Privacy Policy

Last updated: 7 September 2026

This policy explains which personal data we collect through the diving.rs site, why we collect it, how long we keep it and what rights you have.

The data controller is Marko Veniger, a private individual, of Milutina Milankovića 120a, 11000 Belgrade, Republic of Serbia. Contact for anything concerning data: marko@diving.rs.

1. Which data we collect

Account data. Signing in is done through a Google account. From Google we receive your name, email address and profile picture, along with the technical tokens the site needs in order to recognise you as signed in.

Profile data. The nickname you choose yourself, which is publicly visible. A phone number and full name are optional — they are never shown publicly, and they are seen by our staff while handling your requests and by the admins of a club you apply to (see section 3).

Qualification documents. When you ask for a certification to be verified, you send us a photograph of your dive card. As a rule that photograph carries your name and certification number, and sometimes a date of birth and a photograph of you. For us this is the most sensitive data on the site, and section 4 deals with it separately.

Service applications. When you send an application for training, mentorship or a tank fill: name, phone number, email address, areas of interest and the message you write yourself.

Club membership applications. When you apply to a dive club through the site: your nickname and profile, the note you write with the application, and the full name, email address and phone number held on your account. We pass these to that club's admins — without them the club does not know who is asking to join, or how to answer. Section 3 has the detail.

Content you publish. Photographs in the gallery and their attribution data, as well as dive logs — dive profiles, times, depths and notes — which are published under the name of the diver leading them.

Messages. Notices we send to your inbox on the site (for example, the outcome of a certification verification), along with the settings by which you choose which of them also go to your email address. The same notices may be sent by email — see section 5.

2. Why we process data, and on what basis

3. Cookies, analytics and third parties

We use no tracking cookies, and for that reason we have no cookie consent bar.

• Session cookie. Set only when you sign in, and used solely so that the site recognises you. Signing in is not possible without it.
• Display settings. The site remembers how you left it: your theme (light/dark) and which rows you had expanded are kept by the browser alone and never sent to us — the expanded rows are dropped when you close the tab. The "only my clubs" choice is kept in a cookie that does reach our server, since the list is assembled according to it before the page is sent to you. None of these hold personal data and none are used for tracking.
• Analytics. We use Umami, which runs from our own server, sets no cookies and collects no data by which anyone could be identified. Only aggregate technical data is recorded — device type, browser and country. Admin visits are not recorded.
• Maps. Map tiles are fetched from the servers of the OpenStreetMap Foundation, which in the process sees your device's IP address.
• Video. Videos are embedded through youtube-nocookie.com mode, which sets no tracking cookies before the recording is started.
• Email. We use an email provider to send the messages described in section 5; for that purpose it processes your email address and the whole content of the message, including the names of any trips, clubs and dives mentioned in it. The inbox on the site works without it: switch every group in section 5 off and none of those notices reach the provider. An application you send for a service is a separate matter — it reaches us by email whatever those settings say, together with the contact details you wrote on it.
• Dive clubs. The clubs on the site are separate parties, not our staff. When you apply to a club for membership, we show that club's admins your full name, email address, phone number and the note you wrote with the application, alongside the nickname and profile that are public anyway. Only the club you applied to sees them, on its own dashboard, for as long as the application or the membership lasts; from that point the club answers for what it does with them. Applying is voluntary — withdraw the application or leave the club and the record is deleted, after which the club no longer sees any of it here.

The site runs on our own server; apart from the disclosure described above, the database is not shared with third parties.

4. Qualification documents — the 48-hour limit

We keep the photograph of a dive card only until we have reviewed the request, and for 48 hours at most. Once it has been reviewed — or once that period runs out — the document is deleted automatically, and this is built into the site itself rather than being only a promise. If we do not manage to handle a request in time, the document is deleted, the request is withdrawn, and we notify you of it.

After deletion, all that remains is the record of which certification was recognised, without the photograph itself.

5. Email notices, and how you switch them off

Notices travel on two channels. The inbox on the site always receives everything — it keeps a complete record of what happened to your account, whatever you have switched off. The settings described in this section govern email only.

Messages are divided into five groups:

We send no offers until you switch them on yourself. Signing in with a Google account is not consent to marketing. The other groups are on by default, and you can switch off any group — or any single item within it — at any time, on the account page. The "Running your club" group is shown only to people who actually administer a club.

Unsubscribing without signing in. Every message we send carries an unsubscribe link in its footer, and a standard header field from which your email app renders its own unsubscribe button. One click is enough: it switches off exactly the item that message belongs to, and nothing else. The link opens no session, cannot read or change your data, and keeps working for as long as the message sits in your mailbox. Even after unsubscribing, everything still reaches your inbox on the site.

6. How long we keep data

7. Your rights

Under the Law on Personal Data Protection you have the right to:

• ask for access to the data we process about you;
• ask for inaccurate data to be corrected;
• ask for data to be erased;
• ask for processing to be restricted, and object to processing;
• ask for data portability;
• withdraw consent at any time, which does not affect the lawfulness of processing carried out before the withdrawal.

You can send a request to marko@diving.rs. Consent to the "Offers" group is yours to withdraw directly, by switching that group off in your email settings or by unsubscribing from the message itself.

You can delete your account yourself. The account page carries a button for deleting the account. On confirmation, your account, certifications, verification requests in progress, club applications and memberships, gallery photographs and dive logs are deleted immediately and permanently. The action cannot be undone.

If you consider that we are processing your data contrary to the law, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

8. Children

The site is not intended for children under 15, and we do not knowingly open accounts for people of that age.

9. Changes to this policy

We may change this policy. The changed version applies from the day it is published on this page, and the date of the last change is given at the top.