Data Processing Addendum

Terms such as “personal data,” “processing,” “controller,” “processor,” “data subject,” “supervisory authority,” and “personal data breach” have the meanings given to them in the GDPR.

• “Customer Data” means personal data that the Controller or its users enter into, upload to, or otherwise make available through the Services, and that the Processor processes on behalf of the Controller.
• “Subprocessor” means any third party engaged by the Processor to process Customer Data on its behalf.
• “Data Subject” means any individual whose personal data is included in Customer Data — typically the Controller's own customers, staff, instructors, and referral agents.

The Controller acts as the data controller of Customer Data and determines the purposes and means of processing.

The Processor acts as the data processor and processes Customer Data only on the Controller's documented instructions, as set out in:

• the main service agreement or terms of service;
• this DPA;
• the Controller's configuration and use of the Services; and
• any additional written instructions agreed in advance.

If the Processor believes that an instruction from the Controller infringes applicable data protection law, it will inform the Controller without undue delay.

Subject matter: Provision of the Ombar dive shop management platform and related services.

Duration: For the term of the main service agreement, plus any post-termination return or deletion period set out in Section 11.

Nature and purpose: Hosting, storing, organizing, retrieving, transmitting, displaying, and otherwise processing Customer Data to provide the Services and related support, security, and maintenance.

Categories of data subjects:

• customers of the dive shop (divers, students, guests)
• emergency contacts provided by those customers
• dive shop staff and instructors
• referral agents and partners

Types of personal data:

• identification and contact data (name, email, phone, nationality)
• certification data (level, agency, number, dive history)
• special category data: health and medical information relevant to dive safety, where entered by the Controller
• booking, reservation, scheduling, and equipment assignment data
• payment status and transaction metadata
• notes and communications entered by Controller staff
• content of messages and support communications

The Controller represents and warrants that:

• it has the right to transfer Customer Data to the Processor and to instruct the Processor to process it as contemplated by this DPA;
• it has provided appropriate notices and obtained any required consents from data subjects, including explicit consent for processing of health and medical data under Article 9 of the GDPR, where such data is entered into the Services;
• it has a valid legal basis under applicable law for processing Customer Data and instructing the Processor to process it;
• it will comply with applicable data protection laws in its own capacity as controller;
• it will not use the Services to process categories of personal data that are outside the scope described in Section 3 without the Processor's prior written agreement.

The Processor will:

1. Process only on documented instructions — process Customer Data only on the Controller's documented instructions, including with regard to transfers of personal data to a third country, unless required to do so by EU, Member State, or other applicable law;
2. Confidentiality — ensure that persons authorized to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
3. Security — implement appropriate technical and organizational measures as described in Section 7 (Annex II);
4. Subprocessors — engage Subprocessors only in accordance with Section 6;
5. Assistance with data subject rights — taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests from data subjects exercising their rights under applicable data protection law;
6. Assistance with Controller obligations — assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to the Processor (including personal data breach notification, data protection impact assessments, and prior consultation with supervisory authorities);
7. Return or deletion — at the choice of the Controller, delete or return all Customer Data to the Controller after the end of the provision of Services relating to processing, and delete existing copies unless applicable law requires storage of the personal data; and
8. Audits — make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR, and allow for and contribute to audits, including inspections, as set out in Section 9.

The Controller provides a general authorization for the Processor to engage Subprocessors to assist in providing the Services, subject to the conditions in this Section.

6.1 Current Subprocessors

As of the effective date of this DPA, the Processor uses the following Subprocessors:

The list above is kept up to date in this section and on our Privacy Policy.

6.2 New Subprocessors

The Processor will notify the Controller of any intended addition or replacement of Subprocessors that process Customer Data, giving the Controller at least thirty (30) days to object on reasonable data-protection grounds. If the Controller objects, the parties will work together in good faith to resolve the objection. If the objection cannot be resolved, the Controller may terminate the affected portion of the Services.

6.3 Subprocessor Obligations

Where the Processor engages a Subprocessor to carry out specific processing activities on behalf of the Controller, the Processor will impose data protection obligations on the Subprocessor that are no less protective than those set out in this DPA. The Processor remains fully liable to the Controller for the performance of the Subprocessor's obligations.

The Processor implements the following technical and organizational measures to protect Customer Data:

Access control and authentication:

• role-based access controls
• unique user accounts and strong password requirements
• access to production systems limited to authorized personnel on a need-to-know basis

Encryption:

• encryption of data in transit using industry-standard TLS
• encrypted backups

Network and infrastructure security:

• isolated production environments
• firewall and network access restrictions
• logging and monitoring of production access and key events

Operational security:

• regular encrypted backups on a rolling two-week cycle, stored in the European Union
• change management and deployment review
• separation of development, staging, and production environments

Incident management:

• procedures for detection, investigation, and notification of personal data breaches
• documented response workflow

Organizational measures:

• confidentiality obligations for personnel with access to Customer Data
• internal documentation of processing activities
• periodic review of security measures

These measures may be updated from time to time to reflect technical developments, provided that the level of protection is not reduced.

The Processor will notify the Controller without undue delay, and in any event within seventy-two (72) hours after becoming aware of a personal data breach affecting Customer Data. Such notification will include, to the extent known:

• the nature of the breach, including categories and approximate number of data subjects and records affected;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its effects; and
• contact details for further information.

The Processor will cooperate with the Controller and provide reasonable assistance to support the Controller's own breach notification obligations to supervisory authorities and data subjects.

The Processor will make available to the Controller, upon reasonable written request, information reasonably necessary to demonstrate compliance with this DPA and with Article 28 of the GDPR.

The Controller may, no more than once per calendar year (unless required more frequently by a supervisory authority or following a confirmed personal data breach), conduct an audit of the Processor's relevant processing activities. Audits must be:

• conducted on reasonable prior written notice (at least thirty (30) days, unless otherwise required by law);
• carried out during normal business hours;
• subject to the Processor's reasonable confidentiality and security requirements; and
• limited to information and systems directly relevant to the processing of Customer Data under this DPA.

Where available, the Processor may satisfy audit requests by providing relevant third-party certifications, audit reports, or standardized security documentation.

Where the Processor transfers Customer Data originating from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, such transfers are subject to appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) (Module 2: Controller-to-Processor or Module 3: Processor-to-Processor), and, where applicable, the UK International Data Transfer Addendum to the EU SCCs.

The Controller authorizes the Processor to enter into SCCs with its Subprocessors on the Controller's behalf where required.

Where the primary hosting location is outside the EEA (currently Singapore), the Processor will ensure that appropriate transfer mechanisms are in place and, upon request, provide reasonable information about those mechanisms.

Upon termination or expiry of the main service agreement, and at the Controller's choice, the Processor will either:

• return all Customer Data to the Controller in a commonly used, machine-readable format; or
• delete all Customer Data from its active systems.

Deletion will be completed within ninety (90) days of termination, except where applicable law requires storage of personal data for a longer period. Backup copies will be overwritten in the ordinary course of the Processor's backup cycle (up to two weeks) and will not be retrieved or restored.

The Processor will confirm deletion in writing upon the Controller's written request.

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the main service agreement. Nothing in this DPA limits either party's liability to a data subject under applicable data protection law.

In the event of a conflict between this DPA and the main service agreement, this DPA will prevail with respect to the processing of personal data. In the event of a conflict between this DPA and the EU Standard Contractual Clauses (where incorporated), the SCCs will prevail.

This DPA takes effect on the later of (a) the effective date set out above and (b) the date on which the Controller accepts the Services, and remains in effect for the duration of the main service agreement and any required post-termination period.

For questions regarding this DPA, subprocessor notifications, or data protection matters:

Code Sense Studio OÜ

Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia

[email protected]

ombar-suite.com

(Summary — full details set out in Section 3.)

• Nature and purpose of processing: Provision of the Ombar dive shop management platform.
• Duration: For the term of the service agreement plus any post-termination return or deletion period.
• Categories of data subjects: Dive shop customers, emergency contacts, staff, instructors, referral agents.
• Types of personal data: Identification, contact, nationality, certification, health/medical, booking, scheduling, equipment, payment metadata, staff notes, communications.
• Special categories: Health and medical data relevant to dive safety (Article 9 GDPR).
• Frequency: Continuous, for the duration of Services.

See Section 7.

See Section 6.1.