Data Processing Addendum

The Processor will process personal data only to provide, secure, support and improve the contracted service under documented instructions in the agreement, product settings and authorised use. It will notify the Controller if an instruction appears unlawful, unless prohibited. Processing for the Processor's independent controller purposes is governed by the Privacy Notice and is outside this DPA.

The Controller determines lawful purposes and bases, gives required notices, obtains valid consents where relied upon, limits data to what is necessary, configures retention and access, responds to individuals and ensures instructions are lawful. The Controller must not upload unlawful data or use sensitive information for unrelated profiling or marketing.

The Processor ensures that authorised personnel are bound by confidentiality, receive appropriate security/privacy training and access data only as necessary for their role.

The Processor will maintain measures appropriate to risk, including:

• logical tenant isolation using organization UUID scope;
• role-based access and least privilege;
• authentication, session and CSRF controls;
• encryption in transit and provider-managed encryption at rest where available;
• secret management and separation of environments/credentials;
• authorised file routes, safe filenames and upload validation;
• logging/audit of critical changes and payment events;
• verified and idempotent webhooks;
• vulnerability/dependency maintenance, backups and recovery procedures;
• restricted access and handling for health, waiver and minor data;
• incident response and periodic control review.

The Processor may update controls while maintaining an equivalent or stronger protection level.

The Controller grants general authorisation for subprocessors in the Provider Schedule. The Processor will give advance notice of a new subprocessor where required, allowing a reasonable objection based on documented data-protection grounds. The Processor will impose materially equivalent obligations and remains responsible for subprocessor performance to the extent required by law.

Restricted transfers will use an applicable adequacy decision, the then-current EU Standard Contractual Clauses or another lawful safeguard. Where SCCs are required, the appropriate controller-to-processor module is incorporated, this DPA and its schedules complete the annexes, the competent supervisory authority and governing law follow the Controller's establishment where required, and conflicting commercial clauses yield to the SCCs. The parties will cooperate on transfer-impact assessment and supplementary measures.

Taking account of the processing, the Processor will provide reasonable technical and organisational assistance for access, correction, deletion, restriction, portability, objection and automated-decision requests. If the Processor receives a request concerning Controller data, it will direct it to the Controller and not respond substantively unless authorised or legally required.

The Processor will notify the Controller without undue delay after confirming a personal-data breach affecting Controller data and provide available information on nature, categories, likely consequences, measures and contact. Information may be supplied in phases. The Controller remains responsible for authority and individual notifications unless law assigns otherwise.

The Processor will reasonably assist with security, data-protection impact assessments and prior consultation, considering the nature of processing and information available. Additional bespoke work may be charged at agreed rates unless caused by the Processor's breach.

At termination or written instruction, the Processor will return/export and delete Controller data according to the Platform Terms and Retention Schedule, unless law requires retention. Residual backups remain protected, are not restored for ordinary use and expire on schedule.

The Processor will provide information reasonably necessary to demonstrate compliance, such as current security summaries, subprocessor information and independent reports where available. If that is insufficient, the Controller may conduct one proportionate audit per year on reasonable notice, during business hours, without compromising other tenants, security or confidentiality. More frequent audits are allowed after a material incident or regulator request. The Controller bears ordinary audit costs unless material non-compliance is found.

Liability follows the Platform Terms except where mandatory data-protection law or the SCCs require otherwise. If this DPA conflicts with the Platform Terms on processing, this DPA controls; SCCs control over both for covered transfers.

• Subject matter: hosting and operation of dive-business customer, booking, document, payment and operational workflows.
• Duration: agreement term plus the deletion/retention period.
• Nature: collection, recording, organisation, storage, retrieval, consultation, transmission, reconciliation, restriction, export, deletion and support.
• Purposes: provide the configured Software service under Controller instructions.
• Data subjects: customers/divers, participants, guardians, emergency contacts, staff, contractors, business contacts and persons in communications/incidents.
• Personal data: identity/contact, account IDs, booking/service, certifications/experience, documents/signatures, equipment, communications, payment references, technical/audit data and business records.
• Special data: health/medical, accessibility, insurance and incident information where the Controller uses those features.
• Frequency: continuous during use of the service.
• Controller instructions: the agreement, authorised settings/actions and documented support requests.

The Provider Schedule in `00-legal-and-booking-schedules.md` is incorporated and must be published with legal entity, location and safeguard fields completed.

Processor security/privacy contact: the address in the Platform Identity Schedule. Controller contact: the verified administrative or privacy contact in the organization account.