Who processes your data
Siami is an app by Germán Ezequiel Laso Andino, trading under the name ProfBlu. He is the controller of the data of your account, your profile and what Siami publishes.
- Owner: Germán Ezequiel Laso Andino, libero professionista.
- Partita IVA: 04702090988. Codice fiscale: LSNGMN88S04Z600M.
- Professional activity not registered in the Registro delle Imprese (no REA number).
- Contact address: Via della Sega 1, 38080 Verdesina, Porte di Rendena (TN), Italy.
- Email for anything about your data: socials@profblu.com.
No data protection officer has been appointed: the law does not require one for an activity of this size.
If you only visit the website
You need no account to look at spots, profiles, shops, schools and events, and we ask you for no data.
- We count visits with Umami, a measurement program that runs on our own server and leaves no cookies or identifiers in your browser. From your IP and browser it computes a visit identifier that changes every month (the IP is not stored) and records which pages were seen, which site and campaign you came from, the type of browser, system and device, the language and the approximate country and city. Only on
siami.profblu.com; test copies are not measured. - We also keep our own page view counter, with no data that identifies you.
- Near me only works if you allow it in your browser. The location is rounded to two decimals (a few kilometres) before it leaves your browser, is used to sort what you see and is not stored on our servers. Once you've allowed it, the site opens right near you: for that your browser remembers the last location, already rounded, and you can delete it whenever you like by clearing the site's data.
- Without your location, the site tells our server your browser's time zone (for example,
Europe/Rome) to start with the spots in your country. It isn't used for anything else.
If you have an account
Siami has no password of its own: your identity is the same central account you use across the platform, created from the "Sign in" button. With that account, Siami stores:
- Your sports profile: the nickname and public address you choose, your sports, your declared level, your home spots and the social accounts you want to link. Whatever you put on your public profile can be seen by anyone.
- Your accreditations: when you ask for a qualification to be recognised (a diving, kitesurf, snowboard or surf certification), you upload an image of the document. A person reviews it; once decided, the file is deleted and only the decision remains, unless it has to be kept because of a dispute, in which case we tell you.
- Your logbook: the sessions you record, and the school's signature when the school confirms them.
- Your date of birth, to check the minimum age (see Minors).
- Who you follow and the spots you save, and the reports you make about content that breaks the rules.
- Your membership and the prize draws you enter, with their result.
- If you use the app and allow it, the notification token your phone creates for the app, to send you notifications.
Siami's database does not store your IP address. As on any website, the web server writes it in its technical logs together with the page requested and the browser (those logs are deleted automatically after 15 days), and the central sign-in keeps the IP and browser of each sign-in, for your account's security.
Health data: the minimum
Siami does not ask for health data. Some diving schools ask for a medical clearance: if Siami ever records it, it keeps only the outcome —fit, pending or not fit—, never the certificate or the diagnosis. Do not upload medical certificates as evidence for an accreditation: if one arrives, we delete it.
Unclaimed profiles
Siami may build the profile of a person who does not yet have an account, with information that person has already made public: competition results, lists of instructors of a federation or a school, press articles, their own website. This is what Article 14 GDPR regulates, when data are not obtained from the person.
- Where it comes from. Public sources we find with web search engines, partly with automated tools, and what schools, federations and organisers publish. We check that every link works before publishing it.
- What is published. Name or public nickname, sports, where they live or train, a short introduction, their public achievements and results, their latest competitions or projects, public videos they appear in, their spots, their public social accounts and, if available, a freely licensed photo with its author; each item with the link to its source, and the sources at the foot of the profile. It is never presented as verified.
- What we do not do. We publish no private contact details, no home address, no health data and no special category of data under Article 9 GDPR. We never build the profile of a minor.
- Is it you? From the profile you can claim it with your account and manage it from then on, or ask us to delete your data without an account (how, in Delete your data). If you ask for deletion, we remove the profile and record that it must not be built again.
The website has published these profiles since 2026-10-20.
Why, and on what legal basis
- Your account, profile, accreditations, logbook, follows and prize draws: because it is what is needed to provide what you yourself switch on (performance of a contract).
- The minimum age: to comply with the law and protect minors (legal obligation and legitimate interest).
- Unclaimed profiles and the spot ranking: legitimate interest in offering public, accurate information about the sport, with the objection and deletion described above.
- Counting visits: legitimate interest in knowing how the site is used, with the cookieless measurement described above.
- School applications (For schools): the school's name, sport, place and the contact you leave, to answer you (pre-contractual steps). We also store when you accepted this policy and which version of the text you saw.
We do not advertise, and we do not sell or pass data to third parties for commercial purposes.
Where it is processed, and who else sees it
Hetzner (Hetzner Online GmbH, Germany) hosts the server, the database, the files and the backups. Umami runs on that same server.
To work out today's conditions we query Open-Meteo with each spot's coordinates, never with your data. To find public information about spots and people we query Exa, in the United States: we send it only searches about information that is already public, never data from your account.
For phone notifications, the notification token and the text of each notification go through Expo's notification service, which delivers them through Apple (APNs) or Google (FCM).
Schools and shops see what concerns them: the school that signs a session sees that session. Nobody else: there is no advertising analytics tool in the code.
How long
- Your account, profile, logbook and follows: while your account exists.
- Accreditation images: until the request is decided.
- Unclaimed profiles: while the information remains public and relevant, or until the person asks for deletion.
- School applications: one year from receipt, if no agreement is reached.
- Web server technical logs (IP, page requested, browser): 15 days.
- Umami visit figures: no fixed term; they do not store your IP.
- Encrypted database backups: 35 days. What you delete also disappears from them when the last backup containing it expires.
Your rights
You can exercise the rights the General Data Protection Regulation gives you: access, rectification, erasure, portability, objection, restriction and withdrawal of consent without affecting what was done before. Write to socials@profblu.com. We answer within the legal deadline, one month at most.
You can complain to the supervisory authority: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it); in Argentina, the Agencia de Acceso a la Información Pública (www.argentina.gob.ar/aaip); in Spain, the Agencia Española de Protección de Datos (www.aepd.es); or the authority of the country where you live.
Minors
The minimum age for a Siami account is 16. When you create your profile we ask for your date of birth; if you are under the minimum age you cannot have a public profile: you do not appear in the athlete list, in search or in share links. If you notice a profile that belongs to a minor, write to us and we take it down.
Security
Communications are encrypted (TLS). Access to data depends on each person's role. If we detect a breach that affects you, we will tell you, and the supervisory authority within the 72 hours set by law.
Changes
If we change what we do with data, we change this text and move the revision date.