Privacy Policy

Code Sense Studio OÜ (“we”, “us”, or “our”) provides Ombar, a software platform and related services for dive shops and related businesses (the “Services”).

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our website, platform, and related services.

Depending on the context, we may process personal data:

• directly for our own business purposes, such as account management, billing, support, security, and product improvement; and
• on behalf of our customers — dive shops that use Ombar to manage bookings, customer records, schedules, communications, and related operations.

If you are a customer or end user of a dive shop using Ombar, the dive shop is the party primarily responsible for your personal data. In that case, we process that data on their behalf, subject to our agreement with them.

Company name: Code Sense Studio OÜ

Registered in: Estonia (e-Residency)

Business address: Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia

Email: [email protected]

Website: ombar-suite.com

If you have questions about this Privacy Policy or our privacy practices, you can contact us using the details above.

A. Information provided directly to us (dive shop account holders)

• name
• email address
• phone number
• dive shop / company name
• job title or role
• billing information
• account login details
• support requests and communications
• information submitted through forms, demos, or onboarding

B. Information processed through the Services on behalf of dive shops

Depending on how the dive shop uses the Services, this may include:

• customer names and contact details
• nationality
• certification level, certification agency, certification number
• logged dive history
• health and medical information provided by the customer to the dive shop (e.g. fitness-to-dive notes, medical conditions relevant to dive safety)
• booking and reservation details
• dive schedules and trip participation records
• equipment assignments
• referral agent information
• transaction and payment status information
• notes entered by dive shop staff
• communication history related to bookings or customer service

Because some of this data — particularly medical and health information — constitutes special category data under the EU General Data Protection Regulation (GDPR), dive shops using Ombar are responsible for obtaining explicit consent from their customers before entering such data into the platform.

C. Automatically collected information

When users access our website or platform, we may collect:

• IP address
• browser type and version
• device information
• operating system
• pages viewed
• timestamps and session activity
• referring URLs
• log and diagnostic data

We do not currently use cookies for analytics or advertising. If we introduce analytics, tracking, or cookie-based technologies in the future, we will update this Policy and, where required, request your consent.

D. Payment information

Subscription fees are currently invoiced directly and paid by bank transfer. We may introduce third-party payment processors in the future; if we do, we will update this Policy to reflect the providers used and the data they receive. We do not store full payment card details.

We use personal data to:

• provide, operate, maintain, and improve the Services
• create and manage accounts
• authenticate users and secure access
• process subscriptions, invoices, and billing
• provide customer support and onboarding
• communicate about service updates, security notices, and administrative matters
• monitor performance, troubleshoot issues, and prevent abuse or fraud
• comply with legal obligations
• enforce our terms, agreements, and internal policies
• analyze usage trends and improve product functionality

Where we process personal data on behalf of a dive shop, we do so only to provide the Services according to that customer's documented instructions.

Where applicable, we process personal data on one or more of the following legal bases:

• performance of a contract — to provide the Services to the dive shop and operate accounts
• compliance with legal obligations — e.g. accounting and tax records
• legitimate interests — securing, maintaining, and improving the Services, provided these interests are not overridden by your rights
• consent — where required by law, including for any future analytics or marketing cookies

Where a dive shop uses Ombar to collect and manage customer information, the dive shop is responsible for identifying and documenting the appropriate legal basis for its own processing activities — including explicit consent for health and medical data.

Strictly necessary cookies. Used to keep users signed in, maintain session state, and support core security. These always load — they are required to use the platform and do not need consent under GDPR / ePrivacy.

Analytics & product improvement (consent-gated). If you accept analytics through the cookie banner, we load Microsoft Clarity. Clarity records anonymised session data (clicks, scroll behaviour, page navigation) so we can identify usability problems and improve the product. Clarity drops the cookies _clck and _clsk and retains session recordings for up to 30 days (with a reduced sample retained up to 13 months). Clarity does not load until you accept analytics in the banner.

You can change your choice at any time at Cookie settings. The choice persists for 12 months on the device that made it.

We do not use advertising or cross-site tracking cookies. If that changes, this section will be updated and a fresh consent will be requested where required.

We do not sell personal data. We engage the following third-party service providers (“subprocessors”) to operate the Services:

We may also share personal data with:

• professional advisers (legal, accounting)
• regulators, courts, or law enforcement where required by law
• successors in the event of a merger, acquisition, restructuring, or asset sale

When we share personal data with service providers, we do so under appropriate contractual and confidentiality protections, including data processing agreements where required.

The list above is kept up to date on this page. We will provide reasonable notice before adding new subprocessors that process personal data on behalf of dive shop customers.

When we process personal data provided by a dive shop through the Services, we act as a data processor (GDPR) / service provider (CCPA equivalent), and the dive shop acts as the data controller.

In that context:

• the dive shop determines the purposes and means of processing customer data;
• we process that data only to provide the Services and related support, security, maintenance, and contractual functions;
• data subject requests relating to customer records held by a dive shop should be directed first to that dive shop; and
• our obligations as a processor are set out in a separate Data Processing Addendum (DPA) available to dive shop customers.

When we process data for our own purposes — for example, managing the dive shop's own account with us — we act as a data controller.

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy.

On account deletion or contract termination, we will return or delete personal data processed on behalf of the dive shop in line with the DPA, subject to legal retention requirements.

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure, including:

• encryption in transit (TLS)
• access controls and authentication
• isolated production environments
• regular backups stored in the European Union
• logging and monitoring

No system can guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials and for notifying us promptly of suspected unauthorized access.

Ombar serves dive shops primarily in the European Union and Southeast Asia. As a result, personal data may be transferred between these regions.

Our primary database is hosted in Singapore with DigitalOcean, and backups are stored in the European Union. Day-to-day operations and support access take place from Estonia, where Code Sense Studio OÜ is established. When personal data of individuals in the EU or UK is transferred to a country outside the European Economic Area that has not received an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914) and supplementary measures where required.

The specific transfers we rely on today are:

• EU / EEA / UK → Singapore for primary database hosting on DigitalOcean. We rely on EU SCCs Module One (controller-to-controller) and Module Three (processor-to-sub-processor) as relevant.
• EU / EEA / UK → United States for transactional email via Postmark (ActiveCampaign LLC). We rely on EU SCCs and Postmark's data processing addendum.
• EU / EEA / UK → Ireland → United States for subscription billing via Stripe Payments Europe, Ltd. (EU) and onward transfers to Stripe, Inc. (US) under Stripe's SCCs.
• EU / EEA / UK → Ireland → United States for Microsoft Clarity analytics, where Microsoft Ireland Operations Limited is the EU contracting party with onward transfers to Microsoft Corporation (US) under SCCs. Clarity only loads after explicit cookie-banner consent.

For customers in Southeast Asia, we process personal data in accordance with applicable local privacy laws in the jurisdictions where the dive shop operates (including Singapore's PDPA, Thailand's PDPA, Indonesia's PDP Law, and the Philippines' Data Privacy Act). For PDPA-regulated transfers out of Singapore, Code Sense Studio OÜ provides protection comparable to PDPA standards through the contractual safeguards above.

Depending on applicable law (including the EU GDPR, UK GDPR, and relevant Southeast Asian privacy laws such as Singapore's PDPA, Thailand's PDPA, Indonesia's PDP Law, and the Philippines' Data Privacy Act), individuals may have rights to:

• access personal data we hold about them
• correct inaccurate or incomplete data
• request deletion (“right to erasure”)
• object to or restrict certain processing
• request data portability
• withdraw consent where processing is based on consent
• lodge a complaint with a supervisory authority (in the EU, this is your national Data Protection Authority; in Estonia, the Andmekaitse Inspektsioon)

To exercise these rights, contact us at the email in Section 2. If your data is processed by us on behalf of a dive shop, we will forward your request to the dive shop or assist them in responding, as appropriate.

We respond to verified requests within the timeframes required by applicable law (generally one month under GDPR).

Some dive shops offer introductory programs for children (for example, PADI Bubblemaker for children aged 8 and above). In those cases, bookings and associated personal data are provided by a parent or legal guardian on behalf of the child, and the dive shop is responsible for obtaining appropriate parental consent under applicable law.

We do not knowingly collect personal data directly from children. If you believe a child's personal data has been provided to us improperly, contact us and we will review and take appropriate action, including deletion where required.

Ombar may integrate with or link to third-party services. We are not responsible for the privacy practices of third parties, and users should review the privacy policies of those providers separately.

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and take appropriate steps to notify affected users where required by law.

For privacy-related questions, subprocessor notifications, or data subject requests:

Code Sense Studio OÜ

Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia

[email protected]

ombar-suite.com