We respect your privacy. This policy explains what personal data we collect when you use geodiving.lv or our services, how we use it, and what rights you have.
1. Who we are
The website geodiving.lv is operated by SIA “GSMD”, registration No. 40203514419, registered address Ikšķiles iela 2 – 2C, Ogre, Ogres nov., LV-5001, Latvia (“we”, “us”). We are the data controller for the processing described in this policy.
For data protection questions, contact georgijs@geodiving.lv, +371 23 111 390.
2. What personal data we collect
Contact form
When you submit the contact form on our Contacts page, we receive your name, email address and the content of your message. We receive these details as an email; they are not published or stored in a public database on the website.
Direct enquiries
If you contact us by phone, email or through our Facebook, Instagram or TikTok profiles, we process your contact details and the information you choose to share with us.
Course and dive bookings
To arrange and run a course or a dive, we may need your full name, contact details, date of birth, diving experience and existing certifications, and a confirmation that you are medically fit to dive. Where the law or a training standard requires it, we may also record identification data in order to issue a certificate.
Course purchases
Courses payments are processed by the payment service provider Stripe. During a purchase your name, contact details, billing information and order details are processed. We never receive or store your full card number, expiry date or CVC code – that data is handled by Stripe only.
Underwater works and ROV services
For commercial enquiries we process the contact details of your representatives and the information contained in the project documentation you send us.
Technical data
Our web server keeps standard access logs, which may include your IP address, browser type, the page requested and the time of the request. This data is used only to keep the website running and secure.
3. Why we use your data and on what legal basis
- To reply to your enquiry and provide the information you asked for – your consent when you submit the contact form, and our legitimate interest in responding to enquiries (Art. 6(1)(a) and (f) GDPR).
- To prepare and perform a contract for a course, dive, underwater work or underwater survey – performance of a contract (Art. 6(1)(b) GDPR).
- To assess fitness and ensure diving safety – performance of a contract and compliance with our legal obligations (Art. 6(1)(b) and (c) GDPR). Health-related data is processed only with your explicit consent or on another basis permitted by Art. 9 GDPR.
- To issue invoices and keep accounting records – compliance with a legal obligation (Art. 6(1)(c) GDPR).
- To keep the website secure and functioning – our legitimate interest (Art. 6(1)(f) GDPR).
We do not sell personal data, and we do not use it for automated decision-making or profiling.
4. Cookies and third-party content
This website does not use advertising or analytics cookies and does not build visitor profiles. Cookies may still be set, or your IP address disclosed, in the following cases:
- The Polylang language plugin stores your language choice in a cookie (
pll_language) so that pages open in the language you selected. - WordPress sets session cookies only for users who log in to the site administration area.
- Fonts (Google Fonts) and the smooth-scrolling library (jsDelivr) are loaded from external content delivery networks. When those files are requested, those providers receive your IP address and browser information.
You can block or delete cookies in your browser settings, but some parts of the website may then not work as intended.
5. Who we share data with
- Our web hosting and email providers, which store the website and our correspondence on our behalf.
- Payment provider Stripe, in relation to purchases made by choosing courses. Stripe acts as an independent payment service provider and processes data under its own privacy policy (stripe.com/privacy).
- Diving certification agencies, where a certificate has to be issued in your name.
- Accounting, audit, insurance and legal service providers, where necessary.
- Public authorities, where disclosure is required by law.
6. Transfers outside the European Economic Area
Some of our service providers, including Stripe, may process data outside the European Economic Area. Where that happens, the transfer is protected by the European Commission’s Standard Contractual Clauses or another safeguard permitted under Chapter V of the GDPR.
7. How long we keep your data
- Enquiries and contact form messages – [TODO: e.g. 1 year] from the last communication, unless they lead to a contract.
- Contract, course and certification records – [TODO: e.g. 5 years] after the service is completed, or longer where a training standard requires it.
- Accounting documents – for the period required by law (normally 5 years, in some cases 10 years).
- Server access logs – [TODO: e.g. 3 months].
Once the retention period ends, data is deleted or irreversibly anonymised.
8. Your rights
In relation to your personal data you have the right to:
- access the data we process about you;
- have inaccurate or incomplete data corrected;
- request erasure where there is no longer a lawful basis for processing;
- request restriction of processing;
- object to processing based on our legitimate interests;
- receive your data in a structured, machine-readable format (data portability);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise these rights, write to georgijs@geodiving.lv. We will reply within one month. If you are not satisfied with our response, you may lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija, Elijas iela 17, Riga, LV-1050, pasts@dvi.gov.lv, www.dvi.gov.lv).
9. Data security
We take reasonable technical and organisational measures to protect data against unauthorised access, loss or disclosure. Access is limited to staff and partners who need the data to do their work. The website is served over an encrypted connection.
10. Children
Our services are aimed at adults. Minors may take part in diving activities only with the consent of a parent or legal guardian, and we receive their data through that parent or guardian.
11. Changes to this policy
We may update this policy from time to time, for example if our services or legal requirements change. The current version is always available on this page, together with the date it was last updated.
12. Contact us
If you have questions about this policy or about how we handle your data, please contact us:
SIA “GSMD”
Ikšķiles iela 2 – 2C, Ogre, Ogres nov., LV-5001, Latvia
Email: georgijs@geodiving.lv, liene@geodiving.lv, madara@geodiving.lv
Phone: +371 23 111 390, +371 22 727 377, +371 26 004 599