Privacy Policy

This Privacy Policy explains how DIVCAAS ("we", "us", "our") collects, uses, stores and protects personal data when you use the DIVCAAS platform — whether accessed via web browser, the Microsoft Store app, Google Play app, or any other distribution channel.

By using DIVCAAS, you agree to the collection and use of information as described in this policy.

1 Who We Are

DIVCAAS is a professional competency assessment and portfolio management platform designed for the offshore diving industry. It is operated by the Diving Technical Authority responsible for your organisation's competency programme.

The platform is hosted on Cloudflare's global edge network. Structured data is stored in Cloudflare D1 (a managed SQLite database) and uploaded evidence files are stored in Cloudflare R2 object storage.

2 What Data We Collect

Account & Profile Data

• Full name and email address
• Diver ID / employee number
• Job role (IMCA C003 competency role e.g. D02 Ball Diving Supervisor)
• Employer / company name
• Account type (candidate, assessor, verifier, admin)

Competency & Assessment Data

• Self-assessment responses for each competency unit and item
• Assessor sign-off records including decision, notes and digital signature
• Verifier sign-off records including decision, notes and digital signature
• Evidence documents uploaded to support competency claims (PDFs, images, forms)
• Evidence review decisions and feedback notes
• Competency progress and completion status

Certificate Data

• Certificate number, issue date and expiry date
• Certificate approval status and history
• Certificate image (generated PDF/JPEG)

Activity Data

• Login timestamps and IP addresses (for security audit purposes)
• Session activity within the platform

What We Do NOT Collect

• Payment or financial information
• Passport or national ID numbers
• Medical records (beyond what you voluntarily upload as evidence)
• Location / GPS data
• Contacts, camera or microphone access

3 How We Use Your Data

4 Data Storage & Security

All data is stored on Cloudflare infrastructure — structured records in Cloudflare D1 and uploaded files in Cloudflare R2. Data is encrypted in transit using TLS 1.3 and encrypted at rest at the storage layer.

The platform is served via Cloudflare Pages with HTTPS enforced on all connections. Full technical details are published on our Security & Compliance page.

Security Measures

• All connections encrypted via HTTPS / TLS 1.3
• Multi-tenant isolation — each client organisation's data is strictly separated
• Role-based access control (candidate, assessor, verifier, administrator)
• Passwords stored using PBKDF2 hashing (100,000 iterations) — never in plain text
• Brute-force login protection with account lockout
• Signed, time-limited session tokens (HMAC)
• Server-side audit log of security events (logins, password changes, deletions)
• No sensitive data logged to external analytics services

5 Data Sharing

We do not sell your personal data to any third party.

Data may be shared only in these limited circumstances:

• Within your organisation: Assessors and verifiers assigned to you can view your portfolio data as part of the competency assessment process
• Administrators: Your organisation's DIVCAAS administrator can access your profile and certificate data for management purposes
• Service providers (sub-processors): Cloudflare (hosting, D1 database, R2 file storage), Resend and EmailJS (transactional email), Zoho (support mailbox) — see our Data Processing Agreement for the full list
• Legal requirement: If required by law, regulation or court order

No data is shared with IMCA, third-party training providers, or any other external organisations without your explicit consent.

6 Cookies & Local Storage

DIVCAAS does not use traditional browser cookies for tracking.

We use browser localStorage for:

• Storing your login session token (so you stay logged in)
• Caching evidence files locally for offline access
• Storing app preferences (theme, layout settings)

This data is stored entirely on your device and is cleared when you sign out or clear your browser data. No third-party tracking cookies are used.

7 Your Rights

Under GDPR and applicable data protection laws, you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your account and all associated data ("right to be forgotten")
• Portability: Request your data in a machine-readable format (JSON/CSV export)
• Restriction: Request we limit how we process your data
• Objection: Object to processing based on legitimate interest

You also have the right to lodge a complaint with your national data protection authority (e.g. the ICO in the UK).

8 Data Retention

We retain your data for as long as your account is active or as required by your organisation's competency management obligations.

9 Children's Privacy

DIVCAAS is a professional platform intended exclusively for adults working in the offshore diving industry. We do not knowingly collect data from anyone under the age of 18.

If you believe a minor has created an account, please contact us immediately and we will delete the account.

10 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify users via the in-app notification system.

Continued use of DIVCAAS after changes are posted constitutes acceptance of the updated policy.