Data Processing Agreement

The Customer is the controller of the personal data it and its users enter into iVessel — crew records, hours of rest, certificates, contacts, documents, positions and similar ("Customer Data"). iVessel is the processor of Customer Data. iVessel is an independent controller of the account data it needs to run the service and bill for it (user login details, billing contact, usage and security logs), as described in the iVessel Privacy Policy.

iVessel processes Customer Data only to provide, maintain, support and improve the service as described in the Agreement and the Customer's use of the product's features, and otherwise only on the Customer's documented instructions. iVessel will tell the Customer if it believes an instruction breaches Data Protection Law. iVessel does not sell Customer Data, use it for advertising, or use it to train AI models.

Everyone iVessel authorises to process Customer Data is bound by a duty of confidentiality. Access is limited to what is needed to run and support the service.

iVessel maintains appropriate technical and organisational measures, including: encryption in transit (TLS) and at rest; row-level access control in the database so each company can only reach its own records; role-based permissions set by the Customer's administrators; optional multi-factor authentication, enforceable fleet-wide by the Customer; password screening against known breached-password lists; audit records of edits to regulated records such as hours of rest; daily database backups; and vulnerability management of the application and its dependencies. A current description is kept at ivessel.co/security.

The Customer authorises iVessel to use the sub-processors listed in Annex 2. iVessel will give at least 30 days' notice by email to the account's administrators before adding or replacing a sub-processor. If the Customer objects on reasonable data-protection grounds and iVessel cannot offer an alternative, the Customer may terminate the affected subscription without penalty before the change takes effect. iVessel remains responsible for its sub-processors' performance under this DPA and binds each to written terms no less protective than these.

Taking into account the nature of the processing, iVessel will assist the Customer, by appropriate technical and organisational measures, in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection). The product provides export of records and deletion of accounts and crew records; where a request cannot be met with those tools, iVessel will act on the Customer's written instruction within 10 business days. iVessel will also assist with data-protection impact assessments and prior consultations with supervisory authorities where its processing is in scope, with the information it holds.

iVessel will notify the Customer's administrators by email without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. iVessel will keep the Customer informed as the investigation progresses.

The Customer can export its records at any time. On termination of the Agreement, Customer Data remains available in read-only form for 24 months so the Customer can export it, as set out in the Privacy Policy. After that period, or earlier on the Customer's written request, iVessel deletes Customer Data within 30 days, and deletes it from backups within a further 35 days, except where law requires retention (for example invoices and payment records). Deletion of a user's own account is available in the product at any time; records a user created for a vessel remain the Customer's.

On written request, no more than once a year unless a breach or a supervisory authority requires it, iVessel will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of its hosting providers' independent audit reports (SOC 2 / ISO 27001). Where this is not sufficient, iVessel will allow an audit by the Customer or an independent auditor it mandates, on 30 days' notice, during business hours, at the Customer's cost, under confidentiality, and without access to other customers' data.

iVessel is established in the United States and Customer Data is stored in the United States (AWS, via Supabase). For transfers of personal data from the EEA, the Customer and iVessel enter into the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated by reference with the options in Annex 3. For transfers from the United Kingdom, the UK International Data Transfer Addendum to those clauses applies. For transfers from Switzerland, the clauses apply with the adaptations required by the Swiss FADP. Customers that require their data to stay in a given country can ask for a dedicated deployment in an AWS region of their choice, priced separately.

Data subjects are not parties to this DPA. Each party's liability under this DPA is subject to the limitations in the Agreement, to the extent Data Protection Law allows.

This DPA lasts as long as iVessel processes Customer Data. If it conflicts with the Agreement, this DPA prevails for data protection matters. If it conflicts with the Standard Contractual Clauses, the Clauses prevail. iVessel may update this DPA to reflect changes in law or in the service; material changes are notified to administrators 30 days ahead, and the current version and date are always shown at ivessel.co/dpa.

Except where the Standard Contractual Clauses require otherwise, this DPA is governed by the law of the State of Wyoming, United States, as the Agreement is.

Providers that receive no personal data (barcode lookups, AIS position feeds) are listed in the Privacy Policy.