Last updated: August 2026
Gran Canaria Divers S.L. respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, how long it may be retained, with whom it may be shared, and the rights you have under the General Data Protection Regulation (GDPR) and applicable Spanish data protection legislation.
The controller responsible for the processing of your personal data is:
Gran Canaria Divers S.L.
Puerto de Mogán, Gran Canaria, Spain
CIF: B76079771
Email: info@grancanariadivers.com
For any questions regarding this Privacy Policy or the processing of your personal data, you may contact us using the email address above.
Depending on how you contact us and which services you use, we may collect and process:
We aim to collect only the information reasonably necessary for the relevant purpose.
Personal data may be collected when you:
The same data-protection principles apply regardless of whether information is collected electronically or on paper.
We process personal data where necessary to:
For ordinary booking and customer administration, processing is generally necessary for the performance of a contract or to take steps requested by you before entering into a contract.
Where applicable, we also process information to comply with legal obligations.
Gran Canaria Divers may request your passport or national ID number where this information is required for identification, invoicing, administration or applicable legal requirements associated with your booking or activity.
Passport and ID information is not used for advertising or unrelated marketing purposes.
Access to this information is limited to persons who require it for legitimate operational, administrative, accounting or legal purposes.
Diving requires an appropriate level of medical fitness.
Customers may therefore be required to complete a Medical Self-Declaration Form before participating in diving activities.
The purpose of the Medical Self-Declaration is to identify whether medical clearance from a doctor is required before participation.
A positive answer on a Medical Self-Declaration does not necessarily mean that a person cannot dive. It may mean that appropriate medical clearance must first be obtained.
Where required, Gran Canaria Divers may request a medical certificate or other confirmation from an appropriately qualified doctor confirming fitness to dive.
Medical information constitutes specially protected personal data under the GDPR and is handled accordingly.
Gran Canaria Divers processes medical information only to the extent reasonably necessary for diving safety, participation requirements, documentation obligations and, where applicable, the establishment, exercise or defence of legal claims.
Medical information is not used for marketing, advertising or unrelated commercial purposes.
Access to medical documentation is restricted to persons who require access for legitimate safety, operational, administrative or legal purposes.
Personal information may also be collected on paper forms completed at Gran Canaria Divers.
This may include customer information, activity documentation, diving information, Medical Self-Declarations, medical clearance and course documentation.
Paper documentation containing personal information is kept securely and is accessible only where required for legitimate operational, safety, administrative or legal purposes.
Documents that no longer need to be retained are securely destroyed.
When you participate in a diving course, additional documentation may be required for training, certification, safety and record-keeping purposes.
This may include:
Certain course and training records may need to be retained after completion of your course.
Such documentation will be retained for as long as required by applicable law, relevant training or certification requirements, or where retention is reasonably necessary for the establishment, exercise or defence of legal claims.
Where no continuing retention requirement exists, the documentation will be securely destroyed or deleted.
Gran Canaria Divers does not retain personal data for longer than necessary for the purpose for which it was collected, subject to applicable legal and documentation requirements.
Activity and medical documentation
Paper Medical Self-Declarations and other activity documentation that is no longer required will normally be securely destroyed after the customer’s activities with Gran Canaria Divers have been completed and following their departure, provided that no legal, safety, training, certification or legitimate documentation requirement requires continued retention.
Where a document must be retained for one of those purposes, it will be kept only for the period reasonably necessary or legally required.
Course documentation
Course and training records will be retained for the period required by applicable law, relevant training or certification standards, or legitimate documentation requirements.
Invoices and accounting information
Invoices, copies of issued invoices and associated accounting documentation are retained for the periods required under Spanish tax and accounting legislation.
Electronic information
Electronic personal data will be deleted, anonymised or access-restricted when it is no longer necessary, subject to applicable legal or legitimate retention requirements.
Electronic and online payments may be processed through third-party payment service providers, including SumUp.
Where card information is entered directly into a payment provider’s payment environment, Gran Canaria Divers does not need to receive or store your complete payment-card details.
We may receive and retain information necessary to:
Payment service providers process payment information in accordance with their own privacy and security requirements.
Our website and online booking system process information necessary to provide online reservations and purchases.
This may include information entered during checkout, booking selections, order information, customer contact details, IP or technical information required for website operation and security, and payment-related transaction information.
Information provided during checkout is used primarily to process and administer your booking and fulfil associated legal and accounting obligations.
Our website may use cookies and similar technologies required for:
We may use services such as Google reCAPTCHA or similar security technologies to protect forms, accounts, bookings and other areas of our website against spam, automated activity and abuse.
Where applicable law requires consent for non-essential cookies or technologies, these will be handled through the appropriate cookie-consent mechanism.
Gran Canaria Divers may communicate with customers by email, telephone or WhatsApp where necessary to:
Communications necessary for an enquiry, booking or existing customer relationship are considered operational communications and are not treated as unrelated marketing.
We will not use medical information, passport/ID information or other sensitive information for marketing purposes.
Where personal information is used for direct marketing and consent is legally required, appropriate consent will be obtained separately.
Where processing is based on consent, that consent may be withdrawn at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Gran Canaria Divers does not sell personal data.
Personal data may be disclosed where reasonably necessary to:
Only information reasonably necessary for the relevant purpose will be disclosed.
Where a third party processes personal data on behalf of Gran Canaria Divers, appropriate data-protection requirements apply.
Some technology, communication, payment, website or service providers may process information outside Spain or the European Economic Area.
Where personal data is transferred internationally, Gran Canaria Divers requires the transfer to be made in accordance with applicable GDPR requirements and using an appropriate legal transfer mechanism where required.
Depending on the circumstances and applicable law, you may have the right to:
These rights are subject to applicable legal limitations. For example, Gran Canaria Divers may be required to retain invoices, accounting documentation, training records or other information despite a deletion request where continued retention is required by law or another lawful basis applies.
To exercise your data-protection rights, please contact:
Gran Canaria Divers S.L.
Email: info@grancanariadivers.com
We may request reasonable information necessary to verify your identity before acting on a request.
If you believe that your personal data has been processed in violation of applicable data-protection law, you have the right to lodge a complaint with the Spanish supervisory authority:
Agencia Española de Protección de Datos (AEPD)
You may also contact Gran Canaria Divers first at info@grancanariadivers.com so that we have an opportunity to address your concern.
Gran Canaria Divers takes appropriate technical and organisational measures to protect personal information against:
Access to sensitive information, particularly medical information and passport/ID information, is restricted to persons who require access for legitimate purposes.
Paper documents containing sensitive personal information are securely stored and securely destroyed when retention is no longer necessary.
Gran Canaria Divers may update this Privacy Policy where our services, systems, legal requirements or data-processing activities change.
The current version will always be made available on our website.
Last updated: August 2026
