We respect your privacy and are committed to protecting it through our compliance with this privacy policy (“Policy”). This Policy describes the types of information we may collect from you or that you may provide (“Personal Information”) on the underwaterly.com website (“Website” or “Service”) and any of its related products and services (collectively, “Services”), and our practices for collecting, using, maintaining, protecting, and disclosing that Personal Information. It also describes the choices available to you regarding our use of your Personal Information and how you can access and update it.

This Policy is a legally binding agreement between you (“User”, “you” or “your”) and Underwaterly (“Underwaterly”, “we”, “us” or “our”). If you are entering into this agreement on behalf of a business or other legal entity, you represent that you have the authority to bind such entity to this agreement, in which case the terms “User”, “you” or “your” shall refer to such entity. If you do not have such authority, or if you do not agree with the terms of this agreement, you must not accept this agreement and may not access and use the Website and Services. By accessing and using the Website and Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy. This Policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.

The controller responsible for the processing of your personal information under the GDPR is Underwaterly, Boltzmannstraße 3, 85748 Garching, Germany, Email: dpo@underwaterly.com.

Pursuant to Art. 13(1)(b) GDPR, the contact details of our Data Protection Officer are:

Simon Zilker
Email: dpo@underwaterly.com

When you open the Website, our servers automatically record information that your browser sends. This data may include information such as your device’s IP address, browser type, and version, operating system type and version, language preferences or the webpage you were visiting before you came to the Website and Services, pages of the Website and Services that you visit, the time spent on those pages, information you search for on the Website, access times and dates, and other statistics.

Information collected automatically is used only to identify potential cases of abuse and establish statistical information regarding the usage and traffic of the Website and Services. This statistical information is not otherwise aggregated in such a way that would identify any particular User of the system.

When you create an account on Underwaterly, we may collect the following types of information:

• Your name and contact details

• Profile information and preferences

• Dive logs and dive-related data

• Location information (if you choose to provide it)

We let you register and log in to Underwaterly using your Google account ("Sign in with Google"), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

To be able to offer this option, our app loads a program from Google (Google Identity Services) when you open it. Loading it transmits technical data to Google - in particular your IP address, information about your browser and operating system, and the address of the page you are viewing - before and regardless of whether you actually use the option. Without it, the "Sign in with Google" button cannot be displayed. This processing is based on our legitimate interest in offering an established and secure sign-in method alongside email and password (Art. 6(1)(f) GDPR). We do not use Google's "One Tap" sign-in prompt.

If you then select "Sign in with Google", Google transmits your name and email address to us so we can create and authenticate your Underwaterly account. This further processing is based on your consent (Art. 6(1)(a) GDPR), given by actively selecting "Sign in with Google". You can withdraw this consent at any time with effect for the future, without affecting the lawfulness of the processing carried out before the withdrawal.

Google may process this data in the United States. Google participates in the EU-U.S. Data Privacy Framework and/or relies on Standard Contractual Clauses as a safeguard for such transfers; see policies.google.com/privacy for details.

You can also create an Underwaterly account with just an email address and password, without using Google Sign-In.

We may use the collected information for the following purposes:

• Providing and improving the Underwaterly app

• Personalizing your experience and customizing content

• Processing payments, if applicable

• Communicating with you regarding updates or important information

• Analyzing app usage and trends to enhance our services

Processing your Personal Information depends on how you interact with the Website and Services, where you are located in the world and if one of the following applies: (i) you have given your consent for one or more specific purposes; (ii) provision of information is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof; (iii) processing is necessary for compliance with a legal obligation to which you are subject; (iv) processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in us; (v) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party. We may also combine or aggregate some of your Personal Information in order to better serve you and to improve and update our Website and Services.

We prioritize the security and confidentiality of your personal information. We do not sell, trade, or rent your personal information to third parties. However, we may share your information in the following circumstances:

• With your consent or as required by law

• With trusted third-party service providers who assist us in operating our app

• In response to legal requests or to protect our rights and safety

We implement reasonable security measures to protect your personal information from unauthorized access or disclosure.

We may update this Privacy Policy from time to time. We encourage you to review this page periodically for any changes. By continuing to use Underwaterly, you agree to the updated Privacy Policy.

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. These rights include:

• The right to access, update, or delete the personal information we hold about you.

• The right to rectification.

• The right to object.

• The right to restrict processing.

• The right to data portability.

• The right to withdraw consent.

You can exercise most of these rights directly in the account settings of your Underwaterly account. If you have any other request or need assistance, please contact us using the details provided below in the "Contact Us" section.

Our Website and Services use “cookies” to help personalize your online experience. A cookie is a text file that is placed on your hard disk by a web page server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you. If you choose to decline cookies, you may not be able to fully experience the features of the Website and Services.

We may use cookies to collect, store, and track information for security and personalization, to operate the Website and Services, and for statistical purposes. Please note that you have the ability to accept or decline cookies. Most web browsers automatically accept cookies by default, but you can modify your browser settings to decline cookies if you prefer.

Our Website and Services use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to help us understand how visitors use our Website and Services, such as which pages are visited and for how long.

We only load Google Analytics on the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), which you can give or withdraw at any time via our cookie settings. Data may be transferred to and processed by Google in the United States; Google participates in the EU-U.S. Data Privacy Framework and/or relies on Standard Contractual Clauses as a safeguard for such transfers.

You can find more information on Google's data practices at policies.google.com/privacy, and you can opt out of Google Analytics using the Google Analytics opt-out browser add-on.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

Stripe We offer the option to process the payment transaction via the payment service provider Stripe, ℅ Legal Process, 510,Townsend St., San Francisco, CA 94103 (Stripe). This is in line with our legitimate interest in offering an efficient and secure payment method (Art. 6 para. 1 lit. f DSGVO). In this context, we share the following data with Stripe to the extent necessary for the performance of the contract (Art. 6 para. 1 lit b. DSGVO).

• Name of the cardholder

• E-mail address

• Customer number

• Order number

• Bank details

• Credit card data

• Credit card validity period

• Credit card verification number (CVC)

• Date and time of transaction

• Transaction amount

• Name of the provider

• Place

Processing of the data provided under this section is not required by law or contract. We cannot process a payment via Stripe without the submission of your personal data. Stripe has a dual role in data processing activities as a controller and processor. As a controller, Stripe uses your submitted data to comply with regulatory obligations. This is in accordance with Stripe's legitimate interest (pursuant to Art. 6 (1) lit. f DSGVO) and serves the performance of the contract (pursuant to Art. 6 (1) lit. b DSGVO). We have no influence on this process. Stripe acts as an order processor in order to be able to complete transactions within the payment networks. Within the scope of the order processing relationship, Stripe acts exclusively according to our instructions and has been contractually obligated to comply with the provisions of data protection law within the meaning of Art. 28 DSGVO. Stripe has implemented compliance measures for international data transfers. These apply to all global activities where Stripe processes personal data of individuals in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs). For more information about opting out and opting in with Stripe, please visit: https://stripe.com/privacy-center/legal. Your data will be stored by us until the payment processing is completed. This includes the period required for processing refunds, receivables management and fraud prevention.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that our processing of your personal information infringes the GDPR.

The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach, Germany
Website: lda.bayern.de

If you have any questions or concerns about our Privacy Policy or your personal information, please contact us:

Underwaterly
Boltzmannstraße 3
85748 Garching
Germany
Email: dpo@underwaterly.com