DEKKO privacy policy
Informative translation. In case of discrepancy, the Spanish version prevails.
DEKKO is a platform for dive centres and for the divers who book with them. This policy explains what data we process, why, for how long and what rights you have. It is written to be understood: if anything is unclear, write to us at hola@dekko.club.
1. Who is the controller
ENES Estrategia Conjunta, S.L. (sociedad unipersonal) (trading as DEKKO)
Tax ID (NIF): B22468284
Address: Partida Valls, s/n, 43350 Les Borges del Camp (Tarragona), Spain
Email: hola@dekko.club
We have not appointed a Data Protection Officer because, given the volume and type of data we process, it is not mandatory. Any privacy question is handled at hola@dekko.club.
2. Two different roles: the centre and DEKKO
When you sign up as a diver on the website or app of a centre that uses DEKKO, your data is processed by two controllers, each for its own purposes:
| What data | Who decides about it | What for |
|---|---|---|
| Bookings, payments and dive history with that centre | The centre (DEKKO does it on its behalf, as processor) | Managing your bookings, payments and activity with the centre |
| Your DEKKO profile: identification, contact details, certifications, insurance and documents | DEKKO, as controller | Giving you your own diver profile that you can use at any centre in the DEKKO network |
For what the centre does with your bookings, please also read that centre's privacy policy. This policy covers everything DEKKO processes as controller.
3. What data we process
About the diver (DEKKO profile):
- Identification and contact: first name, surname, email, phone, date of birth, country and language.
- Diving certifications: agency, level, number and date, and the image of the card if you upload it.
- Diving insurance: company, policy and expiry date.
- Documents you upload (for example, certifications or certificates).
- Health data (medical statement), only if the centre asks for it and you give your explicit consent.
- Your communication preferences and the record of your consents.
- Technical data on your use of the app and the website (device, logins, errors).
About the dive centre (DEKKO customer): contact details of its managers, billing and payment details, and use of the platform.
About visitors to dekko.club: data you send us when asking for information or a demo, and browsing data according to your cookie preferences.
4. What we use the data for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your DEKKO profile and letting you use it at any centre in the network | Performance of the Terms of use you accept when signing up (art. 6.1.b GDPR) |
| Sharing your profile and documents with the centre you book with, so that it can validate them | Performance of the Terms of use (art. 6.1.b) |
| Reminding you when your insurance or documents are about to expire | Performance of the Terms of use (art. 6.1.b) |
| Improving the platform and its security | Legitimate interest (art. 6.1.f), using the minimum data needed |
| Producing aggregated, anonymised statistics about the sector | Legitimate interest (art. 6.1.f); the results never allow anyone to be identified |
| Sending you communications and offers from DEKKO and from the centres in the network | Your consent (art. 6.1.a), optional box |
| Sending you offers from third parties selected by DEKKO (equipment, trips, insurance) | Your consent (art. 6.1.a), optional box |
| Processing your health data to assess your fitness to dive | Your explicit consent (art. 9.2.a), optional box |
| Managing the contract with centres, their billing and their support | Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c) |
| Handling requests for information and demos | Pre-contractual measures (art. 6.1.b) |
| Web analytics | Your consent in the cookie banner (art. 6.1.a) |
Optional boxes always appear unticked. Not accepting them does not stop you from signing up or booking.
5. Third-party offers: we do not sell or share your data
If you agree to receive third-party offers, they reach you through DEKKO. The third party does not receive your data.
Only if, for a specific offer, you yourself ask that third party to contact you (for example, by tapping “I want to be contacted”), DEKKO passes your contact details to that third party and for that offer. Each disclosure is recorded and you can withdraw it at any time.
6. Diver insurance
If the centre has enabled it, you can take out the insurance the centre works with from your profile. DEKKO only tells the insurer which centre you come from. The contract is between you and the insurer, under its own privacy policy.
7. Your profile is yours
Your DEKKO profile does not depend on any particular centre. If a centre stops using DEKKO, your profile stays active and you can keep using it across the rest of the network. That centre keeps only the history of what you did with it.
8. How long we keep the data
| Data | Period |
|---|---|
| DEKKO profile | As long as you have the account. If you do not use it for 36 months, we will notify you and, if you do not reply, we will delete it |
| Health data | As long as you maintain your consent; it is deleted when you withdraw it |
| Record of consents | As long as the account exists and 3 years afterwards, as evidence |
| Data from the contract with centres | For the term of the contract and 6 years afterwards |
| Billing | 6 years |
| Requests that did not lead to a contract | 12 months from the last contact |
| Web analytics | Up to 14 months, or as stated in the cookie banner |
When we delete your data, we may keep it blocked for the time required by law, solely to deal with legal liabilities.
9. Who works with us (providers)
To provide the service we use providers that process data on our instructions, under a data processing agreement:
| Provider | What for |
|---|---|
| Supabase | Database and hosting |
| Cloudflare | Network, security and web hosting |
| Stripe | Payments (also acts as an independent controller) |
| Anthropic and OpenAI | Artificial intelligence features (assistant, sales suggestions) |
| Meta Platforms (WhatsApp) | Assistant messaging |
| Brevo | Email sending |
| Manychat and Make | Message automation |
| Search positioning, maps and analytics services | |
| Microsoft Clarity | Website usage analytics, with your consent |
| GitHub | Code hosting |
| External advisers | Accounting and tax obligations |
Some of them are outside the European Economic Area. In those cases, transfers are made with the safeguards of the GDPR: an adequacy decision (including the EU-US Data Privacy Framework where the provider has signed up to it) or Standard Contractual Clauses (Decision (EU) 2021/914).
We also disclose data to public authorities when the law requires it.
10. Minors
Children under 14 can only be registered by their father, mother or legal guardian, who gives consent on their behalf. If we detect a registration of a child under 14 without that consent, we delete it.
11. Your rights
You can ask at any time for:
- Access: to know what data we hold about you.
- Rectification: to correct inaccurate data.
- Erasure: to delete your data.
- Objection: to stop us using it for a purpose based on legitimate interest.
- Restriction: to have us keep it without using it while a complaint is being resolved.
- Portability: to receive your profile in a standard format.
- Withdrawal of your consents, from your profile or by email, without affecting anything done before.
- Not to be subject to automated decisions with legal effects without human involvement. DEKKO does not make decisions of that kind.
Write to us at hola@dekko.club stating your name and the right you are exercising. If we cannot verify your identity with your account details, we will ask you for a document proving it. We reply within one month (two in complex cases, letting you know).
If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.aepd.es · C/ Jorge Juan, 6, 28001 Madrid).
12. Security
Encryption in transit (TLS 1.2 or higher) and at rest, role-based access, access logs and backups. If a security breach affects your data, we notify the authority within 72 hours and, where appropriate, you.
13. Changes
If we change this policy, we will publish the new version with its date. If the change affects what you accepted when signing up, we will ask you to accept it again.