DIVE TIMOR LDA — PRIVACY POLICY

This Privacy Policy explains how Dive Timor, LDA (“Dive Timor”, “we”, “us”, “our”) collects, uses, stores, shares, and protects personal data in connection with:

• divetimor.com — Dive Timor’s public marketing website and staff editorial admin application
• book.divetimor.com — Dive Timor’s customer booking and related forms service

This is Dive Timor’s own privacy policy. It is not a template or sample. It applies to visitors to these sites, customers who create a booking account, and authorised staff who sign in to the admin application on divetimor.com.

Application / brand association. This policy covers the Dive Timor websites and applications operated by Dive Timor, LDA at the domains above, including the staff admin application that uses Google Sign-In and Facebook Login. Public page: https://divetimor.com/privacy.

Who we are

Dive Timor, LDA
70 Avenida de Portugal, Hamahon, Kampung Alor, Dom Aleixo, Dili, Timor-Leste
Email: info@divetimor.com
Phone / WhatsApp: +670 7723 7092

What these sites do

divetimor.com is a marketing and information site for diving, courses, whale watching, accommodation, and related services in Dili. An in-app admin application on the same domain is used only by authorised Dive Timor staff to publish content and manage photos. Staff may sign in with Google Sign-In, Facebook Login, or a passkey. We do not use passwords for staff admin on the marketing site.

book.divetimor.com is our booking service. Customers, Agencies, or Staff using that site are required to create an account to book and to complete / submit related declarations. The Dive Timor diver declaration (previously hosted with our other forms) will be completed on book.divetimor.com as part of that customer account flow.

Other forms may still be available on forms.divetimor.com until they are retired or moved. Those services collect data needed to deliver the form or booking you submit.

What data we collect

Public website visitors (divetimor.com)

• Technical data that is typical of web hosting and delivery (for example IP address, browser type, and request logs), used to operate and secure the site.
• We do not require you to create an account to browse the public marketing pages.

Customers, Agencies, Staff (book.divetimor.com)

When you create a booking account or use booking and declaration forms, we may process:

• Account details you provide (for example name, email address, and login credentials or sign-in method for your booking account)
• Legally and contractually required details needed to arrange accommodation, dives, courses or other related services (for example scans of passports, medical declarations)
• Booking and contact details needed to arrange dives, courses, or related services
• Information submitted in the Dive Timor diver declaration and any other booking-related forms (for example health, experience, and emergency-contact details you choose to provide)
• Technical and session data needed to keep you signed in and to secure the booking service

Staff admin users (Google Sign-In, Facebook Login, and passkeys on divetimor.com)

See the dedicated Google user data section below for Google Sign-In. In summary, when a staff member signs in we may process:

• Name and email address from the identity provider (Google or Facebook)
• Profile image URL supplied by the provider (if any)
• Provider account identifiers needed to link the OAuth account
• OAuth tokens and scopes needed to complete and maintain sign-in
• Session data (to keep you signed in securely), which may include IP address and user agent
• Passkey / WebAuthn credentials if you register a passkey
• Staff allowlist email addresses used to decide who may sign in after the first admin is set up

Editorial and operational data

Staff may upload or edit content and photos. Associated metadata (for example alt text, credits, and tags) is stored so we can publish and manage the site.

We do not sell personal data.

Google user data

This section applies specifically to Google user data accessed when authorised staff use Google Sign-In to access the Dive Timor staff admin application on divetimor.com.

Google Sign-In is not used for public website visitors and the public parts of the booking website. Only staff who are permitted to use the admin portals for each website may access these with their Google sign-in.

What Google user data we access

When a someone chooses “Continue with Google”, our application requests basic Google account profile information required for sign-in (typically OpenID Connect scopes such as openid, email, and profile). From that sign-in we may receive and store:

Google user data	How it appears in our systems
Google account identifier	Linked to the user account so we can recognise return sign-ins
Name	Displayed in the interface and stored on the user record
Email address	Stored on the user record; used to enforce the access to parts of the system relevant to that person
Email verification status	Stored so we know the provider confirmed the email
Profile picture URL	Stored if Google supplies one; may be shown in the admin interface
OAuth access / refresh tokens and granted scopes	Stored only as needed to complete and maintain the Google sign-in session with our authentication service

We do not request Google scopes that access Gmail, Google Drive, Google Calendar, Contacts, or other Google Workspace content. We do not read your Google emails, files, or calendars.

How we use Google user data

We use Google user data only to:

• Authenticate the user and create or recognise their Dive Timor user account
• Enforce the staff email allowlist (so only authorised staff can access the administrative areas of each website)
• Maintain a secure signed-in session for the application
• Display the user’s name (and profile image, if available) in the interface
• Operate, secure, and improve the authentication and access-control features of the application

We do not use Google user data for advertising, marketing lists, credit scoring, surveillance, or any purpose unrelated to providing or improving the Dive Timor admin application’s sign-in and access functionality.

How we store Google user data

Google user data used for user sign-in is stored in our application database (hosted with our infrastructure providers) together with related session and authentication records. Access is limited to the systems and authorised staff needed to operate the admin application.

With whom we share, transfer, or disclose Google user data

We do not sell Google user data. We do not transfer or disclose Google user data to third parties for advertising, data brokerage, or any purpose other than providing or improving the Dive Timor admin application.

We may share or disclose Google user data only as follows:

• Infrastructure processors that host our database, application, and related services, and that process data on our instructions to run the Dive Timor websites and admin application
• Booking Agencies or Individuals that are genuinely making a booking on someone else's behalf, but only where they have provided that information themselves to start with</li>
• Google, as the identity provider, when you use Google Sign-In (Google’s processing of your Google Account is governed by Google’s own policies)
• Legal / emergency disclosure, where required by applicable law, or in a genuine emergency involving safety or security

We do not share Google user data with other Dive Timor customers, public website visitors, or unrelated third-party apps.

Limited use

Dive Timor’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve user-facing features that are prominent in the Dive Timor admin application’s authentication and access experience.

Data protection mechanisms

We protect personal data, including Google user data used for user sign-in, with measures appropriate to the nature of the data and our systems, including:

• Restricting Google Sign-In to the parts of the application that actually need it, not to the public marketing pages
• Enforcing a staff email allowlist, and full RBAC, for access to the administrative parts of the application
• Using encrypted transport (HTTPS) for the websites and admin application
• Storing authentication and session data in access-controlled systems
• Limiting admin access to authorised staff
• Supporting passkeys as an additional staff sign-in method where configured

Sensitive customer health or declaration data collected on book.divetimor.com is processed for booking and safety purposes under the customer sections of this policy, and is not obtained from Google Sign-In.

Scans of any document containing sensitive information, including but not limited to passports, medical declarations, are stored separately from operational business administration systems.

Retention and deletion of Google user data

We retain Google-linked account, session, token, and allowlist records for as long as needed to provide relevant access, maintain security, and meet legal or operational record-keeping needs. Session and token data may be shorter-lived than the underlying account.

To request deletion of Google user data we hold (or other personal data):

1. Email info@divetimor.com with the subject line Privacy / data deletion request.
2. Include the Google account email used for sign-in and enough detail for us to identify your request.
3. We will confirm receipt and process legitimate requests within a reasonable time, subject to any data we must retain by law or for safety, accounting, security, fraud prevention, incident, or dispute records.

You may also revoke the application’s access to your Google Account via your Google Account permissions, and use Google’s own account and privacy tools for data held by Google as the identity provider.

How we use data (purposes)

We process personal data to:

• Operate and secure the public website, booking service, and admin systems
• Create and maintain customer booking accounts
• Process bookings and the Dive Timor diver declaration (and related forms)
• Authenticate staff (including via Google Sign-In and Facebook Login) and enforce the staff email allowlist
• Authenticate users (including via Google Sign-In and Facebook Login) and enforce appropriate access to their data
• Maintain sessions and passkeys for admin access
• Publish and manage editorial content and photos
• Respond to enquiries sent to our contact addresses
• Meet legal, accounting, safety, and security obligations where applicable

Facebook and Google process sign-in according to their own policies when users use those providers on the admin site. We receive the account information needed to create or recognise a user record, as described above for Google and in the staff admin section for Facebook.

Cookies and similar technologies

Sign-in on divetimor.com uses cookies or similar storage for session and authentication (including OAuth state handling). These are required for the secured areas to function.

book.divetimor.com uses cookies or similar storage as needed for customer accounts, sessions, and booking flows. The public marketing pages on divetimor.com and book.divetimor.com do not require you to create an account.

Sharing

We share personal data only as needed to run the services described above, for example:

• Hosting, database, and infrastructure providers that process data on our instructions
• Identity providers (Google, Facebook / Meta) when users choose to sign in with them
• Where required by law, or in a genuine emergency

We do not sell personal data to third parties for marketing. For Google user data specifically, see Google user data → With whom we share, transfer, or disclose Google user data.

Retention

We keep customer booking accounts, declarations, booking records, user / staff account, session, allowlist, and related records for as long as needed to provide the services, meet safety and operational needs, and for a reasonable period afterward for security and legal records. You may request deletion as described below and in the Google user data section.

Your rights and how to request deletion

You may request access to, correction of, or deletion of personal data we hold about you in connection with these websites, your booking account, and staff admin access (including Google user data used for staff sign-in).

How to request deletion of your data

1. Email info@divetimor.com with the subject line Privacy / data deletion request.
2. Include the email address used for your booking account and/or for Google or Facebook staff sign-in (if applicable), and enough detail for us to identify your request.
3. We will confirm receipt and process legitimate requests within a reasonable time, subject to any data we must retain by law or for safety, accounting, or security (for example fraud prevention, incident, or dispute records).

If your request relates to data held only by Facebook or Google as the identity provider, you may also use those providers’ own account and privacy tools.

Children

The admin area is for authorised staff only. Booking accounts and diver declarations are for customers arranging dive and related services with us. The public marketing site is general audience information about our dive centre and is not directed at children.

Changes

We may update this Privacy Policy from time to time, including if we change how the application uses Google user data. The current version will always be published at https://divetimor.com/privacy. Material changes that affect how we use Google user data will be reflected in that published version before or when those changes take effect.

Contact

Privacy questions and data requests: info@divetimor.com

For general contact details, see Contact us.