Our privacy policy establishes an auditable ledger for every customer record we keep.
Budi Dive maintains transparent data records for diver safety, NAUI course verification, and equipment rental servicing. We log operational information strictly for maritime safety compliance and technical inquiry fulfillment.
This policy is formatted as a structured technical ledger. Each entry explicitly states the legal clause, plain-language operational meaning, and the exact statutory or contractual basis that permits data processing under United States state privacy statutes and international privacy frameworks.
| Clause Identifier | Operational Meaning & Plain Summary | Legal Basis & Regulatory Reference |
|---|---|---|
|
|
This policy took effect on October 16, 2026. All digital touchpoints, including inquiry dispatches from our Tampa workshop, follow these terms until superseded by an updated ledger revision. | Statutory baseline established October 16, 2026 under Florida and United States consumer privacy standards. |
|
|
The responsible operator and data controller is Budi Dive, trading at budi-dive.shop. Physical operations and diving records are managed at 803 North Tampa Street, Tampa, Florida 33602, Tampa, Florida, United States. | Direct business identification; legal accountability under Florida commercial registration and NAUI facility standards. |
|
|
Our inquiry endpoint (mifufad.php) receives: full diver name, telephone number, email address, physical address or home city, requested service or course kind, equipment sizing or gas specifications, and safety medical waiver notes. The support chat (seba27d.php) stores live conversation text and an ephemeral token. We capture server logs containing IP address, browser user-agent, referral URL, and form timestamp. When visiting through paid marketing campaigns, we receive platform click identifiers (gclid, msclkid, fbclid). | Pre-contractual inquiry steps, maritime equipment fitting safety requirements, and defensive system security logging. |
|
|
Data is processed strictly to: calculate customized training or rental estimates, schedule boat charter seats (capped with 3 spots left), verify diver medical eligibility, calibrate regulator intermediate pressure settings to personal specifications, answer dispatch inquiries, and defend our infrastructure against spam abuse. | Service fulfillment, diving risk mitigation, life-safety equipment preparation, and server integrity preservation. |
|
|
We process communications on the basis of contract initiation or performance. We process medical acknowledgments and marketing cookies strictly on unambiguous consent. Technical network logs and bot defense honeypots operate under our legitimate interest to keep maritime communications secure and dependable. | Contractual necessity, express voluntary consent, and legitimate operational security interests. |
|
|
This website currently runs paid promotional campaigns and receives real-time traffic from Google Ads, Microsoft Advertising, and Meta Ads. When a visitor arrives via these ad networks, their query string carries a unique parameter: gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads. We do not store or transmit these identifiers unless storage consent is explicitly granted. | Campaign performance attribution and click telemetry, gated strictly by express consent prior to execution. |
|
|
We implement Google Consent Mode v2 as our core telemetry gate. On initial page load, four default security signals are set to denied: ad_storage, ad_user_data, ad_personalization, and analytics_storage. If a visitor declines cookies or dismisses the prompt, all four signals remain permanently denied. Only an explicit click on our Accept button updates these states to granted. | Google Consent Mode v2 regulatory compliance and ePrivacy Directive storage requirements. |
|
|
Data is shared only with named infrastructure providers: Google LLC / Google Ireland Ltd (Google Ads telemetry when permitted), Microsoft Ireland Operations Ltd / Microsoft Corporation (Microsoft Advertising; review their privacy practices at privacy.microsoft.com), Meta Platforms Ireland Ltd (Meta Ads attribution), our domestic Linux web hosting provider for database persistence, and our encrypted transactional SMTP mail carrier. | Data processing agreements with strict confidentiality mandates; cross-referenced via privacy.microsoft.com. |
|
|
Budi Dive operates from Florida in the United States. Inquiries originated by foreign travellers or overseas divers are routed to servers located inside the United States. Transatlantic data transfers rely upon standard contractual clauses and adequacy frameworks certified by our cloud service vendors. | Standard Contractual Clauses (SCCs) and Data Privacy Framework safeguards for cross-border communications. |
|
|
We do not retain information indefinitely. Diver inquiries, gear sizing requests, and email logs are purged after 24 months. Support chat transcripts and browser tokens are deleted after 12 months. Web server traffic logs and diagnostic connection headers are overwritten after 90 days. Stored cookie consent records under site_consent_v2 expire after 12 months. | Fixed data minimization schedules: 24 months for inquiries, 12 months for chat, 90 days for network logs. |
|
|
We enforce Transport Layer Security (TLS 1.3) across all budi-dive.shop URLs. Database storage uses authenticated access controls, rate-limited dispatch endpoints, invisible anti-spam honeypots (agency and website), and continuous intermediate-pressure bench calibration logs kept off public networks. | Technical and organizational security benchmarks pursuant to Article 32 GDPR and US state security rules. |
|
|
Divers visiting from the European Economic Area or United Kingdom hold full rights under gdpr: the right to access personal data, rectify inaccurate training credentials, demand erasure of obsolete messages, restrict processing, receive a portable export of records, object to marketing profiling, and withdraw consent at any moment without penalty. | General Data Protection Regulation (Regulation EU 2016/679 - gdpr) Articles 15 through 22. |
|
|
Under the California Consumer Privacy Act as amended (ccpa / CPRA) and related state laws in Virginia, Colorado, Connecticut, and Florida: residents have the right to know what personal details are collected, access specific data points, request deletion of non-essential records, correct inaccuracies, and opt out of any sale or sharing of personal data. Budi Dive does not sell diver personal information. | California Consumer Privacy Act (ccpa), CPRA, Florida Digital Bill of Rights, and harmonized US consumer statutes. |
|
|
Our site detects and immediately respects the global privacy control (GPC) signal transmitted via your browser headers. If your browser sends Sec-GPC: 1, optional telemetry and advertising tags remain suppressed automatically without requiring interaction with our cookie banner. | Legal recognition of automated universal opt-out signals under global privacy control specifications. |
|
|
Our digital website is not directed toward children under 16 years of age. We never knowingly collect personal data from minors online. For youth scuba certifications (such as Junior Open Water), course inquiries and liability waivers must be executed directly by a parent or legal guardian at our shop desk. | Children's Online Privacy Protection Act (COPPA) and parental consent mandates for junior diving rosters. |
|
|
If you believe our data handling infringes applicable statutes, you have the right to lodge a formal grievance with the Florida Office of the Attorney General, the California Privacy Protection Agency (CPPA) for California residents, or the supervisory authority within your European Union member state. | Direct statutory appeal paths before state Attorneys General and national data protection commissions. |
|
|
To submit an access, correction, or deletion request, email [email protected] or post written notice to 803 North Tampa Street, Tampa, Florida 33602, Tampa, Florida, United States. We verify diver identity against government photo ID or past log entries. A data request is answered within 7 days. | Formal subject access response protocol; hard guarantee that all inquiries receive determination within 7 days. |
|
|
Any modifications to our processing methods or ad partner integrations will be published directly within this ledger with an amended effective date. Significant revisions affecting diver consent are announced via notice banner for thirty days following deployment. | Public notification obligations and ongoing transparency covenants. |
|
|
Questions regarding our data ledger or safety records reach an authorized human instructor directly: email [email protected], telephone +1 (291) 555-4852, or visit our Tampa service counter at 803 North Tampa Street, Tampa, Florida 33602, Tampa, Florida, United States. | Mandatory consumer point-of-contact under US Federal Trade Commission rules and state privacy acts. |
Require diving logbook or equipment record deletion?
Execute a verified request under our formal subject access protocol.