Your Privacy Matters

1

About this policy

This Privacy Policy applies to Abyss Scuba Diving Pty Ltd (ABN 41 092 353 789), trading as Abyss Scuba Diving (Abyss, we, us or our). It covers personal information we handle through our website, online accounts and bookings, our Ramsgate dive centre, phone, email and SMS communications, courses, local dives, equipment sales and servicing, events and dive travel.

We manage personal information in accordance with applicable privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles where they apply, and the Health Records and Information Privacy Act 2002 (NSW) in relation to health information where it applies. This policy should be read with our Terms and Conditions and any specific collection notice shown when we ask for information.

You may browse most public parts of our website without identifying yourself. We need accurate identifying information when it is impracticable to provide a service anonymously—for example, when processing an order, booking a course or trip, verifying a diving certification, issuing training credentials or responding to a safety matter.

2

Personal information we collect

The information we collect depends on how you deal with us. It may include:

We may also collect photographs, video, testimonials or social-media content that you provide to us, or that is created during an Abyss activity where appropriate notice or permission has been given. If you apply to work with Abyss, we may collect your employment history, qualifications, licences, references and work-entitlement information.

Please do not give us personal information about another person unless you are authorised to do so. If you book for another diver or a group, please make sure each participant receives this policy and any relevant collection notice.

3

How we collect and hold information

We usually collect personal information directly from you when you:

• create an account, make a booking or purchase, register for a course, or complete a waiver, medical questionnaire or other form;
• visit our dive centre, call, email, text, message us through social media or submit an online enquiry;
• attend a course, dive, trip, event or promotion, or ask us to service equipment; or
• subscribe to updates, enter a competition, complete a survey, leave a review or apply for a role.

We may also receive information from a person making a booking for you, your parent or guardian, an employer, school, club or group organiser, a training or certification agency, a travel supplier, a payment provider, or another party you authorise. Website information may be collected automatically through cookies and similar technologies.

Information may be held in our booking and customer-management systems, training and certification records, email and communications systems, secure cloud services, payment and accounting records, and limited paper records. Some systems are operated for us by specialist service providers.

4

Why we collect, use and disclose information

We handle personal information where reasonably necessary to:

• provide and administer courses, certifications, local dives, charters, equipment hire, trips, events, retail sales, deliveries, servicing and other requested services;
• confirm identity, age, certification, prerequisites, experience, equipment requirements and fitness to participate;
• manage accounts, bookings, schedules, waitlists, payments, deposits, refunds, invoices and customer support;
• communicate confirmations, reminders, itinerary changes, weather or safety updates and other important service information;
• register training, issue certification credentials and maintain training-quality records;
• plan travel, accommodation, diving, transfers and emergency arrangements;
• protect the health and safety of customers, staff and the public, respond to incidents and manage insurance or legal claims;
• prevent fraud, misuse and security incidents, and maintain website and business systems;
• improve our services, customer experience, website content and business operations through feedback and analytics;
• send relevant news, course, dive, travel or product marketing where you have consented or where otherwise permitted by law;
• administer competitions, surveys, promotions, reviews and loyalty or community activities; and
• meet legal, tax, accounting, regulatory, insurance and record-keeping obligations, and establish or defend legal rights.

If required information is not provided, we may be unable to complete a booking or purchase, assess whether you can safely participate, issue a certification, deliver a service or respond fully to an enquiry.

6

Children and young people

Privacy rights apply regardless of age. Where a participant is under 18, we may collect their information from the participant, a parent or guardian, or an authorised group organiser. Whether a young person can make their own privacy decision depends on their ability to understand the proposed collection, use or disclosure.

We may seek consent or confirmation from a parent or guardian where appropriate, particularly for bookings, waivers, health information, travel and the use of identifiable images. We ask parents, guardians and group organisers to provide only information that is reasonably necessary.

7

Who we may share information with

We do not sell or rent personal information. Depending on the service, we may disclose relevant information to:

• Abyss staff, instructors, Divemasters, trip leaders and contractors who need it to perform their role;
• booking, customer-management, website-hosting, cloud-storage, IT support, cybersecurity, communications, email and SMS providers, including the DiveShop360 platform;
• PADI and other training or certification organisations where needed to register training, verify qualifications or issue credentials;
• payment processors, banks, finance providers, accountants and fraud-prevention services;
• dive operators, accommodation providers, tour operators, transport providers, airlines and other suppliers involved in a trip or service you book;
• product suppliers, equipment service agents, couriers and delivery providers;
• analytics, advertising, review, survey, promotion and marketing providers, subject to your choices and applicable law;
• medical and emergency services, insurers, professional advisers and claims handlers where reasonably necessary;
• government bodies, regulators, courts, tribunals, law-enforcement agencies or other parties where required or authorised by law; and
• a prospective purchaser or adviser in connection with a genuine business sale, merger or restructure, subject to appropriate confidentiality safeguards.

We take reasonable steps to use reputable providers and to limit disclosure to what is reasonably required for the relevant purpose.

8

Overseas storage and disclosure

Some of our technology, booking, certification, payment, analytics, communications and travel providers operate or store information outside Australia. Personal information is therefore likely to be disclosed to, or processed in, the United States and may also be disclosed in New Zealand or in the destination country connected with a service or trip you book—for example, Vanuatu or Indonesia.

Our destinations and service-provider arrangements may change. It may not always be practicable to identify every country in which a provider or its subcontractors process information. You may contact our Privacy Officer for current information relevant to your booking.

Before disclosing personal information to an overseas recipient, we take reasonable steps required by Australian privacy law. Overseas recipients may also be subject to the laws of their country.

9

Payments

Card and online payments are processed using specialist payment providers and financial institutions. Abyss retains the transaction information reasonably needed to confirm, reconcile and support a payment. A payment provider may collect and handle payment-card information under its own privacy and security terms.

For your protection, do not send complete payment-card details by ordinary email, SMS or social-media message.

10

Cookies, analytics and online advertising

Our website and service providers use cookies and similar technologies. These may:

• keep the website, account, security, login, booking and shopping-cart functions working;
• remember preferences and improve usability;
• measure visits, traffic sources and interactions so we can improve content and services; and
• help measure or deliver relevant advertising where those tools are enabled.

We use analytics tools, including Google Analytics, which may collect device and interaction information. Third-party tools may set their own cookies and combine information in accordance with their privacy policies.

You can block or delete cookies through your browser settings. Some essential account, cart, checkout or booking functions may not work correctly if cookies are disabled. Where the website provides a cookie or privacy control, you can also use that control to manage available choices.

11

Marketing, email and SMS choices

Purely operational communications—such as booking confirmations, required course instructions, safety notices, trip changes and a direct response to your enquiry—are service communications. If a message also promotes a course, dive, trip, event, product or offer, we treat that message as marketing and apply the consent and unsubscribe requirements below.

We may send news, offers and information about relevant courses, dives, trips, events or products where you have consented or where otherwise permitted by law. Electronic marketing will identify Abyss and include a way to unsubscribe.

• Email: use the unsubscribe link or reply asking to unsubscribe.
• SMS: reply STOP where that option is provided, or contact us.
• Other marketing: contact our Privacy Officer using the details below.

We process electronic-marketing unsubscribe requests within the period required by law, including within five working days where the Spam Act 2003 (Cth) applies. Opting out of marketing will not prevent purely operational messages that are reasonably necessary for an active booking, purchase, account, safety matter or enquiry. We may retain a minimal suppression record so that we can respect your opt-out.

12

Photographs, video, reviews and testimonials

We may invite customers to appear in photographs or video, provide a review or share a testimonial. If we intend to use identifiable content for promotional purposes, we will seek permission or provide appropriate notice and a reasonable opportunity to opt out, depending on the circumstances.

If you do not want to be identifiable in photographs or video at an activity, please tell the instructor, trip leader or photographer as early as possible. You may also contact us about future use of content, although we may not be able to recall material already lawfully printed, published or shared by others.

13

Security, data breaches and retention

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Measures may include access controls, secure service providers, protected connections, staff procedures, system monitoring, backups and secure disposal. No online or storage system can be guaranteed to be completely secure.

If a suspected data breach occurs, we will take steps to contain and assess it. Where the Notifiable Data Breaches scheme or another law requires notification, we will notify affected individuals and the Office of the Australian Information Commissioner or another relevant authority.

We retain information only for as long as reasonably needed for the purposes described in this policy or to meet legal, tax, accounting, training, certification, safety, insurance and dispute-resolution requirements. Retention periods vary by record type. Training, certification, waiver, incident and transaction records may need to be kept longer than general enquiries or marketing records. When information is no longer required, we take reasonable steps to destroy it or de-identify it.

14

Access, correction and deletion requests

You may ask us to:

• provide access to personal information we hold about you;
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• explain the general source or handling of your information; or
• delete or de-identify information where it is no longer required or authorised to be retained.

Send your request to our Privacy Officer using the details below. We may need to verify your identity before acting. We will respond as soon as reasonably practicable and within any timeframe required by applicable law. We do not charge to make a request. If the law permits a reasonable cost for providing access, we will discuss it with you first.

In limited circumstances, the law may permit or require us to refuse access, correction or deletion. If that happens, we will provide written reasons where required and explain how you may complain.

15

Privacy questions and complaints

If you believe we have mishandled your personal information, please contact our Privacy Officer and describe the issue. We will acknowledge and investigate the complaint, may ask for further information, and will aim to provide an outcome within 30 days.

If you are not satisfied with our response, or we have not responded within a reasonable time, you may be able to complain to the Office of the Australian Information Commissioner. For a complaint about health information handled in NSW, you may also be able to contact the Information and Privacy Commission NSW. The appropriate regulator depends on the information and law involved.

16

Third-party websites and policy updates

Our website may link to booking, payment, certification, travel, social-media or other third-party services. Those services have their own privacy practices. Please review their policies before providing information directly to them.

We may update this policy when our services, systems or legal obligations change. The current version will be published on this page with an updated date. Material changes may also be communicated through our website or directly where appropriate.