Data Processing Agreement

The parties and their roles

This agreement is between the customer named in the Order (you), as controller, and NBS Maritime OOD (we), as processor, for the personal data we process on your behalf when we provide SeaDirect Protect. It forms part of every Order that involves personal data, under the Terms of Service.

How it fits with the rest of the contract

On the protection of personal data, this agreement prevails over the Terms of Service and the Order. Where personal data is transferred under the European Commission's standard contractual clauses, those clauses prevail over this agreement. An Order may add protections but may not reduce the ones in this agreement.

When it applies

This agreement applies for as long as we process personal data for you, including after the contract ends until the data is returned and deleted as described under When processing ends.

Definitions

• GDPR: Regulation (EU) 2016/679. Controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings the GDPR gives them.
• Customer personal data: personal data we process on your behalf in providing the Services, as described in Annex A.
• Sub-processor: another processor we engage to carry out processing of customer personal data for you.
• Standard contractual clauses: the clauses adopted by Commission Implementing Decision (EU) 2021/914.
• Other capitalised words (Order, Services, Platform, Appliance, Agent, Site) have the meanings in the Terms of Service.

Subject matter, nature and purpose

We process customer personal data to provide the Services in your Order: protecting your networks, endpoints and people, detecting and responding to threats, managing vulnerabilities, updates, backups and remote access, keeping your compliance registers and evidence, training your staff and crew, and supporting you. Annex A sets out the categories of data subjects and personal data, and the processing operations.

Duration

Processing lasts for the term of the contract and the period after it described under When processing ends.

Your documented instructions

We process customer personal data only on your documented instructions. Those instructions are the Order, the Terms of Service, this agreement, and the settings you or your authorised users choose in the portal. Further instructions must be in writing and within the scope of the Services; instructions that change the scope may be charged as a change to the Order.

If an instruction is unlawful

We tell you at once if, in our opinion, an instruction infringes the GDPR or other data protection law, and we may suspend following it until you confirm or change it.

Processing required by law

If the law of the European Union or of a member state requires us to process customer personal data other than on your instructions, we tell you before we do so, unless that law forbids telling you.

Security findings and statistics

Where the processing produces technical findings about a threat (a hostile network address or domain, the fingerprint of a malicious file, a detection signature, an attack pattern), we may use those findings and anonymous statistics across our customers and in our threat intelligence, and share the findings with partners and third-party organisations for research and collective defence, as the Terms of Service describe. Before a finding leaves your environment we remove everything that identifies you or could be associated with you, even by inference, and we never share customer personal data, suspicious files themselves, or findings that point to you by their nature. Where a finding is itself personal data, such as an attacker's network address, we process it as a controller, on our legitimate interest in network and information security that Recital 49 of the GDPR recognises, and not on your behalf.

Lawful basis and transparency

You are responsible for having a lawful basis for the processing you instruct, for informing data subjects, for any data protection impact assessment and any consultation with employees or their representatives that your law requires, and for the accuracy of the personal data you provide. This includes the monitoring features listed in the Terms of Service.

Special categories

The Services are not designed to process special categories of personal data or data about criminal convictions, but network traffic, files, backups and register entries can contain them. Where this matters to you, use the exemptions and settings the portal offers, and do not enter such data into registers unless you need to.

Confidentiality

Everyone we authorise to process customer personal data has signed a confidentiality undertaking, or is bound by a statutory duty of confidentiality, that continues after their work for us ends.

Need to know

Access to customer personal data is limited to the people who need it to provide, secure and support the Services, is granted with the least privilege that does the job, uses personal accounts with multi-factor authentication, and is logged. Staff with access to customer environments are background-checked where the law allows, and trained in data protection and security when they join and every year after.

Our measures

We implement the technical and organisational measures described in Annex B, which take account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as Article 32 of the GDPR requires.

Keeping them current

We review the measures at least once a year and when the Services change. We may change them, provided the overall level of protection does not fall.

General authorisation

You give us a general written authorisation to engage sub-processors. The sub-processors we use when this agreement is signed are listed in Annex C.

Notice of changes

We tell you at least 30 days before we add or replace a sub-processor, by notice in the portal and by email to your account contact, naming the sub-processor, what it does and where.

Objecting

You may object within those 30 days on reasonable data protection grounds. We then discuss the objection with you in good faith. If we cannot address it, for example by not using that sub-processor for your data, you may end the affected product without penalty before the change takes effect, and we refund fees paid in advance for it.

The same duties, passed on

We engage each sub-processor under a written contract that imposes data protection duties at least as protective as this agreement. We remain responsible to you for the performance of each sub-processor's duties.

The rule

We store and process customer personal data in the European Union, in Germany, and do not transfer it outside the European Economic Area, except as described in the following clauses or with your prior written agreement.

AI-assisted drafting

When you or your users ask the Platform to prepare a draft with artificial intelligence, the text needed for that draft may be processed by the AI provider listed in Annex C outside the European Economic Area. That transfer is made under the standard contractual clauses (module three, processor to processor), together with the supplementary measures our transfer assessment identified. The provider works under zero data retention: it processes the text only to produce the draft, keeps no copy of the request or the result, and does not train models on it.

Notification emails

Emails the Platform sends to your users (notifications, alerts, invitations) are delivered through the email service listed in Annex C, which processes the recipient's name and address and the message in the United States, under the EU-US Data Privacy Framework and the standard contractual clauses.

Payments

Where you pay by card, the payment service listed in Annex C processes the billing contact and payment details of your organisation, and may transfer them to the United States under the EU-US Data Privacy Framework and the standard contractual clauses.

Copies on request

On request, we give you a copy of the transfer mechanism and a summary of our transfer assessment, with commercial terms removed.

Requests that reach us

If a data subject contacts us about customer personal data, we pass the request to you without undue delay and do not answer it ourselves unless you instruct us to.

Our assistance

Taking into account the nature of the processing, we help you answer requests to exercise rights under Chapter III of the GDPR, first through the export, correction and deletion tools in the portal, and otherwise on request. Assistance that takes more than reasonable effort may be charged at our standard rates, after we have told you.

Notice to you

We notify you of a personal data breach affecting customer personal data without undue delay, and no later than 24 hours after we become aware of it.

What the notice contains

As far as we know it at the time, and in further notices as we learn more:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• the name and contact details of the person you can talk to;
• the likely consequences of the breach;
• the measures we have taken or propose to take, including to reduce its possible adverse effects.

Who notifies the authority

You decide whether to notify the supervisory authority and the data subjects. We do not notify them on your behalf unless you instruct us to or the law requires us to. A notice from us is not an admission of fault or liability.

Assistance

We provide the information you reasonably need to carry out a data protection impact assessment about the Services and, where needed, to consult the supervisory authority beforehand, as Articles 35 and 36 of the GDPR require. The Platform's own records of what each feature collects are the starting point.

Information

We make available the information you need to show that the duties in Article 28 of the GDPR are met. We answer one reasonable security or data protection questionnaire a year at no charge.

Audits

Where that information is not enough, you or an independent auditor you appoint may audit our compliance with this agreement once a year, on 30 days' written notice, during business hours, at your cost, under a confidentiality undertaking, and without access to other customers' data or to information whose disclosure would weaken the security of the Services. An audit required by a supervisory authority, or following a personal data breach affecting you, does not count towards the once a year.

Retention periods

Customer personal data is kept for the periods in Annex D, and the Platform deletes it automatically when its period ends. Where the law sets a minimum period, we never delete sooner. You may ask for a longer period for your data, within what the GDPR's storage limitation allows.

Legal holds

If you need records preserved, for example for an investigation or a dispute, we place a legal hold on your data at your request, and automatic deletion stops for it until you release the hold.

Return

When the contract ends, you have 30 days to export customer personal data from the portal, and on request we export it for you in structured, commonly used, machine-readable formats.

Deletion

After that, we delete customer personal data from the Platform within 30 days and from backups as they cycle out within a further 90 days, unless the law of the European Union or a member state requires us to keep it, in which case we keep only what is required, only for that purpose, and protected as this agreement requires. We confirm deletion in writing on request.

Data on your premises

Data held on Appliances, Agents and backup media at your Sites is wiped when an Appliance is returned to us. Data on your own machines and media remains under your control.

Liability

Each party's liability under this agreement is governed by the Liability section of the Terms of Service, including the cap of twice the ordinary amount for breaches of this agreement. Nothing in this agreement limits either party's liability to data subjects under Article 82 of the GDPR.

Changes

We may change this agreement where a change in law, a decision of a supervisory authority or a change in the Services requires it, giving you 30 days' notice. Other changes follow the Changes to these terms section of the Terms of Service.

Governing law

This agreement is governed by the law, and disputes about it are decided in the forum, that the Terms of Service set for your Order.

Contacts

Our data protection officer is the contact for everything in this agreement, at the address published in the privacy notice. You name your own contact for data protection matters in the Order or in the portal.

Categories of data subjects

• your employees, crew and contractors who use the networks, machines and accounts in scope;
• guests and visitors who use networks you provide through the Platform;
• the users of your client portal accounts;
• people named in your registers and records, such as supplier contacts, incident reporters, asset owners and those responsible for controls;
• people who take part in training, skills evaluations and phishing simulations;
• people who appear in content the Services process for security, such as files flagged as suspicious, remote session recordings and backups.

Categories of personal data

• identity and contact details of portal users and named contacts: names, work email addresses, phone numbers, roles;
• account and access data: logins, multi-factor authentication records, permissions, and activity logs in the portal;
• device and network identifiers: hostnames, user names on machines, IP and MAC addresses;
• network metadata: connection records, domain names, traffic volumes and flow summaries;
• security events: alerts, detections, response actions and the evidence attached to them;
• where inspection of encrypted web traffic is switched on: the security-relevant parts of that traffic, inspected on the Appliance;
• software and hardware inventory of the machines in scope;
• remote access records and session recordings;
• removable media, driver and application control logs;
• guest and crew voucher use;
• vessel position data;
• training, quiz, questionnaire and simulation results;
• the contents of registers, documents and evidence you enter or upload;
• files flagged as suspicious, and the contents of endpoint backups.

Processing operations

Collection from Appliances and Agents, storage, analysis and correlation, detection and automated response, display in the portal, reporting and export, backup and restore, remote access, AI-assisted drafting on request, transmission of notifications by email, and deletion.

Frequency and duration

Continuous, for the term of the contract and the period described under When processing ends.

Confidentiality and access

• separation of each customer's data in the Platform;
• role-based access for our staff, least privilege, personal accounts, multi-factor authentication, and logging of every access to customer environments;
• remote sessions to customer machines only within the approval rules the customer sets, each one logged;
• secrets and signing keys held apart from the systems that use them.

Integrity

• encryption in transit between every component, and between the Platform and Appliances and Agents, with each device authenticated by its own credentials;
• software updates and configuration pushed to devices signed and verified before they are applied;
• configuration changes validated before they reach a device, and reverted automatically if they would cut a site off;
• records of security-rule and configuration changes kept for at least 12 months.

Availability and resilience

• hosting in professional data centres in Germany with physical access control;
• regular backups of the Platform's data;
• protection on Appliances and Agents that continues when the link to the cloud is down;
• monitoring of our own infrastructure by the same platform we provide to customers.

Testing and improvement

• vulnerability management and patching of our own systems;
• automated tests before release, and staged roll-out of updates so a fault is caught early;
• a documented process for handling incidents and vulnerabilities, including the reporting duties of the EU Cyber Resilience Act;
• yearly review of these measures.

Data minimisation

• automatic deletion when each retention period in Annex D ends;
• only technical findings about threats leave a customer's environment, stripped of anything that could be associated with that customer;
• only the text needed for a draft is sent to an AI provider.

Hosting

• OVHcloud (OVH SAS and its affiliates): hosting of the Platform, its databases, file storage and backups, in data centres in Germany.

Email delivery

• Microsoft Ireland Operations Limited, with processing by Microsoft Corporation in the United States (Azure Communication Services): delivery of notification emails to your users, under the EU-US Data Privacy Framework and the standard contractual clauses.

AI-assisted drafting

• Denev Operations EOOD (UIC 207759183), Shumen, Bulgaria, through its vynflow.cloud service hosted in the European Union: routes drafting requests to the provider below and keeps no copy of the text;
• Fireworks AI, Inc. (United States): generation of drafts under zero data retention, under the standard contractual clauses.

Payments

• Stripe Payments Europe, Limited (Ireland), with transfers to Stripe, Inc. in the United States: card payments and billing for your subscription, under the EU-US Data Privacy Framework and the standard contractual clauses.

Development and support

• Denev Operations EOOD (UIC 207759183), Shumen, Bulgaria, our technology partner: development, maintenance and third-line technical support of the Platform, with access to customer environments only when a support case needs it.

Security and operational records

• security artifacts and detections: 12 months (legal minimum);
• endpoint protection events: 12 months (legal minimum);
• application logs: 12 months (legal minimum);
• device signal events: 12 months (legal minimum);
• commands sent to Appliances and Agents: 12 months (legal minimum);
• remote access connection records: 12 months (legal minimum);
• remote session recordings: the period you set in the portal, from 7 days to 12 months, 90 days unless you choose otherwise; the oldest recordings may be deleted sooner only if the recording store reaches its capacity;
• flow summaries: 12 months;
• bandwidth samples and their roll-ups: 12 months;
• device telemetry samples: 90 days;
• DNS lookup history: 90 days;
• installer requests: 90 days.

Accounts

• portal activity log: 3 years;
• access reviews and invitations: 3 years;
• sign-in tokens: 30 days.

Registers, evidence and documents

Kept for the contract, and removed a defined period after each record is closed, under the record retention schedule shown in the portal, unless a legal hold applies.

On Appliances and Agents

• quarantined files: up to 90 days;
• local system logs: 90 days.

The legal minimums

Security logs and records of configuration changes and access to information systems are kept for at least 12 months under Article 29 of the Bulgarian Ordinance on the Minimum Requirements for Network and Information Security. Accounting records are kept for 10 years under the Bulgarian Accountancy Act.