Privacy notice

Who we are

Lakshadweep Scuba Adventures Private Limited, trading as Lak Scuba, runs the dive centre and this website. Under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) we are the “data fiduciary”: we decide why your details are collected and how they are used.

Lak Scuba, Western Beach Road, Near Mohidheen Palli, Kavaratti Island, UT of Lakshadweep, India — 682555.
Email bookings@lakscuba.com, and put “Privacy” in the subject. Phone or WhatsApp +91 94977 66338 or +91 94977 66224.

Every question, request and complaint about your personal information goes to that email address. We have not named a separate grievance officer.

What we collect, and why

We collect what the next few paragraphs list, for the purpose named in each. We use it for that purpose.

Booking

When you book, we ask for the lead booker’s name, phone number and email address. For each person diving we ask for a name, an age group (adult, 12 to 17, or under 12), whether they are an Indian or a foreign national, and a certification level where the course needs one. We also keep the trip you chose, its dates, any stay you ask us to arrange, and the name and address the bill should be made out to. A booking our team makes for you by phone, WhatsApp or on the boat holds the same details. We use them to hold your places, run the trip and send you your bill.

While you are booking, what you type is held in a draft tied to a cookie in your browser. If you give a name and phone number and do not finish, our system turns the draft into an enquiry, marked as an abandoned booking, so that someone can call you back.

Entry permits and travel

Lakshadweep needs an entry permit for every visitor. In your trip portal, for each person, we ask for the islands you will visit, your arrival and departure dates, how you will travel, your passport number and expiry date, your Indian visa number if you are a foreign national, and your home address. The Department of Tourism’s monthly return lists every dive tourist’s name and address, which is why we need the address. You can also upload a passport or government photo ID, a visa, a certification card, a dive medical letter, a photograph and your flight ticket. Our team applies for the permit on the administration’s e-permit website by hand, then puts the permit, your ship ticket and any lodge voucher in your portal.

To open a passport, ID or visa file in the portal you need a sign-in code entered in the last 24 hours. Every time a member of staff opens a document or reads a passport or visa number, it is logged, and the Owner gets a daily email listing who opened which kind of document for which booking. That email names no guests, shows no numbers and does not include the documents themselves.

Safety, paperwork and medical

Diving needs signed forms. In the portal we ask for your full name, gender, phone numbers, home address, an emergency contact (name, relationship and phone), your certification (agency, level, number and date), whether you have dive insurance, and your choices about PADI marketing. You answer PADI’s medical questionnaire, and sign each PADI form your programme needs, with a signature you draw or type. For a child, a parent or guardian does this and signs too. The public Discover Scuba Diving registration on this website collects the same kind of thing, with its own knowledge review and medical questions, a date of birth and your signatures. Instructors and office staff also write notes, log dives and record certification numbers against a diver. We use all of it to run the dive safely and to keep the records PADI and the Department of Tourism expect. Health answers get special care, set out under Health information.

Payments

Razorpay takes online payments. We keep the amount, Razorpay’s payment and order numbers, the time and whether it worked. We do not see or store your card, UPI or bank details. A payment taken in cash or by bank transfer is entered by our staff with the name of the staff member who took it. Refunds are recorded the same way. For each confirmed booking we also create the bill of supply in Zoho Books from your name, email address, the bill’s name and address, and the amounts.

Messages

We email and message the address and phone number you gave us: your booking confirmation, payment receipts, balance reminders, a request for your documents, a note when your permit is uploaded, and sign-in codes. We keep a record of each message we send. We do not send marketing messages. The newsletter box in the footer stores your email address and the page you were on. We have not sent a newsletter yet. Before we send the first one we will add an unsubscribe link and ask you to confirm your address; until then, write to us if you want to be taken off.

When you send an enquiry from the website, our team’s mailbox also receives a copy of what you wrote, and a note of every payment and refund on a booking goes there too.

The website

The contact and enquiry forms ask for your name, phone number, an optional email address, a topic, rough dates and your message. Cloudflare’s Turnstile checks that a person is sending the form. To slow down abuse we count recent requests against a scrambled, shortened copy of your network address, never the address itself. To sign in to the portal you give an email address and we send a six-digit code.

Why we may use it

You give us your details for a purpose: to enquire, to book, to dive. We use them for that purpose, because you gave them to us for it. Where the law tells us to keep something, such as our accounts and the diver register, we keep it. For documents and health information we do more than rely on that. We show you what we keep and why before you give it, and we record that you read it.

• Documents. We show the notice once on the documents page. We record that your account read it when you press “I have read this”, when you arrive through the link in our document request while signed in, or when you make your first upload. The record holds the date, the version of the notice and which of the three it was. If we change the notice, we ask again.
• Medical questionnaire and forms. You read the notice above the questions and sign. We keep the signature and the date it was signed with the form.

You can take your consent back at any time by writing to bookings@lakscuba.com. We then stop using what that consent covered, and delete it, except what the law makes us keep (see How long we keep it). Withdrawing consent for your health answers means we cannot let you dive.

Health information

PADI’s medical questionnaire is health information. We treat it with more care than the rest.

• What we use it for. Only to decide whether you need a doctor’s approval before you dive. The form’s own rule is that any “Yes” means a doctor must see you.
• Who can see it, in the portal. You can open your signed questionnaire. A child’s parent or guardian can open the child’s. The person who booked for you cannot open it, and sees only “Done”, “Not yet” or “Waiting for doctor”. Our desk and staff app do not show the answers; they show whether a doctor’s approval is needed. Our desk staff can open a doctor’s letter you upload. We plan to let instructors and managers open signed forms, with every opening logged; when that is built we will change this notice.
• Who can see it, on the website registration. Our Owner and Manager can read the answers. Other office staff see only whether a doctor’s approval is needed.
• Where it is. The answers sit in our database and in a signed PDF in Cloudflare storage. No health answer is written to our activity log or our error logs.
• How long. A signed medical questionnaire is kept at least seven years, which is what PADI asks dive centres to do, and stays even if you delete your account. We have not built the deletion after seven years yet. A website registration has no deletion tool yet. Both are in the table under How long we keep it.

Who we share it with

We do not sell your details and we do not run advertising. These are the companies and bodies that receive data from us, and why.

• Razorpay. The amount and our booking reference for every payment, and, for a payment link we send you, your name, email address and phone number. You type your card, UPI or bank details into Razorpay’s own window; they do not reach us and we do not store them. To take your deposit and balance and to refund you.
• ZeptoMail (Zoho). Your email address and the text of each email we send you, including sign-in codes. To deliver our email.
• WhatsApp (Meta). Your phone number and the text of each WhatsApp message we send you. To deliver booking messages, reminders and document requests by WhatsApp, once WhatsApp is switched on for us.
• Cloudflare. Everything on this website, since Cloudflare hosts it: our database (D1), the stored documents and signed forms (R2), the anti-bot check on our contact form (Turnstile), and the sign-in screen our staff use (Access). To run the site and keep your records.
• Zoho Books. For each confirmed booking: your name and email address, the name and address the bill is made out to, the amounts, and each payment and refund. To issue your bill of supply and keep our accounts.
• Our team mailbox on Google Workspace. A copy of every enquiry you send from the website, and a note of every payment and refund on a booking. So that our team sees an enquiry or a payment the moment it happens.
• The Lakshadweep administration (entry permits). What the permit application needs for each person on the trip: your name, the islands and dates, how you travel, and your passport or ID and visa details. Our staff enter these on the administration’s e-permit website by hand; this site does not send them automatically. To apply for your Lakshadweep entry permit.
• The Lakshadweep Department of Tourism. A monthly return listing each person who dived that month with their name, home address and what they paid. Dive centres must file it under the Department’s dive centre guidelines.

Some of these companies handle data outside India. We asked for Cloudflare’s Asia-Pacific region when we created our own database. We have not asked each of the others where it keeps data. Some of these connections are set up in our system and not switched on yet; this notice describes what each one does once it is. If the law requires us to give information to a court or an authority, we will.

How long we keep it

We mark each line below as Automatic when our system does it on its own, Not yet automatic when it is the practice and we have not built the job that enforces it, and Proposal when it is a period we suggest and have not decided. Where nothing deletes a record yet, you can still ask us to.

• A booking you have not finished

  The trip, names, phone, email and invoice details you typed before paying.

  How long: Deleted about 24 hours after you last touched it. Automatic

  Before it is deleted, a draft with a name and a phone number becomes an enquiry (next row) so that someone can call you back.

• Enquiries

  Name, phone, email and message from the contact or enquiry forms, from a booking you started and did not finish, and from calls and messages our team typed in.

  How long: Proposed: 24 months for an enquiry that did not become a booking, then we blank the name, phone, email and message. Proposal, not yet decided

  The owner has not yet decided this. Until then, enquiries are kept and nothing deletes them.

• Sign-in codes

  A scrambled copy of the six-digit code we email you, with your address.

  How long: A code works for 10 minutes. Records older than a day are deleted whenever the next code is requested. Automatic

• Staying signed in

  A scrambled copy of the cookie that keeps you signed in, and when it was made.

  How long: Stops working after 30 days, or when you sign out. Automatic

  The expired record itself is not swept away; it goes when you delete your account.

• Abuse counters

  A scrambled, shortened copy of your network address and a count of recent requests.

  How long: Each counter expires within a day, and expired counters are cleared out as the site is used. Automatic

• Your account, documents and permit details

  Passport or ID, visa, certification card, dive medical, photo, flight ticket and signed waiver files; the permit details form; your home address; the intake and the drawn signature from the dive paperwork; your sign-in addresses.

  How long: Until you delete your account. Deleting removes the files, clears the details and erases the intake and signature, at once. Automatic

  The records in the next four rows are the exceptions.

• Bookings, payments and bills of supply

  Booking dates, products, amounts, the payment ledger, the name and address on the bill, and each diver’s name, age group and nationality (the diver register). Deleting your account blanks the lead’s phone and email on a booking but keeps the rest.

  How long: For as long as the law requires us to keep our accounting records. We have not written down an end date, and nothing deletes them. Not yet automatic

• Permits, tickets and vouchers we issued for your trip

  The entry permit, ship ticket and lodge voucher, and the permit number.

  How long: Kept with the trip. Deleting your account does not remove them, because they are our record of a permit we applied for. No end date. Not yet automatic

• Signed PADI forms and medical questionnaires (portal)

  Each signed form and medical as a PDF, with the answers and the details filled in.

  How long: At least seven years, which PADI asks dive centres to keep. Deleting your account leaves them in place. Nothing deletes them after seven years. Not yet automatic

  The keeping is automatic (account deletion leaves them alone). The deletion after seven years is not built.

• Discover Scuba Diving registration (website form)

  The answers, including the medical questions, your address and date of birth, and your signatures.

  How long: Proposed: seven years, the same as the PADI forms above. Nothing deletes a registration yet, and there is no button for it: to have one erased, write to us. Proposal, not yet decided

  This form is not tied to an account, so “Delete my account” does not reach it.

• Newsletter list

  Your email address and the page you subscribed from.

  How long: Until you ask to be removed. A removed address stays on the list marked as unsubscribed, so that no one else can sign you up again by typing it in; write to us if you want it erased. Not yet automatic

• A record of messages we sent you

  The text, the time and whether it was delivered. The sign-in link in a message is not stored. Your address and phone are kept only as a scrambled copy.

  How long: Kept. No end date, and nothing deletes them. Not yet automatic

• Activity log and document-access log

  Who did what and when: an account or staff number, a booking reference, the action, and for document opens a scrambled network address. They hold no passport number and no health answer.

  How long: Kept. The activity log cannot be changed or deleted by design. No end date. Not yet automatic

• Staff notes, dive logs and certification records

  What our staff write about a diver on a seat: notes, logged dives, the certification number we are told.

  How long: Kept with the seat. Deleting your account does not remove them. No end date. Not yet automatic

Our servers’ own logs are kept by Cloudflare for as long as Cloudflare keeps them. We write nothing about you into them beyond the kind of error and a booking or enquiry reference.

Your rights

Under the DPDP Act you have these rights. To use any of them, write to us.

• Access. Ask for a summary of the personal data we hold about you and what we do with it, and who we have shared it with. The portal already shows you your own documents, forms and permit details.
• Correction. Ask us to fix details that are wrong or out of date. You can change your own permit details and paperwork in the portal; for anything else, write to us.
• Erasure. “Delete my account” on the portal’s Account page removes your documents, permit details, paperwork intake and signature, and your sign-in. It cannot be undone, and it asks for a fresh code first. It keeps the records in the table above that the law or PADI makes us keep. For anything not tied to an account (an enquiry, a Discover Scuba registration, a newsletter address) write to us and we will delete it by hand. We do not yet have a button for that.
• Grievance. If you are unhappy with how we have handled your data, write to bookings@lakscuba.com with “Privacy complaint” in the subject, and say what happened. If we do not settle it, the Act lets you complain to the Data Protection Board of India.
• Nominate. You may name another person to exercise these rights for you if you die or cannot act for yourself. Write to us with their name and how to reach them.

We will ask you to prove who you are before we show, change or delete anything, so that someone else cannot do it in your name. We reply in writing.

Children

Children dive with us: Bubble Maker and Seal Team from age 8, Discover Scuba Diving and the Junior courses from 10. We treat anyone under 18 as a child. A child cannot have their own portal account or be invited to one. A parent or guardian manages the child’s record, gives the permit details, and answers the medical questionnaire and signs the forms for them. We ask for the child’s date of birth, and where a form has a line for the child we ask the child to sign as well as the guardian. The public registration form asks for a guardian’s signatures when the participant is under 18. By filling these in, the parent or guardian gives consent for the child.

We do not track children or show them advertising, because we do not track anyone and run no advertising.

Cookies and tracking

This website has no analytics, no advertising pixels and no social-media trackers. Its content security policy lets scripts load only from this site and from Cloudflare’s Turnstile, and, on the one payment page, from Razorpay. We set only the cookies below. They are first-party, they cannot be read by scripts on the page, and each one is there so that something you asked for works. Because of that we do not show a cookie banner.

• lakscuba_booking: Remembers your trip while you book. Lasts 24 hours.
• lakscuba_pay: Lets you come back to a payment you started, and no one else. Lasts 24 hours.
• lakscuba_session: Keeps you signed in to your trip portal. Lasts 30 days, or until you sign out.

Cloudflare’s Turnstile, on the contact form, and Razorpay’s payment window may set their own cookies to do their jobs. We do not control those.

Changes to this notice

We will change this page when what we do changes, and put the date at the top. If a change affects what you agreed to for your documents, we ask you to read the new notice again. This version is dated 2 October 2026.