Data Processing Agreement

In short: When your charter company uses the Atlas Platform, you decide why and how the personal data of your guests, crew, staff, owners and other contacts is processed. You are the controller. Sail Atlas processes that data only to run the Platform for you and on your instructions. We are your processor (in Türkiye: veri işleyen). This agreement sets out what we may do with the data, how we protect it, which sub-processors we use, how data moves across borders, how we help you with requests and breaches, and what happens to the data when your subscription ends. Your data is hosted by Amazon Web Services in Frankfurt, Germany. We never sell it, use it for advertising or use it to train AI models.

1. About this agreement

1.1 This Data Processing Agreement (“DPA”) is between the charter company or other business that subscribes to the Atlas Platform (“Customer”, “you”) and HeyAtlas.ai LLC, a New Jersey (USA) limited liability company doing business as Sail Atlas, 2037 Lemoine Ave, Suite 330, Fort Lee, NJ 07024, United States (“Sail Atlas”, “we”, “us”).

1.2 This DPA forms part of the Atlas Platform Subscription Agreement (the “Subscription Agreement”). You accept it when you accept the Subscription Agreement, online or by signing an Order Form that refers to it. No separate signature is needed, except for the transfer instruments in section 9 that must be signed separately.

1.3 This DPA is designed to meet the requirements of Article 28 of the GDPR and the UK GDPR, Article 12 of the KVKK and any other Data Protection Laws that apply to the processing of Customer Personal Data.

1.4 Terms defined in the Subscription Agreement have the same meaning in this DPA unless defined below.

2. Definitions

In this DPA:

• “Atlas Platform” or “Platform”: the Sail Atlas software and services described in the Subscription Agreement, including Atlas Dashboard, Atlas Operations, Digital Offers, Direct Booking Websites, Crew List and Atlas AI, and the parts of Atlas Charter, Atlas Crew and Atlas Owner that show your data to the people you work with.
• “Customer Personal Data”: personal data that we process on your behalf in providing the Platform, as described in Annex 1.
• “Data Protection Laws”: all laws on the protection of personal data that apply to the processing of Customer Personal Data, including the GDPR, the UK GDPR, the KVKK and their implementing rules, and U.S. state privacy laws where they apply.
• “GDPR”: Regulation (EU) 2016/679 (General Data Protection Regulation). “UK GDPR”: the GDPR as it forms part of the law of the United Kingdom, together with the UK Data Protection Act 2018.
• “KVKK”: Turkish Personal Data Protection Law No. 6698 and its secondary legislation, including the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik, published on 10 July 2024). “Board”: the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). “Authority”: the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).
• “controller”, “processor”, “data subject”, “personal data”, “processing”, “special categories of personal data” and “supervisory authority” have the meanings given in the GDPR. Under the KVKK they correspond to veri sorumlusu, veri işleyen, ilgili kişi, kişisel veri, kişisel verilerin işlenmesi and özel nitelikli kişisel veri, and the supervisory authority is the Board.
• “Personal Data Breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data while it is processed by us or our Sub-processors.
• “Sub-processor”: another processor that we engage to process Customer Personal Data on your behalf.
• “SCCs”: the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914.
• “UK Addendum”: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0), as amended from time to time.
• “DPF”: the EU-U.S. Data Privacy Framework and its UK Extension.
• “KVKK Standard Contracts”: the standard contracts for transfers abroad published by the Board under Article 9 of the KVKK, in particular the controller-to-processor and processor-to-processor modules.
• “Authorised Users”: your staff and other people you allow to use the Platform under your account.

3. Roles and scope

3.1 You are the controller, we are your processor. For Customer Personal Data, you are the controller and Sail Atlas is your processor. If you process some of this data as a processor for someone else (for example a partner company), you confirm that your instructions to us are authorised by that controller, and we act as your sub-processor.

3.2 What this DPA covers. This DPA covers all Customer Personal Data, in particular data about your guests and passengers, bookings, passenger and crew lists (including passport and ID details), your own crew records, your staff’s work data in Atlas Dashboard and Atlas Operations, messages in your inbox, campaign and offer recipients, bookings made on your booking website, and the data about boats and owners that you share with owners in Atlas Owner. It also covers this data when the Platform shows it to your guests in Atlas Charter, to crew members you assign in Atlas Crew and to owners you invite to Atlas Owner.

3.3 What it does not cover. Sail Atlas is a controller, and this DPA does not apply, for:

• the accounts that guests, crew members and boat owners create in Atlas Charter, Atlas Crew and Atlas Owner, and the public crew profiles in Atlas Crew;
• the account, sign-in and security records of your Authorised Users, billing data about your company, support communications and product analytics; and
• visitors to our website and our own prospects.

We process this data as described in our Privacy Policy and in the app notices, such as the Customer App Privacy Notice and the Crew App Privacy Notice. When you take data from the crew pool in Atlas Crew into your own records (for example by booking a crew member), the copy in your records is Customer Personal Data.

3.4 U.S. state privacy laws. Where U.S. state privacy laws apply, we act as your “service provider” or “processor”. We do not sell or share Customer Personal Data, we do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Platform, and we do not combine it with personal data we receive from others, except as those laws allow.

4. Details of the processing

4.1 The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

4.2 We process Customer Personal Data for as long as you use the Platform and until it is returned or deleted under section 14.

5. Your instructions

5.1 Documented instructions only. We process Customer Personal Data only on your documented instructions, including with regard to transfers abroad, unless a law that applies to us requires otherwise. In that case we tell you about that legal requirement before we process the data, unless the law prohibits this on important grounds of public interest.

5.2 What counts as your instructions. Your documented instructions are:

• the Subscription Agreement and this DPA;
• your configuration and use of the Platform by your Authorised Users, for example the data you enter, the features and settings you turn on, the integrations you connect and the messages and campaigns you send;
• the creation of aggregated or anonymised data described in section 7.6 of the Subscription Agreement; and
• any other written instructions you give us, for example by email to info@sailatlas.app, that are consistent with the Subscription Agreement. Instructions that go beyond the scope of the Platform may require a separate agreement and fees.

5.3 Unlawful instructions. We tell you immediately if, in our opinion, an instruction infringes Data Protection Laws. We may then suspend carrying out that instruction until you confirm or change it. This is not legal advice, and we are not required to check every instruction.

5.4 No use for our own purposes. We do not sell Customer Personal Data, use it for advertising, or process it for our own purposes. We do not use it to contact your guests on our own behalf. Each customer sees only its own data. A guest who links bookings from several charter companies to one Atlas Charter account sees each company’s bookings, but no company sees another company’s data.

5.5 KVKK. We do not disclose Customer Personal Data in breach of the KVKK and do not use it for any purpose other than the processing you instruct, as required by Article 12(4) of the KVKK. This obligation continues after this DPA ends.

6. Confidentiality of our personnel

6.1 We allow access to Customer Personal Data only to our employees and contractors who need it to provide, secure or support the Platform, and only to the extent they need it.

6.2 Everyone we authorise to process Customer Personal Data is bound by a written confidentiality obligation or an appropriate statutory duty of confidentiality. This obligation continues after their engagement ends.

6.3 Our support staff access your account only to answer your support requests, at your request, or where needed to keep the Platform secure and working.

7. Security of processing

7.1 Our measures. We implement and maintain the technical and organisational measures described in Annex 2 to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. We have chosen these measures taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to data subjects, as required by Article 32 of the GDPR and Article 12(1) of the KVKK.

7.2 Updates. We may update the measures as technology and risks change, provided that the overall level of protection does not decrease.

7.3 Shared responsibility. Under Article 12(2) of the KVKK, you and we are jointly responsible for taking the measures in Article 12(1). You are responsible for the parts of security under your control, including:

• assigning roles and permissions to your Authorised Users and removing access when someone leaves;
• keeping your users’ sign-in details secure;
• the security of your own devices and networks; and
• data you export from the Platform or send to third parties through integrations you connect.

8. Sub-processors

8.1 General authorisation. You give us a general written authorisation to engage Sub-processors. The Sub-processors we use at the date you accept this DPA are listed on our Sub-processors page, which forms Annex 3. Some of them are used only if you turn on the related feature or integration.

8.2 Our obligations. Before we engage a Sub-processor, we check that it provides sufficient guarantees to implement appropriate technical and organisational measures. We sign a written contract with each Sub-processor that imposes data protection obligations no less protective than those in this DPA, to the extent they are relevant to the service it provides. Each Sub-processor may process Customer Personal Data only as needed to provide its service to us.

8.3 Notice of changes. We tell you at least 30 days before we add or replace a Sub-processor. We do this by email to the account owner and the administrator contacts on your account, and by updating the Sub-processors page. You can also subscribe to updates as described on that page.

8.4 Your right to object. You may object to a new Sub-processor on reasonable grounds relating to data protection by writing to info@sailatlas.app within 30 days of our notice. We will then discuss your concerns in good faith and, where possible, offer an alternative, for example a way to use the Platform without the new Sub-processor processing your data. If we cannot resolve your objection, you may terminate the affected part of your subscription, or the whole subscription if the affected part cannot be separated, by written notice before the change takes effect. We then refund any prepaid fees for the period after termination. If you do not object within the notice period, the new Sub-processor is treated as approved.

8.5 Urgent replacements. If we must replace a Sub-processor urgently, for example for security reasons or because it stops its service, we may do so with shorter notice. We tell you as soon as possible, and your right to object under section 8.4 still applies.

8.6 Liability. We remain fully liable to you for the performance of each Sub-processor’s obligations.

8.7 Copies. On request, we provide a copy of the data protection terms we have agreed with a Sub-processor. We may remove commercial information and confidential terms that are not relevant to data protection.

9. International transfers

9.1 Where your data is. Customer Personal Data is stored on Amazon Web Services servers in Frankfurt, Germany (region eu-central-1). Sail Atlas is a company established in the United States. Our personnel and some Sub-processors access or process the data from the United States or other countries shown on the Sub-processors page. We transfer Customer Personal Data to another country only as set out in this section.

9.2 EEA. Where the GDPR applies to your processing and our access to or processing of Customer Personal Data is a transfer to a third country, the SCCs, Module 2 (controller to processor), apply between you as data exporter and HeyAtlas.ai LLC as data importer, and are incorporated into this DPA by reference, as follows:

• Clause 7 (docking clause) applies;
• in Clause 9, Option 2 (general written authorisation) applies, with 30 days’ notice as in section 8.3;
• the optional wording in Clause 11 does not apply;
• in Clause 13, the competent supervisory authority is the authority of the EU Member State where you are established or, if you are not established in the EU, the authority determined under Clause 13(a);
• in Clause 17, Option 2 applies: the SCCs are governed by the law of the EU Member State where you are established; where that law does not allow third-party beneficiary rights, or you are not established in the EU, by the law of Ireland;
• in Clause 18, disputes are resolved by the courts of the EU Member State whose law governs the SCCs; and
• Annex I.A is completed with the parties’ details in the Subscription Agreement, Annex I.B with Annex 1 of this DPA, Annex I.C with Clause 13 as above, Annex II with Annex 2 of this DPA, and Annex III with the Sub-processors page.

Where our Sub-processors process Customer Personal Data in a third country, we rely on an adequacy decision (including the DPF, where the Sub-processor is certified) or on the SCCs, Module 3 (processor to processor), with that Sub-processor.

9.3 United Kingdom. Where the UK GDPR applies, the UK Addendum applies to transfers to us, completed as follows: Table 1 with the parties’ details in the Subscription Agreement; Table 2 with the SCCs Module 2 and the selections in section 9.2; Table 3 with Annexes 1 to 3 of this DPA; and in Table 4, either party may end the UK Addendum as set out in its Section 19. Onward transfers to Sub-processors rely on the DPF UK Extension, where the Sub-processor is certified, or on the UK Addendum.

9.4 Türkiye. If you are established in Türkiye or the KVKK otherwise applies to your processing, making Customer Personal Data available to us is a transfer abroad under Article 9 of the KVKK. Unless an adequacy decision of the Board covers the transfer:

• you and we sign the KVKK Standard Contract, controller-to-processor module, separately and without changing its text, as the Regulation requires;
• for onward transfers to Sub-processors abroad, we use the KVKK Standard Contract, processor-to-processor module, or another appropriate safeguard under Article 9 of the KVKK;
• the data exporter notifies each signed KVKK Standard Contract to the Authority within 5 business days of signature. For the contract between us, you are the data exporter and you make this notification. We provide any information and documents you need for it, and copies of our onward contracts on request; and
• you inform data subjects about the transfer abroad in your privacy notice (aydınlatma metni).

If a KVKK Standard Contract conflicts with this DPA, the KVKK Standard Contract prevails for the transfers it covers.

9.5 Other countries. Where other Data Protection Laws require a transfer mechanism, we work with you in good faith to put one in place.

9.6 Requests from public authorities. If a public authority asks us for Customer Personal Data, we:

• tell you promptly, unless the law prohibits this;
• direct the authority to request the data from you where possible;
• review the lawfulness of the request and challenge it where there are reasonable grounds to do so; and
• disclose only the minimum data required and keep a record of the request.

10. Help with data subject requests

10.1 Forwarding requests. If we receive a request from a data subject about Customer Personal Data, for example a request to access, correct or delete data or to object, we forward it to you without undue delay and in any event within 5 business days. We do not answer the request ourselves, except to confirm that we have passed it on, unless you instruct us to.

10.2 Self-service tools. The Platform lets you find, view, correct, export and delete the data of your guests, crew, owners and other contacts, and record opt-outs from marketing. You use these tools to answer most requests yourself.

10.3 Further help. Where the tools are not enough, we help you answer requests by appropriate technical and organisational measures, as far as possible and taking into account the nature of the processing. This includes helping you meet the 30-day deadline under Article 13 of the KVKK and the one-month deadline under Article 12 of the GDPR. We do this without extra charge, unless requests are manifestly unfounded or excessive.

10.4 Guests’ app accounts. If a guest deletes their Atlas Charter account, their booking records with you are not deleted; only the link between the account and your bookings is removed. Requests to delete booking records are for you to decide.

11. Help with impact assessments and other duties

11.1 Taking into account the nature of the processing and the information available to us, we give you reasonable help to meet your obligations under:

• Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultation with a supervisory authority;
• Article 12 of the KVKK, including information you need about our measures; and
• your registration with VERBİS (the Turkish Data Controllers’ Registry), where you are required to register, for example information about our Sub-processors and transfers abroad.

11.2 We give this help mainly through our documentation, this DPA and its annexes. We may charge reasonable fees for help that requires significant work beyond that, after agreeing them with you in advance.

12. Personal data breaches

12.1 Notice to you. We notify you of a Personal Data Breach without undue delay and in any event within 48 hours of becoming aware of it. This allows you to meet your own duties, including notifying the supervisory authority within 72 hours under Article 33 of the GDPR and notifying the Board within 72 hours under Article 12(5) of the KVKK and the Board’s decision no. 2019/10.

12.2 Content. Our notice includes, as far as the information is available:

• the nature of the breach, including when it happened and when we discovered it;
• the categories and approximate number of data subjects and records concerned;
• the likely consequences of the breach;
• the measures we have taken or propose to take to address the breach and limit its possible adverse effects; and
• a contact person who can provide more information.

If we cannot provide all the information at once, we provide it in phases without further undue delay.

12.3 Our actions. We promptly take reasonable steps to contain and investigate the breach and limit its effects. We keep you informed and give you the information and cooperation you reasonably need to notify supervisory authorities and data subjects. We document every breach, its effects and the action taken.

12.4 Your decisions. As controller, you decide whether to notify supervisory authorities and data subjects. We do not notify them about a breach of your data on your behalf unless you instruct us or the law requires it.

12.5 How we notify. We send the notice by email to the account owner and the administrator contacts on your account. Please keep these contacts up to date.

12.6 Unsuccessful attempts. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as blocked sign-in attempts, pings or port scans, are not Personal Data Breaches.

12.7 Our notice of a breach is not an admission of fault or liability.

13. Atlas AI

13.1 How inputs are used. Atlas AI helps your Authorised Users with tasks such as answering questions about your data, summarising, drafting messages and offers, translating text, transcribing voice notes and reading passports and ID documents. When a user uses an Atlas AI feature, the relevant inputs (for example the question, messages, notes, documents, images or voice recordings) and the context needed for the task are sent to OpenAI, L.L.C. or Anthropic, PBC, and for document reading to Base64.ai, only to produce the output and return it to you.

13.2 No training. These providers are our Sub-processors under section 8. Under their API terms, they do not use data sent through their APIs to train their models. They may keep inputs and outputs for a limited period only to detect abuse, under their terms. We do not use Customer Personal Data to train or fine-tune any AI model, our own or a third party’s.

13.3 Your control. You decide whether to use Atlas AI and which of your Authorised Users can use it, through your plan, your settings and user permissions. Do not put special categories of personal data into Atlas AI unless it is necessary and you have a legal basis for it.

13.4 Review of outputs. Outputs are generated automatically and may be inaccurate. Your users must check them before relying on them, especially data read from passports and ID documents. Atlas AI does not make decisions that have legal or similarly significant effects on data subjects. If you use outputs in such decisions, a person on your side must review them, in line with Article 22 of the GDPR and Article 11(1)(g) of the KVKK.

14. Return and deletion

14.1 During the subscription. You can delete Customer Personal Data at any time with the Platform’s tools. Deleted data is removed from our live systems and then from backups when the backups expire, as described in Annex 2.

14.2 At the end of the subscription. When your subscription ends, you can export Customer Personal Data for 30 days using the Platform’s export features, or ask us for an export in a commonly used, machine-readable format. After this period we delete Customer Personal Data from our systems, including backups, within 90 days, and instruct our Sub-processors to delete it, as set out in section 20 of the Subscription Agreement.

14.3 Legal retention. If a law that applies to us requires us to keep some Customer Personal Data longer, we keep only that data, protect it under this DPA, process it only for the purpose required by law and delete it when the retention period ends.

14.4 Confirmation. On request, we confirm the deletion in writing.

15. Audits and information

15.1 Information. We make available to you all information necessary to demonstrate compliance with Article 28 of the GDPR, Article 12 of the KVKK and this DPA. This includes this DPA and its annexes, the Sub-processors list, answers to reasonable security questionnaires (once a year) and summaries of our latest security reviews and tests.

15.2 Audits. If this information is not enough to demonstrate compliance, or a supervisory authority requires it, or after a Personal Data Breach, you may audit our compliance with this DPA, including by inspection. The audit:

• is carried out by you or by an independent auditor who is not our competitor and who is bound by confidentiality;
• is requested in writing at least 30 days in advance, with a proposed scope;
• takes place no more than once in any 12 months, unless a supervisory authority requires it or it follows a Personal Data Breach;
• takes place during normal business hours, without unreasonably disrupting our operations, and without access to other customers’ data or to information that would compromise our security; and
• is at your cost. You give us a copy of the audit report.

15.3 Certifications. If we obtain third-party certifications or audit reports (for example ISO/IEC 27001 or SOC 2), we will make them available, and they can replace an audit for the matters they cover. Where a Sub-processor has such certifications or reports (for example Amazon Web Services), we may use them to demonstrate its compliance.

15.4 Nothing in this section limits the powers of a supervisory authority or the Board.

16. Your responsibilities as controller

16.1 Lawful processing. You are responsible for having a legal basis for all Customer Personal Data you collect or enter in the Platform (under Articles 6 and 9 of the GDPR and Articles 5 and 6 of the KVKK), for giving data subjects the required privacy notices (aydınlatma), including about transfers abroad, and for obtaining consents where needed.

16.2 Special categories. The Platform is not designed for special categories of personal data. You may choose to record such data where a charter needs it, for example dietary, allergy or health notes or accessibility needs. If you do, you are responsible for the legal basis and for recording only what is necessary.

16.3 Children. Passenger lists may include children. You are responsible for making sure their data is collected lawfully, through or with the permission of their parents or guardians.

16.4 Marketing. You are responsible for having valid consent for campaigns and other marketing messages you send through the Platform, honouring opt-outs and, in Türkiye, complying with Law No. 6563 and the Message Management System (İYS).

16.5 Integrations you choose. When you connect services that you contract with directly, such as booking systems or payment providers, we send data to them on your instruction. Those providers act for you, not as our Sub-processors, and your contract with them governs their processing.

16.6 Your other duties. You are responsible for your own duties as controller, including your records of processing, answering data subject requests, notifying breaches and, where applicable, registering with VERBİS.

17. Liability

17.1 Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in section 17 of the Subscription Agreement, and counts towards the same cap.

17.2 This does not limit either party’s liability to data subjects under Data Protection Laws, the SCCs or the KVKK Standard Contracts, or any liability that cannot be limited under applicable mandatory law.

18. Term, precedence and changes

18.1 Term. This DPA applies from when you accept the Subscription Agreement until we have deleted or returned all Customer Personal Data under section 14. Obligations that by their nature should continue, such as confidentiality, survive.

18.2 Precedence. If documents conflict, the following order applies: (1) the SCCs, the UK Addendum and the KVKK Standard Contracts, for the transfers they cover; (2) this DPA; (3) the Subscription Agreement and other terms. This DPA prevails over the Subscription Agreement on any matter relating to the processing of personal data.

18.3 Changes. We may update this DPA to reflect changes in law, guidance from supervisory authorities, or changes to the Platform. Changes to Sub-processors follow section 8. We tell you about material changes at least 30 days in advance. Changes must not reduce the overall protection of Customer Personal Data, unless the law requires it. The current version and its effective date are always shown at the top of this page.

18.4 Severability. If any provision of this DPA is invalid or unenforceable, the rest of the DPA remains in force.

19. Governing law and jurisdiction

19.1 This DPA is governed by the law chosen in section 22 of the Subscription Agreement, and disputes are resolved by the courts or other forum chosen there, except that:

• the SCCs are governed by the law and courts set out in section 9.2, and the UK Addendum by the law of England and Wales and the courts of England and Wales;
• the KVKK Standard Contracts are governed by the law and forum set out in them; and
• nothing in this DPA excludes the mandatory provisions of the GDPR, the UK GDPR or the KVKK, the rights of data subjects or the powers of supervisory authorities and the Board.

20. Contact

For any question about this DPA or the processing of Customer Personal Data, write to info@sailatlas.app or to HeyAtlas.ai LLC, 2037 Lemoine Ave, Suite 330, Fort Lee, NJ 07024, United States.

Annex 1: Details of the processing

Subject matter, duration, nature and purposes

Categories of data subjects

• Guests and passengers, including children on passenger lists, and the people who book on their behalf.
• Prospects and offer recipients: people and agencies to whom you send Digital Offers or quotes.
• Booking-website users: people who browse, enquire or book on your Direct Booking Website.
• Your staff: Authorised Users and other employees and contractors whose work you record in Atlas Dashboard and Atlas Operations.
• Crew in your records: skippers, hostesses, cooks and other crew you employ, book or assign, including freelance crew from Atlas Crew.
• Boat owners: owners of boats you manage, including those you invite to Atlas Owner.
• Campaign recipients: people you send campaigns to by email, SMS, WhatsApp or the Atlas Charter app.
• Contacts at agencies, suppliers and partners.

Categories of personal data

Special categories of personal data

None are required by the Platform. Special categories are processed only where you choose to record them, for example dietary, allergy or health notes, or accessibility needs of guests. You are responsible for the legal basis (section 16.2). The safeguards in Annex 2 apply, and you can restrict who sees such notes through user permissions.

Retention

Customer Personal Data is kept for as long as you keep it in the Platform, in line with your own retention policy, and then deleted as set out in section 14. Technical records are kept for shorter, fixed periods, as set out in Annex 2.

Recipients

Our Sub-processors (Annex 3); and the recipients you choose, such as your guests, crew and owners through the apps, authorities you send passenger lists to, and the services you connect (section 16.5).

Annex 2: Technical and organisational measures

Annex 3: Sub-processors

The Sub-processors authorised under section 8 are listed on our Sub-processors page, with their purpose, the data concerned, their location and the transfer safeguards. The list in force on the date you accept this DPA forms this Annex 3, and it is updated as described in section 8.