Privacy Policy and Personal Data Protection

Last updated: December 2025

1. Introduction

Privacy is a fundamental aspect for Brothers Diving SCP. In compliance with applicable legislation, Brothers Diving SCP undertakes to adopt the necessary technical and organizational measures appropriate to the level of risk associated with the personal data collected.

This Privacy and Personal Data Protection Policy (hereinafter, the “Privacy Policy”) explains how personal data of users (the “Users”) are processed when they interact with https://brothersdiving.com (the “Website”). Users are advised to carefully read this Privacy Policy before providing any personal data through the Website.

2. Applicable Regulations

This Privacy Policy complies with current Spanish and European regulations on personal data protection, in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR);
• Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD);
• Royal Decree 1720/2007 of 21 December, insofar as it does not conflict with the GDPR (RDLOPD);
• Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSICE).

3. Data Controller Identification

In compliance with the duty of information, the following details are provided:

Data Controller: Brothers Diving SCP
Tax ID (CIF): J13696935
Registered Address: Calle las Dalias 12, 35109 San Agustín, Las Palmas, Spain
Email Address: contact@brothersdiving.com
Activity: Recreational and educational diving services, including diving courses, guided dives, try dives, e-learning materials, and the sale of diving-related products.

4. Collection and Processing of Personal Data

In accordance with the GDPR, personal data collected by Brothers Diving SCP through the Website forms shall be incorporated into processing records for the purpose of managing the relationship with Users, responding to requests, inquiries, reservations, and service bookings.

Brothers Diving SCP maintains a record of processing activities as required by the GDPR.

Personal data processed mainly originate from:

• Contact forms: first name, last name, email address;
• Medical forms: information required to assess the User’s fitness for scuba diving activities;
• Subscription and newsletter forms: first name, last name, email address.

Additionally, personal data may be processed in order to:

• Ensure compliance with the Legal Notice and applicable legislation;
• Manage reservations, contracted services, and related communications;
• Improve User experience and service quality;
• Perform statistical analysis through cookies (in accordance with the Cookie Policy);
• Manage Brothers Diving SCP’s presence on social media, without sending individualized commercial communications without prior consent.

Brothers Diving SCP does not sell, rent, or transfer personal data to third parties without the User’s express consent, except where legally required or where strictly necessary collaborations exist, duly informed and subject to confidentiality agreements.

5. Accuracy and Truthfulness of Data

The User guarantees that the personal data provided are truthful, accurate, complete, and up to date, and undertakes to communicate any changes thereto.

6. User Consent

The processing of personal data requires the prior, express, and informed consent of the User, granted through a clear affirmative action.

All Website forms include the express acceptance of this Privacy Policy, the Legal Notice, and the Cookie Policy. Without such acceptance, personal data processing shall not be authorized.

7. Data Processing Principles

Personal data processing is governed by the principles set out in Article 5 of the GDPR, namely:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimization;
• accuracy;
• storage limitation;
• integrity and confidentiality;
• and proactive accountability.

8. Categories of Data Processed

Only identification and contact data are processed. No special categories of personal data as defined in Article 9 of the GDPR are processed.

9. Legal Basis for Processing

The legal basis for processing personal data is the User’s consent and, where applicable, the performance of a contract or the application of pre-contractual measures.

The User may withdraw consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.

10. Data Retention Period

Personal data shall be retained only for as long as necessary to fulfill the purpose for which they were collected or until the User requests their deletion, without prejudice to legally required retention periods.

11. Recipients of Personal Data

Personal data may be shared with the following recipients or categories of recipients:

• Hostinger: hosting service provider for the Website;
• WordPress: platform used for Website management;
• Google Analytics: web analytics service provided by Google Inc.;
• Redsys: secure payment gateway platform.

Should the Data Controller intend to transfer personal data to a third country or international organization, Users shall be informed accordingly at the time the data are collected.

12. Personal Data of Minors

In accordance with the GDPR and the LOPDGDD, minors under fourteen (14) years of age may not provide personal data through the Website without the prior and express authorization of their parents or legal guardians.

Minors aged fourteen (14) and over may lawfully provide their personal data for informational, contact, or access-to-content purposes, provided that such data are adequate, relevant, and limited to what is strictly necessary.

Notwithstanding the foregoing, the contracting of services offered by Brothers Diving SCP is expressly limited to persons over eighteen (18) years of age or, in the case of minors, may only be carried out with the prior, express, and verifiable consent of their parents or legal guardians, who shall assume full responsibility arising from such contracting.

Brothers Diving SCP reserves the right to request documentation to verify the User’s age and, where applicable, parental authorization. If personal data of a minor are processed without the required consent, such data shall be immediately deleted.

13. Data Security and Confidentiality

Brothers Diving SCP implements appropriate technical and organizational measures to ensure the security of personal data. The Website uses an SSL (Secure Socket Layer) certificate to ensure encrypted data transmission.

However, as absolute security on the Internet cannot be guaranteed, in the event of a personal data breach posing a high risk to Users’ rights, Brothers Diving SCP shall notify the competent authorities and affected Users in accordance with the GDPR.

14. User Rights

Users may exercise their rights of access, rectification, erasure, restriction of processing, objection, data portability, and not to be subject to automated decision-making, by submitting a written request marked “GDPR – Brothers Diving SCP”, specifying:

1. Full name and a copy of an official identification document;
2. Specific request and reasons;
3. Address for notifications;
4. Date and signature of the User or legal representative;
5. Any supporting documentation.

Requests may be sent to:

• Email: contact@brothersdiving.com
• Postal address: Calle las Dalias 12, 35109 San Agustín, Las Palmas, Spain

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

15. Links to Third-Party Websites

The Website may contain links to third-party websites whose privacy policies are beyond the control of Brothers Diving SCP. Further information is available in the “Link Policy” section of the Legal Notice.

16. Intellectual and Industrial Property

All Website content, including but not limited to images, text, audio, video, software, trademarks, logos, design, and structure, is the property of Brothers Diving SCP or its licensors. Any unauthorized use is prohibited.

17. Right of Exclusion

Brothers Diving SCP reserves the right to deny or withdraw access to the Website to Users who breach this Privacy Policy.

18. Amendments to the Privacy Policy

Brothers Diving SCP reserves the right to modify this Privacy Policy at any time.

19. Applicable Law and Jurisdiction

The relationship between Brothers Diving SCP and the User shall be governed by Spanish law and submitted to the courts and tribunals of San Bartolomé de Tirajana (Las Palmas), with express waiver of any other jurisdiction