1. Who We Are
Mirissa Collective is a trading name of TP Development (Pvt) Ltd, a company registered in Sri Lanka (company registration no. PV 00346651). TP Development (Pvt) Ltd operates water-based activities (diving, snorkeling, whale watching, kayak, and fishing) in Mirissa and Nilaveli, Sri Lanka. For data protection purposes, TP Development (Pvt) Ltd is the data controller.
For questions about how we handle your data:
Email: hello@mirissacollective.com
Website: www.mirissacollective.com
2. What Data We Collect
When you make a booking, we collect:
- Contact details: Full name, email address, phone number, country of residence
- Participant details: Names, dates of birth of all participants in your booking
- Parent/guardian details (PADI divers aged 10–14 only): Full name, phone number and email address of the participant's parent or legal guardian, collected to run the course and as our contact for the child
- Booking data: Activity, date, time, number of participants, special requests
- Campaign source: If you reached us through one of our own links or ads, the campaign that brought you (source, medium and campaign name) is saved with your booking, so we can see which campaigns bring us guests. It is never shared with advertising networks.
- Payment data:We do not store card details. Payments are processed by our bank's payment gateway. We store transaction references and amounts.
- Health data (diving activities only): PADI Diver Medical Questionnaire responses. This data is treated as sensitive personal data and stored securely with access restricted to operational staff only.
- Uploaded files (PADI courses only): Certification card images and related documents, stored securely with access restricted to operational staff.
- PADI referral details (PADI Open Water Referral, finishing with us): the dive centre and instructor who trained you, your PADI number and your eLearning and confined water dates, as shown on your referral form
- Communication data: Emails and messages sent to hello@mirissacollective.com.
When you use our website, we may collect:
- Technical data: IP address, browser type, pages visited, time spent on site, and masked session recordings, via Google Analytics 4 and Microsoft Clarity, only if you give consent.
- Cookies: See our Cookie Policy.
3. How We Use Your Data
We use your data to:
- Process and manage your booking
- Send booking confirmations, reminders, and relevant pre-activity information
- Process refunds and rescheduling requests
- Comply with PADI requirements for dive course certification
- Meet our bookkeeping, tax, and statutory accounting obligations
- Improve our website and services via analytics (with your consent)
- Respond to your enquiries
If your online payment doesn't go through or checkout isn't completed, we may email you once so you can finish your booking.
We do not use your data for marketing without your explicit consent.
4. Legal Basis for Processing
We process your data on the following legal bases (GDPR Article 6):
- Contract performance:To fulfill the booking you have made with us, and to take steps at your request before a booking is completed (GDPR Article 6(1)(b)), such as the one follow-up email if your online payment doesn't go through
- Legal obligation: To comply with applicable laws and PADI requirements
- Legitimate interests: To manage our business, improve our services, and ensure safety
- Consent: For analytics cookies and any optional marketing communications
Health data from the PADI Medical Questionnaire is processed under GDPR Article 9(2)(a) (your explicit consent) and Article 9(2)(b) (for obligations in the field of occupational health and safety).
5. How Long We Keep Your Data
| Data type | Retention period |
|---|---|
| Booking and participant data | 5 years from activity date |
| Payment transaction references | 7 years (accounting requirements) |
| PADI Medical Questionnaire | 5 years from activity date |
| Uploaded certification files | 5 years from activity date |
| Email communications | 2 years |
| Transactional email archive (confirmations & notifications) | At least 8 months, to meet financial-compliance obligations. These records may include identity-document data. Because we are under a legal obligation to keep them, they are not erased in response to a deletion request during that period (GDPR Article 17(3)(b)). |
| Analytics data | Google Analytics: 14 months. Microsoft Clarity: session recordings 30 days, aggregated heatmap and click data 9 months. |
After the retention period, your data is securely deleted.
6. Who We Share Your Data With
We share your data only where necessary. All data processor agreements are entered into by TP Development (Pvt) Ltd:
- Our bank's payment gateway: payment processing
- Google: Analytics 4 (with your consent), Maps API (for tuk tuk distance calculation)
- Microsoft: Clarity analytics (with your consent)
- PADI: your name and course details are registered with PADI as part of certification
- Postmark: email delivery and inbound email parsing
- R&R Partners: bookkeeping and accounting services (Sri Lanka). To meet our tax and statutory accounting obligations, our bookkeeper is given restricted, read-only access to booking and financial records: booking references, transaction amounts, dates, and payment status. This access does not include customer contact details, participant details, health data, or PADI course information.
We display Google reviews on our website, including reviewer names and profile photos as provided by the Google Places API. These are publicly available reviews published by Google users.
We do not sell your data to third parties.
7. International Data Transfers
TP Development (Pvt) Ltd operates in Sri Lanka. If you are based in the EU/EEA, your data is transferred to Sri Lanka and to the third-party processors listed above, some of which process data outside the EU/EEA. Where this occurs, we rely on Standard Contractual Clauses or the recipient's adequacy decision where applicable.
8. Your Rights
If you are an EU resident, you have the following rights under GDPR:
- Right of access: Request a copy of the data we hold about you
- Right to rectification: Ask us to correct inaccurate data
- Right to erasure: Ask us to delete your data, subject to legal retention requirements
- Right to restriction: Ask us to limit how we use your data
- Right to portability: Receive your data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interests
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time
To exercise your rights, email us at hello@mirissacollective.com. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority.
9. Security
We store your data securely using Supabase (PostgreSQL with encryption at rest and in transit). Access to sensitive data is restricted to authorised personnel only. We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure.
10. Cookies
We use cookies to operate our website and, with your consent, for analytics. For full details, see our Cookie Policy.
11. Contact
For privacy-related enquiries or to exercise your rights:
Email: hello@mirissacollective.com