Data Processing Addendum

This addendum applies where YOS processes personal data on customer's behalf while providing the platform and services. Customer is controller and YOS is processor under Regulation (EU) 2016/679 (GDPR). Where YOS processes personal data for its own purposes (customer's account, billing, security logs, support and product telemetry, analytics), YOS is controller and the privacy policy applies.

YOS processes personal data only on customer's documented instructions, which are: the agreement, this addendum, and the use of the platform's functions by customer and its users. YOS informs customer if, in its opinion, an instruction infringes data protection law. YOS may process where EU or Croatian law requires it and informs customer of that requirement unless the law forbids it.

YOS:

• ensures that persons authorised to process personal data are bound by confidentiality;
• implements the technical and organisational measures in section 6;
• engages sub-processors only under section 7;
• assists customer, taking into account the nature of the processing, in responding to data-subject requests, by the platform's own functions (export, correction, deletion, access logs) and, where those do not suffice, on request at reasonable cost;
• assists customer with security, breach notification, data protection impact assessments and prior consultation, as far as the information available to YOS allows;
• deletes or returns personal data at the end of the service as in section 9;
• makes available the information needed to demonstrate compliance and allows audits under section 8;
• informs customer without undue delay after becoming aware of a personal data breach affecting customer's data, with the information YOS has at the time and the rest as it becomes available.

Customer has a lawful basis for the personal data it enters, including for special categories, informs the data subjects, keeps its users' accounts and permissions correct, and uses the platform's permission system to limit who sees what. Customer is responsible for the content of the data and for the instructions it gives.

YOS maintains measures in line with good industry practice and improves them over time, including: encryption of data in transit; access control by role and permission inside the platform; authentication with password policy and, where enabled, a second factor; audit logging of access and changes; a separate database per vessel; administrative access limited to YOS's operator and logged; daily backups kept for a rolling period; regular updates of the platform and its hosting; sensitive settings protected at rest; and incident handling as in section 4. The measures are described in more detail on request.

Customer gives general authorisation to the sub-processors below. YOS informs customer of additions or replacements at least 14 days in advance, by e-mail to the authorised contact or in the app; customer may object in writing on reasonable data-protection grounds, and if no solution is found within 30 days may terminate the affected service. YOS imposes on each sub-processor data-protection obligations equivalent to this addendum and remains responsible for their performance.

Where AI features run on customer's own API key, the AI provider is engaged by customer and is not a sub-processor of YOS.

Customer may verify compliance once a year, or after a personal data breach, by a written request for information and, where that is not sufficient, an audit by customer or an independent auditor bound by confidentiality, on 30 days' notice, during business hours, without disrupting the service, at customer's cost. Reports of independent audits or certifications YOS holds satisfy the request where they cover the matter.

At the end of the service, customer exports its data through the platform within the export window in section 10 of the terms and conditions. After that YOS deletes customer's personal data from the live instance and lets it expire from backups in the normal backup rotation, unless EU or Croatian law requires longer storage. On request YOS confirms deletion in writing.

YOS stores customer data in the EU. Transfers to sub-processors outside the EU take place only under the transfer basis in section 7 and where the sub-processor's role requires it (push notification tokens and message metadata, payment data, AI requests on the YOS AI add-on).

Liability under this addendum is subject to section 21 of the terms and conditions, except where the GDPR allocates liability between controller and processor in a way the parties cannot change. This addendum lasts as long as YOS processes personal data for customer. The agreement prevails over this addendum except in matters of data protection, where this addendum prevails.

Data protection contact for YOS: info@yos.yachts. Customer's contact: the authorised contact in the order.