Privacy Policy
This policy explains what personal data we collect through the idctenerifecanary.com website and our contact channels, why we use it, how long we keep it and what rights you have. It applies to residents of the European Economic Area and Switzerland and is drafted under Regulation (EU) 2016/679 (GDPR) and the Spanish Ley Orgánica 3/2018 (LOPDGDD).
1. Data controller
The data controller is:
- Controller: Salvatore Giglione, trading as IDC Tenerife Canary
- Address: Avenida de Rafael Puig Lluvina 9, Centro Comercial Salytien, Local 13, 38660 Adeje, Santa Cruz de Tenerife, Spain
- Website: idctenerifecanary.com
- Email: idctenerifecanary@gmail.com
- Phone / WhatsApp: +39 338 753 4400
We have not appointed a Data Protection Officer (DPO), as this is not mandatory for our activity. For any privacy matter, write to the email address above.
2. What data we process, why and for how long
The website has no contact forms or private areas: we collect your data when you write to us, when you enrol on a course and, only if you accept them, through the statistics and marketing cookies described in our Cookie Policy.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering your enquiries by email, WhatsApp or phone | Name, email, phone, content of messages | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) | Until the enquiry is closed; at most 12 months if you do not enrol |
| Enrolment and delivery of courses (Divemaster and internships, Assistant Instructor, IDC, EFR Instructor, MSDT, PADI specialties and TecRec courses) | Personal details, date of birth, ID document or passport, contact details, certifications, PADI number and eLearning account, diving experience, insurance, certification photo | Performance of the contract (Art. 6(1)(b) GDPR) | Duration of the course, then 5 years for possible claims |
| Recording diving activities and providing documentation to the authorities when the law requires it | Identity, ID document, certification, insurance and details of the dives made | Legal obligation (Art. 6(1)(c) GDPR), under Spanish and Canary Islands rules on diving activities | For the period required by those rules |
| Accommodation in our student apartments, if you request it | Name, ID document or passport, nationality, date of birth, dates of stay, payment details | Performance of the contract (Art. 6(1)(b) GDPR) and legal obligation to register guests (Spanish Royal Decree 933/2021, Art. 6(1)(c) GDPR) | 3 years for guest-registration data, as required by law |
| Help finding work after the course (advice, CV review, contacts with dive centres) | CV, certifications, experience, languages, availability | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time | Until consent is withdrawn, at most 2 years after the course |
| Assessing fitness to dive | Medical questionnaire and medical certificate (health data) | Explicit consent (Art. 9(2)(a) GDPR), required to take part safely | 5 years from the end of the course |
| Invoicing and accounting and tax obligations | Name, tax ID (NIF), address, amounts and payment details | Legal obligation (Art. 6(1)(c) GDPR) | 6 years, as required by the Spanish Commercial Code |
| Operation and security of the website | IP address, browser type, pages visited, date and time (technical logs) | Legitimate interest in keeping the website secure and working (Art. 6(1)(f) GDPR) | Normally no longer than 30 days |
| Website visit statistics (Google Analytics) | Pages visited, device, browser, approximate location, cookie identifiers | Consent via the cookie banner (Art. 6(1)(a) GDPR) | 14 months |
| Measuring advertising campaigns and showing ads to people who visited the website (Google Ads, Meta Pixel) | Pages visited, ad clicks, cookie identifiers, device and browser | Consent via the cookie banner (Art. 6(1)(a) GDPR) | According to cookie duration, at most 13 months |
| Showing embedded YouTube videos and Google Maps | IP address, cookie identifiers, interactions with the content | Consent via the cookie banner (Art. 6(1)(a) GDPR) | According to cookie duration, at most 8 months |
| Publishing course photos and videos on the website and social media | Images in which you can be recognised | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time | Until consent is withdrawn |
Without the data required for enrolment, the mandatory documentation and the medical questionnaire, we cannot let you take part in the activity. We do not sell your data, we use it for personalised ads only if you accept, and we do not take automated decisions with legal effects concerning you.
3. Who we share data with
We share your data only with those we need in order to provide our service:
| Recipient | Why | Where |
|---|---|---|
| PADI (Professional Association of Diving Instructors) | Course registration and issuing certifications | United Kingdom and USA |
| Insurance company | Activating dive insurance, if you buy it through us | EU |
| Boat service companies | Organising boat dives (participants' names) | Spain |
| Dive centres and potential employers | Job opportunities, only if you ask us to | Spain, EU and other countries |
| Google (Gmail, Analytics, Ads, YouTube, Maps) | Email; statistics, ads and embedded content (only with consent) | EU and USA |
| Meta (WhatsApp, Facebook and Instagram Pixel) | Messages and calls if you choose WhatsApp; ad measurement (only with consent) | EU and USA |
| Cloudflare, Inc. | Website hosting, content delivery (CDN) and network security; processes technical data such as IP addresses and request logs | USA, with servers in several countries, including the EU |
| Pexels and Pixabay | Streaming some of the website's background videos (they receive your IP address) | EU (Germany) |
| Tax adviser, banks and payment services (Stripe, PayPal) | Accounting, invoicing and payments | Spain / EU |
| Public authorities (including the Government of the Canary Islands and, for accommodation guests, the Spanish Ministry of the Interior) and judicial authorities | When the law requires it, for example to record diving activities or register guests | Spain |
These parties process data as processors on our behalf or as independent controllers (for example PADI for certifications, the insurer for the policy, WhatsApp for its own service).
Transfers outside the European Economic Area. The United Kingdom benefits from an adequacy decision of the European Commission. Transfers to the United States are made to providers certified under the EU-U.S. Data Privacy Framework or on the basis of the Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of the safeguards in place. If you ask us to send your CV to a dive centre outside the European Economic Area, we do so only with your explicit consent (Art. 49(1)(a) GDPR).
If the business is transferred or restructured, the data may be transferred to the new controller, who will process it for the same purposes.
4. Cookies
For details on the cookies and similar technologies used by the website, see our Cookie Policy.
5. Minors
PADI professional courses are reserved for people aged 18 or over. Some PADI specialties are open from age 15: for anyone under 18 we ask a parent or guardian to consent and sign the enrolment forms and the medical questionnaire. We do not knowingly collect data from children under 14; if we find out we have received it, we delete it.
6. Security
We apply appropriate technical and organisational measures to protect data against loss, misuse and unauthorised access: access limited to the people who need it, protected accounts and an encrypted connection (HTTPS) on the website. We require equivalent guarantees from providers who process data on our behalf.
7. Third-party websites and services
The website contains links to external services such as WhatsApp and Google Maps. When you use them, their own privacy policies apply, and we recommend reading them. The Google and TripAdvisor reviews and awards shown on the website are text and images published by us: viewing them sends no data to Google or TripAdvisor.
8. Your rights
You can exercise the following rights at any time, free of charge:
- Access: find out whether we process your data and receive a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask for your data to be deleted when it is no longer needed or if you withdraw consent.
- Restriction: ask us to temporarily suspend processing.
- Portability: receive the data you gave us in a structured format and transfer it to another controller.
- Objection: object to processing based on our legitimate interest.
- Withdrawal of consent: withdraw any consent you gave (for example for photos and videos), without affecting processing already carried out.
Write to idctenerifecanary@gmail.com stating which right you wish to exercise. We may ask you to confirm your identity. We reply within one month of the request.
9. Complaints to the supervisory authority
If you believe the processing does not comply with the law, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can also contact the authority of the EU country where you live or work.
10. Changes to this policy
We may update this policy when our services or the law change. The version in force is always published on this page, with the date of the last update. If the changes are significant, we will let you know.
Last updated: 26 October 2026