent
• lodge a complaint with a supervisory authority

You can edit certain information and delete your account from the app. You may also exercise your rights by emailing support@divebubble.io.

We normally respond within one month. This period may be extended where permitted by law, in which case we will inform you.

You may lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or the place of an alleged infringement.

DiveBubble accounts are available only to people aged 18 or older.

Minors may participate in a trip through and under the responsibility of a parent or legal guardian, where permitted by the trip organiser or dive center. A parent or guardian must use their own DiveBubble account and must not create an account in the minor's name.

We do not knowingly allow minors to create DiveBubble accounts. If you believe that a minor has created an account or provided personal data directly to us, contact support@divebubble.io.

We use reasonable technical and organisational measures designed to protect personal data, including access controls and encryption in transit.

No service can guarantee absolute security. You should contact us if you believe your account or personal data has been compromised.

We may update this Privacy Policy as DiveBubble develops or legal requirements change.

We will update the effective date and notify users of material changes through the app, website or another appropriate method where required. If a change requires consent, we will request it separately.