Data Processing Agreement
Version 2026-10-14
DiveOpsHub Data Processing Agreement
This data processing agreement (“Data Processing Agreement”) forms part of the agreement between:
- Controller: the Customer (dive school, dive centre or other business) that uses DiveOpsHub (“Controller”); and
- Processor: IJsselmuiden Management B.V., trading under the name DiveOpsHub, Noorder Leidsevaart 1, 2182 NA Hillegom (“DiveOpsHub”).
Article 1 — Definitions
Terms such as personal data, processing, data subject, data concerning health, personal data breach (data breach), sub-processor and supervisory authority have the meaning given in the GDPR. Other terms have the meaning given in the DiveOpsHub Terms of Service.
Article 2 — Subject matter, nature and purpose
2.1 DiveOpsHub processes personal data solely in order to provide the Service to the Controller, as described in Annex 1.
2.2 The processing consists of collecting (including via the customer portal and the enrolment page), storing, consulting, editing, transmitting (e-mail, integrations), retaining and deleting data in the Service.
2.3 DiveOpsHub processes the data only on the basis of documented instructions from the Controller. This Data Processing Agreement, the settings the Controller chooses in the Service (such as activated modules and integrations) and the actions of its Users count as such instructions. If DiveOpsHub is legally required to carry out a processing operation, it will notify the Controller in advance, unless the law prohibits this.
2.4 DiveOpsHub does not process the data for its own purposes and does not sell it. Anonymised, aggregated usage data that cannot be traced back to individuals does not fall under this.
Article 3 — Term
3.1 This Data Processing Agreement applies for as long as DiveOpsHub processes personal data for the Controller, including the retention periods after termination (Article 13).
3.2 Obligations which by their nature continue (such as confidentiality) remain in force after termination.
Article 4 — Data subjects and data
4.1 The categories of data subjects and personal data, including special categories of personal data (health), are set out in
Annex 1.
4.2 The Controller warrants that it has a valid legal basis for each processing operation, in particular for data concerning health, data of minors and copies of identity documents, and that it informs the data subjects about this.
Article 5 — Obligations of DiveOpsHub
5.1 DiveOpsHub processes the data solely in accordance with the instructions of the Controller.
5.2 Everyone who has access to the data on behalf of DiveOpsHub is bound by confidentiality.
5.3 DiveOpsHub provides reasonable assistance with requests from data subjects (Article 9), security (Article 6), data breaches (Article 7) and data protection impact assessments (DPIAs) and prior consultations.
5.4 DiveOpsHub notifies the Controller if, in its opinion, an instruction infringes the GDPR or other legislation.
5.5 DiveOpsHub maintains a record of the processing activities it carries out as a processor (Article 30(2) GDPR).
Article 6 — Security
6.1 DiveOpsHub takes appropriate technical and organisational measures as referred to in Article 32 GDPR, having regard to the nature of the data, including health data. An overview is set out in Annex 2.
6.2 DiveOpsHub may update measures as long as the level of protection remains at least equivalent.
6.3 DiveOpsHub does not use personal data of the Controller for testing or development, unless the Controller gives written permission for this; in that case this takes place in a shielded environment and, where possible, with pseudonymised or anonymised data.
Article 7 — Data breaches
7.1 DiveOpsHub informs the Controller without undue delay, and where possible within 48 hours of becoming aware of it, of a data breach concerning data of the Controller.
7.2 In doing so, DiveOpsHub provides the information the Controller reasonably needs for its notification obligation to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where necessary, the data subjects, and takes measures to limit the consequences.
7.3 Notification to the supervisory authority and the data subjects is the responsibility of the Controller, unless agreed otherwise.
Article 8 — Access by DiveOpsHub
8.1 Employees of DiveOpsHub and the tools it engages (Annex 3) only have access to the data to the extent necessary for providing, managing and securing the Service and resolving failures.
8.2 Access to the server takes place only via personal, key-secured connections; access to the data is limited as far as possible to counts and measurements, without viewing the content.
8.3 DiveOpsHub uses the AI assistant (Annex 3) only through a business account covered by a data processing agreement with the provider. Only the data needed for the task is retrieved, where possible counts and measurements instead of the content; the assistant does not store any personal data on the server. The logs of that work are kept on the DiveOpsHub administration computer and are deleted after 30 days.
Article 9 — Rights of data subjects
9.1 The Service assists the Controller with requests from data subjects, including with exports of customer and equipment data, the modification and deletion of data, and the customer portal in which an End Customer can view his or her own data, forms and service reports.
9.2 DiveOpsHub provides reasonable additional assistance (access, rectification, erasure, restriction, portability, objection).
9.3 If DiveOpsHub receives a request directly from a data subject, it refers the data subject to the Controller and informs the Controller; it does not handle the request independently.
Article 10 — Sub-processors
10.1 The Controller gives DiveOpsHub general authorisation to engage sub-processors. The current sub-processors are listed in Annex 3.
10.2 DiveOpsHub imposes on sub-processors obligations at least comparable to those in this Data Processing Agreement and remains responsible towards the Controller for their actions.
10.3 DiveOpsHub announces a new or replacement sub-processor at least 30 days in advance by e-mail. The Controller may lodge a reasoned objection within that period; if consultation does not lead to a solution, the Controller may terminate the service concerned.
10.4 Parties that the Controller itself chooses and connects (such as its accounting package or Google Drive) are not sub-processors of DiveOpsHub. DiveOpsHub sends data to them on the instructions of the Controller, who itself enters into an agreement with that party for this purpose.
Article 11 — Transfers outside the EEA
11.1 The Service is hosted within the European Union (Finland).
11.2 Some sub-processors (Annex 3) are established in the United States or may process data there. In those cases DiveOpsHub ensures an appropriate transfer mechanism in accordance with Chapter V GDPR, such as certification under the EU-US Data Privacy Framework or the EU standard contractual clauses.
Article 12 — Audits
12.1 Upon request, DiveOpsHub makes available the information necessary to demonstrate compliance with Article 28 GDPR.
12.2 The Controller may carry out (or have carried out) an audit at most once a year, after reasonable notice and without unnecessarily disrupting business operations. The costs are borne by the Controller, unless the audit demonstrates a material shortcoming on the part of DiveOpsHub.
Article 13 — Retention, return and deletion
13.1 During the Agreement the Controller determines how long data is retained, with the exception of the fixed retention periods in Annex 1, which the Service applies automatically.
13.2 At the end of the Service the Controller may request an export for up to 30 days. After its environment has been deleted, DiveOpsHub retains the files and a database copy for a further three calendar months and deletes them thereafter; copies in back-ups expire no later than 60 days later. Statutory retention obligations remain unaffected.
Article 14 — Liability
The liability provisions of the DiveOpsHub Terms of Service apply to this Data Processing Agreement, without prejudice to mandatory law and Article 82 GDPR.
Article 15 — Final provisions
15.1 In the event of conflict with the Terms of Service, this Data Processing Agreement prevails as regards the processing of personal data.
15.2 This Data Processing Agreement is governed by Dutch law.
Annex 1 — Overview of the processing
Purpose: the administration and business operations of the Controller via the Service: customer management, courses and training, rental, service and inspection of equipment, point of sale and invoicing, fill, punch and gift cards, forms and signing, communication with End Customers and the integrations chosen by the Controller.
Categories of data subjects:
- customers and students of the Controller, including minors;
- parents or guardians who sign on behalf of a minor;
- persons who register via the Controller's enrolment page;
- employees, instructors and other Users of the Controller;
- contact persons of suppliers and business relations of the Controller.
Categories of personal data:
- identification and contact details: name, address, e-mail, telephone, date of birth, language;
- copy (photo) of an identity document for rentals;
- passport photo for a certification card;
- diving certifications and certification cards, course enrolments, progress per lesson, instructors' notes;
- health data (special categories of personal data): medical questionnaires, fitness declarations, the date of the medical statement, whether medical clearance is required, and RDC number and expiry date;
- signed forms and declarations, with signature (as an image), time, device and IP address;
- customers' equipment, service tickets, inspections, service reports and photos;
- rental data: issue, return, deposit;
- purchases, invoices, payments, quotations and balances of fill, punch and gift cards;
- sent e-mails (recipient, subject, time, content);
- login data (passwords only in encrypted form), login times, IP addresses in security and system logs.
Fixed retention periods that the Service applies automatically:
| Data | Period |
|---|---|
| Photo of an identity document for rentals | 5 working days after return; if the rental is still outstanding, no later than 90 days after issue |
| Content of sent e-mails | 3 calendar months after sending (data about the message is retained) |
| Registration requests that were never confirmed | 30 days |
| Data of a deleted environment (files and database copy) | 3 calendar months after deletion |
| Back-ups | 14 days on the server, 60 days at the external location |
| System logs of the server | 3 months |
| All other data | for as long as the Controller retains it, and thereafter in accordance with Article 13 |
Tax retention obligations (such as 7 years for invoices) are the responsibility of the Controller; the Service does not delete invoices of its own accord.
Annex 2 — Security measures
- Hosting: Hetzner, Helsinki data centre (Finland), within the EU.
- Connections: exclusively encrypted (HTTPS/TLS, automatically renewed certificates, HSTS).
- Separation: each customer has its own, separate database; files are kept separately per customer.
- Access: roles and permissions per module, including a separate permission for viewing medical forms; forms open only for those permitted to save; sessions expire upon deactivation, change of role or password reset.
- Login: passwords stored hashed; limits on the number of login attempts and login e-mails; login links for the customer portal work once and are valid for 30 minutes.
- Web security: security headers, including a Content Security Policy; protection against cross-site request forgery; restriction of uploads (type and size); shielded retrieval of external files.
- Storage of keys: access keys for integrations (such as Moneybird) encrypted in the customer's database; secrets of the Service outside the source code, readable only by the server.
- Server: the application runs isolated from the rest of the system (restricted permissions, read-only program directory); uploaded files are readable only by the application.
- Back-ups: daily, of all databases and files, on the server and at an external location, with automatic monitoring that warns if a back-up fails to occur; restoration has been tested.
- Audit log: actions such as signing, signing off and changing checklist items are recorded with time and employee.
- Maintenance: security updates of the operating system and the software libraries; periodic security audit of the code (most recently September 2026).
- Retention periods: applied automatically in accordance with Annex 1, with monitoring that reports if a clean-up run fails to occur.
Annex 3 — Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Hetzner Online GmbH (Gunzenhausen, Germany) | Hosting of the Service and storage of all data | Finland (Helsinki), EU |
| Backblaze, Inc. | External storage of back-ups | EU (eu-central region, Amsterdam) |
| Sendinblue SAS, trading as Brevo (Paris, France) | Sending e-mail on behalf of the Customer and DiveOpsHub (login links, invitations, confirmations, receipts, reports, newsletters) | France / Germany (EU) |
| Google Ireland Ltd. (Google Workspace) | E-mail mailboxes of DiveOpsHub (contact, support and privacy messages) | Ireland (EU); processing in the US possible, on the basis of the EU-US Data Privacy Framework and the EU standard contractual clauses |
| Anthropic, PBC | AI assistant (Claude) that DiveOpsHub uses through a business subscription in development and technical management; in doing so it sees only the data retrieved for the task. Anthropic processes that data as a processor under its data processing agreement (Data Processing Addendum) to its commercial terms and, under its commercial terms, does not use it for training. The logs are kept for 30 days on the DiveOpsHub administration computer | US, on the basis of the EU-US Data Privacy Framework and the EU standard contractual clauses included in that data processing agreement |
Not a sub-processor (for clarification):
- Mollie B.V.: only for the subscription that the Customer pays to DiveOpsHub; does not process End Customer data.
- Healthchecks.io: only receives a technical signal that a task has run, without personal data.
- Moneybird, Google Drive and a previous point-of-sale system of the Customer: connected on the instructions of the Customer (Article 10.4).