Data Processing Agreement

Agreement on Data Processing in accordance with Article 28 General Data Protection Regulation.

Table of contents

1. Subject Matter of Agreement
2. Technical and Organizational Measures
3. Rectification, Restriction and Erasure of Data
4. Quality Assurance and Other Duties of the Processor
5. Subcontracting
6. Supervisory Rights of the Controller
7. Authority of the Controller to Issue Instructions
8. Deletion and Return of Personal Data
9. Term of Processing; Termination
10. General Provisions

Annex 1: Nature and Purpose of Processing, Subject Matter of Processing, Type of Data, Categories of Data Subjects
Annex 2: Technical and Organizational Measures

1.Subject matter of agreement

1.1.

According to the General Terms and Conditions of Greenships OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 5, 10117, Estonia (hereinafter “Processor”) for “Software as a Service” as well as the quote of the Processor (hereinafter collectively “Main Agreement”) the Processor makes available software products (hereinafter “Software”) for use via internet to the customer designated in the Main Agreement (hereinafter “Controller”). The Processor and the Controller are hereinafter individually or, as applicable, collectively also referred to as “Party” or “Parties”. The Processor operates the Software through a data processing service provider (also known as “Software as a Service” model). This Agreement on Data Processing (hereinafter “Agreement”) specifies the Parties’ duties regarding data protection laws. The Agreement applies to all services which relate to the commissioned data processing where the Processor or its personnel may get in contact with personal data, which are provided to the Processor by the Controller.

1.2.

The type of processed data and categories of data subjects, and the nature, purpose and subject matter of processing of personal data by the Processor on behalf of the Controller and the categories of data subjects are defined in Annex 1.

1.3.

This Agreement does not apply to personal data for which the Processor determines the purposes and means of processing in its own right — in particular account and login data of the individuals to whom access is granted, support correspondence, and invoicing and payment records. For those data the Processor acts as a controller, and its Privacy Policy applies.

2.Technical and organizational measures

2.1.

The Processor shall establish measures in accordance with Art. 28 Para. 3 Point c, and Art. 32 GDPR in particular in conjunction with Art. 5 GDPR. The measures to be taken are measures of data security and measures that guarantee an appropriate data protection level taking account of risks for confidentiality, integrity, availability and resilience of systems. The state of the art, implementation costs, the nature, scope and purposes of processing as well as the probability of occurrence and the severity of the risk for the rights and freedoms of natural persons within the meaning of Art. 32 Para. 1 GDPR must be taken into account. The measures taken by Processor are specified in Annex 2.

2.2.

The technical and organizational measures are subject to technical progress and further development. In this respect, the Processor may implement alternative adequate measures. However, the security level of the defined measures shall not be reduced. Substantial changes must be documented.

2.3.

The Processor regularly controls the internal processes as well as the technical and organizational measures in order to ensure that the data processing which lies within this responsibility is carried out in accordance with the applicable data protection laws and to ensure the protection of the rights of the data subjects.

3.Rectification, restriction and erasure of data

3.1.

The Processor may not on its own authority modify or delete the data that is being processed on behalf of the Controller, or restrict the processing such data, but only on documented instructions from the Controller. In the event that a data subject contacts the Processor directly concerning a modification or deletion of data, or restriction of processing, the Processor shall immediately forward the data subject’s request to the Controller.

3.2.

The Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the data subject’s ‘right to be forgotten’, and rights to rectification, data portability and access. The Processor may request payment of fees for assistance which is not owed under the Main Agreement.

4.Quality assurance and other duties of the Processor

4.1.

The Processor entrusts only such employees with the data processing outlined in this Agreement who have been bound to confidentiality. Unless required by law to process the data, the Processor shall not process the data except as on instructions from the Controller, which includes the processing allowed under this Agreement and the Main Agreement.

4.2.

The Processor shall assist the Controller in complying with the obligations concerning the security of personal data, reporting of data breaches, data protection impact assessments and prior consultations, as stipulated in Articles 32 through 36 of the GDPR.

These include:

4.2.1.

The obligation to report a personal data breach to the Controller without undue delay and in any event within 48 hours of the Processor becoming aware of it, with the information available at that time and with further information as it becomes available.

4.2.2.

The duty to assist the Controller with regard to the Controller’s obligation to provide information to the data subject and to immediately provide the Controller with all relevant information in this regard.

4.2.3.

Supporting the Controller with its data protection impact assessment.

4.2.4.

Supporting the Controller regarding prior consultation with the supervisory authority.

4.3.

Processor may charge a fee for support which is not included in the description of services in the Main Agreement or which is caused by a misconduct of the Controller.

5.Subcontracting

5.1.

Subcontracting for the purpose of this Agreement is to be understood as services which relate directly to the provision of the principal service. This does not include ancillary services, such as telecommunication services, postal / transport services, maintenance and user support services or the disposal of data carriers, as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing equipment. The Processor shall, however, be obliged to make appropriate and legally binding contractual arrangements and take appropriate inspection measures to ensure the data protection and the data security of the Controller’s data, even in the case of outsourced ancillary services.

5.2.

The Controller herewith agrees that the Processor engages the following sub-processors for the provision of its Service:

The Processor uses each provider’s services in accordance with that provider’s then-current general terms of use and security measures, as published by the provider, and has concluded a data processing agreement with each.

5.3.

The Processor notifies the Controller of any intended change with respect to the addition of, or replacement by, any other processors. The Controller may object to such change by giving notice within 14 days as of receipt of the notification of change. If the Controller does not oppose within such term, the change shall be deemed approved. The Controller may not oppose without having an own legitimate interest which overrides the interests of the Processor.

5.4.

If a sub-processor provides processing outside of the EU or the EEA, the Processor shall ensure compliance with data protection laws by taking appropriate measures, shall put in place a transfer mechanism permitted by Chapter V GDPR, and shall inform the Controller on request which mechanism is used.

6.Supervisory rights of the Controller

6.1.

The Controller has the right, after consultation with the Processor, to carry out inspections or to have them carried out by an auditor to be designated in each individual case. The Controller has the right to convince itself in the Processor’s business premises of the Processor’s compliance with this Agreement by means of random checks, which are, as a rule, to be announced in good time.

6.2.

The Processor shall ensure that the Controller is able to verify compliance with the obligations of the Processor in accordance with Art. 28 GDPR. The Processor undertakes to give the Controller the necessary information on request and, in particular, to demonstrate the execution of the technical and organizational measures.

6.3.

Evidence of such measures may be provided by

6.3.1.

Compliance with approved codes of conduct pursuant to Art. 40 GDPR;

6.3.2.

Certification according to an approved certification procedure in accordance with Art. 42 GDPR;

6.3.3.

Current auditor’s certificates, reports or excerpts from reports provided by independent bodies (e.g. auditor, data protection officer, IT security department, data privacy auditor, quality auditor);

6.3.4.

A suitable certification by IT security or data protection auditing (e.g., according to ISO/IEC 27001, in accordance with EU General Data Protection Regulation (GDPR) standards).

6.4.

The Processor may claim remuneration for enabling Controller inspections.

7.Authority of the Controller to issue instructions

7.1.

The Controller shall immediately confirm oral instructions (at the minimum in text form).

7.2.

The Processor shall inform the Controller immediately if he considers that an instruction violates data protection laws. The Processor shall then be entitled to suspend the execution of the relevant instructions until the Controller confirms or changes them.

8.Deletion and return of personal data

8.1.

Copies or duplicates of the data shall not be created without the knowledge of the Controller, with the exception of (i) backup copies as far as they are necessary to ensure appropriate data processing, and (ii) retention of data required to meet statutory data retention laws.

8.2.

After conclusion of the contracted work, or earlier upon request by the Controller, at the latest upon termination of the rendering of IT-services, the Processor shall hand over to the Controller or – subject to prior consent – destroy all documents, processing and utilization results, and data sets related to the contract that have come into its possession, in a data-protection compliant manner. The same applies to any and all connected test, waste, redundant and discarded material. The log of the destruction or deletion shall be provided on request. The Processor’s obligations under this Section 8.2 do not apply to the extent that Union or EU Member State law requires storage of the personal data.

8.3.

Documentation which is used to demonstrate data processing in accordance with the Agreement shall be stored beyond the contract duration by the Processor in accordance with the respective retention periods. The Processor may hand such documentation over to the Controller at the end of the contract duration to relieve the Processor of this contractual obligation.

9.Term of processing; termination

9.1.

The duration of this Agreement corresponds to the term of the Main Agreement and includes the term after termination of the Main Agreement until full return or deletion of the personal data which have been provided by the Controller to the Processor in connection with the performance of the Main Agreement. This does not affect the right to terminate the Agreement with good cause.

10.General provisions

10.1.

This Agreement shall be governed by and construed in accordance with Estonian law. Place of performance and jurisdiction is Tallinn, Estonia.

10.2.

Any amendments or additions to this Agreement, including this Section 10.2, require written form.

10.3.

Should individual provisions of this Agreement be invalid or unenforceable for actual or legal reasons, without rendering the continuity of the remaining provisions unreasonable as a whole for a Party, this shall not affect the validity of the remaining provisions. The same shall apply in the event of a contractual gap. In lieu of the invalid or unenforceable provisions or to close any contractual gap, the Parties shall agree to a provision that comes closest to fulfilling the economic purpose intended by the Parties.

Annex 1

Nature and Purpose of Processing, Subject Matter of Processing, Type of Data, Categories of Data Subjects

Categories of data subjects. In particular:

• Users of the Software — the personnel of the Controller and any third parties to whom the Controller grants access.
• Business contacts whose details the Controller enters into the Software, for example contacts at suppliers, yards, agents and counterparties.

Type of data. Depending on the modules licensed, the following categories of personal data may be collected, processed and used:

• Contact and account data of users of the Software: name, work e-mail address, telephone number, employer, role, access rights and authentication data.
• Contact data of business contacts entered by the Controller: name, work e-mail address, telephone number, employer, role.
• Data on the use of the Software (protocol data): sign-in records, and actions taken in the system together with the time and the acting user. Where the Software records an electronic acknowledgement or signature, this includes the identity of the person acting, the time, and the originating IP address.
• Any personal data the Controller chooses to include in documents it uploads to the Software, over the selection of which the Processor exercises no influence.

Categories not processed. The Software does not collect or hold crew records, employment, remuneration or performance records, travel documents, health, fitness or medical information, biometric data, or any other special category of personal data within the meaning of Art. 9 GDPR. Should the Controller license a future module for which such data is necessary, this Annex must be amended in writing before that module is made available, and the Parties shall agree the additional safeguards that apply.

Recipients. The Processor and the sub-processors named in Section 5.2.

Nature and purpose of processing. Making available of the Software together with storage via the internet; rendering of IT services, in particular support services.

Annex 2

Technical and Organizational Measures

Preliminary remark. Within the scope of this Agreement, Greenships OÜ (hereinafter “Greenships”) solely processes personal data for the purpose of meeting its service and support obligations under the Main Agreement. All data are processed on the platforms named in Section 5.2 of the Agreement. Greenships accesses the data through its personnel who are entrusted with the provision of the services (hereinafter “Support Personnel”), using devices provided or designated for that purpose (hereinafter “Support Computers”). Greenships has entered into agreements with each of the providers named in Section 5.2 for the use of their services. The technical and organizational measures undertaken by those providers are specified in their respective online service terms.

The following describes the technical and organizational measures undertaken by Greenships.

1.Confidentiality (Art. 32 Paragraph 1 Point b GDPR)

1.1 Physical Access Control. Support Computers are used from premises under the control of the Support Personnel using them. Where Greenships operates business premises, access to those premises is controlled through appropriate security measures, including locks and access authorization procedures, and access is granted only after verifying the authorization of the individual requesting entry. Greenships is committed to implementing and maintaining appropriate physical security measures to protect personal data in accordance with relevant data protection regulations.

1.2 Data Carrier Control. No unauthorized reading, copying, modification or deletion of data carriers: Greenships does not use removable data carriers to store data of the Controller. Where data is held locally on a Support Computer for the purpose of resolving a support incident, the device is encrypted at rest and the local copy is removed once the incident is resolved.

1.3 Access, Process and User Control. Access to Support Computers, to the platforms named in Section 5.2 and to any data processed on them is restricted to authorized Support Personnel. In particular:

• Support Computers are used for meeting Greenships’s service and support obligations.
• Access to Support Computers is protected by a password or biometric lock, and the screen lock activates automatically after a period of inactivity.
• Access to production systems and to the platform consoles of the sub-processors is personal and is not shared. Credentials are held in a managed secret store rather than in configuration files or documents.
• Access rights are reviewed when a person’s role changes and withdrawn when it ends.

Greenships is committed to implementing and maintaining appropriate access control measures to protect personal data in accordance with relevant data protection regulations.

1.4 Separation. Data collected for different purposes is processed separately to ensure data security and privacy:

• Access to data is strictly controlled to ensure that each user can only access the data of the organisation to which they belong. Measures are in place to prevent unauthorized access to data of other Controllers.
• Data separation is maintained through access control mechanisms, ensuring that users and Support Personnel only interact with the data relevant to them.
• In case of a support incident, Support Personnel have access only to the data necessary for resolving the specific issue, so that the confidentiality and separation of customer information are preserved.

1.5 Pseudonymisation (Art. 32 Para. 1 Point a GDPR; Art. 25 Para. 1 GDPR). The processing of personal data in such a manner that the data cannot be associated with a specific data subject without the assistance of additional information, provided that this additional information is stored separately and is subject to appropriate technical and organizational measures:

Greenships does not build profiles of individuals from the Controller’s data and does not use the Controller’s data for its own purposes, including for training or improving statistical or machine-learning models. Where the Software offers a feature that transmits content to an external service in order to produce a result for the Controller, that service is named in Section 5.2 and the feature operates only where the Controller has enabled it.

2.Integrity (Art. 32 Para. 1 Point b GDPR)

2.1 Data Transport Control. No unauthorized reading, copying, modification or deletion in case of electronic transmission or transport:

• Any transmission or transport of data is encrypted in transit.
• Any transmission or transport of data is logged.
• Any transmission or transport of data is only done for the purpose of backups or data processing in accordance with this Agreement and the Main Agreement.

2.2 Data Entry Control. Verification of whether and by whom personal data is entered into a data processing system, is modified or deleted:

Only Support Personnel are entrusted with the processing of personal data within the scope of the commissioned data processing. Log data are generated for each data entry, modification or deletion; such log data include information on the author of the processing. Each support incident is logged. Edited protocols are made available to the Controller upon the Controller’s request.

2.3 Data Integrity. No damage to data due to system failures:

Support Computers are maintained so that there is no damage or loss of data. In addition, all data processed on the platforms named in Section 5.2 are backed up on those platforms’ standard schedule to ensure data integrity and minimize any risk of data loss due to system failures or other incidents.

3.Availability and Resilience (Art. 32 Para. 1 Point b GDPR)

3.1 Availability Control. Protection against accidental or wilful destruction or loss:

• Data protection measures. Greenships ensures that data protection measures are in place for the hosted data, including the protections offered by the platform providers for the server environment where data is stored.
• Data backups. Regular data backups are conducted as detailed in Section 2.3 to protect against data loss.
• Infrastructure. The server infrastructure which hosts the data is managed platform infrastructure, maintained by the providers named in Section 5.2 to ensure reliable operation and data availability.

3.2 Rapid Recovery (Art. 32 Para. 1 Point c GDPR). In the event of a system malfunction or data issue:

• System examination. Issues with the server environment or data handling are promptly examined for potential errors to assess whether any data has been affected.
• Data restoration. In the event of data damage or loss, the affected data will be restored from the available backups as described in Section 2.3.
• Incident reporting. A report detailing the scope and resolution of the incident will be maintained for future reference to ensure continuous improvement in the data recovery processes.

3.3 Reliability. Availability of all functions of the system and error reports:

• System maintenance. The server environment, the Support Computers and the data handling systems are updated, checked for errors, and maintained regularly to ensure system reliability.
• Compliance with technical standards. The systems used for data hosting and management are regularly reviewed to ensure compliance with current technical standards and best practices.

4.Procedures for regular testing, assessment and evaluation (Art. 32 Para. 1 Point d GDPR; Art. 25 Para. 1 GDPR)

4.1 Data Protection Management. At Greenships, the following responsibilities related to data protection are managed directly by the company:

• Training and consulting. The company provides training and consulting to its personnel regarding obligations and requirements under data protection laws.
• Compliance control. Data protection compliance is overseen through the implementation of strategies for the protection of personal data, raising awareness, and conducting training. This also includes regular reviews and controls related to data protection.
• Data protection impact assessment. Consultation on data protection impact assessments is provided as needed.
• Supervisory authority liaison. The company maintains contact with and cooperates with the relevant supervisory authority regarding data protection matters.

All personnel are advised on data protection issues and are required to comply with data protection laws. The company regularly reviews, either internally or through qualified personnel, whether internal procedures meet data protection law requirements and takes appropriate measures to ensure compliance. Legal advice on data protection law issues is sought as needed.

4.2 Incident Response Management. In the event of a security incident that could impact the data processing systems or the data of Greenships, the following procedures are followed:

• Incident reporting. Any security incident affecting the data processing systems is reported to the management immediately.
• Notification to Controller. If the security incident potentially impacts the data of the Controller, Greenships will notify the Controller in accordance with Section 4.2.1 of this Agreement.

4.3 Data Protection by Design and Default (Art. 25 Para. 2 GDPR). When choosing the hardware and software used for the performance of services under the Main Agreement, Greenships takes account of such hardware’s and software’s compliance with the principle of data minimisation. When processing the data Greenships refrains from using components which are not required for the processing of the data and which may impair the data of the Controller.

4.4 Order Control. Greenships is under the contractual obligation to process the Controller’s data in accordance with the Controller’s instructions. The rights of Greenships are clearly and comprehensively set forth in a contract. Orders and support requests are documented in text form in order to document such orders and support requests for future reference.

Version 2 · 3 September 2026