Privacy policy

1. Controller and contact

The controller under the General Data Protection Regulation (GDPR) and other data protection legislation is:

You can contact us using these details at any time about privacy or to exercise your rights.

2. General information on data processing

Scope of processing

We process personal data only as necessary to provide this website, deliver your booked courses and comply with legal obligations.

Legal bases

• Article 6(1)(b) GDPR: Processing to perform a contract (e.g. course booking, course access and certification) or take steps at your request before entering into a contract.
• Article 6(1)(c) GDPR: Processing to comply with legal obligations, particularly commercial and tax retention requirements.
• Article 6(1)(f) GDPR: Processing based on legitimate interests, such as operating the website securely and reliably.
• Article 6(1)(a) GDPR: Processing based on consent where we expressly request it in a particular case. You may withdraw consent at any time with effect for the future.

Recipients

We share your data only as necessary for these purposes. Recipients include our hosting provider, the payment provider PayPal and the training organisation responsible for your course (PADI or ProNRC). See the following sections for details.

Automated decision-making

We do not make solely automated decisions about access to training or certification, or carry out profiling within the meaning of Article 22 GDPR. The operator handles and decides on course activation and certification.

3. ZAP-Hosting and server logs

This website, its database and associated email services are hosted by ZAP-Hosting. The hosting provider processes technical access data to deliver pages and maintain secure operation. This may include:

• IP address of the requesting device
• Date and time of the request
• Requested page or file and volume of data transferred
• HTTP status code
• Browser and operating system (user agent)
• Previously visited page (referrer), if transmitted

Purpose: Delivering the website, maintaining stability and IT security, and preventing and investigating misuse.
Legal basis: Article 6(1)(f) GDPR: our legitimate interest in a secure, functional website.

We do not combine these data with other sources to create user profiles.

4. Course bookings and participant data

When you book a PADI or ProNRC Nitrox eLearning course, we process the data you provide in the booking form. Depending on the course, these include:

• First and last name, date of birth
• Email address and, where applicable, telephone number
• Address, country and selected course language
• Selected course, booking reference, price, payment status and date
• Existing diving qualifications and, where applicable, PADI number
• Photograph, if required for the selected course (see section 5)

Purposes: Processing the booking, providing or activating the course, communicating with you, assigning the course and obtaining certification from the relevant training organisation, and meeting legal retention obligations.
Legal bases: Article 6(1)(b) GDPR (contract performance) and Article 6(1)(c) GDPR (legal obligations).

Required information: The data marked as required are necessary to enter into the contract and obtain certification. Without them, we cannot book the course or apply for your certification.

5. Processing and storage of photographs

Depending on your course, a photograph may be needed for identification or certification. For PADI, you may provide a photo instead of a PADI number; ProNRC requires a certification photo. The image is stored securely in the booking system and shared with the relevant training organisation only as necessary for processing or certification (see section 9).

Legal basis: Article 6(1)(b) GDPR (contract performance).

Deletion

• Photos no longer needed are generally intended to be removed from our own booking system one calendar month after completion of certification has been recorded, unless legal reasons prevent this. The recorded completion date, not the purchase date, is decisive.
• Deletion from our system does not automatically delete copies already transferred to PADI or ProNRC. Backups may also follow their own deletion cycles.

6. PayPal payments

We use PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, for course payments. The checkout includes the PayPal JavaScript SDK, which may connect to PayPal as soon as the payment page opens. PayPal may process technical data and use its own cookies or similar technologies. Orders are created through the PayPal REST API and payment results are verified on the server.

We send PayPal the order details needed for payment, particularly the booking reference, course description, amount and currency. We receive and store PayPal order and capture IDs, payment status, amounts and timestamps. Our checkout does not collect your PayPal login credentials or full card or bank details.

Purpose: Processing the payment and matching it to the booking.
Legal basis: Article 6(1)(b) GDPR.

PayPal processes data as an independent controller. For details, see the PayPal privacy statement.

7. Booking confirmations and email communication

We send confirmations, access details and organisational messages about bookings and course activation. We use the mailbox nitroxkurs@nitrox.info hosted by ZAP-Hosting and its SMTP server. Processing includes sender and recipient addresses, message contents and technical sending and delivery information; the mail server keeps dispatch logs. Acceptance by the mail server does not necessarily mean successful delivery to the recipient.

If you contact us by email or telephone, we process your details (such as name, contact details and message) to answer and handle your enquiry.

Legal bases: Article 6(1)(b) GDPR (contract performance and pre-contractual enquiries), or Article 6(1)(f) GDPR for enquiries unrelated to a contract (legitimate interest in answering enquiries).

Note: depending on the mail servers involved, email may travel over the internet without encryption. Where possible, avoid sending confidential information by unencrypted email.

8. Cookies and essential session functions

Cookies and similar browser storage technologies are used, among other things, to manage sessions. We do not use our own analytics or marketing services on the editorial pages. The PayPal SDK is loaded for payments (see section 6).

The checkout and protected administration may use essential session cookies and browser session storage for the booking process, authentication and security. The PayPal SDK may use additional technologies, as explained in PayPal's privacy information (section 6).

Legal bases: Section 25(2)(2) TDDDG permits access to your device where strictly necessary to provide a service you expressly request. Subsequent data processing is based on Article 6(1)(b) and (f) GDPR. Essential cookies do not require consent. You can block or delete cookies in your browser settings, but this may limit some functions.

9. Sharing data with PADI and ProNRC

Depending on your course, we share the participant data needed for course assignment and certification with the responsible training organisation:

• PADI Nitrox eLearning: PADI
• ProNRC Nitrox eLearning: ProNRC

Depending on the process, names, contact details, dates of birth, training and certification records, existing certification numbers and, where applicable, a certification photo may be sent through the relevant course or certification systems. The precise data depend on the requirements of the booked course.

Legal basis: Article 6(1)(b) GDPR (course delivery and certification).

Processing by the organisations themselves

PADI and ProNRC may store and process transferred data in their own systems, for example to manage certifications. Their respective privacy policies apply to this independent processing. We have no direct control over it.

This does not affect our responsibility as the operator of Nitrox.info for collecting your data and transmitting them to the organisations.

• PADI: PADI privacy policy (https://www.padi.com/privacy)
• For information on further processing by ProNRC, participants can contact the responsible organisation through their certification platform.

10. International transfers and data protection safeguards

We use a German hosting provider and international training and payment providers. In particular, PADI and PayPal may process personal data outside the EU or EEA. These providers explain their transfers and safeguards in their privacy information (sections 6 and 9). A German registered office alone does not rule out cross-border access by service providers for our hosting.

International transfers are subject to Articles 44 et seq. GDPR, for example adequacy decisions or appropriate safeguards such as standard contractual clauses. The applicable arrangement depends on the processing concerned. We make no unverified assurances about third-party locations or safeguards.

11. Retention and deletion

We keep personal data only as long as needed for the relevant purpose or required by law.

• Photos: generally removed from our booking system one calendar month after recorded certification, if no longer needed and no other legal retention obligation applies.
• Booking and payment records: payment IDs, amounts and documents required for statutory documentation and tax purposes are kept for the applicable retention period. PayPal transaction IDs alone do not always constitute a complete accounting record.
• Other participant and course data: after certification, data no longer needed are removed through the intended deletion process. Data required for legal obligations or legitimate purposes remain stored. Email correspondence is kept only as long as needed for processing or legal evidence.
• Server logs: See section 3.
• Data held by PADI, ProNRC and PayPal: Their retention periods are determined by the respective organisation.

12. Your data protection rights

Under the GDPR you have the following rights:

• Access to the data we hold about you (Article 15 GDPR)
• Rectification of inaccurate data (Article 16 GDPR)
• Deletionwhere the conditions are met (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21 GDPR)
• Withdrawal of consent with effect for the future (Article 7(3) GDPR). This does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, send a message to nitroxkurs@nitrox.info or to the postal address above. We can only delete data within our own area of responsibility; for data held by PADI, ProNRC and PayPal, see sections 5, 6 and 9.

13. Right to complain to a data protection authority

If you believe that the processing of your data infringes data protection law, you may lodge a complaint with a supervisory authority (Article 77 GDPR). The authority generally responsible for our business in Bavaria is:

You can also contact the supervisory authority at your place of residence or work.

14. Data security

We use encrypted HTTPS connections for the website and protected access to booking administration. The administration area is password-protected; access controls apply to booking submissions and administrative actions. Uploaded photos are stored in an area not intended for direct public access. We do not claim that all stored data are additionally encrypted or that backups are deleted within specific periods.

Despite these measures, internet data transmission can have security vulnerabilities; complete protection cannot be guaranteed.