Effective from: 19 October 2026
1. Data controller
The controller of your personal data is ReqPro, Bartosz Chrabski, with its place of business at ul. Główna 151, 05-830 Rusiec (gm. Nadarzyn), NIP 831 154 48 12, REGON 146443572, operating the Long Deco training centre (the “Controller”).
For any matter concerning personal data you can contact us by phone: +48 666 74 71 74 or by email: info@longdeco.com.
2. Purposes and legal bases of processing
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form, email, phone | name and surname, email, phone, content of the message | replying to your message and further contact | legitimate interest of the Controller (Art. 6(1)(f) GDPR) |
| Newsletter sign-up | email address | sending information about courses, trips and events | your consent (Art. 6(1)(a) GDPR) |
| Enrolment on a course or trip and its delivery | name and surname, date of birth, contact details, certification number and level, diving experience (logbook), invoicing details | concluding and performing the contract, delivering the training | performance of a contract (Art. 6(1)(b) GDPR) |
| Student medical statement | information about your health | assessing whether you can dive safely; a requirement of training standards | your explicit consent (Art. 9(2)(a) GDPR) |
| Certification | student data, photo, course result | issuing of a certificate by the training organisation (PADI, DAN) | performance of a contract (Art. 6(1)(b) GDPR) |
| Billing and accounting | invoice data | meeting tax and accounting obligations | legal obligation (Art. 6(1)(c) GDPR) |
| Establishing or defending legal claims | data necessary in the given case | protecting the rights of the Controller | legitimate interest (Art. 6(1)(f) GDPR) |
3. Recipients of data
Your data may be passed only to entities that help us run our business, and only to the extent necessary:
- provider of website and email hosting: Amazon Web Services EMEA SARL (Luxembourg); servers in the EU (Frankfurt and Ireland);
- the accounting office that keeps our books;
- training organisations that issue certificates: PADI (Professional Association of Diving Instructors) and DAN (Divers Alert Network), which are separate data controllers in this respect;
- Google Ireland Limited: Google Analytics (only with your consent) and the Google Maps and YouTube videos embedded on the website.
4. Transfers of data outside the European Economic Area
Some recipients are based outside the EEA, for example PADI in the USA and Google. In that case data is transferred on the basis of a European Commission decision finding an adequate level of protection (the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission.
5. How long we keep data
- Form messages and e-mails: for the time needed to reply and for any further correspondence, and then until the limitation period for any claims expires.
- Newsletter: until you withdraw your consent.
- Student data: for the duration of the contract, and then until the limitation period for claims expires. We may keep the data needed to confirm completed training for longer if the standards of the training organisation require it.
- Medical statements: for the period required by training standards, but no longer than 7 years from the end of the training.
- Accounting documents: for 5 years from the end of the year in which the tax payment deadline expired.
6. Your rights
You have the right to:
- access your data and receive a copy of it;
- rectify your data;
- erase your data;
- restrict processing;
- data portability;
- object to processing based on our legitimate interest;
- withdraw your consent at any time (for example, unsubscribe from the newsletter). Withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn;
- lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa.
You may also lodge a complaint with the supervisory authority in the EU member state where you live or work, or where the infringement took place.
To exercise your rights, write to info@longdeco.com. You can unsubscribe from the newsletter at any time on the page Unsubscribe from the newsletter (there is also a link in every newsletter) or by writing to info@longdeco.com.
7. Whether you have to provide data
Providing data is voluntary, but without some of it we cannot act:
- without contact details we cannot reply to your message;
- without the student’s data and the medical statement we cannot deliver the training or issue a certificate;
- without an email address we cannot send the newsletter.
8. Automated decisions and profiling
We do not make automated decisions about you and we do not profile your data.
9. Cookies and analytics
The longdeco.com website uses cookies, which are small text files stored in your browser. On your first visit we display a banner where you can accept or reject cookies other than the necessary ones. You can change your choice at any time by clicking the cogwheel icon in the bottom left corner of the page (“Change cookie settings”).
- Necessary (always on): remembering the language version of the site you have chosen and your decision about cookies.
- Analytics and external content (only with your consent):
- Google Analytics 4 (Google Ireland Limited): visit statistics, for example the number of page views, the source of the visit, approximate location and type of device. We use them to improve the website. Basis: your consent (Art. 6(1)(a) GDPR). Data may be transferred to Google LLC in the USA on the basis of the EU-US Data Privacy Framework.
- YouTube and Google Maps: embedded videos and maps may store Google’s own cookies.
Google Analytics does not run without your consent. You can withdraw your consent in the same way; this does not affect the lawfulness of processing carried out before it was withdrawn. You can also delete or block cookies in your browser settings.
10. Changes to this policy
This policy may be updated, for example when the services on the website change. The current version is always available on this page, with the effective date at the top.
