1. Controller

The controller of your personal data is JOOD Usługi Techniczne i Projektowe Sp. z o.o., ul. Na Zjeździe 11/5P, 30-527 Kraków, Poland, KRS 0001197718, NIP 6772531284 (Dive Krakow brand). Contact on data matters: dive@divekrakow.com, +48 451 653 223.

2. What data we process and why

• Emails and phone calls (name, email address, phone number, message): we answer your enquiry and prepare an offer. Basis: Art. 6(1)(b) and (f) GDPR. We keep them until the matter is closed, and no longer than 12 months after the last contact.
• Student data (name, date of birth, contact details, certification level, data needed to issue a certificate): to conclude and perform the training contract. Basis: Art. 6(1)(b) GDPR. Billing and invoice data: Art. 6(1)(c) GDPR, kept for 5 years from the end of the tax year.
• Establishing and defending legal claims: Art. 6(1)(f) GDPR, for the limitation period of claims.
• Medical statement before diving: to assess whether you can dive safely. This is special category data, processed on your explicit consent (Art. 9(2)(a) GDPR). Without it we cannot let you dive. We keep it for the duration of training and then as long as needed to defend against claims (Art. 9(2)(f) GDPR), generally up to 6 years.
• Photos and videos from courses: taken and published on our website and social media only on the basis of the consent in the registration form (Art. 6(1)(a) GDPR), until you withdraw it.
• Server technical data (IP address, time and address of the request): to keep the site secure and working. Basis: Art. 6(1)(f) GDPR. Server logs are kept by the hosting provider for a short time.

3. Cookies

This website does not use analytics or marketing cookies and does not track visitors. Only strictly necessary technical cookies may be used, for example to remember your chosen language. If we introduce analytics or advertising in the future, we will ask for your consent and update this policy.

4. Recipients

Your data may be received by: our hosting and email provider, our accountant, the training organisations PADI and CMAS to the extent needed to issue a certificate, and, where necessary, a doctor. We do not sell data. Some recipients, including training organisations and IT providers, may process data outside the European Economic Area. This happens under Art. 49(1)(b) GDPR (performance of a contract, such as issuing a certificate) or using standard contractual clauses or an adequacy decision.

5. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting the lawfulness of earlier processing). Write to dive@divekrakow.com. You may also lodge a complaint with the President of the Personal Data Protection Office, UODO (ul. Stawki 2, 00-193 Warsaw, Poland).

6. Voluntary data and automated decisions

Providing data is voluntary but necessary to enrol on a course. We do not make automated decisions and do not profile users.

7. Changes

Last updated: November 2026. We will announce significant changes on this page.