Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between The Muster App Ltd, a company registered in England and Wales ("we", "us", "our", the "Processor") and the vessel operator who subscribes to the Service ("you", the "Controller").

Where this DPA conflicts with the Terms of Service or the Privacy Policy, this DPA prevails in respect of the processing of personal data.

1. Definitions

• "Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, and — where applicable to the processing — Regulation (EU) 2016/679 (EU GDPR) and any other data protection law applicable to a party.
• "Controller", "Processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given in the UK GDPR.
• "Service" means The Muster App and Muster Mate applications and related services, as defined in the Terms of Service.
• "Vessel Data" means the personal data we process on your behalf through the Service, as described in Annex 1.
• "Sub-processor" means any third party engaged by us to process Vessel Data.

2. Roles of the parties

You are the Controller of Vessel Data. We are the Processor. Each party will comply with its own obligations under Data Protection Laws.

You are responsible for establishing and maintaining a lawful basis for the collection and processing of Vessel Data, for providing the required information to visitors, crew and other data subjects, and for the accuracy and legality of the data you enter into the Service.

Where we determine the purposes and means of processing — for example, in relation to our own account, billing and security records, or the aggregated and anonymised information described in clause 13 — we act as a Controller in our own right, and that processing is governed by our Privacy Policy rather than by this DPA.

3. Scope and instructions

We will process Vessel Data only on your documented instructions, including in relation to transfers to a third country, unless we are required to process it by law that applies to us. Where we are required to process by law, we will inform you of that requirement before processing, unless the law prohibits us from doing so.

Your documented instructions are:

• this DPA;
• the Terms of Service and the Privacy Policy;
• the configuration choices and actions taken by you and your vessel administrators through the Service; and
• any further written instruction you give us that we accept.

We will inform you if, in our opinion, an instruction infringes Data Protection Laws. We may decline to act on an instruction that we reasonably believe would put us in breach of Data Protection Laws, and we may charge for work required to implement an instruction that goes beyond the standard functionality of the Service.

4. Confidentiality and our personnel

We restrict access to Vessel Data to the members of our personnel who need it to perform this agreement.

Purposes. Our personnel access Vessel Data only in order to:

• provide support that you or your vessel administrator has asked for;
• investigate, diagnose and fix a fault, error or data problem affecting the Service;
• maintain the security of the Service and investigate a suspected security incident or misuse; and
• comply with a legal obligation.

We do not access Vessel Data for any other purpose. In particular, we do not access it to build profiles of individuals, to market to your crew or visitors, or to inform any commercial dealing concerning your vessel.

Least privilege. Access is limited to the individuals who need it for the task in hand, and to the data needed for that task. Administrative and infrastructure access is held by a small number of named individuals and is reviewed when a person's role changes or their engagement ends.

Confidentiality. Every person we authorise to access Vessel Data is bound by a written confidentiality obligation, or is under an appropriate statutory obligation of confidentiality. That obligation survives the end of their engagement with us.

Recorded. Actions taken through the admin interface are recorded in your vessel's audit trail, which your vessel administrators can inspect. Direct administrative access to our servers and databases is restricted to authorised personnel and is recorded in our infrastructure access logs.

Notice. Where we access an identifiable individual's records in order to investigate a fault, we will normally tell your vessel administrator what we accessed and why. We may not be able to do so where telling you would prejudice an active security investigation, or where we are prohibited by law.

5. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to data subjects, we will implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk. Our current measures are described in Annex 2.

We may update those measures over time, provided that the level of protection is not reduced.

6. Sub-processors

You give us general written authorisation to engage Sub-processors. Our current Sub-processors are listed in Annex 3.

Before a new Sub-processor begins processing Vessel Data, we will:

• impose on it, by written contract, data protection obligations that are no less protective than those in this DPA; and
• give you at least 30 days' notice, by email to your account's billing or administrator address and by updating Annex 3.

You may object to a new Sub-processor on reasonable data protection grounds within that notice period. If you do, we will work with you in good faith to find a solution. If we cannot, you may terminate your subscription for the affected part of the Service, and we will refund any fees you have paid covering the period after termination.

We remain fully liable to you for the performance of each Sub-processor's obligations.

7. Data subject rights

The Service gives your vessel administrators the ability to access, correct, export and delete Vessel Data directly. In the first instance, you should use those tools to respond to a data subject request.

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as this is possible, to fulfil your obligation to respond to requests to exercise a data subject's rights.

If we receive a request directly from a data subject relating to Vessel Data, we will not respond to it substantively. We will tell the data subject to contact the vessel operator, and we will inform you of the request without undue delay.

8. Assistance

Taking into account the nature of processing and the information available to us, we will provide you with reasonable assistance in relation to:

• your obligation to keep personal data secure (Article 32 UK GDPR);
• notification of personal data breaches to a supervisory authority and to data subjects (Articles 33 and 34);
• data protection impact assessments (Article 35); and
• prior consultation with a supervisory authority (Article 36).

We may charge a reasonable fee for assistance that goes materially beyond what the Service provides as standard, and we will tell you before any charge is incurred.

9. Personal data breach

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Vessel Data.

Our notification will describe, so far as we know it at the time: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures we have taken or propose to take; and a point of contact for further information. Where we cannot provide all of that information at once, we will provide it in phases without further undue delay.

Notifying you of a breach is not an admission of fault or liability.

10. International transfers

Vessel Data is stored in the United Kingdom / European Economic Area, in the AWS eu-west-2 (London) region.

Where a transfer of Vessel Data outside the UK or EEA is necessary — including any transfer to a Sub-processor listed in Annex 3 — we will ensure that an appropriate transfer mechanism under Data Protection Laws is in place, such as an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, along with any supplementary measures required.

11. Deletion and return

You may export or delete Vessel Data at any time through the Service.

On termination or expiry of your subscription, we will, at your choice, delete or return Vessel Data to you. You may request an export within 30 days of termination. After that period we may delete Vessel Data.

We may retain Vessel Data to the extent required by law, and Vessel Data will persist in routine encrypted backups until those backups age out on the rolling retention cycle stated in Annex 2. Retained data remains subject to this DPA for as long as we hold it.

12. Audits and information

We will make available to you the information necessary to demonstrate compliance with Article 28 UK GDPR and with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In practice:

• We will respond to a reasonable written request for information — including a completed security questionnaire — within 30 days.
• You may request an audit no more than once in any 12-month period, unless required by a supervisory authority or following a personal data breach affecting your Vessel Data.
• You will give us at least 30 days' written notice, conduct the audit during normal business hours, and take reasonable steps to avoid disrupting the Service or other customers.
• Any auditor you mandate must not be a competitor of ours and must sign a confidentiality undertaking on reasonable terms.
• An audit must not require us to disclose another customer's data, or information that would compromise the security of the Service.
• You bear your own costs, and we may charge for our reasonable time where an audit goes beyond responding to a written request.

13. Aggregated and anonymised data

We may create and use aggregated and anonymised information derived from use of the Service, for the purposes of operating, securing, analysing and improving the Service, and for producing statistics about the Service as a whole.

Before such information is used for those purposes, it is aggregated across customers and stripped of anything that identifies a vessel, a person, or an individual record, so that it is no longer personal data and cannot reasonably be used to re-identify any individual or vessel.

We will not publish, disclose or otherwise use a named vessel's figures, or figures attributable to an identifiable vessel, without that vessel operator's prior written agreement. This clause survives termination.

14. General

• Term: This DPA takes effect when you accept the Terms of Service and continues for as long as we process Vessel Data on your behalf.
• Liability: Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.
• Precedence: In the event of a conflict, this DPA prevails over the Terms of Service and the Privacy Policy in respect of the processing of personal data.
• Changes: We may update this DPA where necessary to reflect a change in the Service, in our Sub-processors, or in Data Protection Laws. We will notify vessel operators of material changes by email or through the Service, and we will not make a change that materially reduces your protection under this DPA without your agreement.
• Governing law: This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, in each case as set out in the Terms of Service.
• Contact: Data protection queries — support@themusterapp.com.

---

Annex 1 — Details of the processing

Subject matter. Provision of The Muster App and Muster Mate — a maritime safety, visitor management and crew administration platform — to the vessel operator.

Duration. For the term of the subscription, plus the deletion and backup periods described in clause 11 and Annex 2.

Nature and purpose of the processing. Collection, recording, organisation, structuring, storage, retrieval, consultation, use, transmission, erasure and destruction of Vessel Data, for the purpose of: recording who is aboard a vessel; visitor check-in, check-out and badge generation; crew records and the crew board; muster and drill records; hours of rest records; safety documents, policies, checklists and forms; deliveries; notifications to crew devices; and support, fault diagnosis and security of the Service.

Types of personal data

Categories of data subjects. Visitors and contractors attending the vessel; crew members; guests where recorded; vessel administrators and other authorised users; recipients of deliveries.

Special category data. The Service is not designed for, and we do not ask you to enter, special category data as defined in Article 9 UK GDPR. Identity documents and photographs are processed for identification purposes only; we do not perform biometric facial recognition on them. If you choose to enter special category data in a free-text or document field, you are responsible for having a lawful basis and an Article 9 condition for doing so.

Frequency. Continuous, for the duration of the subscription.

---

Annex 2 — Technical and organisational measures

Our current measures include:

Infrastructure and encryption

• All data is hosted on Amazon Web Services infrastructure in the eu-west-2 (London) region.
• All data in transit is encrypted using HTTPS/TLS.
• Databases and file storage are encrypted at rest with server-side encryption.
• Files are served only through time-limited signed URLs; storage buckets are not publicly readable.
• The database is not reachable from the public internet; it accepts connections only from our application servers.
• Administrative access to servers is via AWS Systems Manager Session Manager. Inbound SSH is closed at the network level; the only ports open to the internet are those serving the web applications.
• File storage is private, with no public read access, and is served to authorised users through a content delivery network rather than directly from the storage bucket.

Access control and separation

• Every vessel's data is logically separated. Application queries are scoped to a single vessel, and each API request is resolved to the authorised device or administrator session that made it, and to the vessel that device or session belongs to.
• iPads must be authorised by a vessel administrator with a vessel-specific access code before they can access any vessel data. Authorisation can be revoked by the administrator at any time.
• Crew accounts in Muster Mate are linked to a vessel only by an access or invite code issued by that vessel.
• Administrator and crew passwords are stored hashed and salted. We never store or transmit passwords in plain text.
• Administrative roles restrict which parts of the admin interface a person can use.

Logging and monitoring

• Actions taken through the admin interface are written to an append-only audit trail that records the actor, the action, the target and the time, and that vessel administrators can inspect.
• Application and infrastructure logs are collected in AWS CloudWatch, with alarms on infrastructure health.
• Error conditions raise an alert to our team.

Operational

• Automated database backups are taken daily, encrypted at rest, and retained on a rolling 35-day basis.
• Changes are tested on a separate staging environment, which uses its own database and test data, before being released to production.
• Personnel access to production data is governed by clause 4 of this DPA.
• We maintain a documented process for handling a personal data breach, including notification under clause 9.

We may change these measures as the Service develops, provided the level of protection is not reduced.

---

Annex 3 — Approved Sub-processors

---

The Muster App Ltd
support@themusterapp.com