Data controller
For Center data and its internal users, the controller is Munaeko Development Software Solutions, S.L. (Okeanun brand). For diver/client data managed by the Center, the controller is the Center and Okeanun acts as processor. Privacy contact: [email protected].
- Legal name
- MUNAEKO DEVELOPMENT SOFTWARE SOLUTIONS, S.L.
- Brand
- Okeanun
- Tax ID
- B88989868
- Registered office
- Gran Vía Manuel López Carreño, 1, 2.º, 30180 Bullas, Murcia, España
- D-U-N-S Number
- 374074558
- Privacy contact
- [email protected]
- Country
- Spain
1. Controller identity and contact channel
Within the Okeanun Manager service (the «Service» or «Manager»), the privacy role depends on the specific processing and on who determines its purposes and means. In general, for the Center’s personal data (including the Center’s internal users, staff, administration and billing contacts, and Service usage), Munaeko Development Software Solutions, S.L. (tax ID B88989868, registered at Calle Gran Vía 1, 2º, 30180 Bullas (Murcia), Spain) acts as controller. For the personal data of the Center’s divers/clients that the Center manages in Manager, the Center acts as controller and Okeanun acts as processor on the Center’s behalf, under the applicable Data Processing Agreement (DPA) (Art. 28 GDPR), accepted by the Center on subscription. The contact channel for Service privacy matters is [email protected], without prejudice to the Center’s internal channels for exercising rights over processing for which the Center is the controller.
2. Purpose and scope of this Policy
This Policy fulfils the duty to inform in digital services when personal data is collected, providing in a concise, accessible, intelligible and plain-language way a complete explanation of what data is processed, for what purposes, on what legal bases, for how long, to which recipients or processors it may be disclosed, whether there are international transfers, and what rights data subjects have, including the right to complain to the AEPD. For Manager, this Policy covers (i) Okeanun’s own processing as controller (Center data and its internal users) and (ii) processing carried out by Okeanun as the Center’s processor over diver/client data entered or managed by the Center in the Service.
3. Key definitions for interpreting this Policy
For this Policy, personal data means any information about an identified or identifiable natural person, and processing means any operation or set of operations on personal data, automated or not, including collection, recording, organisation, storage, consultation, use, disclosure or erasure. Controller means the party determining the purposes and means of processing; processor means the party processing data on the controller’s behalf; and recipient means the person or body to whom data is disclosed, whether or not a third party. These definitions matter to distinguish when Okeanun processes data on the Center’s behalf (as processor) and when it processes data on its own behalf (as controller).
4. Processing principles and accountability
Okeanun applies the principles of lawfulness, fairness and transparency, purpose limitation, minimisation, accuracy, storage limitation, and integrity and confidentiality, so that processed data is limited to what is necessary, kept only as long as needed and protected with appropriate technical and organizational measures, and compliance can be demonstrated through internal documentation, data-protection policies and, where applicable, records of processing activities. Privacy by design and by default means implementing, both when determining the means and during processing, technical and organizational safeguards ensuring that, by default, only necessary data is processed and data is not made accessible to an indefinite number of people without human intervention.
5. Data subjects and data processed in Manager
Manager may process personal data of different data-subject categories: (i) the Center’s staff and internal users (administrators, instructors, operations staff, etc.); (ii) the Center’s business contacts (billing, management, administration contacts); (iii) the Center’s divers/clients (registered or not, including «guest divers»); and (iv) where applicable, other booking-related contacts. Depending on the Center’s configuration and operations, data may include identification and contact details, booking and activity data, certifications, insurance and, possibly, health data (a special category), as well as payment-related information as needed to manage transactions, without prejudice to the payment provider handling card data under its own regime. Processing of special categories requires a reinforced approach to safeguards and security.
6. Purposes and legal bases when Okeanun acts as controller
When Okeanun processes Center data as controller, typical purposes include: (i) managing Center onboarding, account administration and internal-user access; (ii) managing subscription, billing and collection, including payment issues and operational communications; (iii) providing technical support and customer service, resolving incidents and maintaining Service continuity; (iv) ensuring Service security, preventing fraud or unauthorized access and keeping reasonable technical logs; and (v) meeting applicable legal obligations. These purposes rest, as the case may be, on the necessity to perform the contractual relationship with the Center and/or on the legitimate interest tied to Service security and operation, without prejudice to legal obligations where applicable. The duty of transparency requires these purposes and bases to be communicated clearly and understandably.
7. Processing when Okeanun acts as the Center’s processor
For the personal data of divers/clients the Center manages in Manager, Okeanun acts as processor and processes data only following the Center’s documented instructions, consistently with use of the Service and the applicable processing agreement. Here Okeanun does not determine its own purposes for that data (which belong to the Center), and undertakes to keep confidentiality, adopt appropriate security measures, assist the Center in handling data-subject rights where possible and, at the end of provision, delete or return the data at the Center’s choice, save where legal retention applies. If Okeanun were to determine its own purposes and means over that data in breach of this framework, it could be configured as controller for that processing.
8. Processors, sub-processors and recipients
To provide the Service, Okeanun may use providers that process data on its behalf (processors or sub-processors depending on the role), choosing only providers offering sufficient guarantees to apply appropriate technical and organizational measures and formalising a written legal instrument setting out the subject, duration, nature, purpose, data types and data-subject categories, and equivalent obligations. In case of sub-processing, the processor may not engage another processor without prior authorization and must inform of intended additions or replacements, with the controller able to object on justified grounds under the applicable contractual scheme.
9. International transfers
Where providers located outside the European Economic Area or processing data from third countries take part in the Service, Okeanun will arrange such transfers per applicable-law requirements, using appropriate safeguards where relevant and keeping sufficient information about those safeguards and how to obtain a copy of or access them. The existence of international transfers and reference to the applicable safeguards is part of the minimum information required in digital-service privacy policies.
10. Retention periods and erasure criteria
Personal data is kept for as long as necessary for the purposes it is processed for and, where a specific period cannot be given, per objective criteria consistent with the contractual relationship and any liabilities that may arise. In processing where Okeanun acts as processor, at the end of provision the data must be deleted or returned at the Center’s choice, along with deletion of copies, unless EU or Spanish law requires retention, to be arranged contractually. Storage limitation is an essential processing principle and must integrate with erasure, retention and, where applicable, blocking procedures.
11. Data-subject rights and how to exercise them
Data subjects have the right to request access, rectification, erasure and restriction of processing and to lodge a complaint with the supervisory authority, and this information must be provided clearly, accessibly and by appropriate means, including electronic. In Manager, the channel for privacy matters on processing where Okeanun acts as controller is [email protected]. For processing where the Center is controller (diver/client data managed by the Center), rights should preferably be exercised with the Center; nevertheless, when Okeanun receives a request tied to processing on the Center’s behalf, it may route it or assist technically per the processing agreement and the nature of the processing. The controller must inform in writing of the action taken and provide the information free of charge, with limits for manifestly unfounded or excessive requests, and may request additional information to confirm identity where there are reasonable doubts.
12. Layered information in Service forms
At data-collection points within the Service (sign-up, internal-user invitations, operational forms, configuration screens), a layered-information model may be used, offering a brief first layer with the controller’s identity, purpose and a reference to exercising rights, and referring to this Policy for full detail. This model is consistent with transparency criteria in digital environments and meets the duty to inform understandably, without overloading forms or sign-up flows.
13. Security of processing and traceability
Okeanun applies appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including access controls and measures to prevent unauthorized access, ensure integrity and enable recovery after interruptions. Where necessary given the type of data and risks, controls oriented to traceability and control of input and access will be implemented, especially relevant with sensitive documentation. Security must be consistent with the state of the art, cost of implementation, and the nature, scope, context and purposes, and must be reviewed and updated where necessary.
14. Security breaches and notification
On a personal-data breach, the controller must document the facts, effects and corrective measures. Where Okeanun acts as processor, it will notify the controller (the Center) without undue delay of breaches it becomes aware of. The response scheme and notification timelines are part of the required security governance, especially in digital services.
15. Automated decisions and profiling
If the Service were to implement automated decisions or profiling relevant to data subjects, their existence must be disclosed and, at least in such cases, meaningful information provided about the logic involved and the significance and envisaged consequences for the data subject. Absent such decisions, the Service is not deemed to make individual automated decisions with legal or similarly significant effects without the corresponding information and safeguards.
16. Data protection officer
Where applicable, the data protection officer’s contact details must be provided, ensuring proper and timely involvement in data-protection matters, access to data and processing operations and independence. In the Service, the designated privacy-contact channel is [email protected].
17. Changes to the Privacy Policy
Okeanun may update this Policy on changes to the Service, its processes or regulatory developments. The current version will be made available accessibly, and material changes will be notified through reasonable mechanisms within the Service or by electronic means, consistently with the duty of transparency.
18. Records of processing activities as transparency and compliance
Okeanun keeps records of the processing activities it carries out as controller and, where applicable, of those it carries out as processor on the Center’s behalf, with the minimum required content (purposes, data-subject and data categories, recipients, international transfers, erasure periods and a general description of security measures). These records are kept available to the supervisory authority on request, reinforcing accountability and internal compliance traceability.
19. Impact assessment and risk analysis for sensitive processing
Where the Service supports large-scale processing of special-category data or processing that, due to new technologies, its nature, scope, context or purposes, entails a high risk to rights and freedoms, Okeanun will carry out the corresponding risk analysis and, where appropriate, a data protection impact assessment, adopting the necessary mitigation measures. If, after that assessment, a high residual risk remains unmitigated, the supervisory authority will be consulted before starting the processing, as part of the preventive compliance approach.