Privacy Policy

Last updated: October 2026

This policy explains which personal data we process when you use our website ocean-pure.org, the gift page or our portal my.ocean-pure.org. We follow the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Controller

Visiting the website

• Hosting: The website runs on Cloudflare. Each visit creates technical data such as IP address, time, page requested and browser. We use it to run the site securely and to protect it from attacks.
• Fonts: We load fonts from Google Fonts. Google receives your IP address when this happens.
• No trackers: We use no analytics or advertising trackers.
• Language setting: We store your chosen language locally in your browser.

Donations and gifts

For a donation or a coral gift we process the details you enter: name and email of the giver, name and email of the recipient, engraving text, dedication and the services ordered. We need them to process the donation, create the certificate, send updates about your coral and issue a donation receipt.

Payments (TWINT, card, Apple Pay, Google Pay) are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, with group companies in the USA). The amount, your email address and payment details go to Stripe, which also uses them to prevent fraud. We do not see or store full card or account details. For an adoption, Stripe stores the payment method for the yearly donation until you cancel. More: Stripe privacy policy.

Portal and sign-in

• Account: In the portal we store your name, email address, donations, corals and documents. For companies also the company name, contact person, packages and correspondence.
• Sign-in: You sign in with a link sent by email or with Google. With Google we only receive your name, email address and profile picture.
• Cookies: We only use technically necessary cookies: a sign-in cookie (up to 30 days) and, during Google sign-in, a short security cookie (10 minutes). If you arrive via a member’s share link, a cookie stores only that link’s code for 60 days so we can credit the donation to the member (no data about you).
• Map: The map with the coral locations loads satellite images from Esri (ArcGIS World Imagery, Esri Inc., USA) and, if you switch, map images from OpenStreetMap. Esri or the OpenStreetMap Foundation receives your IP address. If team members use "My location", the browser asks for permission first. We only store the position of the cone, not yours.
• Association bookkeeping: Invoices that suppliers send to [email protected] and bank statements sent to [email protected] are stored as accounting records (legal retention 10 years). To pre-fill invoice data, the content of an invoice may be sent to Anthropic (AI, USA); Anthropic does not use this data for training. For foreign currencies we request the daily rate from frankfurter.dev (currency and date only, no personal data).

Ocean press review (team only)

The daily press review is only for signed-in members of our team. If you turn on push notifications in the portal, we store your browser’s technical subscription address with two keys, the language and your user account. Delivery runs through your browser’s push service (e.g. Google, Apple, Mozilla or Microsoft). When you turn it off, we delete the entry. Images and original articles are loaded directly from the media outlets’ sites; for translations the article text may be sent to Anthropic (AI, USA) – without personal data.

Emails and contact

When you write to us, we process your message and contact details to reply. We send emails through the service Resend. Incoming emails are received through Cloudflare and forwarded to our mailbox at Google. We keep a record of our exchange with donors, companies and partners in our portal.

Team documents

We store documents for grant applications and projects in Google Drive. Only members of our team have access.

For photos on the reef, approved team members use the ProDive app. It loads the dive plan (cones, spots, the coral's name, last photo) onto the phone and sends new photos to our portal. The data stays encrypted on the device and is deleted after 14 days.

Where the data is stored

Our database is hosted by Cloudflare in Europe. Some providers (Cloudflare, Google, Resend, Stripe) are based in the USA, so data may be transferred to the USA. These providers rely on recognised safeguards such as the Data Privacy Framework or standard contractual clauses.

We do not sell data and do not share it for advertising.

How long we keep data

We keep data only as long as we need it for its purpose. Records of donations and payments are kept as long as the law requires (in Switzerland usually 10 years).

Your rights

You can ask for access to your data, have it corrected or deleted, and object to processing. Write to [email protected]. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) and, if the GDPR applies to you, to the supervisory authority in your country.

Changes

We update this policy when our services change. The current version on this page applies.