Privacy Policy

FreedivingHome is a social platform dedicated to freediving, providing logbook, community, event, and marketplace-style notice-board features.

FreedivingHome is a digital notice board. It does not process payments, hold funds, provide escrow services, or act as a financial intermediary between users.

This Privacy Policy is provided under Article 13 of Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and other applicable EU and Italian data protection laws. It explains what personal data we collect, why we collect it, how long we keep it, who may receive it, and what rights you have.

1. Data Controller

No Data Protection Officer ("DPO") has been appointed as of the date of this Privacy Policy, because the controller's current assessment is that the conditions in Article 37 GDPR are not met. This assessment will be reviewed as the platform grows or if the nature, scope, context, or purposes of processing change.

2. Categories of Personal Data Collected

FreedivingHome may process the following categories of personal data.

Logbook and dive data

Logbook and dive data is voluntarily entered by users. FreedivingHome does not require users to upload medical records, medical certificates, or fitness-to-dive certifications as part of the logbook.

Dive metrics such as depth and duration are treated as activity and performance information within the platform. They are not intended to be used by FreedivingHome for medical diagnosis, health assessment, or certification purposes.

Uploaded files and malware scanning

Files uploaded by users are stored on EU-based infrastructure, including Hetzner Object Storage in the Nuremberg, Germany region.

Uploaded files are automatically scanned using ClamAV for malware detection and platform security. FreedivingHome does not extract file contents for profiling, advertising, or unrelated purposes.

Analytics

FreedivingHome uses self-hosted Umami Analytics to measure aggregate platform usage. Umami is configured without cookies, browser fingerprinting, or cross-site tracking. Analytics data is processed within the controller's EU-based infrastructure and is not shared with third parties for analytics or advertising purposes.

3. Purposes and Legal Bases for Processing

We process personal data only for the purposes listed below, each linked to a legal basis under Article 6 GDPR.

Legitimate interests balancing summary

Where FreedivingHome relies on legitimate interests under Article 6(1)(f) GDPR, those interests include:

• keeping the platform secure and reliable;
• preventing fraud, spam, abuse, and unauthorised access;
• enabling expected community interactions between users;
• maintaining logs and backups needed to operate and protect the service;
• understanding aggregate platform usage without behavioural advertising or invasive tracking.

FreedivingHome has considered the impact of these activities on users' rights and freedoms. The processing is limited to what is necessary for the relevant purpose, retention periods are restricted, and safeguards such as access controls, encryption, malware scanning, and log rotation are used. FreedivingHome does not carry out behavioural advertising, cross-site tracking, or individual advertising profiling.

3.1 User-to-user contact disclosure

When you use the "Contact" function on a marketplace-style listing or event page, FreedivingHome sends the following information to the listing owner or event organiser:

• your display name;
• the email address associated with your account;
• the message you submit through the contact form.

This allows the recipient to reply to you directly. FreedivingHome does not store the content of the submitted message after forwarding it. However, transactional email metadata relating to the delivery of the email may be retained as described in Section 4.

This disclosure is based on FreedivingHome's legitimate interest in enabling communication between community members and on your reasonable expectation when you choose to initiate contact.

4. Retention Periods

FreedivingHome keeps personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by EU or Italian law, or is necessary for the establishment, exercise, or defence of legal claims.

Backups and restricted access

FreedivingHome maintains encrypted backups of the database and uploaded files for resilience and disaster recovery. Backups are retained for up to 21 days.

Backup decryption keys are stored separately from production servers. Access to backups is restricted to authorised privileged operators only and is limited to what is necessary for security, recovery, maintenance, or legal purposes.

4.1 Account deletion

When you delete your account, FreedivingHome deletes or irreversibly anonymises your account data, profile data, logbook data, and associated user content within technically reasonable timeframes.

Residual copies may remain temporarily in encrypted backups until the relevant backup rotation cycle expires, which is no longer than 21 days.

Certain limited data may be retained for a longer period where required by EU or Italian law, or where necessary to resolve disputes, enforce terms, protect the service, or establish, exercise, or defend legal claims.

Aggregated or anonymised information that can no longer reasonably identify you may be retained for statistical, security, or service-improvement purposes.

5. Data Recipients and Disclosures

Personal data may be processed by the data controller and by authorised persons acting under the controller's instructions.

FreedivingHome may also use service providers acting as processors under Article 28 GDPR agreements. These providers process personal data only on documented instructions and for the purposes necessary to provide their services.

FreedivingHome does not sell personal data and does not share personal data with third parties for behavioural advertising.

Self-hosted components such as PostgreSQL, Redis, ClamAV, Umami Analytics, Grafana, Prometheus, and Loki are operated on EU-based infrastructure controlled by or for FreedivingHome and are not separate third-party analytics or advertising services.

User-to-user disclosures

If you use the "Contact" function for a listing or event, FreedivingHome discloses your display name, account email address, and submitted message to the relevant listing owner or event organiser, as described in Section 3.1.

Legal disclosures

FreedivingHome may disclose personal data where required to comply with EU or Italian law, a binding request from a competent authority, or where necessary to establish, exercise, or defend legal claims.

6. International Transfers

FreedivingHome's primary infrastructure is located in the European Union.

Some technical providers may involve transfers of personal data or limited technical metadata outside the EU/EEA, particularly where a provider has a US parent company or operates a global network.

Where such transfers occur, FreedivingHome relies on appropriate safeguards under Chapter V GDPR, including:

• adequacy decisions adopted by the European Commission, including the EU–US Data Privacy Framework where the recipient is actively certified and the transfer falls within the scope of that certification;
• Standard Contractual Clauses approved by the European Commission;
• supplementary technical and organisational measures where appropriate.

FreedivingHome does not knowingly transfer personal data to countries or organisations that lack an adequacy decision or appropriate safeguards under Chapter V GDPR.

7. Automated Decision-Making

FreedivingHome does not carry out profiling or automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

FreedivingHome also does not carry out behavioural advertising, cross-site tracking, or advertising profiling.

8. Children

FreedivingHome is intended for users aged 16 or older.

Where a higher minimum age applies under the law of your country of residence, that higher age applies. Where local law allows a lower digital-consent age, FreedivingHome may still apply 16 as the platform minimum unless it expressly states otherwise.

FreedivingHome does not knowingly collect personal data from children below the applicable minimum age.

If FreedivingHome becomes aware that a user is below the applicable minimum age, it will take reasonable steps to delete the account and associated personal data.

Parents or guardians who believe that a child below the applicable minimum age has registered on the platform may contact [email protected] to request review and deletion.

9. Your Rights

Under Articles 15–22 GDPR, you have the following rights regarding your personal data.

• Right of access — Art. 15 GDPR: you may request confirmation of whether we process your personal data and obtain a copy of that data.
• Right to rectification — Art. 16 GDPR: you may request correction of inaccurate personal data or completion of incomplete personal data.
• Right to erasure — Art. 17 GDPR: you may request deletion of your personal data where the applicable conditions are met.
• Right to restriction of processing — Art. 18 GDPR: you may request that we limit how we process your personal data in certain circumstances.
• Right to data portability — Art. 20 GDPR: you may request to receive personal data you provided to us in a structured, commonly used, machine-readable format, where the legal conditions apply.
• Right to object — Art. 21 GDPR: where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for legal claims.
• Right to withdraw consent — Art. 7(3) GDPR: where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decisions — Art. 22 GDPR: you have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects. FreedivingHome does not carry out this type of processing.

How to exercise your rights

You can exercise your rights by contacting:

[email protected]

FreedivingHome will respond without undue delay and in any event within one month of receiving your request. This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests. If an extension is needed, FreedivingHome will inform you within one month of receiving the request.

If FreedivingHome has reasonable doubts about your identity, it may request additional information necessary to confirm your identity before acting on the request.

Right to lodge a complaint

You have the right to lodge a complaint with the Italian supervisory authority:

You may also lodge a complaint with the supervisory authority of the EU Member State where you habitually reside, where you work, or where the alleged infringement occurred.

10. Updates to This Policy

FreedivingHome may update this Privacy Policy from time to time for legal, technical, security, or operational reasons.

The date at the top of this page indicates when the Privacy Policy was last updated.

If changes materially affect your rights or the way FreedivingHome processes your personal data, FreedivingHome will take reasonable steps to notify you in advance where required or appropriate, for example by email to the address associated with your account or by a prominent notice within the platform.

Where a change requires your consent under applicable law, FreedivingHome will request that consent separately.

11. How to Contact Us

For privacy, legal, or GDPR-related requests: