Privacy Policy

How Kefi Divers collects, uses and protects personal data of visitors and customers.

Last updated: March 2026

Privacy Policy for Kefi Divers. Learn how we collect, use, and protect your personal information when using our diving services in Chania, Crete.

1. Introduction

Kefi Divers ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (kefidivers.com) or use our diving services in Chania, Crete. By using our services, you consent to the practices described in this policy.

2. Information We Collect

We may collect the following types of personal information:

Contact Information:

Name, email address, phone number, and country of residence when you make a booking or contact us.

Booking Details:

Preferred dates, number of participants, age groups, experience level, and special requests.

Health & Medical Information:

Relevant medical conditions or fitness declarations required for safe participation in diving activities, as mandated by PADI standards.

Payment Information:

Payment details processed securely through our third-party payment providers (Stripe, PayPal). We do not store your full credit card details.

Website Usage Data:

IP address, browser type, pages visited, and time spent on our site, collected through cookies and analytics tools.

3. How We Use Your Information

We use the information we collect to:

Process and confirm your bookings for diving experiences, courses, and trips.

Communicate with you about your reservations, including confirmations and reminders.

Ensure your safety by assessing medical fitness for diving activities.

Improve our website, services, and customer experience.

Comply with legal obligations and PADI certification requirements.

4. Legal Basis for Processing (GDPR)

Under the EU General Data Protection Regulation (GDPR), we process your data based on:

Contractual necessity:

To fulfil bookings and deliver services you have requested.

Legal obligation:

To comply with applicable laws, including health and safety regulations for diving.

Legitimate interest:

To improve our services and maintain business operations.

Consent:

For marketing communications, which you may withdraw at any time.

5. Sharing Your Information

We do not sell your personal data. We may share your information with:

PADI:

For certification records and course registrations, as required by PADI standards.

Payment Processors:

Stripe and PayPal, to securely process transactions.

Boat Operators & Partners:

Essential trip details (name, participant count) to coordinate diving excursions.

Legal Authorities:

When required by law or to protect our rights and safety.

6. Cookies & Analytics

Our website uses cookies and similar technologies to enhance your browsing experience. These include:

Essential cookies:

Required for site functionality (e.g., booking forms, navigation).

Analytics cookies:

To understand how visitors use our site and improve performance.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect your experience on our website.

7. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Booking records and PADI certification data may be retained for up to 7 years in accordance with legal and regulatory requirements. You may request deletion of your data at any time, subject to our legal obligations.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Payment processing is handled by PCI-compliant third-party providers. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your Rights

Under the GDPR, you have the right to:

Access:

Request a copy of the personal data we hold about you.

Rectification:

Request correction of inaccurate or incomplete data.

Erasure:

Request deletion of your personal data ("right to be forgotten").

Restriction:

Request that we limit the processing of your data.

Portability:

Receive your data in a structured, commonly used format.

Objection:

Object to the processing of your data for certain purposes.

Withdraw consent:

Withdraw consent for marketing communications at any time.

To exercise any of these rights, please contact us using the details below.

10. Third-Party Links

Our website may contain links to third-party websites (e.g., PADI, accommodation partners). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

11. Children's Privacy

Our diving services are available to participants of various ages in accordance with PADI age requirements. For participants under 18, we require parental or guardian consent before collecting any personal information. Parents or guardians may contact us to review, update, or delete their child's information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Email:

Phone:

Location:

Kalyves, Chania, Crete, Greece