Privacy policy

Controller: DiveWithSteini, Sven Steinhardt, Hasenplatz 4, 71083 Herrenberg, Germany, email: sven@divewithsteini.de.

1. Legal bases and principles

Personal data is processed only where a legal basis applies, in particular consent (Art. 6(1)(a) GDPR), contract or pre-contractual steps (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)) and legitimate interests in secure, reliable operation and communication (Art. 6(1)(f)). Health data used for enrolment is processed only with explicit consent under Art. 9(2)(a) GDPR where required. Access to or storage of non-essential information on a terminal device requires consent under Section 25 TDDDG.

2. Hosting, server logs and transport security

The website is hosted by STRATO. When pages are requested, technically necessary server information such as IP address, date/time, requested resource, referrer, user agent and status information may be processed in server logs to deliver and secure the website. The website uses encrypted HTTPS/TLS transmission where supported by the hosting environment.

3. Cookies, local storage and consent

The DiveWithSteini consent manager stores the choice locally in the browser under dws_consent_v1. This is local storage rather than an advertising cookie. The choice is used only to remember whether external media and statistics may load and is requested again after approximately 180 days. Necessary storage does not require optional consent where it is strictly required to provide a service requested by the user. WordPress may additionally use necessary login/security cookies for administrators or logged-in users.

4. YouTube and Google

Where YouTube videos are embedded on DiveWithSteini, the website uses YouTube's privacy-enhanced domain youtube-nocookie.com and does not set an iframe source before consent to “External media”. No YouTube thumbnail is fetched before consent. Once enabled and a video is loaded or played, Google/YouTube may receive technical data such as IP address, device/browser information and interaction data; Google may use cookies or comparable technologies under its own policies. Transfers to countries outside the EEA may occur depending on Google's processing. Details are available in Google's privacy policy and Google's cookie information.

Google states that YouTube may, depending on context and settings, use cookies or similar identifiers such as VISITOR_INFO1_LIVE or __Secure-YNID. The exact identifiers and lifetimes are controlled by Google and may change. If GA4 is enabled, Google currently documents the first-party cookies _ga and _ga_<container-id>, with a default expiration of two years; in DiveWithSteini they can only be created after statistics consent.

Google Analytics: Google Analytics is currently not activated on this website. Google Search Console: an optional verification meta tag can be used; the tag itself does not place a visitor cookie. Google Maps: the website does not automatically embed Google Maps; external map links only connect to the provider after the user follows them. Google Fonts and reCAPTCHA: this website does not load Google Fonts or Google reCAPTCHA.

5. Self-hosted photos and videos

Media stored in the WordPress media library under the DiveWithSteini upload area is delivered from the website/hosting itself. Loading these self-hosted images and videos does not require a connection to YouTube, Google or social-media platforms.

6. Contact, email, WhatsApp and Instagram

The contact form processes the entered name, email address, optional telephone number, subject and message to answer the enquiry. The form sends the information by email; no separate CRM contact record is created from the enquiry. WhatsApp is provided as an external link. The website also offers a privacy-controlled Instagram profile embed. Instagram content is not loaded before consent to the “External media” category. Only after that consent may the browser connect to Meta/Instagram and transmit technical connection data such as the IP address and browser information. The provider’s privacy rules then apply.

7. Online enrolment and health data

The enrolment workflow processes identification/contact details, selected course, contractual declarations, signatures, emergency-contact information and limited health-related information required for diving training. Health-related material is stored separately and encrypted by the enrolment module. The current configured retention period for health-related data is 90 days. Contract records are configured for 10 years, subject to applicable statutory obligations. Access in the administration area is restricted to authorised users and relevant access events are logged.

8. Newsletter, interests and campaign statistics

The newsletter processes the email address, language, subscription status, confirmation token and timestamps. Subscription uses double opt-in. Subscribers may voluntarily indicate interests such as courses, trips or research so that messages can be selected more appropriately. No newsletter is sent until the confirmation link has been used, and each newsletter contains an unsubscribe mechanism. Where a campaign contains a DiveWithSteini tracking link, only an aggregate click counter for that campaign is increased; the click statistic is not stored against an individual subscriber profile. Processing of the subscription and interest selection is based on consent and can be withdrawn at any time with future effect.

9. Reviews and community content

Reviews can be submitted either through a personal review link or directly on the experiences page. Personal links may store the invited person's name, email address where supplied, course, token and workflow status. Direct public submissions store the rating, review text, display name, optional course/dive information, a technical workflow token and the publication consent. Reviews are never published automatically: every submission enters an editorial approval workflow first. The public form uses a hidden honeypot and a pseudonymous rate-limit key derived from technical request data for up to one hour; the review protection does not store the raw IP address itself and Google reCAPTCHA is not loaded for this purpose. Community stories containing a person's name, course/trip context or image are published only where the relevant material may lawfully be used.

10. Availability and reservation requests

The availability form may process name, email address, optional telephone number, selected course/interest, requested slot and a free-text note to arrange and confirm an appointment. A request does not automatically create a paid booking; it is reviewed and confirmed personally. A short-lived technical rate limit is used to reduce repeated automated requests. If an optional deposit is configured, its amount and payment status may be stored with the reservation. No external online payment service is currently enabled in the DiveWithSteini reservation workflow.

11. Personal participant area

For an existing enrolment, an authorised administrator can issue a personal passwordless participant link. Only a cryptographic hash of the access token is stored; the raw token is contained in the personal link. The participant area can display course information, training status, meeting point, checklists and selected learning resources. It deliberately does not expose health information or signed enrolment documents. Access links can be revoked or regenerated and are protected against indexing by search engines.

12. Workshop, cylinder and cellar requests

Requests for regulator service/drop-off, cylinder inspection, air fills or an appointment at the DiveWithSteini cellar may process name, email address, optional telephone number, preferred date and free-text details. The data is used to answer and organise the requested service. The public form uses a hidden honeypot and a short-lived pseudonymous rate limit to reduce automated abuse without Google reCAPTCHA.

13. Email delivery and other WordPress components

DiveWithSteini sends transactional messages through the WordPress mail function. Depending on the hosting or SMTP configuration, the hosting provider or an additionally configured mail service may be involved in delivery. Additional WordPress extensions, theme integrations, analytics, anti-spam or marketing services, if installed separately, must be assessed and reflected in this privacy information according to their actual use.

14. Recipients, international transfers and retention

Data is disclosed only where necessary for hosting, communication, contract performance, legal obligations or a service explicitly enabled by the user. When Google/YouTube, an externally configured payment provider or other non-European services are activated, international data transfers cannot be excluded. Retention follows the specific purpose, configured deletion periods and statutory retention duties. Reservation, participant-area and service-request records should be deleted or anonymised once they are no longer required for the relevant purpose or applicable legal obligations.

15. Your rights

Subject to the legal requirements, data subjects may request access, rectification, erasure, restriction, portability and may object to processing based on legitimate interests. Consent can be withdrawn at any time with future effect. There is also a right to lodge a complaint with a competent data-protection supervisory authority. Cookie/consent choices can be changed at any time using “Cookie settings” in the footer.

16. Changes

This privacy information is updated when the website's functions or configured services change. The actual configuration shown above therefore takes precedence over generic service descriptions.