Privacy policy.

Who we are

N35.9 is operated by Dan Lipton, sole trader.

Email: dan@n359collective.com
Website: n359collective.com

For the purposes of data protection law, Dan Lipton is the data controller.

What data we collect

When you enquire

When you submit the enquiry form on our website, we collect your name, email address, and any information you choose to include in your message — such as your diving experience, travel dates, or the names and ages of other participants. We use this to respond to your enquiry and plan your course.

When you book

If you proceed to a booking, we may also collect your date of birth, nationality, mailing address, diving certification number from your associated training agency (if applicable), emergency contact details, and medical questionnaire responses. This information is necessary to arrange your dive training safely, process your certification, and meet our duty of care as a dive training provider.

Medical information

Scuba diving requires a standard medical self-declaration (the RSTC Medical Statement). If any conditions are flagged, a physician's clearance is required before training can begin. We collect this information solely to ensure your safety. Medical information is not shared with any third party except, where necessary, the relevant training agency for certification processing, or emergency medical services in the event of an incident.

When you visit the website

We use cookies and analytics tools to understand how the site is used. See our Cookie Policy for details. We do not use advertising cookies or share your browsing data with advertisers.

Payment information

All payments are made by direct bank transfer. We do not collect, store, or process credit or debit card information. We may retain records of payments received (date, amount, and sender reference) for accounting purposes.

Why we collect it (legal basis)

• Legitimate interest: responding to enquiries, improving our service, website analytics.
• Contract: processing bookings, arranging dive training, issuing certifications.
• Legal obligation: financial record-keeping, tax reporting.
• Consent: where we rely on consent (e.g. optional cookies), you can withdraw it at any time.

Who we share it with

We share personal data only where necessary:

• Training agencies (e.g. PADI, SSI)— to process your certification. Each agency's own privacy policy governs their handling of your data.
• Local dive operators and boat charters — names and group size only, to arrange logistics. No medical or contact data is shared with operators.
• HMRC — financial records as required by UK tax law.
• Insurance providers — in the event of an incident, relevant details may be shared with DAN Europe or other insurers.

We do not sell, rent, or trade your personal data. We do not use your data for marketing unless you have explicitly opted in.

Where your data is stored

Your data is stored securely using cloud-based tools (email, file storage). Some of these services may process data outside the UK. Where this is the case, we ensure appropriate safeguards are in place, such as standard contractual clauses.

How long we keep it

• Booking and certification records: retained for 7 years from the date of the course, in line with UK tax and professional record-keeping requirements. Certification records are held by the issuing training agency indefinitely.
• Medical questionnaires: retained for the duration of the course plus 7 years, then securely destroyed.
• Enquiry and website data: retained for as long as it remains useful to our business operations, then securely deleted.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to processing based on legitimate interest
• Request restriction of processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where consent is the legal basis

To exercise any of these rights, email dan@n359collective.com. We will respond within 30 days.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised. We will not reduce your rights under this policy without your consent.