Skip to content
Open the app

Data Processing Agreement

Last updated: 21 October 2026

This agreement applies between the dive shop that uses DiveHive (the "Controller") and AppMinds.dev Inc., a company incorporated in the Philippines (SEC registration no. 2026070257796-63), Behind Aya's Swiss Bakery, Sto. Niño, Puerto Galera, Oriental Mindoro 5203, Philippines (the "Processor", "DiveHive"), and forms part of the Terms of Service. It is meant to satisfy Article 28 of the GDPR and the corresponding requirements of the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

1. Subject matter, duration and nature of the processing

  • Subject: hosting and processing of the personal data a dive shop collects from its customers and staff through DiveHive.
  • Duration: as long as the shop uses DiveHive, plus the retention period in section 9.
  • Nature and purpose: storing, displaying, signing, sealing and exporting waivers and medical questionnaires; bookings and trip planning; guest records; staff scheduling.

2. Categories of data and data subjects

  • Data subjects: the shop's divers and guests, the shop's staff.
  • Data: names, contact details, nationality, birth date, emergency contacts, certification details, bookings, signed documents, medical questionnaire answers (special category / sensitive personal information), physician clearances, notes.

3. Controller instructions

The Processor processes the data only on documented instructions of the Controller, which are given by using the features of DiveHive and by written requests to support@divehive.app. The Processor tells the Controller without undue delay if it believes an instruction breaks data protection law, and may pause that instruction until it is confirmed or changed.

4. Confidentiality

Persons authorised to process the data are bound by confidentiality. Medical answers and documents are accessible only to the diver and to the shop's owners and administrators.

5. Security measures

The Processor applies appropriate technical and organisational measures (Annex 1):

  • encryption of data in transit;
  • role-based access control and separation of medical data from other records;
  • logging of access to sensitive records;
  • regular backups;
  • signed and sealed PDFs for waivers and medical forms;
  • confidentiality duties for personnel and a process for security incidents.

6. Sub-processors

The Controller gives general authorisation for the following sub-processors (Annex 2): the hosting provider (Singapore), the email delivery provider, push notification services, the weather data provider (no personal data of divers is sent to it) and the translation provider DeepL SE, Germany (receives only the text a user asks to translate, for example a shop note or message). Payment providers that a shop connects for payments from its divers are chosen by the Controller and work under the Controller's own agreement with them; they are not sub-processors of the Processor. The Processor informs the Controller of changes at least 30 days in advance, and the Controller may object on reasonable data protection grounds within that time. If the objection cannot be resolved, the Controller may end the subscription and receive a pro rata refund of the unused prepaid period.

7. International transfers

The Processor operates from the Philippines and hosts data in Singapore. Where personal data of the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, the parties rely on the standard contractual clauses (or the UK addendum) and the Processor applies the safeguards of section 5. Transfers within and from the Philippines follow the accountability rules of the Data Privacy Act.

8. Assistance and data subject rights

The Processor helps the Controller to answer data subject requests and to meet security, breach notification and impact assessment duties. A diver can access their own copies of signed documents and can export and delete their DiveHive account at any time. Records held by the shop are not deleted when a diver deletes their account: the shop keeps them as controller under its own retention rules.

9. Retention and deletion

  • Signed documents are kept for the retention period the shop sets (defaults: waivers 7 years, medical forms 2 years, unless the country of the shop requires otherwise; never less than 12 months) and are then deleted automatically.
  • When a shop is deleted, its operational data (schedule, fleet, staff, bookings, boards) is deleted after a 30-day grace period. Signed waivers, medical forms and physician clearances stay stored until their retention date and are then deleted, together with the shop record.
  • On termination, the Controller can export its data before deletion. On written request, the Processor confirms in writing that the data has been deleted.

10. Personal data breaches

The Processor notifies the Controller without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. The notice describes the nature of the breach, the data and people affected, the likely consequences and the measures taken or proposed. The Processor cooperates with the Controller so that the Controller can meet its own notification duties.

11. Audits

The Processor makes available the information needed to show compliance with this agreement. Once a year, and after a breach, the Controller may audit the Processor, or have an independent auditor bound by confidentiality do so, with reasonable written notice, during business hours and without disrupting operations. The Controller bears the cost of the audit.

12. Liability

Each party is liable for its breaches of this agreement under applicable law. The limits of liability in the Terms of Service apply, except where the law does not allow them.

13. Contact

AppMinds.dev Inc., Behind Aya's Swiss Bakery, Sto. Niño, Puerto Galera, Oriental Mindoro 5203, Philippines (SEC registration no. 2026070257796-63). Data protection contact: support@divehive.app. Data protection officer: not appointed.