Data Processing Addendum

1.1 For personal data that you or your users enter into Scuba Manager about your clients, divers, staff and instructors ("Customer Personal Data"), you are the controller and we are your processor.

1.2 For data about account holders, billing contacts and website visitors, we are the controller, as described in our Privacy Policy (scuba-manager.com/privacy). This Addendum does not cover that data.

1.3 If this Addendum and the Terms conflict on the protection of personal data, this Addendum wins.

2.1 Subject matter and purpose: providing Scuba Manager to you: bookings, client records, team and instructor management, assets, dive sites, emails and support.

2.2 Duration: for as long as you use the Service, plus the deletion period in section 9.

2.3 Nature: storing, organising, displaying, sending, backing up when available, and deleting data through the Service, and viewing it when we provide support or maintenance.

2.4 Data subjects: your clients and divers, your staff and instructors, and any other people whose details you enter.

2.5 Categories of data: names, contact details, dates of birth, nationality, certification levels and numbers, equipment sizes, bookings and payments recorded in the Service, notes, files you upload, and medical or waiver flags if you choose to record them.

2.6 Special categories: health information is sensitive data. You decide whether to record it, and you are responsible for having a lawful basis, usually the person's explicit consent. We recommend recording only a simple flag (for example "medical form received, cleared") and not medical details.

3.1 We process Customer Personal Data only on your documented instructions. Your instructions are these Terms, this Addendum, and the way you use and configure the Service. Any further instruction must be in writing (email is enough) and must be something the Service can reasonably do.

3.2 We tell you if we believe an instruction breaks data protection law.

3.3 We may process Customer Personal Data otherwise only where EU or Greek law requires it. In that case we tell you first, unless the law forbids it.

3.4 You are responsible for the lawfulness of the data you enter and of your instructions, including the notices you give and the consents you collect from your clients.

Everyone who can access Customer Personal Data on our side is bound by confidentiality and accesses it, including through AI tools under our control, only for support and maintenance of the Service.

5.1 We maintain the technical and organisational measures in Annex 2, taking into account the state of the art, cost, and the risks to the people concerned.

5.2 We may improve these measures over time, but we will not reduce the overall level of protection.

6.1 You give us general authorisation to use sub-processors. The current list, with what each does, where it processes data and the transfer safeguard, is in section 7 of our Privacy Policy (scuba-manager.com/privacy). At the date above it is: Supabase (database, sign-in, file storage; EU, Frankfurt), Lovable with Cloudflare (hosting and delivery of the web app), Stripe (billing), Resend (email delivery), Google (website analytics, only with the visitor's consent) and Anthropic (AI assistance used by our team for support and maintenance).

6.2 We give each sub-processor data protection obligations that are at least as protective as this Addendum, and we remain responsible to you for their work.

6.3 We will email the account owner at least 30 days before adding or replacing a sub-processor. You may object in writing within that period on reasonable data protection grounds. We will then discuss it with you in good faith. If we cannot resolve the objection, you may cancel your subscription before the change takes effect, and we will refund any amount you have paid for the period after cancellation.

6.4 Booking engines or other services that you choose to connect (for example FareHarbor) act for you under their own terms. They are not our sub-processors, and data you send to them or receive from them is your responsibility.

7.1 We store Customer Personal Data in the EU.

7.2 Some sub-processors are based in, or may access data from, the United States. For those we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Decision 2021/914). You authorise these transfers.

8.1 Requests from people. If one of your clients or staff contacts us to exercise a data protection right, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to. The Service lets you view, correct, export and delete records; where you cannot do something yourself, we will help on reasonable request.

8.2 Assessments and authorities. We will give you reasonable information to help with a data protection impact assessment or a consultation with a supervisory authority, as far as it concerns the Service.

8.3 Breaches. If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and we aim to do so within 48 hours. We will tell you what we know: what happened, the categories and approximate number of people and records concerned, the likely consequences, and what we have done or propose to do. If we do not have all of this at once, we will send it as we learn it. We will not notify authorities or your clients on your behalf unless you ask us to in writing. Telling you about a breach is not an admission of fault.

9.1 After your subscription ends, you have 30 days to export your data from the Service.

9.2 After those 30 days, we delete Customer Personal Data within a further 30 days, unless EU or Greek law requires us to keep part of it. On request, we confirm deletion in writing.

9.3 If backups exist, deleted data disappears from them when they are overwritten in the normal cycle described in Annex 2. Audit records of deleted items, which may include a copy of the deleted record, are kept for security and dispute purposes.

10.1 We will make available the information reasonably needed to show that we meet this Addendum, and answer your reasonable written questions about it, normally within 30 days.

10.2 If that information is not enough, or a supervisory authority requires it, you may audit our compliance with this Addendum once a year, with at least 30 days' written notice, during business hours, through an auditor bound by confidentiality, and at your own cost. The audit covers our own processes; our sub-processors are audited through the reports and certifications they publish.

11.1 Each party's liability under this Addendum is subject to the limitation of liability in the Terms. This does not limit any rights that data subjects have directly under the GDPR.

11.2 This Addendum is governed by Greek law, and the courts of Athens have exclusive jurisdiction, as set out in the Terms.

11.3 We may update this Addendum to reflect changes in law, in the Service or in our sub-processors. We will tell account owners of material changes by email at least 30 days in advance. Changes required by law may apply sooner.