Privacy Policy

This policy explains which personal data All Sea Dive Club processes when you use our website, book an activity, check in at the dive centre or contact us, why we do so and which rights you have.

1. Who is responsible

All Sea Dive Club (trading name), business owner Hany Mostafa Mohamed
Inside Gravity Samra Bay Hotel & Aqua Park, at the end of El Mamsha, Hurghada, Red Sea Governorate, Egypt
Phone / WhatsApp: +20 120 035 7771
Email: info@allseadiveclub.de

Further details are listed on our company information page.

2. Which laws apply

We are a dive centre established in Egypt, so we process personal data in accordance with the Egyptian Personal Data Protection Law (Law No. 151 of 2020) and its executive regulations. Where the EU General Data Protection Regulation (GDPR) also applies to our processing – for example because we offer our services to people in the European Union (Art. 3(2) GDPR) – we additionally state the legal bases and rights it provides.

3. Data we process and why

3.1 Visiting the website

To deliver pages, the web server necessarily receives technical data from your browser, such as your IP address, the requested address, the time and your browser information. Our hosting provider processes this data to run the website and protect it against misuse (legitimate interest, Art. 6(1)(f) GDPR).

We also keep simple visitor statistics of our own. They use no cookies. From your IP address and browser information our server calculates a code that changes every day and cannot be traced back; the IP address and the full browser information are not stored. We record the page visited, the language, the device type (for example mobile or desktop) and the country, which our server derives from the IP address using a locally stored database without contacting any third party. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, no statistics are recorded. Entries older than 30 days are deleted automatically at regular intervals during normal use of the website. The purpose is to understand which pages are used and to improve the website (legitimate interest, Art. 6(1)(f) GDPR).

3.2 Booking requests

When you send a booking request we process the activity, date and time, the number of divers and non-diving guests, your first and last name, email address, phone and WhatsApp number, country, equipment choice, your hotel and its area (required for activities whose pickup is coordinated via WhatsApp), your room number if you give it, special requests, any promo code, your chosen payment method and the time at which you accepted the medical declaration. We use this data to check availability, confirm your booking, contact you about it and prepare your activity. You will receive an email confirming that we have received your request. Legal basis: performance of a contract and steps prior to entering into a contract (Art. 6(1)(b) GDPR).

Our team adds the pickup time and meeting point once they have been agreed with you, and records the payments you make to us (amount, payment method and date). These details appear on your booking invoice (PDF). You can open the invoice through a private link in your confirmation email, on the confirmation page in the browser you booked with, and through our booking lookup with your booking reference and email address. The link only works for your booking; please do not share it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.3 Diver check-in and membership

Before your activity we ask you to complete our check-in form (online or at the dive centre). It records your name, contact details, date of birth, gender, profession, nationality, passport number and, optionally, a photo of your passport, your preferred language, your diving certification (agency, level, number, date, number of dives and date of your last dive), an emergency contact, your answers to our medical questionnaire, your acceptance of our participation terms and your signature. From this we create a membership record with a membership number, valid for one year, so that you do not have to repeat every detail on your next visit.

We need this information to carry out dives and courses safely, to check your qualification, to know whom to contact in an emergency and to document your declarations (Art. 6(1)(b) GDPR). Answers to the medical questionnaire are health data, which Egyptian law and the GDPR treat as sensitive data. We use them only to assess whether a doctor’s approval is needed before you dive. For this purpose we ask for your explicit consent in a separate checkbox on the check-in form (Art. 9(2)(a) GDPR). You can withdraw it at any time by email to info@allseadiveclub.de; the withdrawal applies to future processing only.

Passport photos and signatures are kept in non-public storage on our server and can only be opened by authorised staff in our administration area.

3.4 Contact form, email, phone and WhatsApp

If you use our contact form we process your name, email address, optional phone number, subject, the service you are interested in, your message and the page language, and send you a confirmation email. To protect the form against misuse we store only an irreversible code derived from your IP address, not the address itself. If you write to us by email or call us, we process the data you provide to answer you (Art. 6(1)(b) and (f) GDPR).

Our WhatsApp buttons are simple links. Data is only transferred when you click them and open WhatsApp; WhatsApp then processes your data under its own privacy policy.

For activities with hotel pickup, your confirmation email contains a button that opens WhatsApp with a prepared message to us (booking reference, date, number of participants, hotel and area). Nothing is sent until you send that message yourself. Once the pickup time and meeting point are agreed, our team may send them to the phone number you gave in your booking via WhatsApp. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.5 AI chat assistant

Our website has a chat assistant that can answer questions about our services. It is currently switched off: no chat is shown and no messages are sent to Google. Conversations stored while the chat was active are deleted by an automatic nightly job once they were started more than 30 days ago. We will update this policy before switching the chat on again.

3.6 Review requests

After your visit our team may send you one email with a link to leave a review on Google. This is based on our legitimate interest in feedback (Art. 6(1)(f) GDPR); you can object at any time by replying to the email.

3.7 Google reviews and map

How we display Google reviews is explained in the section “Google reviews” at the end of this page. Our contact page contains an embedded Google Maps map. When the contact page loads, your browser connects to Google servers, which receive your IP address and browser information. Information about Google’s processing is available in the Google Privacy Policy.

3.8 Cookies and browser storage

We only use technically necessary cookies: a session cookie that keeps your visit and forms working and a security cookie (XSRF-TOKEN) that protects forms against forged requests. Both expire after two hours of inactivity. The session itself is stored in our database on the hosting server together with your IP address and browser identification (user agent); expired sessions are removed automatically at regular intervals. In your browser’s storage we keep your cookie choice and an unfinished booking form (until you close the tab). These entries stay on your device.

Our cookie banner lets you allow or refuse statistics (Google Analytics) and marketing (Meta Pixel). These services are currently not activated on our website, so no such tracking takes place, whatever you choose. They would only ever load after your consent, and we would update this policy before activating them. You can change your choice at any time via “Cookie settings” at the bottom of every page.

4. Recipients and service providers

  • Hostinger hosts our website, database and email mailboxes on servers in Germany and sends our emails, such as booking confirmations.
  • WhatsApp (Meta) processes the messages you exchange with us via WhatsApp (section 3.4).
  • Google provides the Places API for the reviews section and the embedded map (section 3.7). Through the Google Business Profile API we only read the reviews of our own business profile.
  • Our staff at the dive centre in Egypt access booking, check-in and contact data to serve you.
  • PADI: if you take a PADI course with us, we pass the data needed to register your certification to PADI.
  • Public authorities, where we are legally obliged to disclose data.

We do not sell personal data.

5. Transfers to other countries

Our website data is stored on servers in Germany and is accessed by our team in Egypt. Google may process data in the United States and other countries. Where a transfer of personal data outside Egypt or the European Economic Area takes place, it is subject to the requirements of the applicable law.

6. How long we keep data

  • Visitor statistics: entries older than 30 days are deleted automatically at regular intervals.
  • Chat conversations: deleted by an automatic nightly job once they were started more than 30 days ago.
  • Session data on our server: sessions expire after two hours of inactivity and expired sessions are removed automatically at regular intervals.
  • Booking requests (including pickup details and recorded payments), check-in forms, membership records, passport photos, signatures and contact messages: these are currently not deleted automatically; they are kept until our team deletes them. When a check-in form or membership record is deleted, its signature and passport photo are deleted with it. You can ask us to delete your data at any time by email to info@allseadiveclub.de (see section 8); we will then delete it unless we are legally obliged to keep it.

7. Security

Our website is served over an encrypted connection (HTTPS). Access to the administration area is restricted to authorised staff accounts, and passport photos and signatures are not publicly accessible.

8. Your rights

Under the Egyptian Personal Data Protection Law you have the right to be informed about your personal data, to access and obtain it, to withdraw your consent, to have it corrected, completed, updated or deleted, to restrict processing to a specific scope, to be notified of a breach affecting your data and to object to processing.

Where the GDPR applies you also have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)), and you may lodge a complaint with a data protection supervisory authority (Art. 77).

To exercise your rights, write to info@allseadiveclub.de. We may ask you to confirm your identity before we answer.

9. Children

Some of our programmes are open to children. Bookings and check-in forms for children must be completed by a parent or legal guardian, who provides the child’s data and signs on their behalf. We treat children’s data as sensitive data and use it only for the requested activity.

10. Changes to this policy

We will update this policy when our services or the way we process data change. The current version is always available on this page.

Last updated: 4 November 2026