Privacy policy

Last updated: 7 October 2026

This policy explains what personal information Scuba Evolution collects, why, who we share it with and the choices you have. It applies to this website, our shop in Glenvista and our training.

1. Who we are

Scuba Evolution (PTY) Ltd, registration number 2014/213535/07, is the responsible party for your personal information. Our address is Shop U44, Glenvista Shopping Centre, Biggarsberg St, Glenvista, Johannesburg South, 2190.

Information Officer: The Information Officer, Scuba Evolution, shop@scubaevolution.co.za, +27 (0) 10 335 1000.

2. What we collect

Information you give us

• Your name, email address, phone or WhatsApp number, and delivery and billing addresses.
• What you buy, book or ask us about, and any messages you send us, including through the chat on this site and on WhatsApp.
• For training: your date of birth, your PADI certification details, an emergency contact, and your answers to the diver medical questionnaire. The questionnaire is health information, which the law treats as special personal information. You complete it as part of PADI's eLearning, and we use it only to make sure it's safe for you to dive.
• For group bookings: each student's name and contact details, so we can arrange their training directly.

Information collected when you use this site

Your device, browser and approximate location, the pages you view, what you search for, what goes into your cart, and whether you complete an order. This comes from cookies and similar technology, through Shopify, Google Analytics and Microsoft Clarity (see sections 5 and 6).

Information from others

Your certification records from PADI, and payment confirmations from our payment providers. We never see or store your full card number.

3. Why we use it

We use your information only where the law allows:

• To deliver what you've asked for: processing orders, delivering parcels, booking and running your training, servicing your equipment, and answering your questions.
• To keep you safe: your medical questionnaire and certification level decide which training you can safely do. We use your health information only with your consent.
• To meet our legal obligations: tax and accounting records, consumer law, and PADI's training standards.
• For our legitimate business interests: preventing fraud, keeping the site secure, and understanding how the site is used so we can improve it.
• For marketing, under the rules in section 4.

4. Marketing by email and WhatsApp

• Email: we send course news, offers and reminders only if you agreed to receive them. If you bought from us before, we may email you about similar products and services, and every email lets you say no.
• WhatsApp: marketing messages go only to people who agreed to receive them. Messages about an order, a booking or your equipment are not marketing.
• Saying no: use the unsubscribe link in any email, reply STOP on WhatsApp, or email shop@scubaevolution.co.za. One request takes you off every channel, and it doesn't affect messages about your orders or bookings.
• We never sell or rent your personal information.

5. Analytics and advertising

• Google Analytics shows us how the site is used in totals and trends. It does not store IP addresses, and detailed visit data is deleted after 14 months.
• Microsoft Clarity shows us where people click and scroll, and replays visits so we can see what is hard to use. Anything typed into a form is masked in your browser, so it never reaches Clarity.
• Google advertising: we use Google signals and Google's advertising features to measure which ads and free listings lead to orders, and to show our ads to people who have visited this site. If you're signed in to Google and have allowed personalised ads, Google can link your visits across your devices. Order details such as the items and order value are shared with Google for that measurement. If you accept marketing cookies, a scrambled (hashed) copy of the email address you use at checkout can also be sent to Google to match orders to our ads. Google cannot read it as an address.
• Customer lists: we may share a scrambled (hashed) copy of your email address or phone number with Google, and in future with Meta (Facebook and Instagram). We do this so we can stop showing you ads for courses you've already done, and to measure how our ads perform. The details are turned into a code before they leave our systems, and Google or Meta match the code against their own users and delete codes they can't match. We include only customers who agreed to marketing, and never anyone under 18. To be left out, email us and we'll remove you before the next upload.
• Your controls: turn off personalised ads at adssettings.google.com, install Google's opt-out add-on from tools.google.com/dlpage/gaoptout, or block or clear cookies in your browser.

6. Cookies

Essential cookies keep your cart, checkout and account working, and the site can't work without them. Analytics and advertising cookies are the ones described in section 5.

When you first visit, a banner asks whether you accept analytics and advertising cookies. Until you choose Accept, they stay off. Essential cookies that run the cart and checkout always stay on. You can change your choice at any time from "Cookie preferences" at the foot of every page.

You can also block or delete cookies in your browser settings, although blocking every cookie stops the cart and checkout working.

7. Who we share it with

We share your information only with service providers who need it to do their job for us, and they must keep it confidential and secure:

• Shopify, which runs this website, our checkout, our customer records and our emails.
• Our payment providers: PayFast, Yoco, Ozow and Mobicred.
• The Courier Guy, which delivers your parcels.
• PADI, which registers your training and issues your certification.
• Xero, our accounting system.
• Google (analytics, advertising and product listings), Microsoft (Clarity) and Meta (WhatsApp).
• Our professional advisers and the authorities, when the law requires it.

8. Information stored outside South Africa

Some of these providers, including Shopify, Google, Microsoft, Meta, PADI and Xero, store information outside South Africa. We use them only where they are bound by data protection laws or contract terms that protect your information at least as well as the Protection of Personal Information Act does.

9. Children

Some of our courses are open to children. We collect a child's information only with a parent's or guardian's consent, and we use it for their training and safety only. We don't send marketing to children, and we never include anyone under 18 in the customer lists described in section 5. Course news for junior students goes to the parent or guardian.

10. How long we keep it

• Orders and accounting records: at least 5 years, as tax law requires.
• Training records: as long as PADI's standards and the law require.
• Marketing details: until you opt out.
• Detailed analytics data: 14 months.

When we no longer need information, we delete it or remove anything that identifies you.

11. Security

This site runs over HTTPS and is hosted on Shopify. Card payments are handled by providers certified to the PCI DSS standard. Customer records sit on systems with controlled access. If we learn of a breach that affects your information, we will tell you and the Information Regulator as the law requires.

12. Your rights

Under the Protection of Personal Information Act you can:

• ask what personal information we hold about you, and who has seen it;
• ask us to correct or delete it;
• object to us using it, including for marketing, at any time;
• withdraw your consent at any time, without affecting anything we did before.

Email shop@scubaevolution.co.za. We may ask you to confirm your identity first.

If you think we've mishandled your information, please tell us first so we can put it right. You can also complain to the Information Regulator: POPIAComplaints@inforegulator.org.za, 010 023 5200, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, inforegulator.org.za.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use information you've already given us, we'll tell you before it takes effect.