Your data
Privacy Policy
Effective 8 September 2026 · Covers cquestdiving.co.za, cquestdiving.com and the C-Quest Diving Safaris app
C-Quest Diving Safaris (“C-Quest”, “we”, “us”) runs dive safaris and PADI courses out of South Africa. This policy explains, in plain terms, what our website and app actually do with information — because most of what either one shows you (tours, past-trip galleries, course details) needs no personal data from you at all.
Our website
We run two websites — cquestdiving.co.za and cquestdiving.com — with the same content on both. Everything in this policy applies equally to each of them.
Apart from the enquiry form described in the next section, they are static pages: no newsletter signup, no cookie banner, and no analytics or advertising trackers of any kind. The other ways to reach us are the direct channels the site lists: emailing or phoning René, or following a link out to our Facebook, Instagram, or YouTube pages, which have their own privacy policies once you’re there.
Booking a tour or course happens the same way — a direct conversation with René by email, phone, or WhatsApp. Any personal details you share to arrange a trip (name, travel dates, payment arrangements) live in that conversation and whatever records René’s business keeps for it, not on the website itself.
Website enquiry forms
Both websites carry a single enquiry form, on the Contact page and the Destination Enquiry page. It is the only part of either site that collects anything from you, and it collects only what you put into it.
What the form asks for
- Name and surname
- Email address — so we can reply
- Subject / destination enquiry — filled in for you when you arrive from an “Enquire” button, and you can change it
- Your message
What is recorded alongside it
With every submission we also store the date and time, the IP address it came from, and your browser’s user-agent string. That is ordinary web-server information, kept so we can trace and block abuse of the form.
Where it goes
Each enquiry is emailed to us at info@cquestdiving.co.za and saved in the website’s own database, where only C-Quest administrators can read it. It goes nowhere else — no third-party form service, no marketing list, no advertising or analytics tool. The form uses a hidden anti-spam field rather than a CAPTCHA, so nothing about you is handed to an outside service to check that you are human.
We keep enquiries for as long as they are useful for answering you and arranging your trip. Ask us to delete yours and we will.
What the app collects
If you just browse the app
Nothing. Viewing tours, past-trip photos, PADI courses, and contact details doesn’t require an account, a sign-in, or any personal information.
If you leave a review
We store the name you type, your star rating, and your review text in our database, so an admin can approve it before it appears publicly under a tour. We don’t verify this name against any account — it’s whatever you enter.
If you enquire about a tour or course
The “Enquire” buttons open a pre-filled message in WhatsApp and hand you off to that app to send it. C-Quest never sees or stores anything you type until you actually send the WhatsApp message — at which point it becomes a normal WhatsApp conversation with René, governed by WhatsApp’s own privacy policy, not this one.
Push notifications
If you allow notifications, your device is registered with Firebase Cloud Messaging under an anonymous device token — not your name or email — so we can notify you when a new tour goes up, new photos land in a gallery, or we send an announcement. You can turn this off in your device’s notification settings at any time.
If you’re a C-Quest admin
Admin sign-in uses Google Sign-In, which shares your Google account name, email address, and profile photo with the app so it can verify you’re authorised to manage tours, courses, and galleries. This only applies to the small number of people who run the business — not regular app users.
How we use it
| Data | Collected from | Used for |
|---|---|---|
| Name, email, subject, message | Anyone using the website enquiry form | Answering your enquiry and arranging your trip |
| Enquiry IP address and browser user-agent | Anyone submitting the form | Tracing and blocking abuse of the form |
| Review name, rating, text | Anyone leaving a review | Displaying approved reviews publicly under the relevant tour |
| Device notification token | Devices with notifications enabled | Delivering new-tour, new-photo, and announcement pushes |
| Google account name, email, photo | C-Quest admins only | Verifying admin access to the management tools |
| Light/dark mode choice | Anyone who toggles it | Remembered on your device only — never sent to us |
We don’t run ads, sell data, or use analytics or ad-tracking SDKs of any kind — there’s simply nothing in the app collecting that.
Who else touches this data
Website enquiries stay on the hosting that runs the two websites. They are not in Firebase and are not shared with any other service.
The app is separate. It runs on Google Firebase, which stores and moves the app data above on our behalf:
- Firebase Authentication & Google Sign-In — admin identity verification
- Cloud Firestore — stores tours, courses, reviews, and admin records
- Cloud Storage — hosts tour photos, gallery images, and PDFs
- Cloud Messaging — delivers push notifications to your device
All traffic between the app and Firebase is encrypted in transit (HTTPS/TLS), and only C-Quest admins can write to the database or storage — enforced by Firebase security rules, not just app-side checks. Google’s handling of this data is governed by Firebase’s own privacy terms.
Your choices
- Delete an enquiry — email us and we’ll remove your enquiry and its record from the website database.
- Remove a review — email us the tour and the name/text you used, and we’ll take it down.
- Stop notifications — disable them in your device settings, or in-app if you’re prompted again.
- Revoke admin access — handled directly by C-Quest through Firebase’s admin list.
C-Quest is based in South Africa and treats personal information in line with the Protection of Personal Information Act (POPIA). Under POPIA, C-Quest is the Responsible Party for the data described above.
Children’s privacy
The app isn’t directed at children, and we don’t knowingly collect information from anyone under 13. If you believe a child has left a review or otherwise shared information with us, contact us and we’ll remove it.
Changes to this policy
If this policy changes, we’ll update the effective date above. Continuing to use the app after a change means you accept the update — for anything material, we’ll also flag it in the app itself.
This document describes the app as it actually behaves at the date above — it’s kept current with the code, not written once and forgotten.
Questions about this policy or your data? Reach out directly.
Ready when you are
Let’s plan your next dive trip
Tell us where you want to dive and how long you have. We’ll come back with an itinerary, a price and a payment plan.