Privacy Policy

1. Controller

The controller for data processing on this website and in the nepqon web app is:

nepqon GbR
Marc Siepenkötter und Marco Müglich GbR
Gartenstraße 13
56332 Wolken
Deutschland

E-Mail: info@nepqon.com
Telefon: +49 171 7073852

Data protection contact

Marc Siepenkötter
E-Mail: info@nepqon.com

2. General information on data processing

Protecting personal data matters to us. We process personal data exclusively within the scope of statutory provisions, in particular the General Data Protection Regulation (GDPR).

nepqon is used by authorised administrators, dive instructors and other authorised users to manage and document training progress within dive education.

3. Which data we process

In the course of using nepqon we process the following personal data in particular:

  • master data of dive students (e.g. first and last name)
  • contact and address data of dive students
  • training data and training progress
  • dives documented as part of the training
  • instructor notes and training assessments
  • user accounts of administrators and dive instructors
  • login and access credentials
  • technical usage data (e.g. IP address, browser information, login timestamps)

4. Purposes of processing

Processing takes place for the following purposes:

  • providing and operating the web app
  • user management and access control
  • documenting training status
  • managing dive students and dive instructors
  • quality assurance within the training
  • IT security and abuse detection
  • error analysis and system stability

5. Legal bases for processing

Processing takes place pursuant to Art. 6(1)(b) GDPR in order to carry out pre-contractual measures and to provide the platform functions.

Where data is maintained by administrators or dive instructors as part of legitimate training processes, processing additionally takes place on the basis of Art. 6(1)(f) GDPR, based on our legitimate interest in structured, secure and traceable training documentation.

6. Access and recipients

Access to personal data is granted exclusively to authorised persons under the role and permission concept:

  • administrators
  • authorised dive instructors
  • technically authorised system administrators

Contact and address data of dive students is visible to administrators only.

Data is not passed on to unauthorised third parties.

Where technical service providers are used for hosting, database operation or maintenance, this takes place exclusively within the framework of processing on our behalf pursuant to Art. 28 GDPR.

7. Retention period

We store personal data only for as long as this is necessary for the respective purposes.

Student and training data is generally stored for as long as an active training or documentation purpose exists.

Once the purpose no longer applies, the data is deleted, unless statutory retention obligations prevent this.

Server log files are generally deleted after 30 days.

8. Data security

We use technical and organisational security measures to protect personal data against loss, manipulation, unauthorised access and other unauthorised processing.

These include in particular:

  • password-protected user accounts
  • role-based access restrictions
  • encrypted data transmission (SSL/TLS)
  • restricted visibility of sensitive student data
  • logging of administrative access

9. Rights of data subjects

Under the GDPR, data subjects have the following rights in particular:

  • right of access (Art. 15 GDPR)
  • right to rectification (Art. 16 GDPR)
  • right to erasure (Art. 17 GDPR)
  • right to restriction of processing (Art. 18 GDPR)
  • right to data portability (Art. 20 GDPR)
  • right to object (Art. 21 GDPR)
  • right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

10. Contact form on this website

When you write to us via the contact form, we process the data you enter: your name, your email address, the optional subject of your enquiry and the content of your message.

This data is transmitted by email to our mailbox only and stored there in order to handle your enquiry. It is not stored in a database on this website.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at entering into a contract, and otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering enquiries.

We delete your enquiry once it has been dealt with conclusively and no statutory retention obligations prevent this.

11. Reach measurement with Umami

To measure reach, this website uses Umami, open-source analytics software that we host ourselves on our own server. The data collected does not leave our infrastructure: it is not passed to any third party and not transferred to a third country.

We process the page visited, the previously visited page (referrer), browser type and version, operating system, device type, screen resolution, language setting, approximate country of origin, and the date and time of the visit. Your IP address is processed only briefly, in order to derive a pseudonymous identifier that changes daily; the address itself is not stored. This means we cannot connect the data to you personally.

Umami uses no cookies and neither stores nor reads any information on your device. Consent under § 25 TDDDG is therefore not required.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in understanding how our website is used and improving it on that basis.

We delete the data collected in this way after twelve months.

You may object to this processing at any time under Art. 21 GDPR; an informal message to info@nepqon.com is sufficient. Independently of that, most common content blockers already prevent the measurement technically.

12. Changes to this privacy policy

We reserve the right to adapt this privacy policy where technical or legal changes make this necessary. The version current at the time of use applies.