Privacy Policy

This policy explains which personal data we process when you visit this website or contact us, why we do it, and what rights you have under the EU General Data Protection Regulation (GDPR). This website uses no analytics, advertising or tracking tools.

1. Who is responsible

Aqua Track, Herbert Mohr
[Street and house number], [Postal code] Punta Cana, La Altagracia, Dominican Republic
Email: [email protected]
Phone and WhatsApp: +1 829 922 8777

EU representative (Art. 27 GDPR): [name and address of the EU representative, if one is required]

2. Hosting and server log files

This website runs on a server hosted by [hosting provider, address and server location]. Every time you open a page, the server automatically records technical data that your browser sends:

• IP address
• date and time of the request
• page requested and the referring page
• browser type, version and operating system

We need this data to deliver the website, keep it secure and investigate errors or attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6 (1) (f) GDPR). Log files are deleted after [number] days, unless we need a specific entry to investigate a security incident.

3. Cookies

We only use cookies that are technically necessary:

• aqua_track_scuba_diving_session: a session cookie that keeps your visit consistent. It expires after 120 minutes of inactivity.
• XSRF-TOKEN: a security cookie that protects forms against cross-site request forgery. It expires with the session.

These cookies do not track you and are not used for marketing. They are permitted without consent under § 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The legal basis for the related processing is Art. 6 (1) (f) GDPR.

Fonts, images and scripts are served from our own server. This website does not load content from Google Fonts, social networks, video platforms or map services.

4. Contact by email

When you email us, we process your email address, your name and the content of your message to answer you and, if you wish, to arrange an experience. Our email is provided by Google (Gmail). The legal basis is the preparation or performance of a contract (Art. 6 (1) (b) GDPR) and, for general questions, our legitimate interest in answering them (Art. 6 (1) (f) GDPR).

5. WhatsApp and our automated assistant

You can contact us on WhatsApp through the button on this website. WhatsApp is operated by WhatsApp Ireland Limited (Meta). Please read WhatsApp's own privacy policy before using it.

Messages to our WhatsApp business number are first answered by an automated assistant. It answers questions about our experiences from our own knowledge base and can take reservation requests. A member of our team can take over the conversation at any time.

To run the assistant, your phone number, your messages and the assistant's replies pass through the following services:

• WasenderAPI connects our WhatsApp number to our systems: [provider's legal name, address and country]
• n8n, the automation software that runs the assistant, on a server we operate: [server location]
• Google Gemini API (Google) generates the assistant's replies.
• Supabase stores the conversation history and reservation requests in a database: [database region]

The legal basis is the preparation or performance of a contract (Art. 6 (1) (b) GDPR) and our legitimate interest in answering enquiries quickly, at any time of day (Art. 6 (1) (f) GDPR). The assistant does not make decisions that have legal or similarly significant effects on you: every reservation is reviewed and confirmed by a person.

Please do not send health information, such as diving medical questionnaires, through the chat. We will tell you how to provide it securely.

6. Reservation requests

When you request a reservation by WhatsApp, we store the details needed to organise your experience:

• name, WhatsApp number and email address
• hotel, room number and check-out date
• chosen experience and date
• number of divers and snorkelers, and any notes you add

The legal basis is the preparation or performance of a contract (Art. 6 (1) (b) GDPR).

7. Transfers outside the EU

We are based in the Dominican Republic, and some of the providers named above process data in other countries, including the United States. Where a provider is certified under the EU–US Data Privacy Framework, transfers to it rely on the European Commission's adequacy decision. Otherwise, they rely on the Commission's standard contractual clauses (Art. 46 (2) (c) GDPR). [Confirm the safeguards used for each provider and for transfers to the Dominican Republic.]

8. How long we keep your data

• Emails and WhatsApp conversations: [e.g. 12 months after the last message]
• Reservation requests: [e.g. until the end of the season, longer where tax or commercial law requires]
• Server log files: see section 2.

9. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• restrict its processing (Art. 18 GDPR)
• receive your data in a portable format (Art. 20 GDPR)
• object to processing based on our legitimate interests (Art. 21 GDPR)
• withdraw any consent you gave, with effect for the future (Art. 7 (3) GDPR)

To use these rights, email [email protected]. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

10. Changes to this policy

We update this policy when our website or services change. The current version is always available on this page.