Privacy policy
What we collect, why, who we share it with, and your rights under Thailand's Personal Data Protection Act (PDPA).
Who looks after your data
Dive Records is the controller of your personal data. For anything about your data, message us on LINE @diverecords.
What we collect
| Data | Examples | When |
|---|---|---|
| Contact details | name, phone, email, LINE name | ordering, booking or chatting with us |
| Delivery address | address, postcode | ordering gear |
| Orders and payment | items, amounts, transfer slips | ordering gear |
| Messages | LINE or email messages | contacting us |
| Course and trip details | date of birth, certification level, emergency contact, health information needed for safety | booking a course or trip |
| Newsletter email | signing up |
- Health information is sensitive data. We ask for your explicit consent before collecting it and use it only for diving safety.
- We never store card numbers. Card payments go directly through a payment provider.
Data in your browser
- The site remembers your language with a cookie, and your site colours, video sound setting and cart in your browser. This stays on your device and is not sent to us.
- We currently use no advertising or tracking cookies. If that changes, we will ask for your consent first.
- YouTube videos load from youtube-nocookie.com only when you press play; Google then handles data under its own policy.
How we use it
| Purpose | Legal basis |
|---|---|
| Delivering gear, exchanges, returns, warranty, running courses and trips | performing our contract with you |
| Accounting and tax | legal obligation |
| Answering messages, preventing fraud, safety recall notices | legitimate interest |
| News and promotions | consent (withdraw any time) |
| Using health information for diving safety | explicit consent |
Who we share it with
Only what each task needs, with:
- our fulfilment partner and couriers, to pack and deliver your order
- instructors and trip partners, to run the course or trip you booked
- payment providers
- service providers such as web hosting, database, email and LINE
- government authorities, when the law requires
We never sell your data.
Transfers outside Thailand
Some service providers may store data on servers outside Thailand. We choose providers with adequate data protection standards as the law requires.
How long we keep it
- Orders and accounting records: as long as accounting and tax law requires
- Messages: 2 years
- Newsletter email: until you unsubscribe
- Health information: deleted within 30 days after the course or trip
Your rights
Under the Personal Data Protection Act B.E. 2562 (2019), you can:
- access and get a copy of your data
- have your data sent or transferred
- object to how we use it
- have it deleted or made anonymous
- have its use restricted
- have it corrected
- withdraw consent at any time
- complain to the Personal Data Protection Committee office (PDPC)
Message us on LINE and we will act within 30 days.
Keeping data safe
Only people who need your data for their work can access it, and data is sent over encrypted connections.
Changes
We may update this policy and will show the date of the latest update above. We will announce important changes on the website.