Privacy policy

Contents

1. Personal Information We Collect

The personal information we collect depends on how you interact with us. We seek to collect information that is reasonably necessary and proportionate for the purposes described in this Policy.

1.1. Contact, Account, and Identity Information

• name, email address, telephone number, mailing address, billing address, and shipping address;
• account credentials, account preferences, authentication records, and customer-service identifiers;
• age or date-of-birth information when reasonably necessary for eligibility, travel, safety, or legal compliance; and
• identity-verification information when reasonably necessary to protect an account, investigate fraud, process a privacy request, administer travel, or satisfy a provider or legal requirement.

1.2. Order, Payment, and Transaction Information

• Products, Services, Bookings, Trip payments, deposits, installment payments, discounts, gift cards, credits, refunds, returns, cancellations, and transaction history;
• billing status, payment authorization information, fraud-screening information, chargeback or dispute records, and limited payment details supplied by Shopify or an authorized payment provider; and
• customization choices, approved proofs, Submitted Material, sizes, specifications, and fulfillment instructions.

Payment-card numbers, security codes, and certain digital-wallet credentials are processed by Shopify and authorized payment providers. Neptune's Vanguard generally does not receive or store complete payment-card numbers or payment-card security codes.

1.3. Dive Trip, Travel, Certification, and Participant Information

When reasonably necessary to administer a Trip, Dive Activity, or related Service, we or a responsible Third-Party Provider may collect:

• training agency, certification level or number, certification date, logged experience, dive recency, requested activities, and relevant skill or Equipment information;
• passport or other travel-document information, nationality, date of birth, arrival and departure information, flight details, rooming preferences, dietary requests, accessibility requests, and information required by a hotel, dive operator, carrier, governmental authority, or destination;
• emergency-contact name, relationship, and contact information;
• signed waivers, releases, participant agreements, medical statements, acknowledgments, consent records, and incident documentation; and
• limited medical-screening, physician-clearance, accommodation, allergy, medication, or other health-related information when reasonably necessary for safety, eligibility, emergency planning, insurance, or provider requirements.

A medical form, physician clearance, or health disclosure does not make Neptune's Vanguard a healthcare provider and does not transfer responsibility for medical fitness to the Company. Participant medical-fitness responsibilities remain governed by Section 13 of the Terms of Service.

1.4. Communications, Marketing, and Submitted Material

• emails, text messages, telephone or chat communications, customer-support requests, survey responses, and communication preferences;
• marketing consent, unsubscribe or opt-out records, and message-interaction information;
• reviews, comments, photographs, videos, artwork, logos, designs, social-media interactions, and other Submitted Material; and
• records of complaints, disputes, privacy requests, policy notices, legal communications, and safety communications.

Submitted Material is also subject to Section 23 of the Terms of Service. Trip or Dive Activity publicity rights are not created merely by this Privacy Policy; any separate photo or publicity authorization required for a particular use will be handled separately.

1.5. Device, Usage, Cookie, and Analytics Information

• IP address, browser type, device type, operating system, language, approximate location, and device or advertising identifiers;
• pages viewed, Site searches, referral URLs, links or advertisements interacted with, cart activity, checkout activity, timestamps, and similar Site events;
• cookie, pixel, tag, local-storage, software-development-kit, and similar technology data; and
• security logs, fraud signals, diagnostics, error reports, and performance information.

2. Sources of Personal Information

We may collect personal information:

• directly from you;
• from a person making a purchase or Booking for you, or from a parent or legal guardian;
• automatically from your device or use of the Site;
• from Shopify, Shop Pay, payment processors, carriers, fulfillment providers, manufacturers, distributors, review platforms, communications providers, analytics providers, marketing platforms, and fraud-prevention providers;
• from dive operators, instructors, divemasters, guides, training agencies, hotels, resorts, transportation providers, insurers, assistance providers, governmental authorities, and other travel or activity providers;
• from social-media platforms when you interact with Company pages, advertisements, messages, or content; and
• from publicly available sources or another lawful source where appropriate.

If you provide personal information about another person, including another Participant or an emergency contact, you represent that you are authorized to provide the information and will direct that person to this Privacy Policy when reasonably appropriate.

3. How We Use Personal Information

We may use personal information to:

• operate, maintain, personalize, and secure the Site and Services;
• create, authenticate, and manage customer accounts;
• review, accept, process, fulfill, ship, track, support, refund, replace, or investigate an order;
• quote, proof, produce, fulfill, and document custom work;
• administer Bookings, Trip payments, rooming, transportation, itineraries, certification verification, documentation, waivers, medical-screening requirements, safety communications, and Trip or Dive Activity participation;
• communicate operational changes, recalls, safety matters, emergencies, schedule changes, provider requirements, and customer-support information;
• detect, investigate, and prevent fraud, abuse, account compromise, security incidents, unlawful conduct, and violations of our agreements;
• provide marketing that you have requested or that is otherwise legally permitted, measure campaigns, and personalize advertising subject to applicable consent and opt-out rights;
• analyze Site performance, customer interactions, demand, and business operations;
• maintain tax, accounting, insurance, safety, compliance, and legal records;
• establish, exercise, defend, or enforce legal rights and agreements; and
• comply with law, court orders, valid legal process, sanctions, governmental requirements, safety obligations, and regulatory duties.

Where applicable law requires a legal basis for processing, we process personal information as necessary to perform a contract or take requested pre-contract steps, comply with legal obligations, protect vital interests, pursue legitimate interests that are not overridden by applicable rights, or based on valid consent.

4. How We Disclose Personal Information

We disclose personal information only where reasonably appropriate for the purposes described in this Policy, including to the following categories of recipients:

Commerce and Technology Providers

Shopify, account providers, payment providers, fraud-prevention services, hosting providers, communications providers, security providers, and customer-support systems.

Product and Fulfillment Providers

Printers, custom-production providers, manufacturers, distributors, warehouses, shipping carriers, return processors, and warranty administrators.

Travel, Dive, and Activity Providers

Dive operators, instructors, divemasters, guides, training professionals, hotels, resorts, airlines, transportation providers, excursion providers, ports, marine authorities, and other entities reasonably necessary to administer a Booking or protect Participant safety.

Emergency, Safety, and Insurance Recipients

Emergency contacts, medical or rescue providers, insurers, assistance providers, responsible activity personnel, and legal or governmental authorities when authorized, required by law, or reasonably necessary to respond to an emergency or safety incident.

Analytics, Advertising, and Social-Media Providers

Shopify and, depending on the integrations and campaigns then enabled, providers such as Google, TikTok, Meta, or similar analytics, advertising, and social-media services. These activities remain subject to applicable consent, opt-out, and privacy-choice requirements.

Professional Advisers and Legal Recipients

Attorneys, accountants, auditors, insurers, consultants, law-enforcement or governmental authorities, counterparties, and successors where reasonably necessary for professional advice, legal compliance, protection of rights or safety, financing, restructuring, merger, sale, or transfer of all or part of the business.

Third-Party Providers may independently determine how they process information for their own services, legal duties, fraud prevention, or platform operations. Their own privacy notices may apply in addition to this Policy.

5. Cookies, Pixels, Analytics, and Similar Technologies

We and our providers may use cookies, pixels, tags, local storage, software development kits, and similar technologies for essential Site functionality, security, preferences, fraud prevention, analytics, campaign measurement, personalization, and advertising.

Current or future integrations may include Shopify technologies and advertising or analytics tools provided by Google, TikTok, Meta, or similar providers. The specific tools may change as our Site, applications, and business operations change.

You may manage cookies and similar technologies through available Site privacy controls and browser settings. Blocking certain technologies may affect Site functionality. Where applicable, the Site may display a cookie banner, consent controls, a “Your Privacy Choices” link, a “Do Not Sell or Share My Personal Information” link, or another privacy-choice mechanism.

Where applicable law requires consent before non-essential technologies are used, we and providers integrated with the applicable consent system will use those technologies in accordance with the consent choices available through the Site.

6. Sale, Sharing, and Targeted Advertising

Some U.S. privacy laws define “sale,” “sharing,” or “targeted advertising” more broadly than an ordinary cash sale. Depending on the advertising, analytics, Shopify, social-media, or similar technologies enabled on the Site, disclosure of device identifiers, IP addresses, cookie identifiers, advertising identifiers, or Site-activity information may be treated as a sale, sharing, or targeted-advertising disclosure under an applicable law.

Where applicable law gives you the right to opt out, you may use the privacy-choice or data-sharing opt-out control displayed on the Site, use a legally recognized browser privacy signal where applicable, or contact support@neptunesvanguard.com with the subject line “Privacy Opt-Out.”

We do not knowingly sell or share for cross-context behavioral or targeted advertising the personal information of a person under sixteen (16) years of age.

We do not sell or share medical-screening information, passport or travel-document information, emergency-contact information, or similar sensitive Participant information for targeted advertising or cross-context behavioral advertising.

7. Email and SMS Communications

We may send transactional communications concerning orders, Bookings, payments, deliveries, safety, schedule changes, account security, policy notices, or customer support.

Where required by applicable law, marketing email and SMS communications are sent only with the consent applicable to that channel. Consent to marketing text messages is not a condition of purchase.

You may unsubscribe from marketing email by using the unsubscribe method contained in the message. You may opt out of marketing SMS messages by replying STOP when that feature is supported. Reply HELP for assistance where supported. Message and data rates may apply.

Opting out of marketing does not prevent necessary transactional, safety, account-security, customer-support, legal, or Trip-related communications.

8. Retention and Data Minimization

We seek to collect and retain personal information only to the extent reasonably necessary and proportionate for the purposes for which it was collected, disclosed purposes compatible with the original collection, legal obligations, safety, fraud prevention, dispute resolution, or other lawful purposes.

Because different information serves different purposes, there is no single retention period for every record. The following criteria generally apply:

Contact, Account, and Customer Records

Generally retained while an account or customer relationship remains active and afterward for a reasonable period necessary for customer support, transaction history, fraud prevention, tax, accounting, dispute, and legal purposes.

Orders, Payments, Refunds, and Financial Records

Retained as reasonably necessary for fulfillment, accounting, taxes, payment disputes, chargebacks, warranties, returns, audits, collection obligations, and applicable recordkeeping requirements.

Trip, Certification, Travel, and Waiver Records

Retained as reasonably necessary to administer the Trip or Dive Activity and afterward where reasonably needed for certification documentation, participant agreements, waivers, insurance, incident response, safety, dispute resolution, or legal requirements.

Medical and Other Sensitive Participant Information

We seek to retain medical-screening, physician-clearance, passport, travel-document, and similar sensitive records for the shortest period reasonably consistent with the Booking, safety, provider, insurance, incident-response, documentation, or legal purpose for which the information was collected. Where practical, unnecessary sensitive information will be deleted, returned, redacted, or access-restricted when the operational need has ended.

Marketing, Cookie, and Analytics Information

Retained according to applicable consent choices, opt-out requests, campaign needs, analytics settings, platform configurations, and provider retention periods.

Security, Fraud, Incident, and Legal Records

May be retained for a reasonable period necessary to investigate incidents, protect accounts and systems, prevent repeated abuse or fraud, preserve evidence, establish or defend legal rights, comply with insurance obligations, or satisfy applicable law.

Third-Party Providers may retain information under their own legal obligations and retention policies even after Neptune's Vanguard no longer requires the information for its own purposes.

9. Security

We use administrative, technical, and physical safeguards reasonably designed for the nature, sensitivity, and scale of the information and our operations. We also rely on security measures provided by Shopify and other responsible service providers.

No transmission, storage system, website, application, or provider can be guaranteed completely secure. You should use unique credentials, protect your devices and accounts, avoid sending unrequested sensitive information through ordinary email, and notify us promptly if you believe an account or communication has been compromised.

This Section does not create a separate liability cap. Any otherwise applicable limitation under Section 26 of the Terms of Service applies only to the extent permitted by applicable privacy, security, consumer-protection, and other mandatory law.

10. U.S. State Privacy Rights

Depending on your state of residence, the nature and volume of our processing, and whether a particular state privacy law applies to Neptune's Vanguard, you may have one or more rights concerning your personal information.

Those rights may include the right to:

• confirm whether we process personal information about you;
• access or obtain a copy of personal information;
• correct inaccurate personal information;
• request deletion, subject to lawful exceptions;
• obtain a portable copy of certain personal information;
• opt out of sale, sharing, targeted advertising, or certain profiling where applicable;
• withdraw consent where processing depends on consent;
• limit certain uses or disclosures of sensitive information where applicable;
• appeal the denial of a privacy request where state law provides an appeal right; and
• receive equal service and not be unlawfully discriminated against for exercising a privacy right.

Submitting a Privacy Request

Email support@neptunesvanguard.com with the subject line “Privacy Request” and describe the right you wish to exercise. Where a Site privacy-choice or data-sharing opt-out control is available, you may also use that control for the applicable request.

We may take reasonable steps to verify identity, authority, residence, and the information associated with the request. Verification requirements will be proportionate to the sensitivity of the request and information involved.

An authorized agent may submit a request where applicable law permits. We may request proof of the agent's authority and, where permitted, direct verification or confirmation from the consumer.

We will respond within the time required by applicable law and will explain a lawful basis for denying, limiting, or extending a request when required.

11. California Privacy Notice

11.1. Applicability

This Section provides supplemental information for California residents. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), applies only when its statutory requirements are satisfied.

The inclusion of this California section does not by itself constitute a representation or admission that Neptune's Vanguard is currently a “business” subject to every provision of the CCPA. Where the CCPA applies, this Section is intended to provide the disclosures and rights applicable to our processing.

11.2. California Categories of Personal Information and Notice at Collection

Depending on your interaction with Neptune's Vanguard, we may collect the following categories of personal information described by California law:

The purposes for collecting and using these categories are described in Sections 3 and 4 of this Policy. Retention periods or criteria are described in Section 8. We do not collect additional categories of personal information or use collected information for materially different, unrelated purposes without providing any additional notice required by applicable law.

11.3. California Sale and Sharing Disclosure

Neptune's Vanguard does not sell personal information for monetary consideration.

Depending on the advertising, analytics, social-media, or Shopify integrations enabled during a particular period, disclosures of identifiers, device information, advertising identifiers, or internet and electronic-network activity to advertising partners may constitute “sharing” for cross-context behavioral advertising or a “sale” under the CCPA's broad definitions.

We do not knowingly sell or share for cross-context behavioral advertising personal information of consumers under sixteen (16) years of age.

We do not sell or share medical-screening information, passport or travel-document information, emergency-contact information, or similar sensitive Participant information for cross-context behavioral advertising.

11.4. Sensitive Personal Information

Where Neptune's Vanguard collects Sensitive Personal Information, we use and disclose it for reasonably necessary purposes such as providing requested Products or Services, processing transactions, maintaining account security, preventing fraud, administering travel or Dive Activities, verifying qualifications, protecting Participant safety, responding to emergencies, complying with law, or other purposes permitted without a separate right-to-limit mechanism.

We do not use Sensitive Personal Information to infer characteristics about a person for unrelated advertising or profiling. If our practices materially change in a manner that triggers a California right to limit use or disclosure, we will provide the notice and choice required by applicable law.

11.5. California Consumer Rights

Where the CCPA applies, a California resident may have the right to:

• know the categories and specific pieces of personal information collected about the resident;
• know the categories of sources, purposes, and third parties associated with that information;
• request deletion, subject to statutory exceptions;
• request correction of inaccurate personal information;
• opt out of sale or sharing of personal information;
• limit certain uses or disclosures of Sensitive Personal Information where the statutory right applies;
• receive information about financial incentives, if any program qualifying as such is offered; and
• not receive discriminatory treatment for exercising CCPA rights.

Requests may be submitted through the methods described in Section 10. A California consumer may use an authorized agent where permitted by law.

11.6. Global Privacy Control and California Opt-Out Signals

Opting out of sale or sharing does not prevent disclosures necessary to process an order, operate the Site, prevent fraud, provide a requested Service, administer a Trip, protect safety, or otherwise perform activities that are not legally treated as sale or sharing.

12. EEA, United Kingdom, and Switzerland

If European Economic Area, United Kingdom, or Swiss data-protection law applies to our processing of your personal information, Neptune's Vanguard LLC generally acts as the controller for the Company-controlled processing described in this Policy.

Lawful Bases

Depending on the processing activity, our lawful bases may include:

• performance of a contract or steps requested before entering a contract;
• compliance with a legal obligation;
• legitimate interests such as security, fraud prevention, customer service, business administration, and protecting legal rights, where those interests are not overridden by your rights;
• protection of vital interests, particularly in an emergency or safety matter; and
• consent where consent is required or selected as the appropriate lawful basis.

Your Rights

Where applicable, you may have rights of access, rectification, erasure, restriction, data portability, objection to certain processing, withdrawal of consent, and the right to lodge a complaint with the data-protection authority responsible for your location.

Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal and does not prevent processing supported by another lawful basis.

13. Children and Minors

The general retail Site is not directed to children under thirteen (13), and we do not knowingly collect personal information from a child under thirteen in violation of applicable law.

If you believe a child has improperly provided personal information to us, contact support@neptunesvanguard.com so that we can investigate and take appropriate action.

A minor may participate in a Product purchase, Trip, Service, or Dive Activity only when permitted by applicable law and the applicable offering. A parent or legal guardian may be required to provide information, consent, and signatures.

Nothing in this Privacy Policy changes the eligibility, certification, medical, supervision, consent, or waiver requirements described in the Terms of Service or an applicable participant agreement.

14. International Processing

Neptune's Vanguard is located in the United States and uses providers that may process personal information in the United States and other countries. Those locations may have privacy and data-protection laws that differ from the laws where you reside.

Where applicable law requires a specific safeguard for an international transfer, we and our providers may rely on legally recognized transfer mechanisms, contractual safeguards, adequacy decisions or frameworks, or another lawful transfer method as appropriate.

Information required for international travel may be provided in the destination country to dive operators, hotels, transportation providers, governmental authorities, port or marine authorities, medical or emergency personnel, or other entities reasonably necessary for the Trip. Their handling of information may also be governed by the law of that destination.

15. Third-Party Sites and Services

The Site may link to or integrate with Shopify, payment services, Shop Pay, social-media services, insurers, dive operators, travel providers, training agencies, manufacturers, fulfillment providers, and other third parties.

Those third parties may independently collect and process personal information under their own privacy notices and terms. A link, referral, integration, or business relationship does not make Neptune's Vanguard responsible for a third party's independent privacy practices to the extent applicable law does not impose that responsibility on the Company.

When Neptune's Vanguard selects or uses a provider to process personal information on our behalf, we seek to use providers appropriate to the nature of the information and service involved and to apply contractual or platform protections where reasonably available.

16. Relationship to the Terms of Service

This Privacy Policy is incorporated into and should be read together with the Terms of Service. The Terms provide the broader contractual framework for the Site, Products, Services, Bookings, Trips, and Dive Activities, while this Policy explains how personal information is handled.

The limitation-of-liability provisions in Section 26 of the Terms apply only to the extent permitted by applicable privacy, data-security, consumer-protection, and other mandatory law.

The informal-dispute process in Section 29 of the Terms does not require a person to postpone a statutory privacy request, legally recognized opt-out, consent withdrawal, report to a privacy regulator, or another remedy that applicable law allows the person to pursue without contractual preconditions.

The contractual claim period in Section 31 of the Terms applies only where applicable law permits contractual modification of the relevant claim period. It does not shorten a period for exercising a statutory privacy right, submitting a privacy request, or pursuing another privacy remedy where applicable law prohibits such shortening.

If a provision of this Policy and another Company document appear to conflict, the order-of-precedence provisions in Section 33.1 of the Terms apply except to the extent mandatory privacy or data-protection law requires a different result.

17. Changes to This Policy

We may update this Privacy Policy prospectively to reflect changes in applicable law, technology, Site configuration, providers, Products, Services, privacy controls, or business practices.

The “Last Updated” date identifies the current version. Where applicable law requires additional notice, affirmative consent, or another procedure for a material change, we will provide that notice or obtain that consent.

A change to this Policy does not retroactively eliminate or reduce a privacy right that already applies to personal information under mandatory law.

18. Contact Us

For privacy questions, access requests, correction requests, deletion requests, consent withdrawals, opt-out requests, or other privacy matters, contact: