Privacy & Cookie Policy

Last updated: 1 November 2026

This policy explains how BookMyDives uses your personal information when you visit BMD (bookmydives.com), create an account, book a Course, or join as a School. It also explains which cookies we use and what your rights are.

1. Who we are

BookMyDives is the controller of the personal information described in this policy. Contact us about anything in this policy at [contact email].

When you book a Course, we share your booking details with the School that provides it. The School then uses them as its own controller to deliver the Course, and its own privacy notice also applies.

2. What we collect

Account details: your name, username, email address, password (stored in encrypted form), and the date you accepted our terms and chose your marketing preferences.
Booking details: the Course, dates, price, your contact details, information about the participant, dietary or other requirements, and messages about the booking.
Health information: your answers to the health and medical questions we ask at checkout, for example about heart conditions, blood clots or epilepsy. This is “special category” data and we protect it with extra care (see section 4).
Payment information: payments are handled by Stripe. We receive confirmation of payment and limited card details (such as the card type and last four digits), but never your full card number.
School details (if you join as a School): business and contact details, date of birth, phone number, address, dive association, photos, course information and payout details.
Technical information: IP address, browser and device type, pages visited and cookie information (see section 9).
Communications: emails and messages you send us, and reviews you post.

3. How we use it and our lawful basis

To create and run your account, take bookings and payments, and pass bookings to Schools. Basis: performing our contract with you.
To send service emails such as email confirmation, booking confirmations, changes and receipts. Basis: performing our contract.
To check and approve Schools, prevent fraud and spam sign-ups, and keep our website secure. Basis: our legitimate interests in running a safe and trustworthy marketplace, and preventing crime.
To send marketing emails about Courses, offers and news. Basis: your consent, which you can withdraw at any time using the unsubscribe link or by emailing us. We only send these if you ticked the marketing box.
To improve our website using statistics about how it is used. Basis: our legitimate interests (see section 9 for cookies).
To keep accounting and tax records and meet other legal duties. Basis: legal obligation.
To handle complaints, disputes and legal claims. Basis: our legitimate interests, and for health information, the establishment, exercise or defence of legal claims.

4. Health information

We ask health questions because diving with certain medical conditions can be dangerous. We collect your answers only to share them with the School running your Course, so it can decide whether you can dive safely and whether you need a doctor’s approval. We rely on your explicit consent, which you give when you answer the questions and complete your booking, and, where relevant, on the need to protect your vital interests. You do not have to give health information, but if you do not, the School may not be able to accept your booking. We keep health answers only as long as needed for your Course and any related claims (see section 7).

5. Who we share it with

Schools: the School running your Course receives your booking, contact and health details. Schools must use them only to deliver and manage your Course.
Service providers who work for us under contract: Stripe (payments), our website hosting company, email delivery services and IT support providers.
Professional advisers such as accountants, lawyers and insurers, where needed.
Authorities such as HMRC, the police or courts, when the law requires it or to prevent fraud.
A buyer of our business, if we sell or restructure it. They would have to use your information in line with this policy.

We do not sell your personal information.

6. International transfers

Some of our service providers, such as Stripe, may process data outside the UK, and Schools may be located outside the UK. When we send your information outside the UK, we make sure it is protected. We either send it to a country the UK government has confirmed provides adequate protection, or use approved safeguards such as the UK International Data Transfer Agreement or Addendum. Information that has to go to a School abroad so it can provide your Course is transferred because it is necessary for your booking.

7. How long we keep it

Account details: while your account is open. If an account has not been used for 3 years, we may delete it after warning you.
Booking and payment records: 6 years after the end of the tax year they relate to, as UK tax law requires.
Health answers: 12 months after the Course date, unless we need them longer because of an incident or claim.
Applications from Schools that we do not approve: 12 months.
Marketing preferences: until you unsubscribe, then we keep a record so we do not email you again.

8. Your rights

You have the right to:

get a copy of your personal information;
have inaccurate information corrected;
ask us to delete your information;
restrict how we use it;
object to processing based on our legitimate interests, and to direct marketing at any time;
receive information you gave us in a portable format;
withdraw your consent at any time. This does not affect anything we did before you withdrew it.

Some of these rights have exceptions, for example where we must keep records by law. To use any of these rights, email [contact email]. We will reply within one month. There is normally no charge.

9. Cookies

Cookies are small files stored on your device. We use:

Strictly necessary cookies: these keep you logged in, remember your basket and checkout, remember your currency choice and protect against fraud (including Stripe’s fraud-prevention cookies). The website does not work properly without them, so they do not need your consent.
Statistics cookies: if we use them, these tell us in aggregate how visitors use our website so we can improve it. UK law allows these without consent as long as we tell you about them and give you a simple way to object. You can object by using our cookie settings, where available, or by blocking them in your browser.
Marketing or third-party cookies (for example, advertising or social media tracking): we only use these if you agree through our cookie banner. You can change your choice at any time.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the website working.

10. Children

Our accounts are for adults aged 18 and over. If a parent or guardian books a Course for a child, the parent or guardian provides the child’s information and answers the health questions for them.

11. Security

We use appropriate technical and organisational measures to protect your information, including encrypted connections (HTTPS), encrypted passwords, restricted access and secure payment processing through Stripe. No website can be completely secure, so please use a strong password and keep it private.

12. Complaints

If you are unhappy with how we have handled your information, please contact us first at [contact email]. We will acknowledge your complaint within 30 days and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

13. Changes to this policy

We may update this policy. We will post the new version on this page and, if the changes are significant, tell you by email or on the website.