01 Personal data

Privacy Policy

Last updated: 15 August 2026

Preamble

This policy describes how Dive With Lau (hereinafter "we") collects, uses and protects the personal data of people who visit the website divewithlau.com (hereinafter "the Site") or who take part in our diving activities, in accordance with Regulation (EU) 2016/679 ("GDPR") and Belgian data protection legislation.

It applies only to natural persons. It may be amended at any time; the version in force is the one published on the Site, together with its update date.

Data Controller

The data controller is:
Dive With Lau — Laurent Larfa
Rue de la Chapelle, Belgium
Email: laurent.larfa@gmail.com
Phone: +33 6 71 33 96 27

Data Collected

Via the Site's contact form

  • Identity: first name, last name;
  • Contact details: email address, phone number (optional);
  • Your diving plans: type of service, level, number of people, preferred dates, preferred language, free-text message.

In the course of our diving activities

When you enrol in a course, outing or trip, we may collect:

  • Identification data: date and place of birth, nationality, language;
  • Postal address;
  • Emergency contact person to be notified in the event of an accident;
  • Billing and payment data;
  • Health data: diver medical questionnaire (standard PADI forms) and, where applicable, a medical certificate issued by a physician. This data is essential to assess your fitness to dive and to guarantee your safety. It is processed only with your explicit consent.

Through browsing the Site

  • Technical server logs (IP address, pages visited, timestamps), for security and proper operation of the Site;
  • Access credentials for protected areas reserved for students.

How Data Is Collected

Data is collected directly from you: when you request information via the contact form or WhatsApp, when you enrol in a course or outing, or when a trip is being prepared.

Some data may also be communicated to us by third-party organisations in the course of our activities, notably PADI (certification history) and DAN Europe (diving insurance).

Purposes and Legal Bases

  • Responding to your requests for information or quotes — legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR);
  • Organising and performing diving courses, outings and trips (enrolment, planning, certification, invoicing) — legal basis: performance of a contract (Art. 6(1)(b) GDPR);
  • Assessing your medical fitness to dive — legal basis: your explicit consent (Art. 9(2)(a) GDPR);
  • Ensuring your safety and communicating the necessary information to authorised persons and medical staff in the event of an accident — legal basis: protection of vital interests (Art. 6(1)(d) and 9(2)(c) GDPR);
  • Complying with our legal obligations, notably accounting and tax obligations — legal basis: legal obligation (Art. 6(1)(c) GDPR);
  • Keeping you informed of our activities when you are already a client — legal basis: legitimate interest (Art. 6(1)(f) GDPR), with the option to object at any time.

Your data is not subject to any automated decision-making or profiling.

Recipients of the Data

Your data is never sold. It is disclosed only to the following recipients, strictly to the extent necessary:

  • PADI, to register your certifications, with your agreement;
  • DAN Europe, if you take out diving insurance;
  • Medical staff and emergency services, in the event of an accident;
  • EmailJS, the technical provider that delivers messages sent via the contact form;
  • OVH, the Site's hosting provider, which accesses data only for the technical needs of the service;
  • The competent authorities, where required by law.

Transfers Outside the European Union

The contact form uses the EmailJS service, whose servers may be located outside the European Union (notably in the United States). This transfer is governed by the appropriate safeguards provided for by the GDPR (standard contractual clauses and/or certification under the EU–US Data Privacy Framework). No other transfer outside the EU is carried out on our initiative.

Retention Periods

  • Contact requests without follow-up: 3 years from your last contact;
  • Health data (medical questionnaires and certificates): 3 years from your last contact;
  • Billing data: 7 years from the date of your last purchase, in accordance with accounting and tax obligations;
  • Other administrative data (diver file, certifications): 10 years from your last contact.

At the end of these periods, the data is deleted or anonymised.

Security

We implement appropriate technical and organisational measures to protect your data: encrypted communications with the Site (HTTPS), restricted access to protected areas, access limited to authorised persons only, and secure storage of paper documents (medical questionnaires, liability releases).

Your Rights

Under the GDPR, you have the following rights:

  • Right of access: obtain confirmation that your data is being processed and receive a copy of it;
  • Right to rectification: have inaccurate or incomplete data corrected;
  • Right to erasure: request the deletion of your data, under certain conditions;
  • Right to restriction: request the temporary suspension of processing, under certain conditions;
  • Right to object: object to processing based on our legitimate interest, and at any time to direct marketing communications;
  • Right to data portability: receive the data you have provided to us in a structured, machine-readable format;
  • Right to withdraw your consent at any time, for processing based on consent, without affecting processing already carried out.

To exercise these rights, contact us at laurent.larfa@gmail.com. Proof of identity may be requested. We will respond within one month, extendable by two months for complex requests.

If you believe your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority: dataprotectionauthority.be, or with the supervisory authority of your country of residence.

Cookies and Local Storage

The Site uses no advertising, audience-measurement or tracking cookies. Only technical elements strictly necessary for the operation of the Site may be used (for example, locally storing your display preferences in your browser). These elements do not identify you and are not transmitted to any third party; they do not require a consent banner.

External Links

This policy applies only to the Site. Third-party websites accessible via links (PADI, DAN Europe, WhatsApp, etc.) have their own privacy policies, which we invite you to consult.

Contact

For any question relating to this policy or the processing of your data: laurent.larfa@gmail.com — +33 6 71 33 96 27.