Privacy Policy

Last updated: 01 September 2026

1. Who we are

Surrey Hills Diving Ltd ("Surrey Hills Diving", "we", "us" or "our") operates the Surrey Hills Diving website, membership service and online booking system.

Surrey Hills Diving Ltd is the data controller for the personal information described in this Privacy Policy. This means that we are responsible for deciding how and why your personal information is used and for ensuring that it is handled in accordance with applicable UK data protection law.

This Privacy Policy explains what personal information we collect, why we use it, how long we retain it, who we may share it with, and the rights you have in relation to your information.

2. Who this policy applies to

This policy applies to personal information relating to:

• representatives and users of member dive centres, dive clubs and other member organisations;
• individuals making or managing bookings;
• divers, staff and other attendees whose details are supplied as part of a booking;
• visitors to our website; and
• individuals who receive communications from Surrey Hills Diving.

A member organisation may provide personal information about other people when making or managing a booking. For example, a dive centre or club may provide the names of divers attending the site or the registration numbers of vehicles being brought onto the site.

3. Personal information we collect

The information we collect depends on how you interact with Surrey Hills Diving.

Account and membership information

When an account is created or managed, we may collect:

• your name;
• your email address;
• the dive centre, dive club or other organisation you represent;
• your organisation's membership level; and
• information associated with the administration and status of your account.

Booking information

When bookings are made or managed, we may collect and retain information including:

• booking dates;
• products and services booked;
• quantities;
• parking reservations;
• prices;
• discounts and membership credits;
• payment status; and
• booking status and booking history.

Member users may be able to view current and previous bookings associated with their organisation.

Attendee and vehicle information

Members may provide information relating to people attending Surrey Hills Diving, including:

• attendee names; and
• vehicle registration numbers.

This information is used to administer visits to the site and to maintain appropriate attendance and site records.

Attendance manifests are also used as part of Surrey Hills Diving's site health and safety procedures.

Payment information

Where online or other electronic payments are available, we may record information such as:

• the amount payable or paid;
• payment status;
• date of payment;
• payment provider; and
• transaction or payment reference numbers.

We do not intend to collect or store complete payment-card numbers or card security codes within the Surrey Hills Diving booking system. Card payment information is processed by our payment provider.

Communications

We may retain information relating to communications with us, including enquiries, booking correspondence and administrative communications.

Where permitted, we may also use contact details to provide news, updates or information relating to Surrey Hills Diving. Marketing communications will be handled separately from communications that are necessary to administer your membership, account, bookings or visits to the site.

4. How we obtain personal information

We may obtain personal information:

• directly from you when you create an account, communicate with us or make or manage a booking;
• from the dive centre, dive club or other member organisation that you represent;
• from another authorised user of your organisation's Surrey Hills Diving account;
• when a member organisation supplies attendee or vehicle information in connection with a booking;
• from our payment provider when a payment is made; and
• from accounting and other service providers where necessary to administer our services.

If you provide personal information about another person, such as an attendee's name or vehicle registration, you should ensure that you are authorised to provide that information and that the individual understands that their information will be provided to Surrey Hills Diving for the administration of their visit and associated site records.

5. Why we use personal information

We only use personal information where we have an appropriate reason to do so under data protection law.

Providing membership and booking services

We use account, membership and booking information to:

• create and administer member accounts;
• identify the organisation and membership level associated with an account;
• provide access to the booking system;
• process and manage bookings;
• apply the appropriate membership pricing, booking rules, discounts and credits;
• manage parking reservations;
• communicate about bookings;
• maintain booking history; and
• provide member users with access to bookings associated with their organisation.

Where these activities relate to providing services under an agreement with you or your organisation, we generally process the information because it is necessary to perform that agreement or to take steps connected with it.

Where the agreement is with an organisation rather than directly with the individual concerned, we may instead rely on our legitimate interests in administering our membership and booking services.

Managing attendance and site safety

We use attendee names, vehicle registrations and associated booking information to:

• identify people and vehicles expected on site;
• prepare and maintain daily attendance manifests;
• manage access to and operation of the site;
• support our health and safety procedures;
• establish who was recorded as attending the site on a particular date; and
• investigate incidents, queries or disputes where necessary.

We process this information because it is necessary for our legitimate interests in operating Surrey Hills Diving safely and effectively, maintaining appropriate site records, and protecting Surrey Hills Diving, our members, visitors and staff.

Payments and accounting

We use payment and transaction information to:

• collect and reconcile payments;
• determine whether bookings have been paid;
• produce and administer invoices;
• maintain financial records;
• manage credits or adjustments;
• investigate payment queries; and
• comply with our accounting, tax and other legal obligations.

Depending on the particular processing involved, we rely on performance of a contract, our legitimate interests in administering our business, and compliance with legal obligations.

Service and administrative communications

We use contact information to send communications necessary for the operation of Surrey Hills Diving, including:

• account and membership information;
• booking confirmations;
• amendments or cancellations;
• payment information;
• important information relating to an upcoming visit;
• changes affecting booked services; and
• important operational or safety information.

These are service communications and are separate from marketing communications.

News and marketing communications

We may send news, updates and information about Surrey Hills Diving where we are permitted to do so.

Where required, we will obtain consent before sending electronic marketing communications. Where another lawful basis or an applicable electronic-marketing exemption allows us to communicate without prior consent, we will only do so where the relevant legal requirements are met.

Marketing communications will provide an appropriate means of opting out or unsubscribing.

Opting out of marketing communications will not prevent us from sending service or administrative messages that are necessary in connection with your account, membership, bookings or visits.

6. Who we share personal information with

We do not sell personal information.

We may share personal information with third parties where this is necessary to operate Surrey Hills Diving, provide our services, process payments, maintain financial records, meet legal obligations, or protect the safety and legitimate interests of Surrey Hills Diving, our members, visitors and staff.

Depending on the services being used, these third parties may include:

Website and hosting providers

Our website and booking system are hosted using services provided by GoDaddy and associated infrastructure providers.

These services may process or store information necessary to operate the website and booking system, including account information, booking information, attendee information and technical information relating to use of the website.

Payment providers

Where electronic payments are made, payment information may be provided directly to our payment provider, such as SumUp.

The Surrey Hills Diving booking system may receive and retain information relating to the transaction, such as the payment amount, payment status and transaction reference.

We do not intend to store complete payment-card numbers or card security codes within our own booking system.

Payment providers may process personal information in accordance with their own legal obligations and privacy terms.

Accounting providers

We may provide relevant customer, invoice, booking and payment information to our accounting software provider, such as QuickBooks, where this is necessary for invoicing, accounting, financial reconciliation and record keeping.

Only information reasonably necessary for these purposes will be transferred.

Email and communications providers

We use third-party systems and infrastructure to send booking confirmations, administrative messages, operational information and other communications.

These providers may process information such as names, email addresses and the content or delivery status of messages on our behalf.

Professional advisers and authorities

We may disclose personal information where reasonably necessary to:

• accountants, legal advisers, insurers or other professional advisers;
• emergency services or other relevant organisations where required in connection with an incident;
• regulators, law enforcement agencies, courts or public authorities where required by law; or
• establish, exercise or defend legal claims.

Surrey Hills Diving staff and authorised users

Access to personal information within Surrey Hills Diving is limited according to operational need.

Authorised Surrey Hills Diving staff and administrators may access booking and attendance information where necessary to operate the site, administer memberships and bookings, manage payments, prepare manifests, deal with customer enquiries or fulfil other legitimate business functions.

Users of member organisations may access current and historical booking information associated with their own organisation. They are not intended to have access to bookings belonging to unrelated organisations.

We take reasonable steps to ensure that organisations processing personal information on our behalf provide appropriate protection for that information.

7. International transfers

Some of the third-party services we use may process, store or provide access to personal information from countries outside the United Kingdom.

Where our use of a service results in a restricted transfer of personal information outside the UK, we will take reasonable steps to ensure that an appropriate transfer mechanism is in place as required by UK data protection law.

Depending on the destination and service provider, this may include:

• UK adequacy regulations;
• recognised contractual safeguards; or
• another lawful mechanism permitted under UK data protection law.

The exact locations used by our service providers may change as their infrastructure and services develop.

Further information about relevant safeguards may be available from us on request.

8. How long we keep personal information

We do not keep personal information for longer than we reasonably need it.

Different types of information are retained for different periods depending on why the information was collected, our operational requirements, health and safety considerations, accounting and tax requirements, and the need to establish or defend legal claims.

Our current retention approach is as follows.

Member accounts

Account and membership information will normally be retained while the organisation remains a member of Surrey Hills Diving or while the account remains active.

When an account or membership ends, we may continue to retain limited information where it remains associated with historical bookings, financial records, attendance records or other information that we have a legitimate or legal reason to retain.

Where information is no longer required, we may delete or anonymise it.

Booking records

We normally retain booking records for up to three years after the relevant booking or visit.

This allows us to:

• deal with queries relating to previous bookings;
• maintain an appropriate operational history;
• investigate disputes or incidents;
• administer credits and adjustments where relevant; and
• maintain records reasonably required for the operation of the business.

Information forming part of a financial or accounting record may be retained for longer.

Attendance records and manifests

Attendee names, vehicle registration numbers and associated attendance information may normally be retained for up to three years following the relevant visit.

We retain these records because attendance manifests form part of our site health and safety arrangements and may also be relevant to the investigation of incidents, insurance matters, operational queries or legal claims.

Where information is no longer required for these purposes, it will be deleted or anonymised where reasonably practicable.

Financial and accounting records

We normally retain invoices, payment records, transaction references and other accounting information for at least seven years where they form part of our financial records.

UK tax and company law may require certain accounting records to be kept for specific periods. We may retain information for longer where required because of an ongoing transaction, enquiry, compliance check, dispute or other legal requirement.

Marketing information

Where you have subscribed to, consented to or otherwise lawfully receive marketing communications, we may retain your contact details and marketing preferences while those communications remain relevant.

If you opt out of marketing, we may retain limited information on a suppression list so that we can respect your request not to receive future marketing communications.

Technical and security information

Technical logs and security information may be retained for shorter periods where they are required for website operation, troubleshooting, fraud prevention, security monitoring or investigation of misuse.

Retention periods for these records may vary depending on the system involved.

Extending retention periods

We may retain information for longer than the periods described above where it is reasonably necessary because of:

• an accident, incident or health and safety investigation;
• a complaint or dispute;
• an insurance matter;
• actual or anticipated legal proceedings;
• a regulatory or law enforcement request;
• an outstanding financial matter; or
• another legal obligation.

When information is no longer required, we will take reasonable steps to delete it, anonymise it, or ensure that access to it is appropriately restricted.

9. How we protect personal information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Measures may include:

• restricting access to personal information according to user role and operational need;
• requiring users to authenticate before accessing member or administrative areas;
• limiting member users to booking information associated with their own organisation;
• restricting wider booking and attendance information to authorised Surrey Hills Diving staff and administrators;
• using encrypted connections when information is transmitted through the website;
• maintaining appropriate website, hosting and software security measures;
• keeping software and systems appropriately maintained and updated;
• using reputable third-party providers for payment processing, hosting, email and accounting services; and
• avoiding the storage of complete payment-card details within the Surrey Hills Diving booking system.

No internet-based system can be guaranteed to be completely secure. We therefore regularly review the measures used to protect the information held within our systems and will respond appropriately where a security incident is identified.

10. Your data protection rights

Depending on the circumstances and the way in which we use your personal information, UK data protection law may give you a number of rights.

These may include:

Right of access

You may ask us for confirmation that we are processing your personal information and request a copy of the personal information we hold about you.

Right to rectification

You may ask us to correct personal information that is inaccurate or to complete information that is incomplete.

Where appropriate, member users may also be able to update certain information directly through the Surrey Hills Diving booking system.

Right to erasure

In some circumstances you may ask us to delete personal information that we hold about you.

This right is not absolute. We may need to retain information where there is an ongoing lawful reason to do so, including where information forms part of:

• financial or accounting records;
• attendance or health and safety records;
• an ongoing booking or contractual relationship;
• an incident, complaint or insurance matter; or
• information required for the establishment, exercise or defence of legal claims.

Where appropriate, information may be anonymised rather than deleted.

Right to restrict processing

In certain circumstances you may ask us to restrict how we use your personal information.

For example, this may apply while we investigate a dispute about the accuracy of information we hold.

Right to object

Where we rely on legitimate interests to process your personal information, you may have the right to object to that processing.

We will consider any objection in accordance with applicable data protection law and the circumstances of the processing.

You have the right to object to the use of your personal information for direct marketing.

Right to data portability

In certain circumstances, where processing is based on consent or contract and is carried out by automated means, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format.

Withdrawal of consent

Where we rely specifically on your consent to process personal information, you may withdraw that consent at any time.

Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

Exercising your rights

If you wish to exercise any of these rights, please contact us using the details provided below.

We may need to ask for information that allows us to confirm your identity before providing personal information or acting on a request.

Data protection rights are subject to certain limitations and exemptions, and not every right will apply in every circumstance.

We will respond to requests within the period required by applicable data protection law.

11. Cookies and website information

Our website may use cookies and similar technologies that are necessary for the website, account login and booking system to operate correctly.

These may include cookies used to:

• maintain a logged-in session;
• provide account and booking functionality;
• maintain website security;
• remember information necessary to provide a service requested by the user; and
• support the technical operation of the website.

Cookies that are strictly necessary for a service requested by the user may be used without obtaining prior consent.

If we use analytics, advertising or other non-essential cookies, we will provide appropriate information about those cookies and obtain consent where required before they are placed on a user's device.

We do not currently intentionally use the Surrey Hills Diving website for behavioural advertising or advertising-based tracking.

Some services supplied as part of our website hosting or other website infrastructure may collect limited technical information about website usage. We periodically review the services and cookies operating on our website to ensure that our privacy information remains accurate.

Where required, further information about specific cookies may be provided through a separate cookie notice or cookie preference tool.

12. Automated decision-making

We do not currently use personal information to make solely automated decisions that have legal or similarly significant effects on individuals.

Some aspects of the booking system operate automatically. For example, membership level may affect:

• prices;
• available products;
• booking availability;
• booking limits;
• discounts or credits; and
• other booking rules.

These functions apply predefined membership and booking rules and are not intended to constitute automated decision-making with legal or similarly significant effects for the purposes of UK data protection law.

13. Contacting us about your personal information

If you have questions about this Privacy Policy, wish to exercise a data protection right, or have concerns about how we have handled your personal information, please contact:

Surrey Hills Diving Ltd

Email: info@surreyhillsdiving.co.uk

Postal address: ...

You do not normally need to pay a fee to exercise your data protection rights.

14. Complaints

If you have concerns about how Surrey Hills Diving has used your personal information, we encourage you to contact us first so that we can investigate and respond.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Information about making a complaint is available from the ICO at:

https://ico.org.uk/

You may exercise your right to complain to the ICO whether or not you have contacted us first.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to:

• the Surrey Hills Diving website or booking system;
• the information we collect;
• the services we provide;
• third-party service providers;
• our business practices; or
• applicable legal or regulatory requirements.

The date at the top of this policy will show when it was last updated.

Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected users where appropriate.