Privacy Statement
Version 2026-10-14
DiveOpsHub Privacy Statement
Last updated: 14 October 2026
Controller: IJsselmuiden Management B.V., trading under the name DiveOpsHub, Noorder Leidsevaart 1, 2182 NA Hillegom · privacy@diveopshub.com
DiveOpsHub is software for dive schools. In this statement you can read which personal data we process, why, for how long and with whom we share it.
1. Two roles: controller and processor
- We are the controller for the data of visitors to diveopshub.com, of dive schools that register or are customers (account, subscription, invoicing, support), and of anyone who e-mails us.
- The dive school is the controller for the data it processes in DiveOpsHub about its customers, students and employees. This also applies if you enrol via a dive school's website, sign a form or log in to a dive school's customer portal. In that case we process that data only on behalf of the dive school (see our Data Processing Agreement). For questions about this, it is best to contact your dive school; see also section 8.
2. Which data do we process as controller, and why?
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You visit our website | IP address, browser and device data in technical logs | Operation and security of the website | Legitimate interest |
| You send a message via the contact form or by e-mail | Name, e-mail address, message | Answering your question | Legitimate interest |
| You register a dive school | Name, e-mail address, name of the school, IP address, accepted terms (version, time) | Creating the account, recording acceptance | Performance of a contract; legitimate interest (evidence) |
| Your school is a customer | Name, e-mail and role of the administrators, company details, login times | Providing the service, managing the account | Performance of a contract |
| Invoicing and payment | Invoice details, payment status, mandate (via Mollie) | Invoicing and collecting payment | Performance of a contract; legal obligation |
| Support | Name, e-mail, content of your question | Providing support | Performance of a contract |
| News from DiveOpsHub | Name, e-mail | Sending news | Consent (you can unsubscribe at any time) |
3. Retention periods
- Registration requests that are not confirmed: 30 days.
- Account and contact details of a customer: for as long as the account exists; after termination a further 30 days for an export, and the data of the environment a further three calendar months (to be able to correct mistakes).
- Invoices and payment data: 7 years (tax retention obligation).
- Service requests: for as long as the account exists, and no longer than two years after the request has been closed.
- Technical logs: 3 months.
- Back-ups: 14 days on the server, 60 days at an external location.
4. With whom do we share data?
We share data only with parties that help us provide the service, and we make agreements with them on security and confidentiality:
| Party | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting and storage | Finland (EU) |
| Backblaze, Inc. | External back-ups | EU (Amsterdam) |
| Brevo (Sendinblue SAS) | Sending e-mail | EU |
| Google Ireland Ltd. (Google Workspace) | Our e-mail mailboxes | EU/US |
| Mollie B.V. | Payment of subscriptions | Netherlands |
| Anthropic, PBC | AI assistant in development and management (business account, with a data processing agreement; under its commercial terms not used for training) | US |
We do not sell personal data and do not share it for advertising purposes. We only provide data to public authorities if the law requires us to do so.
5. Transfers outside the European Union
Our service runs in the EU. Some of the parties above are established in the United States. For those transfers we use the safeguards prescribed by the GDPR, such as the EU-US Data Privacy Framework or the EU standard contractual clauses.
6. Cookies
We use only functional cookies, which are necessary to log in and to make the site work securely:
| Cookie | Purpose | How long |
|---|---|---|
| doh.auth | Keeping you logged in | Employees: until you log out, at most 14 days after your last visit (with “remember me” also after closing the browser). Customer portal: 30 days after logging in via the login link |
| doh.session | Temporary data during your visit, such as a shopping cart | Until you close the browser |
| Security cookie (.AspNetCore.Antiforgery…) | Protecting forms against misuse | Until you close the browser |
In addition, your browser remembers some preferences on your own device (such as the selected printer and the order of tiles); these are not sent to us. We use no analytics, tracking or advertising cookies; that is why there is no cookie banner.
7. Security
We take appropriate measures: encrypted connections, a separate database per dive school, permissions per role, encrypted storage of passwords and keys, daily back-ups, automatic retention periods and regular security checks.
8. Your rights
You have the right of access, rectification, erasure, restriction, objection and data portability, and you can withdraw consent you have given. Send your request to privacy@diveopshub.com; we will respond within one month. If it concerns data that a dive school has entered in DiveOpsHub (for example as a student or customer), we forward your request to that dive school and let you know.
9. Complaints
If you do not agree with how we handle your data, please contact us. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
10. Changes
We may amend this statement. The current version is always available on diveopshub.com, with the date of the last change.
11. Contact
IJsselmuiden Management B.V. (DiveOpsHub) · Noorder Leidsevaart 1, 2182 NA Hillegom · privacy@diveopshub.com