Data processing agreement

Last updated: 10 November 2026

This is a translation. The Dutch text is the one that is legally binding: read it in Dutch.

This data processing agreement is part of the club terms and applies between the club (the controller) and Spectes, Dina Appeldoornlaan 52, 1421 TD Uithoorn (Chamber of Commerce (KvK) no. 42205042), reachable at info@nextdive.app (“Nextdive”, the processor), from the moment the club agrees to the club terms. It gives effect to Article 28 of the General Data Protection Regulation (GDPR).

1. Subject and purpose

• Nextdive processes personal data on behalf of the club to provide the club features: members and roles, group dives and trips, buddy teams, rental, courses and lessons, links with the club's website, and Pro licences for members.
• At the request of the club's staff, Nextdive has an AI model write a summary of a student's progress from what the club recorded about them (courses, attendance, skills, notes and remarks), without the student's name, and keeps it with their enrollment. If the student's profile is visible to that staff member, their own logged dives go along too: Nextdive provides those as controller of the logbook, according to the student's own visibility setting.
• Not covered is what Nextdive processes as a controller itself: a diver's own account, logbook and buddies, and invoicing the club (billing details and who counted towards an invoice). Mollie processes payments under its own responsibility.

2. Data subjects and types of data

• Data subjects: members, staff, students (also without an account), participants in group dives and trips, and the club's contact persons.
• Data: name, e-mail address, phone number, date of birth (for a course with a minimum age), membership, role and whether someone is a paying member, sign-ups, waiting list and payment status, buddy teams, rented gear and sizes, attendance, skills completed and instructors' notes, staff availability, certification level (according to the member's visibility setting), whether a shared document is valid on the day of a dive or lesson (not its content), remarks with a sign-up, and what the club's website or web shop sends.
• The club does not put special categories of personal data, such as health data, in free text fields, unless that is necessary and it has a legal basis for it.

3. Instructions

Nextdive only processes the data on the club's documented instructions. Those instructions are the club terms, this agreement, and what owners and staff set and do in Nextdive. If Nextdive believes an instruction infringes the GDPR, it says so at once. If the law requires Nextdive to process data, it tells the club beforehand, unless the law forbids that.

4. Confidentiality

Everyone with access to the data on behalf of Nextdive is bound by confidentiality and only gets access as far as needed for support and administration.

5. Security

Nextdive takes appropriate technical and organisational measures (Article 32 GDPR), as described in annex 2, and adapts them when technology or risks call for it, without lowering the level of protection.

6. Sub-processors

• The club gives Nextdive general authorisation to engage the sub-processors in annex 1.
• Nextdive announces a new or replacement sub-processor to the owner by e-mail at least 30 days in advance. The club can object on reasonable grounds; if the parties cannot agree, the club can end the agreement free of charge.
• Nextdive imposes the same obligations on sub-processors as this agreement and remains responsible for them towards the club.

7. Transfers outside the EEA

The club's data is stored in the EU (Sweden). Data is only transferred outside the European Economic Area with appropriate safeguards, such as an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

8. Assisting the club

• The club can handle most requests from data subjects (access, rectification, erasure) itself in Nextdive. Where it cannot, Nextdive helps within a reasonable time. Requests Nextdive receives that concern the club, it forwards to the club.
• Where reasonable, Nextdive helps the club with a data protection impact assessment and a prior consultation of the supervisory authority.

9. Data breaches

Nextdive reports a personal data breach concerning the club's data to the owner without undue delay, and at the latest within 48 hours of discovering it. It gives what it knows: what happened, which types of data and roughly how many data subjects are affected, the likely consequences and the measures taken. The club decides whether to inform the supervisory authority and the data subjects; Nextdive helps.

10. Audits

On request, Nextdive gives the club the information needed to show that it complies with this agreement, such as a completed questionnaire or a description of its measures. The club can also, at most once a year and with 30 days' notice, have an audit done by an independent expert bound by confidentiality, at its own expense. Nextdive cooperates.

11. Term and end

• This agreement runs as long as Nextdive processes personal data for the club.
• When the club is deleted or the agreement ends, Nextdive deletes the club's personal data within 30 days, and from backups within 7 days after that, unless the law requires it to be kept. Before that, the club can ask for an export.
• While the agreement runs, these retention periods apply as well: students without an account are removed from a course a year after its last lesson, and what the club's website sends is kept in the club's log for at most 30 days.

12. Liability and order of precedence

Section 10 of the club terms applies to liability. This does not affect the parties' liability towards data subjects under Article 82 GDPR. Where personal data is concerned, this agreement prevails over the club terms.

Annex 1: sub-processors

Annex 2: security measures

• All connections use HTTPS, with security headers. The database, backups and storage are encrypted, in Microsoft data centres in the EU.
• The database is only reachable by the app, which uses no database passwords but a managed identity.
• Passwords are hashed with Argon2id and checked against known data breaches. Two-step verification and passkeys are available; secrets for two-step verification and access keys of connections are stored encrypted.
• Sign-in attempts are limited, and sign-ins and changes to sign-in details go into a security log.
• Within a club, roles and rights decide who sees and may do what. Access by Nextdive itself is limited to support and administration, with two-step verification.
• Backups are made automatically and kept for 7 days; server logs for 30 days.
• Dependencies are updated monthly, and changes to signing in, accounts and security get a security review before they go live.