Data Processing Agreement

Version 3.0.0 · Effective date: 31 August 2026

This Data Processing Agreement (the "DPA") forms part of the Nauticare Subscriber Agreement (the "Agreement") between Nauticare B.V., a private limited liability company (besloten vennootschap) incorporated under the laws of the Netherlands, with its registered office at Hertspieghelweg 30-1, 1055 KN Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 95652469 ("Nauticare" or the "Processor"), and the customer that has accepted the Agreement (the "Customer" or the "Controller").

The DPA sets out the terms on which Nauticare processes personal data on behalf of the Customer when providing the Service. It consists of this main text, Annex 1 (Description of the processing) and Annex 2 (Technical and Organisational Measures, including Appendix A – Authorised sub-processors).

The DPA is accepted together with the Agreement: when the Customer (or a user acting on its behalf) creates an account and accepts the Agreement, accepts an Order Form referring to the Agreement, or first uses the Service, whichever is earliest. Electronic acceptance satisfies the requirement of Article 28(9) GDPR that the DPA be in writing. No signature is required. Where Nauticare and the Customer have signed a separate data processing agreement, that agreement applies instead of this DPA.

1. Definitions

1.1 Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given to them in Regulation (EU) 2016/679 (the "GDPR"). Capitalised terms not defined in this DPA (such as Service, End User, Invited User, Administrator, Customer Data, Order Form and Third-Party Services) have the meaning given in the Agreement.

1.2 "Customer Personal Data" means the personal data contained in Customer Data that Nauticare processes on behalf of the Customer in providing the Service, as described in Annex 1.

1.3 "Data Protection Law" means the GDPR and any other EU or EU Member State law on the protection of personal data that applies to the processing under this DPA.

1.4 "Sub-processor" means any third party engaged by Nauticare that processes Customer Personal Data on Nauticare's behalf.

1.5 "TOMs" means the technical and organisational measures set out in Annex 2. "AI Functionality" has the meaning given in section 4 of Annex 2.

1.6 "Nauticare Local" means the deployment option in which the Service runs on servers or hardware provided by or for the Customer (for example a computer on board a vessel) instead of on Nauticare's cloud infrastructure.

2. Scope and roles

2.1 This DPA applies to all processing of Customer Personal Data by Nauticare under the Agreement, including during trials and demo periods.

2.2 For Customer Personal Data, the Customer is the controller and Nauticare is the processor. Where the Customer itself acts as a processor for a third party (for example a management company acting for a vessel owner), the Customer warrants that its instructions, including the appointment of Nauticare as sub-processor, are authorised by that third party. Nauticare's only point of contact under this DPA is the Customer.

2.3 The Customer is responsible for the lawfulness of the processing of Customer Personal Data, including having a legal basis, informing data subjects (including its crew and other Invited Users), and the accuracy of the data. The Customer indemnifies Nauticare against claims, fines and costs arising from the Customer's instructions, from Customer Data that the Customer was not entitled to provide, or from the Customer's breach of Data Protection Law.

2.4 Nauticare acts as an independent controller, not as processor, for personal data it processes for its own purposes, such as account administration, billing, sales and customer communications, security of its own systems, and usage and billing metrics of the Service. That processing is described in Nauticare's Privacy Policy and is not covered by this DPA, except that a Sub-processor listed in Appendix A may also be used for it.

2.5 Nauticare may create anonymised and aggregated data from the use of the Service that does not identify the Customer or any natural person, and use it to operate, analyse and improve the Service. Anonymised data is not personal data. Nauticare does not use Customer Personal Data to train AI models (section 8).

2.6 Third-Party Services that the Customer chooses to connect to the Service (section 1.8 of the Agreement) are not Sub-processors of Nauticare. Their providers process data under their own arrangements with the Customer.

3. Instructions

3.1 Nauticare processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless EU or Member State law to which Nauticare is subject requires otherwise. In that case Nauticare informs the Customer of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.

3.2 The Customer's documented instructions consist of the Agreement, this DPA, and the Customer's use and configuration of the Service, including the actions and settings of its Administrators and End Users. Additional instructions must be given in writing, must be consistent with the scope of the Service, and may be charged at Nauticare's then-current rates if they require work outside the normal operation of the Service.

3.3 Nauticare processes Customer Personal Data only for the purposes described in Annex 1. Nauticare does not sell Customer Personal Data.

3.4 Nauticare informs the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend that instruction until the Customer confirms or changes it.

4. Obligations of the Processor

4.1 Confidentiality. Nauticare ensures that persons authorised to process Customer Personal Data are bound by confidentiality, by contract or by statute.

4.2 Security. Nauticare implements and maintains the TOMs in Annex 2, as required by Article 32 GDPR. The Customer has reviewed the TOMs and agrees that they provide an appropriate level of security for the processing described in Annex 1.

4.3 Changes to the TOMs. Nauticare may adapt the TOMs to technical and organisational developments, provided that the overall level of protection is not reduced. Material changes are documented and notified to the Customer on request, as set out in section 1 of Annex 2. The current version is published on this page.

4.4 Access by Nauticare personnel. Authorised Nauticare personnel may access the Customer's account and Customer Personal Data to the extent necessary to provide the Service, including onboarding, account setup, support, maintenance, troubleshooting, security and the review of AI conversations flagged by users, in each case on a least-privilege basis as described in Annex 2.

4.5 Data location. Except for Nauticare Local, Customer Personal Data is stored on Google Cloud Platform in the Netherlands (EU), as described in Annex 2. Transfers outside the EU/EEA take place only as set out in sections 6 and 8.

4.6 Records and contact. Nauticare keeps a record of the processing it carries out on behalf of the Customer (Article 30(2) GDPR). Questions under this DPA can be sent to info@nauticare.io. Nauticare is not required to appoint a data protection officer and has not done so.

5. Sub-processors

5.1 The Customer gives Nauticare general written authorisation to engage Sub-processors. The Sub-processors authorised at the date of this DPA are listed in Appendix A.

5.2 Nauticare informs the Customer of any intended addition or replacement of a Sub-processor at least fourteen (14) days in advance, by updating Appendix A on this page and notifying the Customer by e-mail or in the Service.

5.3 The Customer may object on reasonable grounds relating to data protection by notifying Nauticare in writing within that fourteen-day period. If the parties do not resolve the objection within a reasonable time, the Customer's sole remedy is to terminate the affected part of the Service by written notice, effective when the new Sub-processor starts processing Customer Personal Data, in which case Nauticare refunds prepaid fees for the period after termination. If the Customer does not object in time, the change is deemed accepted.

5.4 Nauticare imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA. Nauticare remains liable to the Customer for its Sub-processors, subject to section 13.

6. International transfers

6.1 Nauticare transfers Customer Personal Data outside the EU/EEA only where the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework where the recipient is certified) or the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914).

6.2 The transfers that take place at the date of this DPA, and the safeguard used for each, are listed in Appendix A. They mainly concern the AI Functionality (section 8), e-mail delivery and payments.

7. Nauticare Local

7.1 Where the Customer uses Nauticare Local, Customer Personal Data is stored on hardware provided by or for the Customer, at a location chosen by the Customer. In that case:

• the Customer is responsible for the physical security, availability, power, connectivity and backups of that hardware and for the security of its local network, unless otherwise agreed in writing;
• Nauticare accesses the installation remotely, using the access the Customer provides, for installation, configuration, support, updates and, at the end of the Agreement, deletion;
• the measures in Annex 2 that relate to Nauticare's cloud hosting do not apply to the Customer's hardware, while the application-level measures (authentication, authorisation, logging and the AI safeguards) continue to apply; and
• where the installation is connected to the internet and the AI Functionality is enabled, AI requests are processed as described in section 8.

8. AI Functionality

8.1 The Service includes optional AI Functionality, described in section 4 of Annex 2. When it is used, the relevant request and the data needed for it, limited to data the requesting user is permitted to access, are sent to an AI model provider listed in Appendix A, and the response is returned to the Service.

8.2 AI model providers are engaged as Sub-processors through their paid commercial APIs. Under their terms, data sent through these APIs is not used to train or improve their models. Nauticare does not use Customer Personal Data to train, fine-tune or otherwise improve any AI model.

8.3 On the Customer's written request, Nauticare deactivates the AI Functionality for the Customer's organisation, as set out in section 4.6 of Annex 2. Users can delete their AI conversation history in the Service at any time.

8.4 The AI Functionality can also prepare actions in the Service at a user's request, such as updating inventory quantities. Such actions stay within the user's permissions and are only carried out after the user has reviewed and approved them, as set out in section 4.4 of Annex 2. Actions approved by a user are the Customer's actions.

8.5 The AI Functionality produces automatically generated output that may be incomplete or inaccurate and must be checked before it is relied on or approved. It does not take decisions with legal or similarly significant effects within the meaning of Article 22 GDPR.

9. Assistance

9.1 Taking into account the nature of the processing, Nauticare assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR. The Service lets the Customer's Administrators access, correct, export and delete Customer Personal Data themselves.

9.2 If Nauticare receives a request directly from a data subject concerning Customer Personal Data (for example from a crew member), it refers the data subject to the Customer and does not respond to the request itself, unless the law requires it.

9.3 Taking into account the information available to it, Nauticare assists the Customer with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority.

9.4 Unless legally prohibited, Nauticare informs the Customer of any request from a supervisory or other public authority concerning Customer Personal Data.

9.5 The self-service tools in the Service are provided at no extra cost. Other assistance under this DPA is charged at Nauticare's then-current rates.

10. Personal data breaches

10.1 Nauticare notifies the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Customer Personal Data, as set out in section 3.9 of Annex 2.

10.2 The notification is sent to the Customer's Administrators and includes, as far as known at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not yet available is provided as it becomes available.

10.3 Nauticare takes reasonable measures to contain the breach and mitigate its effects, and provides the information the Customer reasonably requires to meet its obligations under Articles 33 and 34 GDPR. The Customer is responsible for any notification to supervisory authorities and data subjects. A notification is not an acknowledgement of fault or liability.

11. Audits and information

11.1 Nauticare makes available to the Customer, on request, the information necessary to demonstrate compliance with Article 28 GDPR. This consists of this DPA, Annex 2, written answers to reasonable security questionnaires, and the certifications and audit reports of Nauticare's hosting provider.

11.2 Only where that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, may the Customer have an audit carried out by an independent auditor bound by confidentiality who is not a competitor of Nauticare. Audits take place no more than once every twelve (12) months (except following a personal data breach or at the request of a supervisory authority), with at least sixty (60) days' written notice, for no more than one business day, remotely where possible, and within a scope agreed in advance.

11.3 Audits do not extend to data of other customers or to the facilities of Sub-processors, for which their own certifications and reports apply. The Customer bears all costs of the audit, including Nauticare's time at its then-current rates, unless the audit reveals a material breach of this DPA by Nauticare.

12. Return and deletion

12.1 During the term of the Agreement, the Customer can export Customer Data from the Service at any time.

12.2 At the end of the Agreement, the Customer's data is available for retrieval as set out in section 4.5 of the Agreement. Nauticare then returns and/or deletes Customer Personal Data as set out in section 3.13 of Annex 2, unless EU or Member State law requires it to be stored. Data in backups is deleted when the backups expire in the regular backup cycle.

12.3 For Nauticare Local, Nauticare deletes the software and Customer Personal Data remotely within the same period, provided the Customer gives the necessary remote access, or the Customer deletes them itself.

13. Liability

13.1 The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability in section 8 of the Agreement. Nothing in this DPA limits liability that cannot be limited by law, or the rights of data subjects under Article 82 GDPR.

14. General

14.1 Term. This DPA applies for as long as Nauticare processes Customer Personal Data under the Agreement.

14.2 Order of precedence. In case of conflict regarding the processing of personal data: (i) the Standard Contractual Clauses, where applicable; (ii) this DPA; (iii) the Agreement; (iv) Nauticare's Terms and Conditions. Annex 2 is the authoritative description of the technical and organisational measures, Sub-processors, AI Functionality, retention and deletion: where the main text of this DPA and Annex 2 describe the same matter differently, Annex 2 prevails.

14.3 Changes. Nauticare may change this DPA as provided in section 11.7 of the Agreement, without reducing the level of protection of Customer Personal Data unless required by Data Protection Law. Updates to Annex 2 and Appendix A follow sections 4.3 and 5.

14.4 Law and jurisdiction. This DPA is governed by the laws of the Netherlands. Disputes are submitted exclusively to the competent court in Amsterdam, the Netherlands, without prejudice to the rights of data subjects and supervisory authorities under Data Protection Law.

Annex 1 – Description of the processing

Annex 2 – Technical and Organisational Measures

pursuant to Article 28(3)(c) and Article 32 of Regulation (EU) 2016/679 (GDPR)

1. Purpose and scope

This Annex describes the technical and organisational measures (“TOMs”) implemented by the Processor to ensure a level of security appropriate to the risk of the processing of personal data carried out on behalf of the Controller under the Data Processing Agreement (the “DPA”). The measures take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

The Processor may adapt the measures described in this Annex to technical and organisational developments, provided that the overall level of protection is not reduced. Material changes shall be documented and notified to the Controller upon request.

2. Processing environment

• Hosting. The Service is hosted on Google Cloud Platform (“GCP”) in the region europe-west4 (Eemshaven, the Netherlands). Application servers, the production database and stored files are located in this region.

• Data centres. The Processor does not operate its own data centres. Physical infrastructure is provided by Google, whose data centres are certified, among others, to ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and SOC 2.

• Multi-tenant architecture. The Service is a multi-tenant application. Customer data is logically separated by organisation (company) and by vessel, as described in Section 3.4.

3. Technical and organisational measures

3.1 Physical access control

Measures to prevent unauthorised persons from gaining physical access to data processing systems:

• Physical security of the hosting infrastructure is provided by Google in accordance with its certified security programme, including perimeter security, 24/7 security staff, video surveillance, biometric and badge-based access control, and access logging.

• No Controller data is stored on servers located on the Processor’s own premises.

3.2 System access control (authentication)

Measures to prevent data processing systems from being used without authorisation:

• Each user has a unique, personal account. Shared accounts are not provided.

• Passwords are never stored in plain text; they are stored exclusively as salted hashes using the bcrypt algorithm.

• Multi-factor authentication is available to all users, using an authenticator application (TOTP) or one-time codes sent by e-mail.

• Sensitive operations require additional re-authentication of the user (step-up authentication).

• Optionally, users may sign in with their Google account (OpenID Connect).

• Session tokens are transmitted in signed, HttpOnly cookies that are not accessible to client-side scripts. All active sessions of a user are invalidated when the user changes their password or is logged out by an administrator.

• Requests to the Service, including authentication requests, are rate-limited to mitigate brute-force and automated attacks.

• Administrative access of the Processor’s personnel to production infrastructure is restricted to named, authorised individuals and protected by multi-factor authentication.

3.3 Data access control (authorisation)

Measures to ensure that persons authorised to use the Service can access only the data covered by their access rights:

• Access is governed by a role-based access control model (company administrator, company user, company viewer, captain, crew, viewer and others). Within a vessel, access of crew members is granted area by area (e.g. documents, tasks, inventory, crew records) by the Controller’s authorised users.

• Authorisation is enforced on the server for every request. A user can access only the organisation and vessels to which they have been assigned; the user’s identity and role are derived from the authenticated session and cannot be altered by the client.

• Access rights are administered by the Controller’s own administrators, who can grant, change and withdraw them at any time.

3.4 Separation control

Measures to ensure that data collected for different purposes or for different controllers is processed separately:

• Logical tenant separation: every record is bound to an organisation and, where applicable, a vessel; all queries are scoped to the requesting user’s organisation and vessels.

• Production, development and test environments are separated. Automated tests run against dedicated test databases.

3.5 Encryption and pseudonymisation

• In transit. All communication between users and the Service, and between the Service and its sub-processors, is encrypted using TLS (HTTPS).

• At rest. All data stored on GCP, including databases, disks, backups and stored files, is encrypted at rest by default using AES-256.

• Secrets. Credentials and API keys are kept outside the source code and are accessible only to the systems and authorised personnel that require them.

3.6 Transfer control

Measures to ensure that personal data cannot be read, copied, altered or removed without authorisation during electronic transmission or storage:

• Data is transferred exclusively over encrypted connections (see Section 3.5).

• Files stored in the Service are accessible only through authenticated and authorised requests.

• Data exports (e.g. PDF and spreadsheet exports) are available only to users authorised to view the underlying data.

• Data is transferred to sub-processors only to the extent required for the respective service (see Appendix A).

3.7 Input control

Measures to ensure that it is possible to establish whether and by whom personal data has been entered, modified or removed:

• Key records maintain a change history that records the user and the time of creation and modification.

• Activity logs of relevant user actions are available to the Controller’s administrators within the Service.

• Application and access logs are retained on the Processor’s infrastructure for 1 month for security and troubleshooting purposes.

3.8 Availability, resilience and recoverability

Measures to ensure that personal data is protected against accidental destruction or loss and that availability can be restored in a timely manner:

• The Service runs on GCP infrastructure designed for high availability, with redundant power, cooling and network connectivity.

• Backups of the production database are performed daily, retained for 30 days, encrypted, and stored in a separate GCP storage location within the EU.

• Restoration from backup is tested bi-annually. Target recovery point objective (RPO): 24 hours; target recovery time objective (RTO): 1 to 4 hours.

• Rate limiting protects the Service against overload and abusive traffic.

3.9 Personal data breach management

• The Processor maintains a procedure for detecting, assessing, containing and documenting security incidents.

• The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data, and shall provide the information the Controller reasonably requires to meet its obligations under Articles 33 and 34 GDPR.

3.10 Organisational measures and personnel

• All persons authorised by the Processor to process personal data are bound by written confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

• Personnel are informed of their data protection obligations and receive data protection and security training at least annually.

• Access rights of personnel are granted on a least-privilege basis and are revoked without delay when no longer required, in particular upon termination of employment or engagement.

3.11 Secure development and change management

• Changes to the Service are developed in a version-controlled repository and reviewed before deployment to production.

• Automated test suites and automated architecture and code-quality checks are executed before changes are released.

• Database schema changes are applied through versioned, reviewed migrations.

• Third-party software dependencies are maintained and updated to address known vulnerabilities.

3.12 Sub-processor management (order control)

• Sub-processors are engaged only on the basis of written agreements imposing data protection obligations equivalent to those of the DPA, including appropriate technical and organisational measures.

• The current list of authorised sub-processors is set out in Appendix A. The Controller shall be informed in advance of any intended addition or replacement of a sub-processor in accordance with the DPA.

• Where personal data is transferred to a third country, the transfer is based on an adequacy decision (including the EU–U.S. Data Privacy Framework, where the recipient is certified) or on the Standard Contractual Clauses adopted by the European Commission.

3.13 Data subject rights, return and deletion

• The Service enables the Controller to access, correct, export and delete personal data, thereby supporting the Controller in responding to data subject requests.

• Upon termination of the agreement, the Processor shall, at the Controller’s choice, return the Controller’s data in a commonly used format and/or delete it within 30 days, unless retention is required by applicable law. Data contained in backups is deleted when the backups expire in the regular backup cycle.

3.14 Regular review

The Processor reviews and evaluates the effectiveness of these measures regularly, and at least once a year, as well as upon significant changes to the Service or its infrastructure.

4. Additional measures for the AI functionality

The Service includes optional AI-assisted functions, in particular an in-product assistant (chatbot) that answers questions about the Service and the Controller’s data, the extraction of data from uploaded documents (e.g. certificates, passports, invoices and quotes), AI-assisted creation of forms and documents, and actions carried out in the Service at the user’s request and with the user’s approval, such as updating inventory quantities (the “AI Functionality”). The following measures apply in addition to Section 3.

4.1 Model providers

• The AI Functionality uses large language models provided by OpenAI, Anthropic and Google (Gemini) through their commercial application programming interfaces (APIs). The Processor does not operate or train its own models.

• The providers are engaged as sub-processors (see Appendix A) on the basis of their data processing agreements for business customers.

4.2 No use of Controller data for model training

• Under the providers’ commercial terms, data submitted via their APIs is not used to train or improve their models. The Processor has not opted in to any data-sharing programme of the providers.

• The Processor does not use Controller data to train, fine-tune or otherwise improve any AI model.

4.3 Data minimisation and retention

• Data is transmitted to a model provider only on a per-request basis and only to the extent necessary to perform the function concerned. As a rule, a user initiates each request. There are two exceptions, where the call runs automatically within a workflow the user has already started:

  a) Telemetry mapping: only where the Controller has integrated a partner vessel data provider key. Opening its data-point mapping screen requests suggestions for unmapped equipment components. No personal data is transmitted.

  b) Inventory from expenses: saving an expense whose receipt was read by AI matches the receipt lines against a limited set of the vessel's inventory items. This can be disabled at the Controller's request.

• Model providers retain API requests and responses only for a limited period for the purpose of detecting and preventing abuse, and then delete them (according to their current terms: OpenAI up to 30 days; Anthropic up to 30 days; Google up to 55 days).

• Assistant conversations (user questions and assistant answers) are stored in the Processor’s database in the hosting region described in Section 2, so that users can refer to earlier conversations. Users can delete their conversation history at any time directly in the application. Usage metadata (volume and cost per request) is stored for billing and usage-limit purposes.

4.4 Permission-aware data access

• The assistant retrieves Controller data exclusively through the same server-side authorisation checks that apply to the rest of the Service. It can access only the data that the requesting user is already entitled to view; it cannot access data of other organisations, other vessels or areas for which the user holds no permission.

• The identity, role and permissions of the user are taken from the authenticated session and cannot be changed or extended through the content of a conversation.

• The assistant can read data to answer questions and can prepare actions in the Service at the user’s request, such as updating inventory quantities. It can only prepare actions that the requesting user is permitted to perform. Every action that creates, modifies or deletes records is shown to the user first and is only carried out after the user explicitly approves it; the assistant cannot carry out such actions on its own. Approved actions are performed in the name of the approving user and recorded in the same way as changes made by that user (see Section 3.7).

4.5 Integrity and misuse prevention

• The assistant is instructed to treat the content of documents, records and user messages as data and not as instructions, as a safeguard against prompt-injection attempts.

• The use of the AI Functionality is subject to request rate limits and to a monthly usage limit per customer organisation.

• Users can flag an answer as incorrect or unhelpful. Only flagged conversations are reviewed, by authorised personnel of the Processor, for the purpose of quality assurance.

4.6 Transparency, control and international transfers

• Where an answer refers to specific records of the Controller, the assistant can provide direct links to those records within the Service.

• Upon the Controller’s written request, the Processor shall deactivate the AI Functionality for the Controller’s organisation.

• Model providers process requests predominantly in the United States. Such transfers are safeguarded as set out in Section 3.12. The Controller’s core application data remains stored in the hosting region described in Section 2.

Appendix A – Authorised sub-processors