Rubelis OÜ
Privacy Notice
Last updated: October 2026
This notice explains how personal data is processed through rubelis.eu, in line with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and, for data subjects in Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Who is responsible for your data
The seller on rubelis.eu is determined by your answers on the registration form (see the Terms & Conditions). The controller for the personal data relating to your order follows the seller:
| Buyer group | Controller | Processor | Contact |
|---|---|---|---|
| Citizens of the Republic of Türkiye who live in Türkiye (seller: Taylan Kırali) | Taylan Kırali, sole proprietor (şahıs işletmesi); Atatürk Cd. EGS Business Park No:12/1, Yeşilköy, Bakırköy, Istanbul; Bakırköy Tax Office, tax no. 5560293797 | Rubelis OÜ (operates rubelis.eu on his behalf and on his instructions); sub-processors Cloudflare, Brevo and Google | KEP taylankirali@hs01.kep.tr · info@rubelis.com |
| All other buyers (seller: Rubelis OÜ) | Rubelis OÜ; registry code 17579501 (Estonian Commercial Register); Tartu mnt 67/1-13b, 10115 Tallinn, Estonia; phone / WhatsApp +372 5701 7137 | Cloudflare, Brevo, Google (see section 5) | privacy@rubelis.com · info@rubelis.com |
In this notice, “we” means the controller responsible for your data under this table.
Rubelis OÜ’s role for Turkish orders. For the data of buyers who are citizens of Türkiye and live in Türkiye, Rubelis OÜ is a processor: it operates rubelis.eu (registration, account, theory programme, emails) on behalf of Taylan Kırali and on his instructions, using its sub-processors Cloudflare (hosting and database, Western Europe), Brevo (email, EU) and Google (sign-in, only if you use it). Rubelis OÜ processes these data under a contract with Taylan Kırali based on the Turkish Personal Data Protection Board’s standard contract “Standart Sözleşme 2 – Veri Sorumlusundan Veri İşleyene”, which also sets out the processor terms of GDPR art. 28 (see section 5). Taylan Kırali is also the controller for the invoices and accounting records he must keep as the Turkish seller under Turkish tax law.
All other buyers. Where Rubelis OÜ is the seller, Rubelis OÜ is the controller under the GDPR (and the KVKK where it applies). Taylan Kırali has no role for these data.
Website visitors and cookies. For website visitors’ data and cookies (analytics and advertising cookies with your consent, including joint controllership for the Meta Pixel), the controller is Rubelis OÜ as the operator of rubelis.eu.
Independent controllers.
- Guru Dive Doğa Sporları ve Eğitim Merkezi (Istanbul), the authorised dive centre that provides the in-water training, is an independent controller for the student file, the notifications to the Turkish Underwater Sports Federation (TSSF), and the medical statement and liability release it collects. It receives from us only what it needs: your name, contact details, date of birth, diving certification details and dive date.
- PADI is an independent controller for processing your certification.
- Meta (Meta Platforms Ireland Ltd.) is a joint controller with Rubelis OÜ for the collection and transmission of data via the Meta Pixel, if you consent to it (see section 5).
2. How we collect your data
We collect your data directly from you, electronically: through the registration and application forms on rubelis.eu, through “Sign in / Sign up with Google” if you use it, through your use of your account, the theory programme and the instructor portal, through cookies and similar technologies (non-essential ones only with your consent), and through email correspondence with us.
3. What data we process, why and on what legal basis
| Data | Purpose | Legal basis (GDPR / KVKK) |
|---|---|---|
| Name, email, phone, country, city | Handling your registration or application, providing the services and contacting you | Contract, art. 6(1)(b) / KVKK 5/2-c |
| Whether you are a citizen of the Republic of Türkiye; country of residence | Determining the seller (Rubelis OÜ or Taylan Kırali) and issuing the correct invoice | Contract, art. 6(1)(b) / KVKK 5/2-c and 5/2-ç |
| Gender and date of birth | Issuing your PADI certification; applying the age rules (minimum age 12, rules for under-18s) | Contract, art. 6(1)(b) / KVKK 5/2-c |
| Diving certification (agency, level, number, date); logged dives and date of last dive | Checking eligibility and processing your PADI certification | Contract, art. 6(1)(b) / KVKK 5/2-c |
| Photo of your certification card (optional) | Verifying your existing certification | Consent, art. 6(1)(a) / explicit consent, KVKK 5/1 |
| Parent’s or guardian’s name, relationship, email and phone (participants under 18) | Concluding the contract on the child’s behalf and contacting the parent or guardian | Contract, art. 6(1)(b) / KVKK 5/2-c; see the Children’s Privacy Notice |
| Record of the confirmations you ticked: text version, date and time, IP address | Proving that the contract was concluded and the information was provided | Legitimate interest, art. 6(1)(f) / KVKK 5/2-f |
| Theory programme: chapters read and completed, personal notes, Beyond card code | Providing the programme, tracking progress and making the certificate verifiable | Contract, art. 6(1)(b) / KVKK 5/2-c |
| PADI member number and instructor details (instructor applications) | Assessing the application, including the PADI prerequisites | Contract (steps before a contract), art. 6(1)(b) / KVKK 5/2-c |
| Payment confirmation data (name, email, order reference, bank approval code; never full card details) | Processing your payment through Stripe or Garanti BBVA | Contract, art. 6(1)(b) / KVKK 5/2-c |
| Invoice and accounting data | Accounting and tax compliance | Legal obligation, art. 6(1)(c) (Estonian accounting law, for Rubelis OÜ) / KVKK 5/2-ç (incl. Turkish Tax Procedure Law for Turkish invoices) |
| Order confirmation and service emails | Sending the order confirmation, access links and information about your course | Contract, art. 6(1)(b) / KVKK 5/2-c |
| Marketing emails (adults only, optional) | Sending news and offers | Consent, art. 6(1)(a) / explicit consent, KVKK 5/1 |
| Instructor licence acceptance: name, email, PADI member number, date and time, IP address, browser details, agreement version | Proving that the licence agreement was concluded | Contract, art. 6(1)(b); legitimate interest (evidence), art. 6(1)(f) / KVKK 5/2-c, 5/2-f |
| Instructor portal: email, session cookie, material downloads, certification records entered | Secure sign-in, watermarking materials, counting certifications for licence renewal | Contract, art. 6(1)(b) / KVKK 5/2-c |
| Security and access logs | Protecting the platform against misuse | Legitimate interest, art. 6(1)(f) / KVKK 5/2-f |
| Analytics and advertising cookies | Visitor statistics, advertising measurement and targeting | Consent, art. 6(1)(a) / explicit consent, KVKK 5/1 |
| Auction bid data | Running the auction (via GalaBid) | Contract, art. 6(1)(b) / KVKK 5/2-c |
No health data on rubelis.eu. We do not collect your health information. The PADI Medical Statement and liability release are completed only before in-water sessions, at the dive centre, with the instructor who conducts the dives. The dive centre is the controller for that data.
The Beyond card verification page shows only your name and completion date, and only to people who know the card code.
Ticking “I have read the Privacy Notice” on the registration form confirms that you have been informed; it is not consent. Where we rely on consent, we ask for it separately, and you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
4. Is providing your data required?
Fields marked as required on the forms are needed to conclude and perform the contract and to issue your certification. Without them we cannot register you. Optional fields (the certification card photo and the marketing email opt-in) are voluntary; not providing them has no effect on your contract.
5. Recipients and international transfers
| Recipient | Role | Location / transfer basis |
|---|---|---|
| Rubelis OÜ | Processor for Turkish orders (seller Taylan Kırali): operates rubelis.eu on Taylan Kırali’s behalf (registration, account, theory programme, emails) | Estonia / EU: KVKK art. 9, Standart Sözleşme 2 – Veri Sorumlusundan Veri İşleyene |
| Cloudflare | Processor: hosting, security, database (Cloudflare D1, Western Europe); sub-processor of Rubelis OÜ for Turkish orders; Turnstile human verification on forms to prevent abuse (browser and device signals; no cookies). To prevent abuse, IP addresses are not stored; a keyed hash is kept for a few hours at most | EU and US: EU Standard Contractual Clauses and EU-US Data Privacy Framework |
| Brevo | Processor: email and form delivery; sub-processor of Rubelis OÜ for Turkish orders | EU |
| Stripe | Payments for Rubelis OÜ sales | EU and US: EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Garanti BBVA | Payments for Taylan Kırali sales; card details go directly from your browser to the bank; independent controller as a bank | Türkiye |
| Authentication if you use “Sign in / Sign up with Google” (only your name, email and Google account ID are received); Google Analytics and Google Ads only with your consent | EU and US: EU-US Data Privacy Framework | |
| Meta (Facebook, Instagram) | Meta Pixel only with your consent; joint controller with Rubelis OÜ for the collection and transmission of data via the Pixel (CJEU C-40/17, Fashion ID); Meta is solely responsible for its further processing | EU and US: EU-US Data Privacy Framework |
| Online meeting service provider | Online instructor training sessions | Under the provider’s own privacy policy; for any transfer outside the EU, the EU-US Data Privacy Framework or Standard Contractual Clauses |
| Only if you contact us there | Under WhatsApp’s own privacy policy | |
| Taylan Kırali | Seller and controller for buyers who are citizens of Türkiye and live in Türkiye (see section 1; including invoice and accounting records); other buyers’ data is not transferred to him | Türkiye |
| Guru Dive Doğa Sporları ve Eğitim Merkezi | Independent controller; in-water training | Türkiye: for Rubelis OÜ sales, EU Standard Contractual Clauses; necessary for the contract you requested |
| PADI | Independent controller; processing your certification | Under PADI’s own privacy policy |
| GalaBid | Auction (only if you take part) | Under GalaBid’s own privacy policy |
Joint controllership with Meta. If you consent to the Meta Pixel, Rubelis OÜ and Meta Platforms Ireland Ltd. are joint controllers for collecting your data on rubelis.eu and transmitting it to Meta. Rubelis OÜ is responsible for obtaining your consent and for informing you; you can exercise your rights against either party. Meta’s processing after transmission is described in Meta’s own privacy policy.
Turkish orders: transfers from Türkiye abroad (KVKK art. 9). The data of buyers who are citizens of Türkiye and live in Türkiye is stored abroad (cloud infrastructure in Estonia and the EU; database in Western Europe) by Rubelis OÜ as processor for the controller, Taylan Kırali. This transfer is based on the Turkish Personal Data Protection Board’s standard contract “Standart Sözleşme 2 – Veri Sorumlusundan Veri İşleyene” (KVKK art. 9) between Taylan Kırali and Rubelis OÜ, which is notified to the Personal Data Protection Authority as required. Rubelis OÜ processes these data under that contract, which also sets out the processor terms of GDPR art. 28.
All other buyers: transfers to Türkiye (GDPR). Where Rubelis OÜ is the seller, your data is transferred to Türkiye only to Guru Dive (independent controller, in-water training). This transfer is based on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) concluded between Rubelis OÜ and Guru Dive, and is necessary to perform the contract you have requested.
We do not sell personal data.
6. How long we keep your data
| Data | Retention period |
|---|---|
| Account and programme data | While your account is active, plus 3 years |
| Certificate and Beyond card records | As long as verification is offered (up to 10 years) |
| Records of confirmations and consents (timestamp, IP address, text version) | For the duration of the contract plus the limitation period (up to 10 years) |
| Invoices and accounting records | Estonia: 7 years (Accounting Act, Raamatupidamise seadus); Türkiye: 5 years (Tax Procedure Law art. 253) or 10 years where the Turkish Commercial Code applies |
| Certification card photo | Until your certification is verified, at most 12 months |
| Applications that do not lead to a contract | 12 months |
| Marketing consent | Until you withdraw it |
| Cookie consent record | 12 months (the banner asks again after 12 months) |
At the end of the retention period, data is deleted or anonymised.
7. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
8. Children
Registration, the contract and payment for participants under 18 are made by a parent or legal guardian. Children’s data is never used for marketing, profiling or advertising, and minors are never offered the marketing opt-in. The controller for a child’s data follows the same rule as the parent’s order (section 1). For the child’s data, the legal basis is the parent’s or guardian’s consent and the contract the parent makes (GDPR art. 6(1)(a), 6(1)(b) and 8). Details are in the Children’s Privacy Notice.
9. Your rights
Under Articles 15–22 GDPR you have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. For data controlled by Rubelis OÜ, contact privacy@rubelis.com; we respond within one month of a verified request. For data controlled by Taylan Kırali, use the application methods below.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, www.aki.ee) or with the data protection authority of your country of residence or work.
Buyers who are citizens of Türkiye and live in Türkiye (KVKK art. 11). Your controller is Taylan Kırali, and you have the right to learn whether your data is processed and to request information about it; to learn the purpose of processing and whether data is used in line with it; to know the third parties in Türkiye or abroad to whom data is transferred; to request correction of incomplete or inaccurate data; to request erasure or destruction under KVKK art. 7; to request that correction or erasure be notified to third parties to whom data was transferred; to object to a result against you arising exclusively from analysis by automated systems; and to claim compensation for damage caused by unlawful processing. In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply to Taylan Kırali in writing with a wet signature by post to Atatürk Cd. EGS Business Park No:12/1, Yeşilköy, Bakırköy, Istanbul, by KEP to taylankirali@hs01.kep.tr, by secure electronic or mobile signature, or from the email address you have registered with us to info@rubelis.com. Applications are answered free of charge within 30 days at the latest. You may also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). Where the KVKK applies to data controlled by Rubelis OÜ, the same rights can be exercised against Rubelis OÜ at privacy@rubelis.com.
10. Cookies
Strictly necessary cookies and browser storage are used to run the site, remember your cookie choice and keep you signed in. Google Analytics (statistics), Google Ads and Meta Pixel (advertising measurement and targeting) run only if you allow them in the cookie banner; the legal basis is your consent, which you can withdraw at any time with the “Cookie preferences” link at the bottom of every page. Details are in our Cookie Policy.
11. Security
We apply appropriate technical and organisational measures, including encrypted connections (HTTPS), restricted administrative access and access logging. No system is completely secure, and we cannot guarantee absolute security.
12. Changes
We may update this notice from time to time. The date at the top reflects the most recent version.