Last updated: November 6, 2026.
This is a translation of the original Spanish version. In case of any discrepancy, the Spanish version prevails.
1. Who is the controller
The controller of the personal data described in this policy is:
| Owner | ReefDesk |
|---|---|
| Privacy email | legal@reefdesk.io |
| Phone | +34 608 958 153 |
| Website | https://reefdesk.io |
Hereinafter, “ReefDesk” or “we”. You can write to that email address with any question about this policy or to exercise your rights (section 7).
2. Who it applies to and in what capacity
ReefDesk processes data about three groups of people, and its role is not the same for all three.
| Who you are | Where | ReefDesk’s role |
|---|---|---|
| You visit the website or write to us | reefdesk.io and its contact form | Controller |
| You work at a dive center that is a customer | Your account at app.reefdesk.io | Controller of your account data and the subscription |
| You book with a dive center | The dive center’s online store, bookings and medical form | Processor: we process your data on behalf of the dive center, which is the controller |
If you are a customer of a dive center, the dive center decides what data it asks you for and why. To exercise your rights, contact the dive center first; if you write to us, we will forward your request to it. The relationship between ReefDesk and each dive center is governed by a data processing agreement.
3. What data we process, why and on what basis
3.1 If you visit reefdesk.io or write to us
| Data | Purpose | Legal basis |
|---|---|---|
| Contact form: name, work email, dive center name, phone (optional), reason and message | Replying to you, assessing whether ReefDesk is a good fit for your dive center and, if you ask, preparing the setup of your store | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) |
| Whatever you tell us by email, phone or WhatsApp | Handling your inquiry | Pre-contractual steps or legitimate interest in replying to you (Art. 6(1)(b) and 6(1)(f)) |
| IP address and technical data about the visit, in the server logs | Serving the website and protecting it against abuse | Legitimate interest in the security of the site (Art. 6(1)(f)) |
The website does not use analytics, advertising or profiling. We do not send marketing communications.
3.2 If you have a dive center account
| Data | Purpose | Legal basis |
|---|---|---|
| Account: first name, last name, email, phone, language, time zone, role and login credentials (encrypted password or Google sign-in) | Giving you access to the application and managing your team’s permissions | Performance of the contract (Art. 6(1)(b)) |
| Acceptance of the terms: accepted version, date and email | Proving that you accepted the terms | Performance of the contract and legitimate interest in being able to prove it (Art. 6(1)(b) and 6(1)(f)) |
| Dive center and billing details: name, legal name, tax ID, address, email, phone and subscribed plan | Providing the service, charging the subscription and issuing invoices | Performance of the contract and tax obligations (Art. 6(1)(b) and 6(1)(c)) |
| Subscription payment | Processed by Stripe. ReefDesk does not see or store your card details | Performance of the contract (Art. 6(1)(b)) |
| Service emails: verification, password recovery, invitations | Making your account work | Performance of the contract (Art. 6(1)(b)) |
| Use of the application: user ID, email, dive center, role, language, time zone and the actions you take. In 1 out of every 10 sessions the screen is recorded with all text masked | Understanding how ReefDesk is used and improving it | Your consent (Art. 6(1)(a)), which you can withdraw at any time from your user menu |
| Technical errors, without data that identifies you, with your dive center’s ID | Detecting and fixing bugs | Legitimate interest in maintaining the service (Art. 6(1)(f)) |
| IP address of requests | Limiting abuse and protecting the service | Legitimate interest in security (Art. 6(1)(f)) |
3.3 If you book with a dive center that uses ReefDesk
The dive center is the controller of this data and decides what it uses it for. ReefDesk processes it only to provide the service to the dive center, following its instructions, and does not use it for its own purposes.
| Data | What the dive center uses it for |
|---|---|
| Identification and contact: first name, last name, email, phone, date of birth and language | Managing your booking and communicating with you |
| Companions on the booking: first name, last name, phone and, if you provide it, email | Knowing who is taking part in the departure |
| Emergency contact: name, phone and relationship | Being able to notify someone if something happens |
| Diving: certification, agency, number of dives and date of the last one | Checking that the activity is suitable for you |
| Booking and payment: activity, date, amount and payment status. Card payments are processed by Stripe in the dive center’s account | Charging and organizing the departure |
| Billing, if you request an invoice: name or legal name, tax ID and address | Issuing the invoice |
| Medical form: health questionnaire, ID document, address, accommodation and insurance | Assessing whether you can dive safely (section 4) |
| Emails you receive: booking confirmation, medical form and its reminder, invoices | Keeping you informed about your booking |
The legal basis is determined by the dive center. It is usually the performance of your booking, the dive center’s legal obligations and, for health data, your explicit consent.
4. Health data in the medical form
The medical form collects health data, which the GDPR gives special protection. The controller is the dive center that sends it to you; ReefDesk hosts it and processes it on the dive center’s behalf.
- What is collected. A ten-question questionnaire about your health and, if you answer yes to any of them, follow-up questions (heart, breathing, nervous system, mental health, surgery, among others). The dive center may also note allergies, medication and conditions in your record.
- On what basis. Your explicit consent (Art. 9(2)(a) GDPR), which you give when you submit the form. Without it, the form is not submitted.
- What is kept as proof. The date and the version of the text you accepted, your IP address and the browser you used.
- Who sees it. Only dive center staff with permission to view medical forms. Each dive center’s data is isolated from the others.
- What the system does. It automatically flags whether any answer requires medical clearance. The decision on your participation is always made by the dive center staff.
- Validity. A confirmed form is valid for 12 months, so you are not asked for it on every booking.
- Withdrawing consent. You can do so at any time by writing to the dive center. Bear in mind that the dive center may need the form to admit you to the activity.
The application screens recorded for analytics (section 3.2) have all text masked, so medical answers are not captured in those recordings.
5. Who we share data with
We do not sell data or pass it on to third parties for their own purposes. Only the providers we need to deliver the service have access to it, under a data processing agreement, along with public authorities when the law requires it.
| Provider | Purpose | What data | Where it is processed |
|---|---|---|---|
| Supabase | Database, authentication, functions and files of the application | All application data | EU: Stockholm (database) and Frankfurt (functions) |
| Stripe | Charging the subscription and online store bookings | Name, email and phone of the payer; booking details; payment details | Ireland (Stripe Payments Europe), with possible transfers to the US |
| Resend | Sending the application’s emails | Email address and message content | US |
| Amplitude | Usage analytics for the application, only with your consent | The application usage data described in section 3.2 | EU |
| Sentry | Logging technical errors | Technical error data, without identifying data | EU (Germany) |
| Cloudflare | Hosting app.reefdesk.io | IP address and technical connection data | Global network |
| Google (Firebase Hosting) | Backup copy of the application at respaldo.reefdesk.io | IP address and technical connection data | Global network |
| Google (sign-in) | Signing in with your Google account, only if you choose to | Email and name of your Google account | As determined by Google |
| fiskaly | Verifiable invoicing (VeriFactu), only for dive centers that enable it | Tax data of the invoice issuer and recipient | EU |
| OVHcloud | Hosting the website and the contact form | Form data, IP address | EU (France) |
| Google Fonts | Fonts for reefdesk.io | Visitor’s IP address | As determined by Google, which may process it in the US |
Invoices issued with VeriFactu are reported to the Spanish Tax Agency (Agencia Tributaria) as required by law.
Transfers outside the European Economic Area. Some of these providers are based in the United States or may process data there. In those cases, the transfer is covered by an adequacy decision (EU-U.S. Data Privacy Framework) or by the European Commission’s standard contractual clauses. You can ask us for more information at the email address in section 1.
ReefDesk staff can access a dive center’s data only when necessary to provide support or maintain the service.
6. How long we keep data
We keep data only for as long as necessary for the purpose for which it was collected and, after that, for as long as the law requires.
| Data | Period |
|---|---|
| Contact form messages | 12 months from the last contact |
| User account and dive center data | While the subscription is active. After cancellation, 90 days to export the data, after which it is deleted |
| Invoices and tax data of the subscription | The legal periods: up to 6 years for commercial and tax obligations |
| Data of a dive center’s customers (bookings, records, medical forms) | As decided by the dive center, which is the controller. When the contract ends, ReefDesk returns or deletes it according to its instructions |
| Log of sent emails | 12 months |
| Usage analytics and session recordings | The retention period configured with the provider |
| Error logs | The retention period configured with the provider |
A dive center can anonymize the record of a customer who asks for their data to be erased. Anonymization covers the record, its bookings and its medical forms; invoices already issued are kept because of tax obligations.
7. Your rights
You can exercise these rights over your data at any time, free of charge:
- Access: find out whether we process your data and get a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete it when it is no longer needed or you withdraw your consent.
- Objection: object to processing based on our legitimate interest.
- Restriction: ask us to keep your data without using it while a complaint is resolved.
- Portability: receive the data you provided to us in a commonly used format.
- Withdraw any consent you have given, without affecting processing already carried out.
How to exercise them. Write to legal@reefdesk.io stating which right you want to exercise. We may ask you to prove your identity. We reply within one month at most, which may be extended by two further months if the request is complex.
If you are a customer of a dive center, the controller of your data is the dive center: contact it directly. If you write to us, we will forward your request to it and help it respond.
Complaints. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
ReefDesk does not make automated decisions with legal effects on you or create profiles.
8. Cookies and storage in your browser
- reefdesk.io uses a single technical cookie,
pll_language, which remembers the language you chose. It does not require consent. Details are in the cookie policy. - app.reefdesk.io stores in your browser what it needs to work: your session, the language, the active dive center and your view preferences (filters and sort order of lists).
- Application analytics. The analytics tool stores an identifier in your browser. It is only activated if you accept it, and you can change this from your user menu.
9. Security
We apply technical and organizational measures proportionate to the risk:
- Each dive center’s data is isolated from the others in the database.
- Within a dive center, access to customers, payments and medical forms depends on each person’s permissions.
- Connections are encrypted (HTTPS) and accounts can be protected with two-step verification.
- Invoices are kept in private storage and can only be opened with temporary links.
- Sensitive actions, such as anonymizing a customer, are logged.
No system is infallible. If a breach affecting your data occurs, we will report it to the Spanish Data Protection Agency and to the people affected when the law requires it.
10. Minors
ReefDesk is a tool for professionals and is not aimed at children under 14. When a minor takes part in an activity at a dive center, it is the dive center that collects their data and the authorization of their mother, father or guardian.
11. Changes to this policy
We will update this policy when the service or the regulations change. If the change is significant, we will notify dive centers with an active account by email. The date of the latest version appears at the top of this page.