Privacy Policy

1. Controller identity and contact channels

The controller of the personal data processed in connection with the Okeanun app for divers (hereinafter, the “App” or the “Service”) is MUNAEKO DEVELOPMENT SOFTWARE SOLUTIONS, S.L. (“Okeanun” brand), with tax ID B88989868 and registered office at Gran Vía Manuel López Carreño, 1, 2.º, 30180 Bullas, Murcia, Spain. For any privacy matter, as well as for exercising rights in processing where Okeanun acts as controller, the channel [email protected] is available. This Policy constitutes additional or “second layer” information under the layered information approach, and is designed to be concise, transparent, intelligible and easily accessible, in clear language, and is kept permanently available in the App and, where applicable, in the associated web environments.

2. Principles applicable to processing

Okeanun processes personal data in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. In particular, Okeanun applies an accountability approach, meaning it adopts appropriate technical and organisational measures and can demonstrate that processing is compliant, reviewing and updating them where necessary; this approach is implemented through internal policies, documentation of decisions, access controls and traceability measures, which are especially relevant where the Service integrates third-party (centre) access or handles potentially sensitive documentation.

3. Roles and processing scenarios: Okeanun and dive centres

Within the Okeanun ecosystem, processing operations with different controllers may coexist depending on the scenario and the specific purpose. In general, Okeanun acts as controller for the processing needed to operate the Okeanun account and the Service (for example, sign-up, authentication, maintenance, support, security and the operation of the social layer). In addition, certain dive centres act as independent controllers for the data they process to manage their bookings, activities, courses, dives and obligations towards divers; in those cases, Okeanun may process data on behalf of the centre as a processor. The processing arrangement will be set out in a contract or other legal act with the required content, including processing on documented instructions, a confidentiality commitment, security measures, assistance to the controller with the exercise of rights, rules on sub-processing, return or deletion at the end of the service and making information available for audits.

4. What personal data we process

Depending on the use made of the Service, Okeanun may process the following categories of personal data, in line with the data minimisation principle:

• a) Identity and account data: first name and surname (if provided), alias/username, internal identifiers, email, credentials and account preferences.
• b) Contact data: for example, phone number and emergency phone number (if provided).
• c) Activity and content data: dive logbook records, posts, comments, reactions, and content the user uploads or generates in the Service.
• d) Logbook photographs and multimedia content: photographs added by the user to their records, which may contain images of third parties.
• e) Social graph: friendships, buddies, invitations and social relationships within the App.
• f) Location data: location associated with dives where the user adds it to their records or activates features requiring it.
• g) Financial data in relation to centres: information linked to outstanding amounts, vouchers or payment requests where the user uses features requiring it.
• h) Technical and security data: data needed for the operation and protection of the Service and traceability evidence for sensitive operations (for example, confirming or refusing a link with a centre), including, where applicable, IP address and browser/device data.
• i) Metadata of declarations or acceptances: record of acceptance and its traceability (for example, timestamps and associated metadata), for the purpose of evidencing the user’s decision and the security of the Service.
• j) Diver documentation, including special categories: certifications and insurance; and, if the user chooses to provide them, questionnaires, medical certificates or other health-related documentation. Health data constitutes a special category of data and is subject to a reinforced regime of safeguards.
• k) Anthropometric and physiological data: weight, height, boot size, preferred ballast and SAC. Although not a special category, this data is handled with reinforced access precautions given its proximity to the health sphere, is limited to equipment preparation and consumption estimation purposes, and is not included in the directory visible to centres without a link (level 0).

5. Purposes of processing and legal bases

Okeanun processes personal data for specified, explicit and legitimate purposes, identifying the applicable legal basis for each processing operation and ensuring that, where special categories are processed, the corresponding reinforced regime applies.

• a) Sign-up, authentication, account management and provision of Service features. Legal basis: performance of a contract or pre-contractual measures requested by the user.
• b) Support and user care. Legal basis: performance of the contract.
• c) Operational communications necessary for the Service. Legal basis: performance of the contract and/or legitimate interest, to the extent they are necessary and proportionate to the operation of the Service.
• d) Security and integrity of the Service, traceability and prevention of misuse. Legal basis: legitimate interest, with appropriate technical and organisational measures and access controls.
• e) Qualification directory visible to centres without a prior link (level 0). Legal basis: legitimate interest. The user may exercise their right to object using the control/toggle available in the App, the effect of which is exclusion from the level 0 directory.
• f) Verification of the diver↔centre link and record of the operation. Legal basis: performance of the contract and, where applicable, retention of evidence of the user’s acceptance/decision and of its revocation, for evidentiary and security purposes.
• g) Processing of medical documentation or health data provided by the user. Where the user decides to provide health-related data, processing will be carried out on an appropriate legal basis and under the reinforced regime applicable to special categories, including, where applicable, explicit consent for specific purposes; consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Qualification directory and access levels for centres

The Service may include a qualification directory visible to centres without a link (level 0). At that level, the centre may see only the fields that are strictly necessary and configured for that purpose, including: first name and surname, alias, avatar, Okeanun internal identifier, total dives, date of last dive, capabilities derived from certifications and, for each certification, certifying agency (including logo), course name, level and verification status, as well as strictly necessary functional metadata (type, isOkeanunUser). Level 0 does not expose contact data (email, phone), insurance data, anthropometric and physiological data, medical information or information derived from it, images of health documentation, certification identifiers verifiable against third parties (for example, certification number) or certification expiry dates. This delimitation reflects the principles of data minimisation and privacy by default as regards the accessibility of data to third parties.

A centre’s access to diver information beyond level 0 (hereinafter, “level 1 or above”) is not enabled merely because the centre performs a directory search or because a booking made by the centre exists. To enable level 1 or above, there must be a prior relationship with the centre that is considered verified under the Service’s logic. To that end, the following are considered to enable level 1 or above: (i) the existence of a verified diver↔centre link and (ii) membership of the centre (for example, where the diver is an owner, co-owner or staff member of the centre), in which case access derives from belonging to the centre.

A verified link may be confirmed through different channels, described separately to ensure transparency about how access is granted: (a) express acceptance from the App on a dedicated screen for the centre’s access request, showing the access scope and offering the options “Accept”, “Decline” or “Not now”; (b) express acceptance through a link sent by email, with a limited validity period, leading to the same confirmation flow; and (c) in the case of a booking made on a centre’s portal using Okeanun identity by the booking holder themselves (authentication and acting on their own behalf), the link may be considered verified without an additional screen. This automatic verification only applies to the holder acting on their own behalf and not to companions or other people included in the booking, who will receive their own individual confirmation request where appropriate.

In addition, the Service may maintain intermediate relationship states with a centre to reflect operational situations where a commercial link exists (for example, a booking or voucher) without the user having confirmed a verified link: in those cases, the centre does not access the diver’s Okeanun record (level 1 or above), but only what is strictly necessary to manage its own relationship (for example, its booking history, balances, active vouchers and, where applicable, “guest” profiles and documentation collected by the centre itself), the centre acting as controller for that processing.

7. Right to object to the level 0 directory

Where the level 0 directory is based on legitimate interest, the user may object at any time using the control available in the App. The effect of the objection is the user’s exclusion from the directory results for centres without a link. The objection does not affect access by centres with a verified link or access derived from a membership relationship with a centre.

8. Recipients and categories of recipients

In general, Okeanun will not disclose data to third parties except where necessary to provide the Service, where there is a legal obligation, or where the user activates features that involve sharing data with a specific centre (for example, linking, bookings or document management associated with the centre).

• a) Dive centres — linked centre or membership: where a verified link or a membership relationship exists, the centre may access the data necessary within the enabled level to operate bookings, courses, dives, verifications and associated obligations. For processing the centre carries out for its own purposes, the centre acts as controller.
• a) Dive centres — non-linked centre: access to the level 0 directory. In that case, the receiving centre becomes an independent controller for the processing it carries out from receipt of the data and must comply with its own information duty where applicable, in particular where the data is not obtained directly from the data subject.
• b) Providers (processors and sub-processors): Okeanun uses technology providers to deliver the Service (for example, hosting and infrastructure, database, image storage and processing, transactional email, authentication, maps, error diagnostics, support/ticket management and payments). These providers process data on Okeanun’s behalf as processors or sub-processors, on documented instructions and with appropriate contractual obligations, including rules on sub-processing and transparency about sub-processor changes where applicable. The named, up-to-date list of providers and sub-processors, indicating locations and, where applicable, international transfer mechanisms, can be requested at any time at [email protected].

9. International transfers

Certain providers may involve international transfers of personal data, including situations where, even though the processing region is configured in the European Union, there is administrative or support access from third countries. In those cases, Okeanun will apply the required appropriate safeguards and will provide clear information about the existence of transfers and about the means to obtain a copy of or access the safeguards through [email protected].

Likewise, the use of third-party services loaded in the browser (for example, map or third-party identity services) may involve direct data communications from the user’s device to those third parties, which will be covered by the information on recipients and international transfers where applicable.

10. Retention periods

Personal data will be kept for as long as necessary for the purposes for which it is processed, in accordance with the storage limitation principle and applying, where appropriate, erasure or restriction of processing. Okeanun uses specific criteria and periods for relevant categories of data, without prejudice to the fact that certain processing may require additional retention where necessary to handle liabilities and defend claims.

In particular:

• a) Account data and Service operations: while the account remains active and, thereafter, for an additional period of 2 years to manage liabilities and defend claims.
• b) Linking token: up to 72 hours.
• c) Centre access log: 12 months.
• d) Record of diver↔centre link verification and associated traces: while the link subsists and, thereafter, for 2 years.
• e) Fully cancelled bookings with no charges: definitive deletion.
• f) Bookings with charges or associated obligations: retained for as long as necessary to handle obligations and defend claims linked to the financial operation.
• g) Data processed on behalf of a centre: periods are set by the centre as controller; where Okeanun acts as processor, the terms of the processing instrument (DPA) will apply, including return or deletion where appropriate.

11. Users’ rights and how to exercise them

Users may exercise the rights recognised by data protection law (access, rectification, erasure, restriction, objection and portability where applicable), and may withdraw consent where processing is based on consent. Exercising rights is facilitated through accessible channels and procedures allowing a timely response with appropriate traceability.

In any case, the data subject may lodge a complaint with the Spanish Data Protection Agency (AEPD).

• a) Processing where Okeanun is controller: requests may be sent to [email protected].
• b) Processing where the centre is controller: where processing is carried out by a centre (for example, management of bookings, courses or documentation required by the centre), rights must be exercised with the centre. If Okeanun receives a request relating to processing carried out on behalf of the centre, it will provide the technical assistance required under the processing arrangement and the instructions of the controller centre.
• c) Revoking the link and practical limits: the user may revoke a verified link with a centre from the App (Settings → Privacy → Linked centres → “Withdraw access”), with immediate effect on the centre’s access to the diver’s record in Okeanun. Revocation does not prevent the centre from processing (i) its own commercial and operational history (for example, bookings, vouchers, balances and documentation or “guest” profiles collected by the centre itself), for which the centre acts as an independent controller, nor (ii) reverse any prior download or incorporation of data by the centre into its own systems during the period in which it had access; in that case, rights must be exercised with the centre as controller. In the case of a membership relationship (for example, owner, co-owner or centre staff), withdrawing access by revoking the link does not remove access derived from belonging to the centre, which must be handled, where applicable, by leaving the centre in accordance with the applicable procedure.
• d) Real limit of the right to erasure regarding copies retained by centres: erasure requested from Okeanun does not extend to copies or records that centres, as independent controllers, retain to comply with their own obligations or for the establishment, exercise or defence of legal claims. In those cases, rights must be exercised against the centre, without prejudice to the rights available against Okeanun in respect of its own processing.

12. Layered information at collection points

Where personal data is obtained directly from the user, information will be provided clearly and accessibly, and a layered system may be used: a first layer (basic information) at the points of collection (for example, sign-up, forms, linking flows, document upload and payments) and a second layer of additional information through this Policy or a direct link to it. Where personal data is not obtained from the data subject, information will be provided within the applicable terms and time limits, and a layered approach may likewise be used in accordance with Spanish law.

13. Privacy by design and by default, and the Service’s default settings

Okeanun adopts technical and organisational measures to embed data protection by design and by default, so that, by default, only the data necessary for each specific purpose is processed and the amount, extent, accessibility and retention are controlled, taking into account the state of the art, cost and risks to rights and freedoms. These measures are documented and reviewed according to risk.

Notwithstanding the above, the Service includes relevant default settings that should be known from sign-up and that can be changed by the user without friction:

These options are offered to allow an informed decision and effective control by the user over the accessibility of their information in the Service.

• a) Social profile visibility: by default, the social profile is public. This means that certain elements of the profile and of the social content the user voluntarily publishes may be visible in line with the Service’s social logic. The user may change this setting at any time, with immediate effect. Health documentation is not part of the social profile.
• b) Visibility in the directory for centres: by default, the user is visible to centres in the qualification directory (level 0). The user may disable this visibility at any time using the available control, with immediate effect.

14. Security of processing and incidents

Okeanun applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, with access controls, measures aimed at confidentiality, integrity and availability, and traceability mechanisms that are especially relevant for centre access and sensitive operations. These measures are reviewed and updated as necessary in light of risk analysis and, where applicable, impact assessments.

In the event of a personal data breach, Okeanun will document the incident and handle notification obligations where applicable. Where Okeanun acts as processor on behalf of a centre, it will notify the controller centre without undue delay of any security breaches of which it becomes aware, as required under the processing arrangement.

15. Minors

The Service is not intended for minors. However, centres may manage underage divers as “guest divers” and provide or manage their documentation within the centre’s environment. In that case, the centre acts as controller and Okeanun may act as processor on behalf of the centre, with the centre being responsible for obtaining the consent of those holding parental authority or guardianship where necessary, especially in relation to health documentation or other particularly sensitive documentation.

16. Cookies and similar technologies

In the Service’s web environments, Okeanun currently uses only the storage of and access to information on terminal equipment that is strictly necessary to provide the service requested by the user and for security purposes (for example, maintaining the session). No analytics, advertising or personalisation cookies or similar technologies are used, so no consent is requested and no cookie banner is displayed. Should non-strictly-necessary technologies be introduced in the future, clear and complete information about their use and purposes will be provided in advance, the user’s consent will be obtained, and mechanisms to configure and withdraw consent will be made available.

17. Changes to the Privacy Policy

Okeanun may update this Policy where there are changes to the Service, to its processes or as a result of regulatory developments. The current version will be made accessible, stating its last review date, and material changes will be communicated by reasonable means within the Service or by electronic means.