Electronic Records Policy
Where documentation described elsewhere in this document is collected, stored, or transmitted electronically rather than on paper, it is held to the same substantive requirements as its physical equivalent - and, where the diver or mentor is located in the European Union or European Economic Area, to the additional obligations set out under the General Data Protection Regulation (GDPR). This page sets out how FlowState Divers approaches electronic records in practice.
Electronic Records Are Not a Lesser Standard
An electronically signed liability release, a digitally submitted medical history form, or an evaluation record maintained in a training platform carries the same weight, the same retention obligation, and the same dual-copy principle described on the earlier pages of this document as a paper original. Where a mentor collects documentation through an electronic signature system, they remain personally responsible for verifying its completeness and ensuring it is properly stored - moving to digital format does not transfer that responsibility to the platform itself.
Lawful Basis for Processing
Personal data collected through registration, medical, liability, and evaluation documentation is processed on the following lawful bases, consistent with Article 6 GDPR:
- Performance of a contract - processing necessary to deliver the training a diver has enrolled in, including registration details, evaluation records, and programme progression history.
- Legal obligation - processing necessary to meet retention requirements set out elsewhere in this document or imposed by local law, including liability and insurance documentation.
- Consent - processing that goes beyond what is strictly necessary to deliver training, such as optional marketing communication, which a diver may withdraw at any time without affecting their ability to train with us.
Where medical history constitutes special category data under Article 9 GDPR, it is processed only with the diver's explicit consent, given at the point of submission, and solely for the purpose of confirming fitness to train.
Data Minimisation
Storage and Security
Electronic records are stored using access controls limiting visibility to those who require it to perform their role - a mentor's access to evaluation records is limited to their own divers, and complaint documentation is limited to those directly involved in reviewing it, consistent with the confidentiality principles set out elsewhere in this document. Where electronic records are stored or processed by a third-party platform on FlowState Divers' behalf, that platform operates under a data processing agreement consistent with Article 28 GDPR, and is contractually bound to the same security and confidentiality standards FlowState Divers holds itself to directly.
Retention and Erasure
Electronic records are retained for the same periods set out on the earlier page of this document covering what we keep and for how long. Where GDPR's right to erasure (Article 17) is invoked by a diver or mentor located in the EU or EEA, FlowState Divers will assess the request against our legal obligation to retain certain documentation - liability, medical, and complaint records in particular often cannot be erased early where a legal retention obligation or an active legal basis for processing still applies, and the diver will be informed clearly of which records can be erased and which are retained under a documented lawful basis, and for how much longer.
Where no overriding retention obligation applies, erasure requests are honoured within the timeframe GDPR requires, and confirmation is provided once complete.
Right of Access and Portability
Consistent with the dual-copy principle set out on the earlier records page, every diver already holds a copy of their own documentation as a matter of course. Beyond this, any diver or mentor located in the EU or EEA may request a full copy of the personal data FlowState Divers holds concerning them, in a commonly used electronic format, consistent with the right of access (Article 15) and right to data portability (Article 20) under GDPR. Such requests are directed through our official communication channel and fulfilled within the statutory timeframe.
Right to Rectification
Where an electronic record contains inaccurate personal data - a mistaken date, an outdated address, an error in a non-evaluative field - the individual concerned may request correction. This does not extend to disputing the substance of an evaluation record's assessment content, which is addressed instead through the complaint and appeal processes described elsewhere in this document, since an evaluation reflects a mentor's professional judgement rather than a factual data field subject to simple correction.
Cross-Border Transfer
Where electronic records are transferred between a mentor, a regional office, or a processing platform located outside the EU or EEA, that transfer takes place only under a mechanism recognised as providing adequate protection under GDPR - such as an adequacy decision or standard contractual clauses - so that a diver's data protection rights are not diminished simply because their training happened to be delivered or recorded from outside the EU or EEA.
Data Breach Notification
Who to Contact
Questions, requests, or concerns regarding how personal data is processed electronically - including access, rectification, erasure, or portability requests - are directed through the same official channel used for formal complaints: info@flowstatedivers.com. This is treated as a distinct category of request from a conduct complaint, but is received and acknowledged through the same official route to ensure it is properly logged and actioned.