Privacy Policy

DYVUM Expeditions Sdn. Bhd. (“DYVUM”, “we”, “us” or “our”) respects the privacy of our customers, divers, students, travellers and website visitors.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal data in connection with our diving education, travel, expedition and related services.

We process personal data in accordance with applicable Malaysian data protection laws, including the Personal Data Protection Act 2010 and its amendments.

1. Personal Data We May Collect

Depending on your relationship with DYVUM, we may collect information including:

Identity and contact information

name;
date of birth;
nationality;
gender where relevant;
identification or passport information;
postal address;
telephone number;
email address; and
emergency contact information.

Travel information

passport details;
flight information;
travel dates;
rooming requirements;
dietary information;
visa-related information;
travel preferences; and
emergency information.

Diving and training information

diving certification agency;
certification number;
certification level;
diving experience;
logged dives;
recent diving activity;
course enrolment;
training records;
performance and completion information; and
information required to process certifications.

Health and medical information

Where necessary for diving safety, training requirements or travel arrangements, we may process information contained in:

diver medical questionnaires;
medical declarations;
medical clearance documents;
allergies or dietary requirements; and
other health information voluntarily or necessarily provided to us.

Health information will only be processed where reasonably necessary and with appropriate safeguards.

Booking and transaction information

We may collect:

bookings;
invoices;
payment status;
transaction references;
refunds;
booking history; and
related communications.

Payment-card details may be processed directly by our appointed payment provider rather than stored by DYVUM.

Communications

We may retain communications made through:

email;
WhatsApp or other messaging platforms;
enquiry forms;
customer-support communications; and
social-media channels.

Website and technical information

Depending on the technologies deployed on our website, we may collect:

IP address;
browser type;
device information;
pages viewed;
referral source;
website interactions; and
cookie or analytics information.

For further information, see our Cookie Policy.

2. Sources of Personal Data

We may obtain personal data:

directly from you;
from a person making a booking on your behalf;
from another participant in your group;
from training organisations;
from dive operators or instructors;
from travel or accommodation suppliers;
from payment providers;
through our website or communications platforms; or
from other sources where lawful and reasonably necessary.

If you provide another person’s personal data to us, you should ensure that you are authorised to do so.

3. Why We Use Personal Data

We may process personal data to:

respond to enquiries;
administer bookings;
provide diving courses and activities;
arrange travel and expedition services;
register students and process diving certifications;
verify diving qualifications and prerequisites;
coordinate resorts, accommodation, transportation and diving;
administer payments, invoices and refunds;
communicate itinerary and operational information;
maintain customer and training records;
manage safety and emergencies;
meet legal, regulatory, insurance and accounting obligations;
investigate complaints or disputes;
prevent fraud or misuse;
improve our services and website;
maintain customer relationships; and
send marketing communications where permitted.

4. Information Required to Provide Our Services

Certain information is necessary for DYVUM to provide a requested service.

For example, we may be unable to:

enrol you in a course;
process a diving certification;
reserve accommodation;
arrange travel;
verify your eligibility to dive; or
complete an international booking

if required information is not supplied.

Where information is optional, we will endeavour to make that clear.

5. Diving Training Organisations

Where you participate in training administered by a diving certification organisation such as PADI, information required for course administration, student records, eLearning, training verification and certification may be provided to or accessible by the relevant training organisation, instructor or affiliated facility.

Those organisations may separately process information under their own privacy policies.

6. Who We May Share Personal Data With

Where reasonably necessary to provide a service or meet our legal obligations, we may disclose relevant personal data to:

instructors, divemasters and authorised DYVUM personnel;
PADI or another relevant training organisation;
overseas and Malaysian dive operators;
resorts;
hotels;
liveaboards;
boat operators;
airlines and transportation providers where relevant;
destination management companies and ground operators;
activity providers;
insurers and emergency-assistance providers where relevant;
medical or emergency personnel where necessary;
payment processors;
banks and financial-service providers;
accounting and professional advisers;
information-technology and cloud-service providers;
customer relationship and communications platforms;
email and messaging providers;
analytics and website-service providers;
government, regulatory or law-enforcement authorities where required; and
other suppliers directly involved in fulfilling your booking.

We aim to disclose only information reasonably necessary for the relevant purpose.

We do not sell personal data to advertisers.

7. International Transfers

DYVUM operates international diving and travel services.

Providing an overseas trip may therefore require personal data to be transferred outside Malaysia, including to overseas resorts, dive operators, accommodation providers, transportation providers, technology providers or other suppliers.

We will take reasonable steps to ensure that international transfers are handled in accordance with applicable Malaysian data protection requirements.

Where appropriate, safeguards may include contractual obligations, consent or another lawful basis permitted by applicable law.

8. Sensitive Personal Data

Some information used for diving or travel may constitute sensitive personal data, particularly medical or health information.

We will process such information only where reasonably necessary and permitted by applicable law.

Access will be limited to persons who reasonably require the information for the relevant purpose.

9. Marketing

Where permitted, DYVUM may use your contact information to communicate information about:

courses;
trips;
expeditions;
events;
community activities;
conservation initiatives;
promotions; and
related DYVUM services.

You may unsubscribe from marketing communications at any time.

Operational communications relating to an existing booking are not marketing communications and may still be sent where necessary.

10. Photographs and Video

DYVUM may create photographs or video during courses, trips or events.

Where identifiable images are used for promotional or marketing purposes, we will handle such use in accordance with applicable consent and privacy requirements.

You may tell us if you do not wish identifiable promotional images of yourself to be used.

11. Security

DYVUM takes reasonable administrative, organisational and technical measures designed to protect personal data against:

loss;
misuse;
unauthorised access;
disclosure;
alteration; and
destruction.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

12. Data Breaches

Where a personal-data breach occurs, DYVUM will assess and respond to the incident in accordance with applicable Malaysian data-protection requirements, including notification obligations where applicable.

13. Retention

DYVUM retains personal data only for as long as reasonably necessary for:

the purpose for which it was collected;
ongoing customer or training administration;
legal and regulatory requirements;
accounting and tax records;
safety and certification records;
dispute resolution; and
legitimate business record-keeping.

Information that is no longer reasonably required will be deleted, anonymised or otherwise securely disposed of where appropriate.

Different categories of information may be retained for different periods.

14. Your Rights

Subject to applicable Malaysian law, you may have rights relating to your personal data, including rights to:

request access to personal data held about you;
request correction of inaccurate or incomplete information;
withdraw consent where processing depends upon consent;
request that certain processing cease;
opt out of direct marketing; and
exercise other rights provided by applicable law.

Some requests may be subject to statutory exceptions.

15. Accuracy of Information

Please ensure that information supplied to DYVUM is accurate and current.

You should inform us if material information changes, particularly where it may affect travel, safety, diving eligibility or emergency arrangements.

16. Children and Minors

Where services are provided to a minor, DYVUM may require information and consent from a parent or legal guardian as required by applicable law, training standards or supplier requirements.

We will limit collection of information relating to minors to information reasonably required to provide the relevant service.

17. Cookies

Our website may use cookies and similar technologies.

Please refer to the DYVUM Cookie Policy for further information.

18. Third-Party Websites and Platforms

Our website and communications may link to or use third-party services.

Those organisations process information under their own privacy policies, and DYVUM is not responsible for the privacy practices of independent third parties.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology or legal requirements.

The latest version will be published on www.dyvum.com with the date of the latest revision.

20. Contact and Privacy Requests

Questions, requests or complaints concerning personal data may be directed to:

DYVUM Expeditions Sdn. Bhd.

Email: explore@dyvum.com

Website: www.dyvum.com