Privacy policy

Who is responsible

Les Kabourias – Grandson Diving Club, an association within the meaning of Art. 60 et seq. of the Swiss Civil Code, Grandson diving club, Ch. de Bellerive, 1422 Grandson.
Contact for any question about your data: info@kabourias.ch.

The club applies the Swiss Federal Act on Data Protection (FADP). If you live in the European Union, the General Data Protection Regulation (GDPR) also applies.

Where your data is

The website runs on Firebase (Google Cloud), with data hosting chosen in the European Union, which Switzerland recognises as providing an adequate level of protection.

Google acts as the club’s processor under its data processing terms (Cloud Data Processing Addendum). Where data is processed in the United States (account sign-in), the transfer is based on the Swiss-U.S. and EU-U.S. Data Privacy Framework, under which Google is certified, and on the standard contractual clauses.

Emails that the website sends to the committee arrive in the committee’s mailbox (comite@kabourias.ch), hosted by Infomaniak in Switzerland.

What data, and why

Visiting the website

The hosting provider records technical logs (IP address, date, page requested, browser) for the security and proper operation of the website. The club does not use any statistics or advertising tools.

Contact form

Name, email address, subject and message, so that we can reply to you.

Membership application

Name, date of birth, address, mobile number, email address, membership category, certifications, emergency contact, insurance, boat licence and comments, to process your application and welcome you to the club.

Members’ area account and profile

Email address and password (encrypted; the club does not know it), name, membership number, contact details, certification, expiry date of the medical certificate, emergency contact, insurance and boat licence. This data is used to manage your membership, to organise dives safely and to contact you. The date of the medical certificate relates to health: it is visible only to you and the committee.

Members of the school (instructors, divemasters) may enter their instructor certifications (agency, level, specialities).

Boat dives

When you sign up for a dive, your name appears in the list of divers for that dive, visible to approved members: the boat pilot and the other divers know who will be on board. Visitors to the public website only see the dates and the number of free places, never the names.

Guest divers (non-members)

First name, surname, email address, mobile number, certification, experience, insurance and message, so that the committee can decide whether it can welcome you and confirm the dive. If your request is accepted, your name appears in the list of divers for the dive, visible to approved members.

Boat and club house bookings

Date, time, number of people, purpose, boat pilot and name of the person making the request. The schedule and the waiting list are visible to approved members; the committee makes the decision.

Gear exchange

The listing is public, with your first name and the initial of your surname, its photos and its price. Your email address is not published: the buyer writes to you through the website, and you receive their name, email address, phone number if given, and message. These messages are forwarded to you by email.

Profile photo

Optional. You can add a photo to your profile; the website crops and resizes it before uploading. It is visible to you and the committee. You can change or delete it at any time from “My profile”: the file is then erased.

Copy of the boat licence (skippers)

Optional. A skipper can upload a copy of their boat licence (PDF or image) in “My profile”, so that the club can check that they are allowed to drive the boat. It is visible to them and to the website administrators. They can replace or delete it at any time: the file is then erased; it is also erased when the member’s record is deleted.

Personal calendar (subscription)

Optional. A member can subscribe their calendar (Apple, Google, Outlook…) to their dives and the club’s events. The website creates a secret link for them, which replaces signing in: the calendar app reads it regularly and receives dates, places, the skipper’s name and the number of divers signed up, without the other divers’ names. The chosen calendar service (for example Google) therefore receives this information. The member can renew the link at any time: the old one then stops working; it also stops if their account is deleted or suspended.

Question assistant

Optional. The “A question?” bubble on the public pages answers automatically from the website’s content. Your question and the current conversation are sent to Gemini, Google’s artificial intelligence model (Vertex AI), which processes it in the European Union and does not use it to train its models. Neither the club nor the website stores the questions or answers; only a count of questions per day is kept, to limit costs. Your IP address is used only, for a few minutes and in memory, to limit the number of questions per visitor. Please don’t enter personal data: for a request, use the contact form.

To stop robots from abusing the assistant, opening it loads Google’s reCAPTCHA Enterprise (through Firebase App Check): Google analyses browser and device signals and your IP address, and may set its cookies, to check that a human is asking. Nothing is loaded until you open the assistant. Google’s Privacy Policy and Terms of Service apply.

Boat dive logbook

After a dive, the skipper or the committee fills in its logbook: dive done or cancelled, dive site, divers present, how each guest paid (TWINT, cash or to be invoiced) and any remark (conditions, incident), with the name of the person who confirmed it. The logbook is stored with the dive and visible to approved members; each member sees their own dives of the year, and the committee the club’s statistics.

Events and people concerned

For a meeting or another event, the committee can name the members concerned. They receive an email with the event’s date, place and description; the committee sees their names on the event, and each member concerned sees it marked “Concerns you”.

Members’ directory

Optional. In “My profile”, each member chooses whether to share their email, phone number and address with other members. Only what they ticked appears in the directory, with their name, and only approved members can view it. They can stop sharing at any time: their entry then disappears from the directory.

Club documents

The committee uploads club documents to the members’ area (statutes, minutes, instructions) and chooses who sees them: all approved members, or only certain roles (skippers, school, Section Tech…). The committee and administrators see every document. A document may contain names (for example minutes); it is stored with the account of the person who uploaded it.

Problem reports

Signed-in members can report a problem with the website from any page. The report is stored with its author’s name, the page, the browser and the window size; only administrators can view it.

Accounting

The treasurer keeps the club’s accounts in the members’ area: entries, supporting documents (supplier invoices, receipts), club invoices and payments received. To issue invoices, the treasurer sees members’ names, addresses, email addresses and membership numbers. Invoices are sent by email, with a PDF and a Swiss QR-bill. Each member sees their own invoices and balance; the accounts can be viewed by the treasurer and by the members designated by the committee (auditors, committee). Guest divers who are invoiced are recorded with their name and email address. To match payments, the treasurer imports the credit advices from the club’s bank: for each transfer received, the website keeps the date, amount, reference, payment message, and the name and IBAN of the person who paid, as provided by the bank. To issue membership fees, the treasurer also consults the member register (contact details and membership category).

Gas fill log (Section Tech)

For authorised members: fills (date, gas, volumes, pressures, amount) and gas invoices. This data is used to invoice gases and constitutes accounting records.

Member register

The committee imports into the administration area the list of members kept in its invoicing software (Crésus): number, name, address, phone, email address, date of birth and category. It is used to keep contact details up to date and to approve members’ online accounts. From this list, the committee creates an online account for each member (name, email, contact details) without a password: members choose their own when they first sign in. A member who does not want an account can ask the committee to delete it.

Emails sent by the website

The website writes to you to confirm or decline a booking or a place on a dive, and forwards buyers’ messages to sellers. It notifies the members concerned by an event. The committee receives new requests. There is no newsletter.

Who sees your data

• You: your profile, your sign-ups, your bookings, your listings and their messages, your gas fills and invoices.
• The committee and administrators: member records, the member register, membership applications, messages, bookings, guest divers’ requests, the members concerned by an event and every club document.
• The treasurer and the auditors: the accounts, supporting documents, invoices and payments; the treasurer also sees members’ contact details in order to invoice them.
• Approved members: the names of those signed up for dives and the logbook, the booking schedule, the directory (what each member chose to share) and the documents meant for their roles.
• Everyone: published gear exchange listings and dive dates, without names.
• Technical providers: Google (hosting, sign-in) and Infomaniak (club mailboxes and email delivery), solely to provide their service.

The club does not disclose your data to any other third party, except where required by law or, in the event of an accident, to the emergency services.

Legal basis

The club processes your data to perform your membership and the services you request (sign-up, booking, listing), to comply with its legal obligations (accounting), and on the basis of its legitimate interest in organising safe dives and answering messages. For guest divers, the request is based on your consent, given by ticking the box on the form. Under the GDPR: Art. 6(1)(a), (b), (c) and (f).

How long

• Member record and profile: for the duration of membership, then 2 years after membership ends.
• Members’ area account: until you ask for it to be deleted, or 2 years after membership ends.
• Accounts, supporting documents, invoices and billing data (membership fees, gas): 10 years, as required by the Swiss Code of Obligations (Art. 958f CO).
• Dive sign-ups, logbook and bookings: 2 years after the date.
• Directory: as long as the member shares their contact details.
• Club documents: until the committee deletes them.
• Membership applications and contact messages: 1 year after they have been dealt with.
• Guest divers’ requests: 1 year after the dive.
• Gear exchange listings and buyers’ messages: until the seller deletes them, at most 2 years after the sale or withdrawal.
• Hosting provider’s technical logs: according to Google’s retention periods, usually a few weeks.
• Backups: copies of the database at most 14 weeks; monthly full backups 13 months, and they cannot be deleted earlier. Data deleted from the website disappears from the backups when they expire; if a backup has to be restored, the deletions requested in the meantime are made again.

Cookies and browser storage

The website uses neither advertising cookies nor audience measurement cookies. When you sign in to the members’ area, your browser keeps a session key (local storage) so that you stay signed in; it is removed when you sign out. Fonts are hosted on the website itself, without calling Google Fonts.

The conversation with the question assistant stays in the browser tab (session storage) and disappears when you close it. Opening the assistant loads Google’s reCAPTCHA, which may set its own cookies (see “Question assistant”).

Some pages embed Google content: YouTube videos (privacy-enhanced mode) and the map showing how to reach the club (Google Maps). The dive sites map loads its base map from the Federal Office of Topography (swisstopo), which receives your IP address but sets no cookies. When you display these pages, your browser connects to Google, which receives your IP address and may set its own cookies in accordance with its privacy policy.

Security

Communication with the website is encrypted (HTTPS). Access to data is restricted by security rules checked by the server: everyone sees only what their role allows (member, boat pilot, Section Tech, committee, administrator). Passwords are never stored in plain text.

The website is backed up automatically. Full backups are encrypted with a key that only the committee holds; every export of the data by an administrator is reported to the committee.

Your rights

You may request at any time:

• access to your data and a copy in a commonly used format;
• the correction of inaccurate data (most of it can be corrected directly in My profile);
• the deletion of your data or your account, except what the club is legally required to keep (accounting);
• the restriction of processing, or object to it;
• the withdrawal of your consent, with effect for the future.

Write to info@kabourias.ch; the club replies within 30 days. If you believe that your rights are not being respected, you can contact the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, in the European Union, the data protection authority of your country.

Changes

The club updates this text when its services change. The date of the last update is shown at the top of the page.