1. Who we are
JumpMaster is developed and operated by:
PVC Digital Designs 33 Arum Road, Tableview, Cape Town, 7441, South Africa Email: info@jumpmaster.app Website: https://pvcdigitaldesigns.co.za
For the purposes of the General Data Protection Regulation (GDPR), PVC Digital Designs is the data controller for personal data collected through the JumpMaster app and website (jumpmaster.app / jumpmaster.flutterflow.app), except where a dropzone operator is acting as controller for its own staff and customer records (see Section 9).
EU Representative (Art. 27 GDPR): Phillip van Coller 35 Mollstraße, 10405 Berlin, Germany Email: pvcdesigns@gmail.com Phone: +49 152 31657861
If you have any questions about this policy or how your data is handled, contact us at info@jumpmaster.app.
2. Scope
This Privacy Policy applies to:
- The JumpMaster mobile app (iOS and Android)
- The JumpMaster web app (jumpmaster.flutterflow.app)
- The JumpMaster website (jumpmaster.app)
3. What personal data we collect
| Category | Examples | Who provides it |
|---|---|---|
| Identity data | Full name, date of birth | You, or your parent/guardian if you are under 18 |
| Contact data | Email address, phone number | You |
| Skydiving credentials | Skydiving license number, skydiving association number/membership (e.g. PASA, USPA), jump logbook history | You, or verified via PASA/USPA integration |
| Guardian data (minors only) | Parent/guardian name and contact details, consent confirmation | Parent/guardian, for jumpers aged 12–17 |
| Location data | Approximate or precise device location | You (with your permission), used to show nearby dropzones |
| Payment data | Transaction records; card/payment details are handled directly by our payment processor and are not stored by us | You, via Stripe or Payfast |
| Usage & device data | IP address, device type, operating system, app pages visited, time/date and duration of visits | Automatically, when you use the app |
| Waiver/indemnity data | Your agreement to a dropzone’s own liability waiver text | You, at the specific dropzone you’re jumping with |
| Marketing preference | Whether you have opted in to marketing communications | You, via the opt-in checkbox in the app (unselected by default) |
We do not knowingly collect health information, medical history, or details of specific injuries. Indemnity/waiver forms in JumpMaster are general liability acknowledgements set independently by each dropzone — JumpMaster does not require or prompt for medical or health details as part of these forms.
4. Why we process your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Performance of a contract |
| Enabling dropzone check-in, manifesting, load building | Performance of a contract |
| Verifying your PASA/USPA credentials | Performance of a contract / your consent |
| Showing nearby dropzones based on location | Consent (you must grant location permission; you can decline and search manually instead) |
| Processing subscription payments (dropzones) or jump payments (tandems) | Performance of a contract |
| Storing your digital logbook | Performance of a contract |
| Sending you service-related notices (e.g. booking confirmations, account/security notices) | Performance of a contract / legitimate interest |
| Sending you marketing emails or promotions | Consent — only if you have actively opted in via the marketing checkbox in the app. This is off by default and can be withdrawn at any time. |
| Improving and securing the app (aggregated analytics) | Legitimate interest |
| Complying with legal obligations (e.g. tax, fraud prevention) | Legal obligation |
You may withdraw consent at any time (see Section 8). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
5. Children and minors
- JumpMaster is not available to anyone under 12 years of age, in line with international minimum skydiving age standards. Registration is blocked for anyone who indicates an age below 12.
- Jumpers aged 12–17 may register only with verified parental or guardian consent, collected through a dedicated guardian consent flow at sign-up. The guardian’s name and contact details are recorded alongside their consent.
- We do not knowingly collect personal data from children under 12. If we become aware that a child under 12 has provided us with personal data, we will delete it promptly. If you are a parent/guardian and believe your child has provided us with data without proper consent, contact us at info@jumpmaster.app.
6. Location data
We use your device’s location, with your explicit permission, to show you dropzones near you and let you filter results by distance. You can decline location permission at any point (in the app or your device settings) and still use JumpMaster by searching for dropzones manually. We do not use your location for advertising or sell it to third parties.
7. Who we share your data with
We share personal data only where necessary, with the following categories of recipients:
Infrastructure & hosting
- Google Firebase / Google Cloud Platform — our database, authentication, and hosting provider. All Firebase services we use — including the database, Authentication, Cloud Functions, and Analytics — are hosted in the
eur3(Belgium, EU) region; nothing leaves this region.
Payments
- Stripe — used for all dropzones and tandem payments outside South Africa, including Germany/EU. Stripe is GDPR-compliant and acts as an independent processor under its own terms.
- Payfast — used only for South African dropzones. Payfast is not used to process payments for German or EU customers.
Credential verification
- PASA (Parachute Association of South Africa) — used to verify South African-issued skydiving licenses/membership numbers, via a direct connection to PASA’s system, where you choose to connect your profile.
- USPA (United States Parachute Association) — used to verify USA-issued skydiving licenses/membership numbers, where you choose to connect your profile. You log in directly with your own USPA credentials on USPA’s own site; USPA then confirms your details, asks you to accept its own consent checkbox, and sends your confirmed data back to us securely. USPA acts independently in this process, under its own privacy policy.
Marketing
- Mailchimp — used to send marketing communications, but only to users who have actively opted in via the marketing checkbox described in Section 4. Mailchimp is based in the United States; transfers to Mailchimp are covered by its certification under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a contractual fallback.
App platforms
- Apple App Store and Google Play Services — for app distribution, crash reporting, and platform-level services, under their own privacy policies.
Dropzone operators
- If you register with, or check in at, a specific dropzone, that dropzone’s admin and manifest-role staff can see your relevant profile, jump, and manifest information. Other staff roles (e.g. instructors, general staff) do not have access to your personal data beyond what is required to participate in skydiving activities with you (see Section 9).
Legal disclosures
- Where required by law, to comply with a legal process, or to protect the rights, safety, or property of JumpMaster, our users, or others.
We do not sell your personal data to third parties, and we do not share it for third-party advertising purposes.
8. International data transfers
PVC Digital Designs is based in South Africa. Where personal data of EU/German users is accessed from outside the EU (for example, by our support or admin staff), we rely on appropriate safeguards, including the EU Standard Contractual Clauses (SCCs), to ensure your data continues to receive a level of protection equivalent to the GDPR.
Our core database is hosted in the EU (eur3 / Belgium region). We have Data Processing Agreements in place with our infrastructure and payment providers (Google/Firebase, Stripe) governing international transfers.
9. Dropzones as data controllers, and staff access
When you register or check in at a specific dropzone, that dropzone operator acts as an independent data controller for the personal data it collects and manages about you in relation to its own operations (e.g. rosters, staff scheduling, its own waiver text). JumpMaster acts as a data processor on the dropzone’s behalf for this data, under a Data Processing Agreement between PVC Digital Designs and the dropzone.
Within each dropzone’s JumpMaster account, access is role-based:
- Admin and Manifest roles can view jumper, staff, and tandem personal details relevant to running operations.
- Other staff roles (e.g. instructors, ground crew) do not have access to your personal profile data beyond what’s needed to participate in skydiving activities with you (e.g. seeing you on a load).
Data belonging to one dropzone is isolated and is not accessible to other, unrelated dropzones using JumpMaster.
10. Data retention
We retain your personal data for as long as your account is active, and for a limited period afterward where necessary to:
- comply with legal, tax, or accounting obligations;
- resolve disputes; or
- maintain your digital jump logbook history, which by its nature is intended to be a long-term record you can rely on (you may request deletion of this at any time, see below).
Specific retention periods:
- Payment/transaction records: retained for 8 years (Germany/EU customers) or 5 years (South African customers), as required by applicable tax law, even after account deletion.
- Account and profile data (name, email, phone, credentials, location history, usage logs): deleted or anonymized within 30 days of account deletion.
- Digital jump logbook: retained while your account is active, as it is intended to be a long-term personal record; deleted along with your account, or earlier on request.
- Waiver/indemnity records: retained per the relevant dropzone’s own record-keeping requirements, and in any case no longer than necessary for liability/insurance purposes.
When you delete your account (see Section 11), we delete or anonymize your personal data within 30 days, except for payment/transaction records, which we are legally required to retain for the periods above.
11. Your rights
Under the GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your personal data (“right to be forgotten”).
- Restriction — ask us to limit how we use your data in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format, or have it transferred to another provider.
- Object — object to processing based on legitimate interest, and to direct marketing at any time.
- Withdraw consent — where processing is based on consent (e.g. marketing, location), withdraw it at any time without affecting past processing.
- Lodge a complaint — with your local data protection supervisory authority. In Germany, this is the data protection authority of your federal state (Landesbeauftragte/r für Datenschutz), or the Federal Commissioner for Data Protection and Freedom of Information (BfDI).
To delete your account and data yourself: open the app, go to your Profile, scroll to the Info tab, and select “Delete my account.” This is immediate and cannot be undone.
For any other rights request, email info@jumpmaster.app. We will respond within one month, as required by the GDPR.
12. Data security
We apply technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (HTTPS/TLS) and at rest (via Firebase/Google Cloud infrastructure)
- Role-based access controls limiting who can view personal data within each dropzone
- Firebase security rules enforcing data isolation between dropzones
- [Add any additional measures: MFA for admin accounts, regular access reviews, etc.]
No system is 100% secure, but we take reasonable steps appropriate to the risk to protect your information.
13. Data breach notification
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify affected users without undue delay where required by law.
14. Cookies and website tracking
Our website (jumpmaster.app) uses cookies and similar technologies, including Google Tag Manager, for site functionality and analytics. When you first visit our website, a consent banner asks you to choose which categories of cookies you allow (beyond those strictly necessary for the site to function). Non-essential cookies and tags are not set until you actively consent. You can change your preferences at any time via the cookie settings link in the website footer. See our Cookie Policy for a full list of the cookies we use, their purpose, and how long they last.
15. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the app or by email before the changes take effect. The “Last updated” date at the top of this page shows when it was last revised.
16. Contact us
Questions, concerns, or rights requests: info@jumpmaster.app
Postal address: 33 Arum Road, Tableview, Cape Town, 7441, South Africa
EU representative: Phillip van Coller, 35 Mollstraße, 10405 Berlin, Germany — pvcdesigns@gmail.com — +49 152 31657861