Children's Privacy Notice

This notice explains how we process the personal data of participants under 18 (“child”) registered on rubelis.eu. It supplements our Privacy Notice. The controller for the child’s data follows the seller of the parent’s order:

• If the parent is a citizen of the Republic of Türkiye who lives in Türkiye (seller Taylan Kırali), the controller is Taylan Kırali (Atatürk Cd. EGS Business Park No:12/1, Yeşilköy, Bakırköy, Istanbul; KEP taylankirali@hs01.kep.tr; info@rubelis.com). Rubelis OÜ operates rubelis.eu on his behalf as processor.
• For all other parents (seller Rubelis OÜ), the controller is Rubelis OÜ (registry code 17579501, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia; privacy@rubelis.com).

Children under 12 cannot take part in diving. For anyone under 18, registration, the contract and payment are made by a parent or legal guardian on the child’s behalf.

1. What we collect about the child

• Name and date of birth. The date of birth is needed to apply the age rules (minimum age 12 and the rules for participants under 18).
• Contact details provided at registration.
• Diving certification data (agency, level, number, date) and logged dives.
• Progress in the theory programme.
• Certificate details (Beyond card code and certification records).
• Enrolment and payment status.

We also collect the parent’s or guardian’s name, relationship to the child (mother, father or legal guardian), email and phone.

2. Why we use it

To register the child, provide the theory programme and the course, check eligibility, arrange the in-water training with the dive centre, issue and verify certificates, and communicate with the parent or guardian about the course. The order confirmation is also emailed to the parent or guardian.

3. Legal basis

• The consent of the parent or guardian, given at registration (GDPR art. 6(1)(a) and art. 8; under the Estonian Personal Data Protection Act § 8, a child can consent alone only from the age of 13 for information society services, and we always ask the parent or guardian; KVKK art. 5).
• Performance of the contract concluded by the parent or guardian on the child’s behalf (GDPR art. 6(1)(b); KVKK art. 5/2-c).
• Legal obligations for invoices and accounting records (GDPR art. 6(1)(c); KVKK art. 5/2-ç).

4. No marketing, profiling or advertising

We do not use children’s data for marketing, profiling or advertising, and we do not share it with advertising networks. Minors are never offered the marketing email opt-in and do not receive marketing emails.

5. How long we keep it

• Progress and account data: while the account is active (and then as set out in the Privacy Notice).
• Certificate records: longer, for as long as verification is offered (up to 10 years).
• Financial records: for the periods required by law (Estonia 7 years; Türkiye 5 years, or 10 years where the Turkish Commercial Code applies).

At the end of these periods, the data is deleted or anonymised.

6. Parents’ and guardians’ rights

The parent or guardian can ask to access, correct or delete the child’s data and can withdraw consent at any time, by writing to the respective controller: for orders sold by Taylan Kırali, to Taylan Kırali (KEP taylankirali@hs01.kep.tr, a written application with a wet signature to his address above, or from the registered email address to info@rubelis.com); for all other orders, to Rubelis OÜ at privacy@rubelis.com. Withdrawing consent does not affect processing carried out before the withdrawal; data needed for the contract, certification records and legally required records may be kept as described above. All other rights set out in the Privacy Notice, including the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or, in Türkiye, the Personal Data Protection Board, also apply.

7. Who we share it with

• Payment providers (Stripe or Garanti BBVA) receive only the parent’s or guardian’s payment data, not the child’s.
• The dive centre (Guru Dive Doğa Sporları ve Eğitim Merkezi, Istanbul) receives only what is needed for the in-water training: name, contact details, date of birth, certification data and dive date.
• Rubelis OÜ, for orders sold by Taylan Kırali, processes the data only on his behalf and on his instructions (as processor).
• Hosting and email providers (Cloudflare, Brevo) process data only on the controller’s behalf and on its instructions.
• PADI receives the data needed to process a certification.

We do not share children’s data for advertising.

8. Medical statement

We do not collect health information on rubelis.eu. The PADI Medical Statement, co-signed by the parent or guardian, and the parental consent document are completed at the dive centre before any in-water session. The dive centre is the controller for that data.

9. Contact

Parents who are citizens of Türkiye and live in Türkiye (seller Taylan Kırali): Taylan Kırali, Atatürk Cd. EGS Business Park No:12/1, Yeşilköy, Bakırköy, Istanbul · KEP taylankirali@hs01.kep.tr · info@rubelis.com

All other parents (seller Rubelis OÜ): Rubelis OÜ · privacy@rubelis.com · Tartu mnt 67/1-13b, 10115 Tallinn, Estonia