Privacy Policy

1. Who we are

DiveHQ is booking and operations software for liveaboards, dive resorts and dive centers, delivered as a service at divehq.cloud, on operator subdomains such as yourname.divehq.cloud, and on the agency portal. It is a service of DiveHQ Pte. Ltd., Singapore. The company's incorporation is in progress; until it is completed, the party responsible for DiveHQ is the DiveHQ team, contactable at privacy@divehq.cloud. Day-to-day operations are run from Labuan Bajo, Indonesia.

In this policy, "DiveHQ", "we" and "us" mean DiveHQ Pte. Ltd. (or, until its incorporation is completed, the DiveHQ team). An operator is a dive business that subscribes to DiveHQ; a guest is a person who books or travels with an operator; an agency is a travel agency, dive shop or group leader that uses the agency portal.

This policy is written to meet the information duties of the EU and UK General Data Protection Regulation (GDPR), Singapore's Personal Data Protection Act 2012 (PDPA) and Indonesia's Personal Data Protection Law No. 27 of 2022 (UU PDP), as far as each applies to a given person. Where a law gives you more rights than this page describes, the law prevails.

2. Our two roles

Who decides what happens to your data depends on who you are. This distinction runs through the whole policy.

• The operator decides about its guests. When you book, fill in a form, sign a waiver or pay on an operator's DiveHQ-hosted site, the operator is the controller of your data (under the PDPA, the "organisation"; under UU PDP, the Pengendali Data Pribadi). DiveHQ is the operator's processor (under the PDPA, a "data intermediary"; under UU PDP, a Prosesor Data Pribadi): we store and process your data only to provide the software to that operator, on its instructions, under the data processing terms in Annex A of our Terms of Service. The operator's own privacy notice and booking conditions apply to you; questions about them go to the operator first.
• DiveHQ decides about its own customers and visitors. DiveHQ is the controller for the data of operator account users, agency users, people who apply for an operator or agency account, people who contact us or book a demo, and visitors of divehq.cloud.

3. Data we hold for ourselves

Operator account users

• Name, business e-mail address, role in the account, and a password stored only as a one-way hash.
• The company details and billing contact used to set up and invoice the subscription, and the invoices we issue.
• An activity record of actions taken in the admin (who changed what, and when), kept so the operator and we can trace changes and correct mistakes.
• Correspondence with us by e-mail or WhatsApp, and notes from onboarding and support.

Agency users

• Agency name, business e-mail, phone, website, country, city, address, contact person and their e-mail and phone, tax identifier if given, and free-text notes.
• The partnerships, bookings and commissions recorded in the portal for that agency.

People who apply for an account or book a demo

• On the operator sign-up form: company name, type of business, contact name, e-mail, phone, country, website, boat names, message, and the password you choose (stored as a hash).
• To filter automated spam, a submission that looks automated is logged with its IP address and browser identifier.
• Demo calls are booked on Calendly, which processes your booking under its own privacy policy; we receive the details you enter there.

Visitors of divehq.cloud

• Like any web server, ours records technical data about each request (IP address, date and time, page requested, browser identifier) for security and troubleshooting.
• divehq.cloud itself sets no analytics or advertising cookies (section 7). Its pages load fonts from Google Fonts and scripts from cdn.tailwindcss.com and cdn.jsdelivr.net; as with any web request, those providers receive your IP address and browser identifier when your browser fetches them.

4. Guest data we process for operators

Each operator chooses which forms and modules it uses, so not every operator collects everything below. Depending on that choice, an operator's account may hold:

• Identity and contact: name, e-mail, phone and WhatsApp number, address, nationality, date of birth, gender.
• Travel documents: passport or ID number and expiry date, and scans of the document.
• Diving: certification agency, level and number, scans of certification cards, number of logged dives, nitrox certification, equipment sizes.
• Insurance and emergency: insurance provider and policy number, emergency contact name, relationship and phone.
• Logistics: flights, hotel, dietary needs and allergies.
• Health: answers to the medical questionnaire, and any physician's clearance (section 5).
• Signed waivers: Medical Statement, Liability Release, Statement of Understanding, Photo Release and Equipment Rental, as configured by the operator, with the signature, the date and time of signing, and the IP address and browser identifier of the device used to sign.
• Photos uploaded by the guest or the operator, and the guest's photo-release choice.
• Payments and invoices: amounts, dates, method, status and the reference returned by the payment provider. Card numbers are entered on the payment provider's own page and never reach DiveHQ's servers.
• Communications: e-mails and WhatsApp messages sent and received through the account.
• Team notes written by the operator's staff, and a satisfaction flag the staff can set on a customer record.
• Booking source: the referring page, campaign (UTM) parameters, whether the booking came through the operator's booking widget, an agency or an affiliate link, and, when the operator uses Google Analytics and the browser carries one, the Google Analytics client identifier (section 8).

Guests usually reach their forms, waivers and payment pages through a personal link sent by the operator, without creating an account. Anyone holding that link can open those pages, so keep it private.

We do not use guest data for our own purposes. We do not sell it, rent it, use it for advertising, or pass it from one operator to another. The only use we make beyond running the service is described in section 6 (aggregated or anonymised statistics), and it never includes health data. The "Data for AI" export available in an operator's reports is a pseudonymised file that the operator downloads for its own use: it contains no names or contact details, but it does contain booking and trip identifiers, dates and nationalities, so it remains personal data in the operator's hands. DiveHQ does not send it anywhere.

5. Health data and identity documents

Medical questionnaire answers are health data: a special category of data under the GDPR and specific personal data (data pribadi yang bersifat spesifik) under UU PDP. Passport scans and identity numbers also carry a high risk if exposed. For these:

• They are collected only if the operator enables the corresponding form, for the operator to assess fitness to dive, comply with park, port or immigration rules, and act in an emergency.
• The operator is responsible for having the legal basis to collect them, which for health data is normally the guest's explicit consent, and for explaining to guests why they are asked.
• They are stored only in that operator's own database and file storage. Guest documents (passports, certification cards, park-fee receipts) are kept on private storage: there is no public link to them, and they are served only to logged-in staff of that operator whose role gives access. Signed waivers are private too; besides that staff, a guest can download their own signed waivers through their personal trip link.
• They are never included in our statistics, in partner feeds or in the marketplace, and are never sent to analytics tools.

6. Purposes and legal bases

For data where DiveHQ is the controller:

Under the PDPA we collect, use and disclose personal data only for the purposes notified in this policy, with your consent or where the Act allows it without consent (for example, to perform a contract with you). Under UU PDP our bases are the performance of a contract, compliance with a legal obligation, our legitimate interests and, where we ask for it, your consent. Where we rely on legitimate interests, you can object (section 14).

For guest data, the purposes and legal bases are set by the operator, who is the controller. DiveHQ processes guest data only to provide the software: storing bookings, generating invoices, manifests and documents, sending the e-mails and messages the operator configures, taking payments through the operator's own payment provider, backing up and restoring data, and giving support.

7. Cookies

A cookie is a small file a website stores in your browser. These are the cookies DiveHQ's own code sets, on divehq.cloud and on operator sites:

When an operator turns on Google Analytics or a Google Ads tag on its site, Google's own cookies are set as well (for example _ga and _ga_<id>, which Google normally keeps for up to 2 years). See section 8.

DiveHQ itself sets no advertising cookie. divehq.cloud sets only the essential cookies above, which is why it shows no cookie banner. DiveHQ does not currently provide a cookie-consent banner on operator sites: an operator that enables Google tags or the affiliate module is responsible for obtaining any consent its visitors' law requires. You can delete or block cookies in your browser settings at any time; blocking essential cookies prevents logging in and completing a booking.

8. Google Analytics and ad tags

• Google Analytics 4, Google Ads and Google Tag Manager tags run on an operator's site only if that operator enters its own Google identifiers in its settings. The data then goes to the operator's own Google account, under the operator's agreement with Google.
• No Google Analytics tag runs on the personal-link pages (forms, waivers, trip portal, payment links), and the page addresses sent to Google are stripped of any access token.
• Only when the operator has entered its Google Analytics Measurement Protocol credentials, and the guest's browser carried a Google Analytics client identifier at booking time, DiveHQ's server reports the online payments that the payment gateway confirms automatically (today, Xendit payments; other gateways once their automatic confirmation is connected) to the operator's Google Analytics property: one "purchase" event on the first confirmed payment (booking reference, amount, currency, trip, number of divers), then a "payment_received" event for each later payment (booking reference, payment number and type, amount, currency). No name, e-mail address or phone number is sent.
• An operator can also connect a read-only Google Analytics access so that page-view counts for its trips appear in its DiveHQ reports. The access key is stored encrypted and is never displayed.
• divehq.cloud itself runs no Google Analytics, Google Ads or other tracking tag.

9. Who receives data

Providers DiveHQ uses (our sub-processors)

• Hostinger International Ltd: hosts the servers on which every DiveHQ database, file and platform backup is stored, and relays the e-mails DiveHQ sends from its own platform address.

This provider receives only what its task needs and is bound to confidentiality and security by its terms of service. We may later add an encrypted off-site copy of the platform backup with another provider; if we do, we will announce it to operators in advance, as for any new sub-processor (Terms, Annex A, A8), and update this list.

Providers the operator chooses

An operator can connect its own accounts with the following services. They act for the operator, under the operator's contract with them, and receive only what is needed for the function the operator turns on:

• Payments: Stripe, Xendit or PayPal, always on the operator's own merchant account. DiveHQ never receives, holds or transfers guests' money.
• WhatsApp messaging: Wati, Twilio or Meta's WhatsApp Cloud API.
• E-mail sending: the operator's own SMTP server, Brevo, Gmail or Microsoft 365. For Microsoft 365, DiveHQ asks only for permission to send mail and read the sender's basic profile; it cannot read the mailbox.
• Analytics: Google Analytics, Google Ads and Google Tag Manager (section 8).
• Backups: an operator can schedule its own copies of its data to its own Google Drive or Dropbox account. Those copies are the operator's, under its own contract with Google or Dropbox.

Other recipients

• Operators and agencies: when an agency books a departure for its clients, the booking and the travellers' details it enters are shared with that operator; the agency sees only its own bookings.
• Authorities: when we are legally required to, and only what is required. Where the law allows, we tell the operator concerned first.
• A successor business: if DiveHQ's business is transferred, the data goes with it under this policy, and we tell account holders beforehand.

What is published, and what never is

The DiveHQ marketplace listing, partner feeds (for example ScubaDates, LiveaboardHub and Google Merchant Center) and the read-only Partner Availability API publish only trips, boats, dates, prices and availability. They never contain guest data.

We do not sell personal data, and we do not share it for advertising.

10. International transfers

DiveHQ's servers are operated by Hostinger International Ltd and are located in India. Data entered by operators, agencies and guests in Europe, Singapore, Indonesia or elsewhere is therefore transferred to and stored in India, where the platform backups are kept as well.

Where the law of the country of origin restricts such transfers (for example the GDPR, section 26 of the PDPA or article 56 of UU PDP), we rely on the contractual commitments in our providers' terms and on the measures in section 11 to give the data a standard of protection comparable to that law. You can ask us for details of these safeguards at privacy@divehq.cloud.

11. How we protect data

• Separation: each operator has its own database and its own file storage, on its own subdomain. One operator's staff cannot see another operator's data.
• Private documents: guest documents are stored outside the public web folder and served only to logged-in staff of the operator, according to their role; a guest's own signed waivers can also be downloaded by that guest through their personal trip link.
• Passwords are stored only as one-way hashes. Traffic to DiveHQ is served over HTTPS.
• No card data: card numbers are entered on the payment provider's page and never reach our servers.
• Least access: within an operator's account, the operator decides which staff role sees which module. Access to the production servers is limited to DiveHQ's technical team.
• Backups: every night all databases and all files, including private documents and signed waivers, are backed up in full on the server and kept 3 days. These backups are not encrypted at rest; they are protected by the same server access restrictions as the live data. This is a safety net for restoring the service, not a history: any history beyond 3 days is kept by each operator in its own exports and scheduled backups.
• Support access is restricted and recorded (section 12).

Two-factor login is available to DiveHQ's own administrators. It is not yet available for operator and agency users, so choose a strong, unique password and remove staff accounts when people leave. No system is perfectly secure; if something goes wrong, we follow section 17.

12. Support access to an operator account

Sometimes the fastest way to help an operator is to look at its account as one of its users. This is tightly limited:

• Only a DiveHQ super-administrator can open a support session, and must give a written reason.
• The session starts from a single-use link valid for 60 seconds, tied to the administrator's IP address and browser.
• The session lasts 60 minutes at most, shows a permanent banner in the operator's back office for its whole duration, and can be ended at any time.
• Every session is recorded: who opened it, on which account, as which user, why, and when it started and ended.

13. How long we keep data

The export window, deletions and the clearing of applications above are carried out by DiveHQ staff following a documented procedure, not by an automatic job; the deadlines are commitments we keep by hand. Data deleted from the live system is not extracted from existing backups: it disappears from them when each backup expires, after 3 days, and backups are used only to restore the service.

14. Your rights

Depending on the law that applies to you, you can ask to access your data and receive a copy, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw a consent you gave, without affecting what was done before. UU PDP also lets you delay or restrict processing and claim compensation for a breach of the law.

• If you are a guest of an operator, the operator controls your data: contact it directly. You can also write to privacy@divehq.cloud; we forward your request to the operator without delay and carry out its instructions. We act on guest data without the operator's instruction only where the law requires it or where it is needed to protect someone's vital interests, and we then tell the operator.
• If you are an operator user, an agency user, an applicant or a visitor, write to privacy@divehq.cloud.
• Acknowledgement: we confirm receipt of your request, normally within 2 working days.
• Response: we answer within the time the applicable law requires, and in any case within 30 days — for data we control, with the outcome; for guest data, with the operator's answer or what we have done on its instructions. We may ask you to confirm your identity first, and requests are free unless they are manifestly unfounded or excessive.
• Completion: for data we control, the request is carried out within that response time. For guest data, when and how far it is carried out depends on the operator's instructions and on what the operator or we must keep by law (for example invoices). Where the law allows the period to be extended, for example for complex or numerous requests, we tell you within the first 30 days, with the reasons.
• How to ask for deletion, step by step, is on the data deletion page.

15. Children and minors

DiveHQ is a business tool and is not directed at children. Operators may record minors who dive with them (for example junior divers on a family trip). In that case the operator is responsible for collecting the data and the waivers through a parent or legal guardian; DiveHQ's waiver forms include a guardian section for this. If you believe a minor's data was entered without a guardian's agreement, contact the operator or privacy@divehq.cloud.

16. Automated decisions

DiveHQ makes no decision with legal or similarly significant effect based solely on automated processing, and builds no profiles of individuals. The medical questionnaire can show that, given the answers, a physician's clearance is required before diving; that is the questionnaire's own rule, and whether a guest dives is decided by the operator's staff and the physician, not by the software.

17. Data breaches

• If we become aware of a breach affecting an operator's data, we notify that operator without undue delay and, where feasible, within 72 hours, with what we know (what happened, which data and people are affected, what we are doing about it), and keep it informed. The operator, as controller, decides whether to notify its authority and its guests; we help it do so.
• For data where we are the controller, we notify the competent authority and the people affected where the law requires, within the deadlines it sets.

18. Changes to this policy

We update this policy when the software or the law changes. The date at the top of this page is the current version. For a change that materially affects how we use operator or agency data, we e-mail account owners before it takes effect.

19. Contact and complaints

DiveHQ Pte. Ltd., Singapore (incorporation in progress)
Operations: Labuan Bajo, Indonesia
Privacy and data protection officer: privacy@divehq.cloud
Legal: legal@divehq.cloud
Sales and support: hello@divehq.cloud

If you are not satisfied with our answer, you can complain to a data protection authority: in Singapore, the Personal Data Protection Commission; in the European Union or the United Kingdom, the authority of the country where you live or work; in Indonesia, the authority in charge of personal data protection under Law No. 27 of 2022. We would appreciate the chance to resolve your concern first.