Privacy Policy
This Privacy Policy explains why SSI Training Centers obtain your personal data for the purposes of conducting your training, issuing certifications, administration of your private information and any other necessary specifics regarding the performance of this agreement. We review this Privacy Policy periodically for compliance with changes to the GDPR (General Data Protection Regulation) and other relevant regulations. When necessary, we will update the Policy to comply with new requirements. SSI and SSI Training Centers jointly determine the purpose, scope and delivery of training content, processing, issuing and delivering certifications and administration of your personal data stored in the MySSI system at SSI International GmbH, Johann-Hoellfritsch-Straße 6, 90530 Wendelstein, Germany, Email: info@diveSSI.com, Tel:+49-9129-9099380.
If you have questions or you would like a copy of the Joint Controller Agreement which describes the arrangement above and the safeguards of protecting your personal data, go to the following link: https://my.divessi.com/ssi_dc_joint_controller_agreement, or contact SSI at privacy@diveSSI.com.
1. SSI Authorized Training Center “Data Controller” SSI Training Center Name: Ocean First, LLC, 3015 Bluff Street, Boulder, Co 80301
2. Personal Data “Personal data” is any information relating to an individual person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, by reference to information such as a name, identification number, location data, or online identification. Name(s), address(es), telephone number(s), e-mail address(es), user ID(s), credit card number(s), social media account ID(s), login username(s), IP address(es) and GPS data are considered personal data.
3. Processing Your Personal Data SSI International GmbH, SSI Training Centers, your SSI Instructor and other SSI Professionals may all be involved in your training, processing, and delivery of your certification, therefore we need to collect and process the following personal data: • First and Last Name • Address, Post Box • Postcode, City • State, Country • Email Address • Telephone Numbers (optional) • Date of Birth • Gender • Photo • Language • SSI Master ID • Course Type, Course Progress • Certification Data (Number, Date, Instructor, Instructor Number, Number of Certification Dives, Certification Year) • Training Center Affiliation • MySSI App Geo Locations • Medical Information • Insurance Data (when applicable) • SSI Professional Number (only for SSI Professionals) • Quality Assurance Data (for Professionals) NOTE: The personal data we collect is for the sole purpose of delivering training content, processing, issuing and delivering certifications, and administration of your personal data stored in the MySSI system. With your registration in the MySSI system, you will be able to access everything SSI – Digital Training Materials, Digital DiveLog, Certification Cards and more at the SSI website www.divessi.com or on the MySSI mobile app. Additionally, SSI International GmbH (SSI), your SSI Training Center, SSI Instructors and SSI Professionals will have access to your personal data for training and certification purposes. For more information you may go to the SSI Privacy Policy at https://my.divessi.com/myssi_privacy. Here you will learn more about data processing, MySSI, the associated services provided by SSI and how your certification card is automatically processed upon your completion of training. When you initially register at MySSI you will receive an email from SSI with your Username and Password. Additionally, you will be provided a link to the SSI Privacy Policy describing how your personal data will be used. Activation of your MySSI account is mandatory to access your personal profile, training progress, certifications, education level and much more. Upon completion of all academic, pool and open water training, SSI will process your digital certification card information – Your Name, Customer Number (Master ID), SSI Training Center, Certifying Instructor, Year You Started Diving, Level of Experience, Number of Dives, and Issue Date. All this information is accessible through our MySSI account. The described processing is necessary for the performance of a contract (Article 6 (1) (b) General Data Protection Regulation). By registering in MySSI, you are consenting to share your personal data: Name (First and Last), Address (Postbox), Postcode (Zip), City, State, Country, Email Address, Telephone Numbers (optional), Date of Birth, Photo, Language, Gender, SSI Master ID, Course Type, Course Progress and Certification Information (Name, SSI Training Center, Certifying Instructor, Year You Started Diving, Level of Experience, Number of Dives and Issue Date), plus your Training Center Affiliation. Additionally, you are consenting to share all personal information voluntarily provided by you and stored in MySSI (e.g. – specific diving insurance policies (when applicable), Medical Statement for Student and Professional) for processing certification through other SSI Service Centers. You may choose to affiliate or do business with any SSI Service Center or SSI Training Center around the world. For a complete list of all Service Centers and Training Centers log on to https://my.divessi.com/ssi or https:// my.divessi.com/divecenter. By giving your consent, SSI Training Centers may subsequently access your personal data described above in order to identify you, verify or confirm the status of your training and certifications and to offer you continued training and services based on your diving experience. For more information on the relevant data processing and data sharing accessed in the MySSI system, go to MySSI Privacy Policy https:// my.divessi.com/myssi_privacy. Legal basis for the described processing is consent (Article 6 (1) (a) General Data Protection Regulation).
4. Special rules for youth under the age of 16 Youth under the age of 16 cannot participate in any SSI training without the explicit consent of their parent or legally appointed guardian. Personal data for youth under the age of 16 is only used for conducting training and issuing certifications as described above. Youth under the age of 16 who visit www.diveSSI.com cannot register or use the MySSI system without consent from their parent or legal guardian. SSI strongly recommends that the parent or legal guardian closely monitor their youth’s internet activities until they are of legal age.
5. Transferring your personal data to third parties In the event of a diving incident or a complaint against an SSI Professional, your SSI Training Center may transfer your personal data to SSI (SSI International GmbH, Johann-Hoellfritsch-Straße 6, 90530 Wendelstein, Germany) by email to info@diveSSI.com. As required by law, it may also be necessary to forward this same information to other SSI Service Centers or third parties involved in a case or in the performance of this agreement, e.g. – insurance companies, public authorities or other companies affiliated with SSI. This is only as necessary for fulfilling the training requirement, complying with legal obligations and ensuring our legitimate interests. Your SSI Training Center will also transfer your personal data to SSI while storing and processing your personal data. If necessary, this includes the Medical Statement for either the student or the SSI Instructor/Professional for the administration and processing of your training and certifications managed by SSI in the MySSI system – my.diveSSI.com. The purpose of processing and storing your personal data is necessary for the legitimate interests pursued by SSI (Article 6 (1) (f) General Data Protection Regulation). We may also transfer your personal data to the following service providers in order to complete your training: • IT service providers and/or providers of data hosting services; • Service providers of software solutions who also support SSI in providing services including marketing tools, marketing agencies, communication service providers and call centers; • Third parties that provide service to you, e.g. - parcel services for the shipment of your credentials, payment service providers and banks for processing payment; • Other necessary third parties, e.g. - auditors, insurance companies, legal representatives, etc.; • Officials and other public entities as required by law, e.g. - tax authorities, etc.; and, • Industry partners within the dive industry for the purpose of personalized advertising of diver training, products and services with the user’s consent. This includes, for example, advertising for diving insurance, membership for divers, promotion of local training programs and events conducted by Training Centers, etc. The processing is necessary for the purposes of the legitimate interests pursued by us (Article 6 (1) (f) General Data Protection Regulation). SSI will transfer your personal data to external service providers only when third parties are processing the data on our behalf. We will enter into a data processing agreement to ensure that both the security of your data and our information is only used in accordance with our Privacy Policy.
6. Transferring your personal data to third parties outside of the US/EU/EEA SSI will transfer your personal data to SSI Service Centers or other contractual partners outside the US/EU/EEA for verification of your SSI training and certifications. However, such transfers do not change anything in our obligation to protect your personal data in accordance with this Privacy Policy. We will only transfer personal data to a third party or international organization if the controller has provided the appropriate safeguards. When information is transferred outside the US/EU/EEA and whether this is to an SSI affiliate or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by the EU Commission approved standard contractual clause; https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection/data-transfers-outside-eu/model-contracts-transferpersonal-data-third-countries_en. For more information on appropriate Privacy Shield certification go to: https://www.privacyshield.gov, or for a vendor’s Processor Binding Corporate Rules, see: https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection/ data-transfers-outside-eu/binding-corporate-rules_en.
7. Data Security SSI takes an appreciable amount of technical and organizational security to protect your personal data from unintentional or unauthorized modification, deletion, loss, theft, viewing, forwarding, reproduction, use, alteration or access. SSI and our staff comply with confidentiality and data privacy regulations. Likewise, all authorized agents who have access to your personal data to fulfill their professional duties are also subject to the same obligations of confidentiality and data privacy.
8. Data Retention SSI will retain your personal data to the extent permitted in the Privacy Policy. After the end of that relationship, SSI will only retain your records to perform the purposes set out in this agreement. Additionally, SSI and local law may require your SSI Training Center to retain your training records for an extended period of time. While in other cases, SSI may only need to retain your personal data for as long as it takes for administration purposes and to protect itself from any legal claims. For more information about SSI data retention policies, go to; https:// my.divessi.com/myssi_privacy. In the case of a registered user that does not activate the MySSI account and does not get certified within 12 months after registration, the user data and account will automatically be user disabled from the MySSI system. For more information about the MySSI data retention policies, go to MySSI Privacy Policy at https://my.divessi.com/myssi_privacy. 9. Your Rights Your rights regarding SSI processing and storage of your personal data: • You have the right to access and receive a copy of your personal data at SSI, Art. 15 General Data Protection Regulation (GDPR). • If your personal data is incorrect or no longer current, you have the right to modify the information, Art. 16 GDPR. • You have the right to obtain verification your personal data has been deleted from MySSI, (“right to be forgotten”), Art. 17 GDPR. • You have the right to receive a copy of your personal data in a commonly used and legible format. You also have the right to know that we may transmit your data to another controller Art. 20 GDPR. • You have the right to obtain a copy of any restriction of processing where the prerequisites have been met, Art. 18 GDPR. • You have the right to not be the subject of a decision based solely on an automated process, including profiling, which may result in legal consequences or any similar affect concerning you, Art. 22 GDPR. 10. Your right to object Where your personal data is concerned for the use of direct marketing, you have the right to object to that use. Additionally, if we process your data even for legitimate reasons, you also have the right to object at any time if grounds develop out of your specific situation. So that SSI may process your inquiry regarding the rights listed above and ensure your personal data is not given to any unauthorized third parties, please email SSI a short description and clear direction regarding your request to object and or modify your personal data stored at SSI. You also have the right to file a complaint with the data protection authority. In particular, the data protection authority in the country or state of your residence or place of work, if you believe that processing your personal data violated applicable data protection laws, Art. 77 GDPR.
By signing this Privacy Policy, I agree to be responsible for the content of this page.
[signature]