Privacy Policy

This notice ("Privacy Policy") explains how Cibocontinental S.R.L. ("Aquagear PRO", "we") processes personal data when you use the Aquagear PRO mobile app (the "App") and, to a more limited extent, when you browse the website http://www.aquagearpro.com (the "Website"). Core features and processing are provided via the App in Europe and the United Kingdom.

1. Data Controller

Cibocontinental S.R.L.

VAT/CIF: B44726677

Address: Calle Levant 8, 07470 Port de Pollença (Illes Baleares) - Mallorca, Spain

Privacy contact: privacy@aquagearpro.com

Support: support@aquagearpro.com

2. Data We Process

2.1 Account, authentication and session (App)

• account data (e.g., email) and login credentials (not stored in plain text)
• technical authentication and security data (e.g., session tokens, token expiry/rotation)
• security logs and metadata (e.g., login events, failed attempts, device/browser)

2.2 Profile data (App)

• first name and last name (if provided)
• preferences and activity-related information (e.g., skill level) and gear/equipment information
• any additional information you choose to provide within profile/gear sections

We do not collect a physical address unless a specific feature requires it (e.g., shipping/billing). If enabled in the future, we will clearly inform users.

2.3 Map and search data (App)

• map searches, viewed areas, selected spots/facilities
• clicks to third-party external links (e.g., facility/partner websites)

2.4 Location (App)

The App may process location data depending on the permissions you grant:

• While in use: for map features and location-based content.
• Background location (optional): if you enable "Condition Alerts", the App may use location when the App is not open, only to provide the alerts you requested. You can disable the feature and/or the permission at any time in your device settings.

2.5 Camera/Photos and Push Notifications (App)

• camera and/or photo library (if you use photo upload/add-photo features)
• push notifications (if you enable alerts, including "Condition Alerts")

2.6 Future optional permissions (App)

In the future, the App may offer optional features that require additional permissions. Such permissions will be requested only if and when you enable the specific feature. Examples (not necessarily enabled at this time):

• Contacts (e.g., invites/referrals)
• Microphone (e.g., audio content, voice notes)
• Device storage/files (e.g., photos, videos, documents)

2.7 Website calculator (Website)

The Website may provide a calculator/questionnaire. Depending on the flow, it may request data such as sex, age, weight, height, skill level and gear information. The result may be displayed on-screen; if you enter an email address, we may email you the result. If you do not enter an email address, the result is displayed on screen and is not saved as a user profile - no account is created and the result is not linked to your identity.

2.8 Technical and usage data (App and/or Website)

When you use the App and/or Website we may process technical data such as IP address, device identifiers, operating system, app version, security/diagnostic logs and usage events.

3. Purposes and Legal Bases (EU/UK)

3.1 Account management, authentication and security (App)

Create/manage the account, allow login/logout, keep the session active (tokens), prevent unauthorised access and ensure security. Legal basis: performance of a service requested by you (Art. 6(1)(b) GDPR) and our legitimate interests in security (Art. 6(1)(f)).

3.2 Provide map, spots/facilities and content (App)

Enable searches and browsing of spots/facilities and related content. Legal basis: performance of a service requested by you (Art. 6(1)(b)).

3.3 Location and condition alerts (App)

Provide location-based features and, if enabled by you, the "Condition Alerts" feature. Background location is optional and used only to deliver alerts you requested. Legal basis: performance of a service requested by you (Art. 6(1)(b)) and your device permissions/voluntary activation.

3.4 Push notifications (App)

Send alerts if you enable the feature. Legal basis: your voluntary activation and device permissions.

3.5 User content uploads (photos) (App)

Allow you to add/upload photos/content in the App. Legal basis: performance of a service requested by you (Art. 6(1)(b)) and device permissions.

3.6 Weather/conditions (Open-Meteo)

Retrieve weather/conditions data to display in the App/Website. Note: the provider may process technical request data (e.g., IP and service logs). Legal basis: service performance and/or legitimate interests.

3.7 Website analytics (optional)

Google Analytics (Website, consent-based): aggregated website statistics to improve the Website. Legal basis: consent (ePrivacy Directive + Art. 6(1)(a) GDPR). If analytics is not enabled, the Website will operate without analytics cookies.

3.8 Market insights and reporting (aggregated/anonymous)

Produce aggregated and anonymised statistics (e.g., trends by age range/level/gear type) to improve the service and develop partnerships. We do not share identifying personal data with partners. Legal basis: legitimate interests (Art. 6(1)(f)).

4. User-Generated Content (App)

If the App allows you to upload content (e.g., photos), you remain the rights holder. Aquagear PRO uses such content only to provide App features. See the Terms & Conditions for more details.

5. Cookies (Website) and Similar Technologies

The Website may use cookies/similar technologies. Some are necessary; analytics cookies (Google Analytics) are used only with your consent (see Cookie Policy). In the App, device permissions and App/device settings control access to location, camera and notifications.

6. Service Providers

We use providers to support the App and Website. Depending on the service, they may act as processors or independent controllers.

• Supabase - backend and database (including Edge Functions for account deletion)
• Mapbox - maps and address/place search (geocoding)
• Open-Meteo (open-meteo.com) - weather/conditions API
• Vercel - Website hosting/infrastructure
• Google Analytics - Website analytics (consent-based, if enabled)

7. International Transfers (EEA/UK)

Some providers may process data outside the EEA/UK. Where applicable, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) included in provider agreements (e.g., Data Processing Addenda) and suitable security measures.

8. Retention and Account Deletion

To delete your account: in the App, go to Profile → Delete account. Account deletion is processed via a Supabase Edge Function. When you request deletion, we delete or anonymise your account data and revoke authentication tokens where applicable (including Apple and Google sign-in tokens).

• Identity/contact data (e.g., email, first/last name): deleted within 30 days (unless legally required otherwise).
• User photos and user-generated content: deleted within 30 days (unless you request earlier removal and it is technically feasible).
• Financial/transaction records (if applicable): retained for the period required by applicable accounting/tax laws.
• Other usage data (e.g., gear/equipment, sessions, searches): anonymised by removing the link to your identity and kept only in aggregated form.
• Security/technical logs: retained for a limited period (up to 12 months) for security and compliance.

9. Children

The App/Website are intended for a broad audience. However, subscribing to marketing/early access communications (if offered) is limited to users aged 16+. If you are under 16, please ask a parent/guardian to provide their email address for communications.

10. Your Rights

You may exercise GDPR/UK GDPR rights: access, rectification, erasure, restriction of processing, objection, data portability (where applicable), and withdrawal of consent. Contact: privacy@aquagearpro.com. You may also lodge a complaint with the competent supervisory authority - Spain: Agencia Española de Protección de Datos (AEPD); UK: Information Commissioner's Office (ICO).

11. Security

We implement appropriate technical and organisational measures, including access controls, encryption in transit, data minimisation, and security procedures to protect your personal data.

12. Updates

We may update this notice. The latest version will be published on this page with an updated date. We encourage you to review this notice periodically.