Privacy policy

The short version

We’re M&M Jervis Bay: Mim and Mark, two SSI instructors. We collect what we need to book, fit and run your session. Anything extra, like photos, only if you say yes.
Your fit-to-dive questionnaire lives in SSI’s MySSI system (adults) or on a paper form signed by a parent (under 18s). Snorkel guests sign our snorkel waiver. Our website never asks health questions.
Square handles bookings, invoices, reminders, gift cards and payments. We never see your full card number.
We only post photos of you if you’ve said yes. You can change your mind any time.
We only send marketing if you’ve said yes. Booking messages and reminders aren’t marketing.
Some of the services we use store information overseas, including in the United States.
You can ask to see or correct your information, or make a complaint, by messaging us. Details are in sections 17 and 18.

The full policy follows.

1. Who we are

1.1 “We”, “us” and “our” means M&M Jervis Bay. M&M Jervis Bay is the registered business name of a sole trader based in NSW (ABN 99 768 149 271). The business is run by two SSI instructors, Mim and Mark.

1.2 We run scuba and snorkel sessions in pools and at beaches around Jervis Bay and Nowra. We don’t have a shop.

1.3 How to reach us about privacy:

WhatsApp or phone: 0481 759 272
Email: mmjervisbay@gmail.com

1.4 Mim looks after privacy questions for the business.

2. What this policy covers

2.1 This policy explains how we handle personal information: information that identifies you, or could reasonably identify you.

2.2 We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For health information we also follow the NSW Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW).

2.3 It covers our website, our booking page on Square, phone calls, WhatsApp, SMS, email, our Instagram and Facebook pages, and what happens at your session.

2.4 You can ask for this policy in another form (for example, printed or read to you). It’s free.

3. The information we collect

3.1 Contact and booking details. Your name, phone number, email address, the session you want, how many people, preferred dates, and whether anyone is under 18.

3.2 Participant details. For each person in the water: name, date of birth, shirt size and shoe size. If you book a Skills Update, your certification level. We check it in your SSI app, or on your certification card or a photo of it (from any agency).

3.3 Messages. What you tell us by phone, WhatsApp, SMS, email, our website forms or social media messages.

3.4 Payment and gift card details. Square processes your payment. We see your name, what you paid for, the amount, and limited card details such as the card type and last four digits. We never see or store your full card number. For gift cards we also hold the buyer’s and recipient’s names and email addresses.

3.5 SSI training records. Your MySSI account details, the programs you’ve done with us and any certification SSI issues.

3.6 Health information. See section 4.

3.7 Photos and video. Only if you’ve agreed. See section 10.

3.8 Website use. Counts of visits and pages viewed, collected without cookies. See section 12.

3.9 Incident records. If something goes wrong at a session, we write down what happened, which may include health information.

3.10 We don’t collect government identifiers such as your Medicare, passport or driver licence number.

3.11 Staying anonymous. You can ask us general questions without giving your name. To book, we need your real name. SSI needs it to register your training.

4. Health information

4.1 Health information is “sensitive information” under privacy law. We only collect it with your consent, and only when we need it to check you’re fit to dive or snorkel and to plan and run your session. The exception is an incident or emergency: then we may record health information without asking first, if we need it to help you or someone else.

4.2 Adults. Before your session you complete SSI’s medical questionnaire (or fit-to-dive screening) and participation forms in SSI’s MySSI app or website. Your answers are held by SSI in MySSI. As your training centre, we see what SSI’s system shows us, and we use it to check you’re fit to dive and to run your session. We don’t copy your answers onto our website, into Square or into our email.

4.3 Under 18s. SSI doesn’t let minors sign digital forms. So a parent or guardian completes and signs paper versions of the SSI forms at home, and hands them to the instructor running the session. During the session the forms stay with that instructor in a zip folder, so they’re at hand in an emergency. The same day, they go into a locked cabinet at Mim’s home. They’re never left in a car or gear bag. Mim keeps all of them: if Mark runs a session, he gives her the forms that day. We don’t scan or photograph them unless SSI or our insurer asks us to. We keep them for 7 years after the child’s last session, or until they turn 25 if that’s later, or longer if our insurer requires it.

4.4 Doctor’s sign-off. If SSI’s form says you need a doctor’s sign-off, a doctor needs to sign it before you dive. Bring the signed form to your session. If MySSI lets you upload a signed form, you can do that instead. Please don’t send it by WhatsApp or email. We don’t contact your doctor unless you ask us to.

4.5 Things you tell us. You might tell us about a health condition, disability or how you’re feeling, for example before a Scuba Wellness session or an adaptive (Classified Diving) session. We use it only to plan and run your session in a way that suits you. Please don’t put health details into our website forms.

4.6 Forms sent by message. Please don’t send photos of completed medical forms by WhatsApp or email. If you do, or if you tell us about your health by WhatsApp, text or email, we write the safety-relevant part as a short dated note in your file (kept with the paper forms or in our session log). We keep that note for the period in section 15. Then we delete the message and any photos within 7 days.

4.7 Your consent. When you (or your parent or guardian) complete SSI’s forms or our snorkel waiver and share them with us, by linking your MySSI account to us or handing us the paper forms, you consent to us collecting and using your health information for the purposes in section 6. You can withdraw that consent, but then we can’t take you diving. We’ll still keep any records the law or our insurer requires us to keep.

4.8 Scuba Wellness sessions use SSI’s Try Scuba forms: participant registration, the Introductory Fit To Dive screening and the Introductory Scuba liability release, plus the Youth Addendum for anyone under 18. If the screening flags something, we may also ask you to complete SSI’s full Diver Medical questionnaire. If SSI’s form says you need a doctor’s sign-off, section 4.4 applies. We handle that information the same way as our other safety forms.

4.9 Snorkel trips. Before a snorkel trip, you sign our snorkel waiver. As with all our forms, a parent or guardian signs for anyone under 18. If the waiver asks about your health, we treat your answers as health information and handle them the same way as our other safety forms. We keep the waiver for the period in section 15.

5. How we collect information

5.1 We collect most information directly from you, through:

our Square booking page
our website forms (“Ask about a date” and the participant details page)
phone calls, WhatsApp, SMS and email
messages on Instagram or Facebook
SSI’s MySSI system and SSI paper forms
our snorkel waiver
at your session.

5.2 From other people. Someone else may book for you, or a parent may give us a child’s details. If you give us information about other people, please tell them (or their parent or guardian) and point them to this policy.

5.3 From SSI. When you link your MySSI account to us, SSI lets us see your training details and, depending on your MySSI privacy settings, your forms.

5.4 Information we didn’t ask for. If we receive personal information we didn’t ask for and don’t need, we delete or destroy it as soon as we reasonably can, if it’s lawful to do so.

6. Why we collect and use it

6.1 We use your information to:

reply to your enquiry and talk through what suits you
arrange, confirm and change bookings, and send invoices and gift cards
send service messages, such as your 24-hour reminder or a weather call
check SSI age limits and prerequisites
have the right wetsuit, boots and fins ready
check you’re fit to dive or snorkel and manage the risks of your session
register your training and certification with SSI
deal with incidents, first aid and emergencies
meet our legal, insurance, tax and safety obligations, and handle complaints or claims
post photos, but only with your consent (section 10)
send marketing, but only with your consent (section 11).

6.2 We don’t use your information for anything else unless you agree; or you’d reasonably expect it and it’s related to why we collected it (directly related, for health information); or the law requires or allows it (for example, to prevent a serious threat to someone’s life or safety).

6.3 Automated decisions. We don’t use computer programs to make decisions about you. Mim or Mark make every booking and safety decision.

6.4 We never sell your personal information.

7. If you don’t give us information

7.1 You don’t have to give us your information. But if we don’t have what we need, we may not be able to take your booking.

7.2 In particular, SSI’s rules mean nobody dives without completed SSI medical forms (the medical questionnaire or fit-to-dive screening), and anyone under 18 needs forms signed by a parent or guardian. Without a date of birth we can’t check age limits. Without sizes, your gear may not fit.

7.3 If your medical answers mean you can’t dive yet, or you’re waiting for a doctor’s sign-off, tell us as soon as you can. What happens to your payment is in our terms. In short, however much notice you give, you get a credit for the session you couldn’t do. It’s valid for 12 months and you can give it to someone else. The credit is the full price of a single session, or that session’s share of a course ($147.50 for Basic Diver, $139 for Scuba Diver). There’s no credit if you skipped the pre-session forms or turned up affected by alcohol.

8.1 We share information only as needed for the purposes in section 6. The main people and services are:

Square (Square AU Pty Ltd, part of Block, Inc.): our booking page, invoices, payments, gift cards, reminder messages and our customer list (which can include dates of birth and sizes you give us by phone). Square also uses some information for its own purposes, such as fraud prevention. See Square’s own privacy notice for buyers.
Cloudflare (Cloudflare, Inc.): hosts our website and passes website form messages to our email.
Google (Gmail): our email inbox, where website forms and emails arrive.
WhatsApp (WhatsApp LLC, part of Meta): if you message us there.
Meta (Instagram and Facebook): if you message us there, or if we post a photo you’ve agreed to.
Our website developer, [[WEB DEVELOPER: name or business]], who looks after our website and its Cloudflare and GitHub accounts. They may see a website form message while fixing a problem, and must keep it confidential.
GitHub (GitHub, Inc., part of Microsoft): stores our website’s content, including any testimonials or photos we publish on the site. We edit that content with Pages CMS, a tool that connects to GitHub.
SSI, the training agency. SSI’s privacy policy names HEAD Watersports GmbH in Germany as the company responsible for its data. SSI receives your training records, forms and certification.
Our insurer, Oceanic Marine Risk, and its claims handlers, if there is an incident, claim or complaint that involves you.
Emergency services, doctors and hospitals, if you need help. We may share health information you’ve given us to protect your life, health or safety.
Regulators and authorities, such as SafeWork NSW or the police, when the law requires it.
Professional advisers, such as an accountant or lawyer, if we need their help. They must keep it confidential.

8.2 Mim and Mark both see booking and participant information, because either of us may run your session.

8.3 We choose well-known providers and use them under their standard terms. We remain responsible under the Privacy Act for information we share with them.

9. Information that goes overseas

9.1 Some of the services above store or process information outside Australia. Based on each provider’s published privacy information, these countries include:

Square: the United States, Canada, Japan, Ireland, France, Spain and the United Kingdom.
Cloudflare: mainly the United States and the European Economic Area. Its network also runs in data centres around the world.
Google (Gmail): servers around the world, including the United States.
WhatsApp, Instagram and Facebook (Meta): the United States and other countries where Meta and its service providers operate.
GitHub: the United States and other countries where GitHub and its service providers operate.
Pages CMS: Singapore, and other places where its service providers are located.
Our website developer: [[WEB DEVELOPER COUNTRY]].
SSI: Germany. SSI says it also shares data with SSI service centres and training centres around the world, and with service providers including some in the United States.
Our insurer: [[INSURER COUNTRIES: Australia, plus any overseas underwriters or claims handlers — insurer to confirm]].

9.2 These providers can change where they store data. Their current privacy policies have the latest list.

10.1 We love sharing good days in the water on Instagram and Facebook. We only post photos or video of you if you’ve said yes.

10.2 How you say yes. Photo consent is a separate, optional tick box, a signature on a form, or a written reply to our message. It’s never ticked for you, and it’s never a condition of booking.

10.3 Children. We only take photos for posting of anyone under 18 if their parent or guardian has given specific consent for that child. We ask for it on our details page, where the parent or guardian ticks a separate box for each child.

10.4 Scuba Wellness and adaptive sessions. We don’t take or post photos of Scuba Wellness sessions, or of adaptive (Classified Diving) sessions, unless you’ve given specific consent for that session.

10.5 Changing your mind. Tell us any time by WhatsApp, phone or email. We’ll take down posts showing you within 7 days and stop using those photos. We can’t pull back copies other people have already shared or saved.

10.6 Posts on Instagram and Facebook are public, and Meta handles them under its own policies.

10.7 Testimonials. We only publish your review or comments with your permission, with your first name only unless you agree otherwise.

11. Marketing and service messages

11.1 Service messages. We send messages about your booking: the invoice, your 24-hour reminder, changes, weather calls and forms to complete. These are part of our service. We keep them factual, with no offers or ads.

11.2 Marketing. We only send marketing (for example, news about new dates or offers) by email, SMS or WhatsApp if you’ve said yes. Booking with us doesn’t sign you up.

11.3 Unsubscribing. Every marketing message tells you how to unsubscribe. You can also just reply “stop” or message us. We’ll act on it within 5 business days.

11.4 If you ask, we’ll tell you where we got your details.

12. Our website, cookies and analytics

12.1 Our own site doesn’t use cookies for tracking or advertising.

12.2 Analytics. We use Cloudflare Web Analytics to count visits and see which pages are useful. Cloudflare says it doesn’t use cookies or local storage for this, and doesn’t fingerprint visitors.

12.3 Security. Cloudflare may use strictly necessary cookies or checks to keep out spam and bots.

12.4 One setting on your device. If you turn off animations on our site, your browser remembers that choice on your device. It isn’t sent to us.

12.5 Other sites. Links on our site take you to other services with their own cookies and privacy policies, including:

Square (booking page, invoices and gift cards)
WhatsApp
Instagram and Facebook
Google Maps
SSI and MySSI.

12.6 Website forms. Our forms send your message to our Gmail inbox through Cloudflare. We’ve set up our website so it doesn’t store your form. If a form can’t send, it offers to send your message by WhatsApp or your own email app instead.

13. Children, and people who need support to decide

13.1 Our youngest participants are 8 (pool Try Dives and Scuba Wellness). A parent or guardian books for anyone under 18, gives their details and signs their forms.

13.2 We presume children under 15 can’t make their own privacy decisions, so we ask their parent or guardian. We deal with parents or guardians for all under-18 bookings, because SSI’s forms and our snorkel waiver need a parent’s or guardian’s signature. A young person can still ask us about their own information.

13.3 Some adults we dive with may need support to make decisions. We talk with the person directly, and also with a carer, guardian or support person where they need that and have authority to act for them.

13.4 Both instructors hold NSW Working with Children Checks.

14. Keeping information safe

14.1 We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure. For example:

the phone we use for bookings and messages is locked with a passcode or Face ID, and WhatsApp on it has a two-step verification PIN
our Gmail, Square and Cloudflare accounts have two-step verification turned on
only Mim and Mark can get into our Gmail, Square, WhatsApp and SSI accounts. Our website developer can also get into our website accounts (Cloudflare and GitHub) to look after the site
website forms travel over encrypted (https) connections
we keep SSI medical forms inside MySSI or in the paper-form storage in section 4.3. We don’t copy health details into Square, our website or our general email. If you tell us about your health by message, we keep only a short dated note of the safety-relevant part, and delete the message and any photos within 7 days (section 4.6)
paper forms stay with the instructor in a zip folder during the session, then in a locked cabinet at Mim’s home (section 4.3). They’re never left in a car or gear bag
we delete information we no longer need (section 15).

14.2 No system is perfectly secure. If you think your information has been misused, please tell us straight away.

15. How long we keep it

15.1 We keep information only as long as we need it, or as long as the law or our insurer requires. Then we delete it, or destroy paper securely.

Enquiries that don’t become a booking: 12 months.
Booking, payment and invoice records: at least 5 years, as tax law requires.
Participant details (date of birth and sizes), in our Gmail and our Square customer list: 2 years after your last session.
Paper SSI forms for under 18s, snorkel waivers, any copies of health forms, and our notes of a child’s health details sent by message: 7 years after the person’s last session, or until a child turns 25 if that’s later, or longer if our insurer requires it.
Health information about adults that we hold (for example a doctor’s form, or our note of health details you sent us by message): 7 years after your last session, or longer if our insurer requires it.
Incident records: 7 years after the person’s last session, or until a child involved turns 25 if that’s later, or longer if our insurer requires it.
Photos we haven’t posted: 12 months. Posted photos stay up until you withdraw consent or we remove them.
Marketing and photo consent records: while your consent stands, and for 2 years after you unsubscribe or withdraw it, so we can show we had consent.

15.2 When we destroy health information, signed forms or waivers, or incident records, we keep a short note of whose they were, the dates they covered and when we destroyed them.

15.3 SSI also keeps what’s in MySSI under its own policy. We don’t save our own copies of adults’ MySSI forms. Square keeps booking and payment records under its own policy.

16. Data breaches

16.1 If we suspect a data breach, we act straight away to contain it and assess it within 30 days.

16.2 If a breach is likely to cause serious harm to anyone, we’ll tell the people affected and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, under the Notifiable Data Breaches scheme. We’ll also tell you what you can do to protect yourself.

17. Seeing and correcting your information

17.1 You can ask to see the personal information we hold about you, and ask us to correct it if it’s wrong, out of date or incomplete.

17.2 Just message or email us (section 1.3). We may need to check who you are first.

17.3 We’ll reply within 30 days. Asking is free, and we won’t charge you for access.

17.4 For information held in MySSI, you can also see and update most of it yourself in your MySSI account, or ask SSI.

17.5 If we can’t give you access or make a correction (the law allows this in limited cases), we’ll tell you why in writing and how to complain. If we don’t correct something, you can ask us to attach a note saying you think it’s wrong.

18. Complaints

18.1 If you’re unhappy with how we’ve handled your information, please tell us first, by WhatsApp, phone or email (section 1.3). We’ll acknowledge it within 5 business days and aim to give you a full answer within 30 days.

18.2 If you’re not satisfied, or you don’t hear back within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC):

online: www.oaic.gov.au
phone: 1300 363 992.

18.3 If your complaint is about health information, you can also complain in writing to the NSW Privacy Commissioner through the Information and Privacy Commission NSW (www.ipc.nsw.gov.au, 1800 472 679, ipcinfo@ipc.nsw.gov.au). You generally need to do this within 6 months of first becoming aware of the problem.

19. Changes to this policy

19.1 We’ll update this policy when our services, the providers we use or the law change (for example, when the Children’s Online Privacy Code starts). The date at the top shows the latest version.

19.2 If a change affects how we use information you’ve already given us, we’ll tell you before it applies to you.