Privacy Policy for Vidre app
Last updated: August 6, 20261. Introduction
This Privacy Policy describes how personal data is collected and processed through the Vidre mobile application ("the App").
The App is provided by:
Sportsko udruženje Vidre
11000 Belgrade, Serbia
Company registration number: 28824971
Tax ID: 109723596
Email: divingcentervidre@gmail.com
Phone: +381 63 301 753
The entity above is the data controller responsible for your personal data.
The App is intended for members and course participants of Ronilački klub Vidre (Vidre Diving Center) in Belgrade, Serbia. It allows users to book diving activities, receive schedule updates, and communicate with instructors and other members.
This Privacy Policy explains what data is collected, why it is collected, how long it is kept, who it is shared with, and what rights you have.
2. Information We Collect
We collect only the data necessary to operate the App:
| Data | Purpose |
|---|---|
| Name | Identifying you within the club and on activity bookings |
| Email address | Account creation, authentication, service-related communication |
| Authentication credentials | Securing your account (handled by Firebase Authentication — we never see or store your password) |
| Push notification token | Delivering notifications about bookings and activities |
| Booking records | Managing your participation in dives, pool sessions and courses |
| Gear | Listing of gear an user (diver) rents from center |
| Courses | Listing of all levels and certificates user owns |
We do not collect:
- Payment or card information
- Precise location data (GPS)
- Health or medical data
- Contacts, photos, microphone or camera access
- Advertising identifiers
We do not use your data for advertising, profiling, or tracking, and we do not sell it to anyone.
3. Legal Basis for Processing
Under the Serbian Personal Data Protection Act (Zakon o zaštiti podataka o ličnosti, "ZZPL") and, where applicable, the EU General Data Protection Regulation (GDPR), we process your data on the following legal bases:
- Performance of a contract (ZZPL Art. 12(1)(2) / GDPR Art. 6(1)(b)) — to provide your membership and booking services
- Legitimate interest (ZZPL Art. 12(1)(6) / GDPR Art. 6(1)(f)) — to keep the App secure and functioning correctly
- Consent (ZZPL Art. 12(1)(1) / GDPR Art. 6(1)(a)) — for push notifications, which you may withdraw at any time in your device settings
- Legal obligation (ZZPL Art. 12(1)(3) / GDPR Art. 6(1)(c)) — where retention is required by law
4. How We Use Your Information
Your information is used solely to:
- Create and manage your user account
- Authenticate your identity
- Enable booking of diving activities, pool sessions and courses
- Facilitate communication between members and instructors
- Send notifications related to bookings, schedule changes and club activities
- Maintain the security and operation of the App
5. Third-Party Services and International Transfers
The App relies on the following processors:
| Service | Provider | Purpose |
|---|---|---|
| Firebase Authentication | Google Ireland Limited / Google LLC | User authentication |
| Firebase Firestore | Google Ireland Limited / Google LLC | Secure data storage |
| Expo Notifications | Expo (650 Industries, Inc.) | Push notification delivery |
These providers process data on our behalf and under our instructions.
International transfers. Firebase and Expo may store or process data on servers located outside Serbia and the European Economic Area, including in the United States. Such transfers are carried out on the basis of Standard Contractual Clauses approved by the European Commission and, where applicable, the corresponding safeguards recognised under the ZZPL.
Their processing is additionally governed by their own privacy policies:
- Google/Firebase: https://firebase.google.com/support/privacy
- Expo: https://expo.dev/privacy
6. Data Security
We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These include encrypted data transmission (HTTPS/TLS), access controls limiting data access to authorised club administrators, and delegated authentication so that passwords are never stored by us.
No method of electronic storage or transmission is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.
7. Data Retention
| Data | Retention period |
|---|---|
| Account data (name, email) | For the duration of your membership, then deleted within 30 days of account deletion |
| Booking history | Up to 12 months after the activity, for operational and safety records |
| Push notification token | Until you disable notifications or delete your account |
| Data subject to a legal obligation | For the period prescribed by the applicable law |
After these periods expire, data is permanently deleted or irreversibly anonymised.
8. Account Deletion
You can delete your account directly in the App, at any time, via Profile → Delete Account.
Deleting your account permanently removes your name, email address, authentication record and push notification token. Booking records may be retained in anonymised form where required for the club's operational and safety records, in which case they can no longer be linked to you.
You may also request deletion by writing to divingcentervidre@gmail.com. Requests are processed within 30 days.
9. Children's Privacy
The App is intended for members of Ronilački klub Vidre.
The club offers junior diving courses for participants aged 10 and above. Where a user is under 15 years of age, an account may only be created with the consent of a parent or legal guardian, in accordance with Article 16 of the ZZPL. The club obtains this consent as part of the junior course enrolment process, in writing, before an account is created.
Parents and guardians may at any time request access to, correction of, or deletion of their child's data by contacting us at the address in Section 12.
We do not knowingly collect personal data from a child under 15 without such consent. If we become aware that we have done so, we will delete the data without undue delay.
10. Your Rights
Under the ZZPL and, where applicable, the GDPR, you have the right to:
- Access your personal data and obtain a copy of it
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict processing in certain circumstances
- Object to processing based on legitimate interest
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand
To exercise any of these rights, contact us using the details in Section 12. We respond within 30 days.
Right to lodge a complaint
If you believe your data has been processed unlawfully, you may lodge a complaint with the Serbian supervisory authority:
Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti
Bulevar kralja Aleksandra 15, 11120 Beograd
Email: office@poverenik.rs
Phone: +381 11 3408 900
www.poverenik.rs
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last updated" date. For material changes, we will notify users through the App before the changes take effect.
12. Contact
For any questions about this Privacy Policy or the processing of your personal data:
Sportsko udruženje Vidre,
Email: divingcentervidre@gmail.com
Phone: +381 63 301 753
Belgrade, Serbia