Privacy policy

This page explains which personal data DivingDeal.com uses, why, for how long, who it is shared with and how to exercise your rights. We use it only for what is described here, and we do not resell it.

Who is responsible

The data controller is Lewin Digital EOOD (UIC 207991954, ул. Цар Асен 11, 1000 Sofia, Bulgaria).

What we do with your data

1. You browse the website

• Data: the page viewed, the language, the country (inferred by our hosting provider, without keeping your IP address), the source of the visit, the type of device and the duration of the visit. No identifier, no cookie. A marker in your browser storage only indicates that you have visited before.
• Why: to know how many people visit the website (legitimate interest).
• Retention: only totals, not linked to any person, kept without limit.

2. You create an account

• Data: your email address; optional: first name, number of dives, home airport; the language. At each sign-in: IP address and browser, for the security of the account.
• Why: to create and secure your account and to find your notebooks from one device to another (performance of the service you request; legitimate interest for security).
• Retention: as long as your account exists. A sign-in stays valid for 7 days. You can delete your account at any time from “My account”; backups are erased within 28 days.

3. You save a notebook or lists

• Data: the content of your lists, and the items and dates you add to them.
• Why: to provide the feature (performance of the service).
• Retention: as long as your account exists. Before you sign in, these items stay in your browser.

4. You search for a stay or a flight

• Data: for a stay, the dates, the number of travellers, the ages of the children and the nationality you declare; for a flight, the route, the dates and the number of travellers.
• Why: to display prices and to pre-fill your search with the booking partner (your request). For a stay, this information is sent to our price providers, without your IP address or any identifier, and appears in the link to the partner. For a flight, the search is carried out by a partner's search engine, which runs in your browser with your consent to “Marketing” cookies: this partner receives your criteria and your IP address and processes them on its own behalf, under its own policy.
• Retention: kept in your browser (24 hours for the stay; the nationality until you erase it), not on our servers.

5. You subscribe to the newsletter or to offers

(website form, tick box in “My account”, sending of a conversation, “My alerts”)

• Data: your email address, the language, the country, the city you live in if you give it, the destinations and types of alerts you choose, your preference “solo, as a pair or in a group”, and proof of your consent (date and wording accepted).
• Why: to send you our emails (your consent, confirmed by a code or a link).
• Retention: until you unsubscribe. We then keep proof of your consent and of your unsubscribing for 3 years, so that we do not write to you again.

6. You ask to receive a conversation by email

• Data: your email address (which we have verified), your first name, the conversation, the language, the page and a non-reversible hash of your IP address.
• Why: to send you the conversation (your request) and, as stated before sending, to write to you with offers and news from DivingDeal.
• Retention: 12 months.

7. We personalise your offers

(only if you have accepted the newsletter or the offers)

• Data: the pages viewed and the partner links clicked when you are signed in, the additions to a notebook, and the opens and clicks in our emails. From these we infer your interests (destinations, sections) and an estimated diving level.
• Why: to suggest offers that suit you (your consent, which you can withdraw at any time).
• Retention: 12 months, on a rolling basis. This information is erased if you withdraw your consent.

We take no automated decision that produces legal effects concerning you.

8. You talk to Marina or Edith in writing

• Data: your messages (the latest exchanges in the conversation) and your first name if you have given it. An anonymous browser identifier and a daily hash of your IP address are used to limit the number of messages per day.
• Why: to write the answer (your request) and to prevent abuse (legitimate interest). Your messages are passed on for this purpose to an artificial intelligence model provider (Google, through a model access platform). If you ask her for flights, she passes the route, the dates and the number of adults to our flight search partner.
• Retention: we do not keep your messages, except when a conversation is sent by email (point 6). We only keep, unlinked to you (no first name, no IP address), the questions Marina was unable to answer, for 12 months, to improve the service. Message counters are erased after 30 days.

9. You talk to Edith out loud

• Data: your voice, transmitted live to xAI (United States) to make the conversation possible. We keep neither a recording nor a transcript. We keep a technical log: date, duration, page, account or browser identifier, hash of your IP address.
• Why: to hold the conversation (your consent: you start the call and allow the microphone); to limit abusive use (legitimate interest).
• Retention: technical log: 12 months.

10. You turn on notifications

(wallpapers, news)

• Data: a subscription identifier, your language, your region and your country (inferred when you subscribe), and the city you live in if you give it.
• Why: to send you the notifications (your consent, given by granting the permission in your browser).
• Retention: until you unsubscribe, which you can do at any time in your browser's notification settings.

11. You click a link to a partner or a business

• Data: we count the click (page and destination). Some links go through a short-link service, which may process your IP address. You then leave DivingDeal: the destination website is responsible for its own processing.
• Why: to measure the clicks we send (legitimate interest).
• Retention: our counts are totals with no identifier, kept without limit.

12. You write to us

• Data: your email address, your message and, if you give it, your name.
• Why: to reply to you (legitimate interest).
• Retention: 3 years after the last exchange.

13. Businesses featured on the website

• Data: public professional information (name, address, website, contact details, public ratings, photographs), taken from the businesses' official websites and from public directories or platforms.
• Why: to inform travellers (legitimate interest).
• Retention: as long as the listing is published. If you are an individual and this concerns you, you can ask for correction or removal at any time (see the Contact page).

14. Advertising

• Data: with your consent (“Marketing” cookies), the Meta pixel and the Google Ads remarketing tag receive the page you are viewing and, when you click to a partner, the name of its website. We send neither your email address nor your telephone number.
• Why: to measure the effect of our campaigns and to show you our ads on Meta's and Google's services (your consent, which you can withdraw at any time). Meta and Google are responsible, together with us, for this processing.
• Retention: we do not keep this information ourselves; its retention period is set by Meta and Google.

Who we share your data with

We do not sell your data. It is entrusted to service providers who work for us, by category: hosting and delivery of the website (Germany, Slovenia, United States); sending of emails; notifications; artificial intelligence model providers (text: Google; voice: xAI, United States); verification of email addresses; short links; and, if you accept it, advertising (Meta and Google, United States).

When a map or a video thumbnail is displayed, your IP address is passed to the provider of that content (base maps: United States).

The websites and services of partners that you choose to use (flight search engine, booking websites) process your data on their own behalf, under their own policy. Finally, we may disclose data to the authorities where the law requires it.

Transfers outside the European Union

Some providers are located in the United States, or in other countries outside the European Union, or process data there. When we entrust data to them, the transfer relies on the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework or, failing that, on the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, published in the Official Journal of the European Union). For the services that you activate yourself (flight search engine, videos, maps), your browser communicates directly with the provider, which processes your data on its own behalf.

Your rights

You can request access to your data, its rectification, its erasure, the restriction of or objection to its processing, and its portability, and you can withdraw your consent at any time. From “My account”, the “My data” section lets you export your data and delete your account. Every email contains an unsubscribe link.

Right to object. You can object at any time, on grounds relating to your particular situation, to the processing that we base on our legitimate interest, and, without having to give any reason, to receiving our offers and to their personalisation.

You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (КЗЛД, www.cpdp.bg) or with the data protection authority of your country (in the UK, the Information Commissioner's Office, ico.org.uk).

Cookies

See the Cookies page.

Last updated: 21 September 2026.