Privacy Policy

The controller within the meaning of the GDPR, the Austrian Data Protection Act (DSG) and other data protection provisions is:

Daniel Kainz – Meeresschnitt
Website: meeresschnitt.at
Email: kontakt@meeresschnitt.at
Instagram: @meeresschnitt

The full postal address can be found in the imprint. The underwater camera courses are run in cooperation with digitalworld Academy OG (digitalworld-academy.at), which is a joint controller within the meaning of Art. 26 GDPR solely for the booking and invoicing of the courses.

We only process personal data to the extent necessary to provide a functional website and our content and services. Processing is based on Art. 6(1) GDPR – usually on your consent (point a), for the performance of a contract or pre-contractual measures (point b) or on the basis of legitimate interests (point f).

When you send us a message via the contact form, we process the following data:

Name, email address, subject and message. In addition, to prevent spam, your IP address (hashed) and a timestamp are stored briefly in the WordPress database (transients) – for a maximum of 60 minutes.

Legal basis: Art. 6(1)(a) GDPR (consent by ticking the checkbox) and Art. 6(1)(b) GDPR (pre-contractual measures for course enquiries).

Retention: Your enquiry is forwarded to us by email and kept on the mail server for as long as necessary to handle it – usually no longer than 6 months after the conversation has ended, unless statutory retention obligations apply (e.g. § 132 of the Austrian Federal Fiscal Code – 7 years for accounting records once a contract has been concluded).

Spam protection: We use a honeypot (an invisible form field), time-based rate limiting and Cloudflare Turnstile (Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA) on the contact form and the Pre-Course Check. Turnstile uses technical browser and device characteristics as well as your IP address to check that the request comes from a human; no advertising or analytics cookies are set. The script is only loaded on these two pages. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. More: Turnstile privacy notice.

In the Pre-Course Check you can check whether you meet the requirements for a course and sign up for course information. We process your name, your email address, your answers in the checklist (diving requirements and equipment) and the time of sign-up and confirmation. The same rate limiting as for the contact form applies to prevent abuse.

After signing up you receive an email with a confirmation link (double opt-in). Only after you confirm do we send you the evaluation and information about the courses.

Legal basis: Art. 6(1)(a) GDPR (consent). Retention: Unconfirmed sign-ups are deleted automatically after 6 months. Confirmed sign-ups are kept until you withdraw your consent or ask for deletion – an informal message is enough.

Emails from the contact form and the Pre-Course Check (confirmation links, evaluations) are delivered via the email service Brevo (Sendinblue SAS, Paris, France). Brevo processes the recipient address and message content on our behalf; a data processing agreement under Art. 28 GDPR is in place.

Legal basis: as for the respective form (Art. 6(1)(a) or (b) GDPR).

Our website is operated by a professional hosting provider with servers in the EU. A data processing agreement under Art. 28 GDPR has been concluded. When you access our website, the following data is recorded automatically in server log files:

IP address, browser type and version, operating system, referrer URL, page requested, date and time of access, amount of data transferred, HTTP status code.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website securely). Retention: no more than 14 days; the log files are then deleted automatically.

Strictly necessary (no consent required):

dk_consent – stores your choice in the cookie banner (which categories you have allowed) so that the banner does not reappear on every page. Stored for 365 days; a copy is kept in your browser's localStorage.
ms_lang (localStorage) – stores the page language you last chose ("de" or "en"). This value never leaves your device.
WordPress session cookies are only set in the back end, not for visitors.

Legal basis: § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) and Art. 6(1)(f) GDPR – storage is strictly necessary to provide the functions you have explicitly requested (remembering your consent and your language).

Statistics (only with your consent): Google Analytics cookies (_ga, _ga_*) – see section 8. We do not set marketing cookies.

You can change or withdraw your choice at any time via "Manage consent". Details are in the cookie policy.

With your consent we use Google Analytics 4, integrated via the WordPress plugin Google Site Kit. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics records how the website is used (e.g. pages viewed, time on page, device, browser, approximate location) and stores cookies on your device for this purpose.

We use Google Consent Mode: as long as you have not given consent, Google Analytics does not set any cookies. The Google tag is still loaded, however, and may send signals without a cookie identifier to Google (e.g. time, page viewed, browser information); for technical reasons your IP address is transmitted to Google in the process.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission).

Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021 (consent); for loading the Google tag without consent, Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement). Retention: analytics data is kept for no more than 14 months, cookies for no more than 2 years. Withdrawal: at any time via "Manage consent", with effect for the future.

On some pages (e.g. UW Operator, Conservation) we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the privacy-enhanced mode (youtube-nocookie.com): according to YouTube, cookies are only set once you play the video. When the page loads, however, the player is already retrieved from YouTube's servers, which transmits your IP address and technical browser data to Google, including to the USA (Data Privacy Framework, see section 8).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our work attractively); once you play a video, Google's privacy policy also applies.

When opened, the interactive Sightings Atlas loads satellite imagery from Esri (ArcGIS Online, Esri Inc., Redlands, USA) and fonts from Fontshare (Indian Type Foundry, India). The mapping library CesiumJS is hosted on our own server; only if it cannot be loaded from there is it retrieved from jsDelivr or cesium.com as a fallback. Your IP address is transmitted to the respective provider, possibly in a country outside the EU.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in displaying the map). The atlas is only loaded when you open that page.

Apart from those listed above, we do not use any external tracking or advertising services: no Facebook Pixel, no Meta Conversion API, no social media plugins with tracking, no advertising networks. The website's fonts are served locally from our own server.

Links to our Instagram profiles are plain hyperlinks without any tracking. Once you click such a link, the privacy policy of the respective provider applies.

For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar and by the padlock symbol.

You have the following rights regarding your personal data at any time:

Access (Art. 15 GDPR) – You can request information about the data we hold about you.
Rectification (Art. 16 GDPR) – You can have inaccurate data corrected.
Erasure (Art. 17 GDPR) – You can request the deletion of your data unless a statutory retention obligation applies.
Restriction (Art. 18 GDPR) – You can request that processing be restricted.
Data portability (Art. 20 GDPR) – You can receive your data in a machine-readable format.
Objection (Art. 21 GDPR) – You can object to the processing of your data.
Withdrawal of consent (Art. 7(3) GDPR) – You can withdraw any consent you have given at any time, with effect for the future.

To exercise your rights, an informal message via our contact form is sufficient.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The competent authority in Austria is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

We reserve the right to amend this privacy policy to keep it in line with current legal requirements or to reflect changes to our services. The new privacy policy then applies to your next visit.

Last updated: October 2026