Data Processing Addendum

Version 1.0 · September 5, 2026

This Addendum forms part of the Terms of Service between ArcNautical (the Processor) and the customer entity accepting those Terms (the Controller). It applies whenever ArcNautical processes personal data on the Controller's behalf and to which the GDPR, the UK GDPR, or the Swiss FADP applies.

1. Definitions and roles

Controller, Processor, Personal Data, Processing, Data Subject, Sub-processor and Personal Data Breach have the meanings given in the GDPR. Applicable Data Protection Law means Regulation (EU) 2016/679, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and India's Digital Personal Data Protection Act 2023, each as applicable.

1.1 Two distinct roles, stated plainly

ArcNautical acts in two different capacities, and conflating them would misdescribe what actually happens. A data protection officer reviewing this will ask, so it is set out up front:

1. As Processor — for everything the Controller gives us or generates in the platform: account and user records, the vessel and fleet lists the Controller submits, cargo and voyage details, customer references, API usage and audit logs. We process these only on the Controller's instructions. This is the subject of this Addendum.
2. As independent Controller — for the reference corpus we compile from public and official sources in order to operate the screening engine: sanctions designations, corporate registry and beneficial-ownership records, port state control inspection results, and casualty and detention data. Some of those records name individuals, so they are personal data. We determine the sources, the methodology and the retention for that corpus; the Controller does not instruct us on it, and we could not accept an instruction to alter a sanctions record. Our lawful basis is legitimate interests under Article 6(1)(f) — the prevention of sanctions evasion and financial crime — and, where relevant, the substantial public interest basis in Article 9(2)(g) read with the Member State law implementing restrictive measures.

The Controller is not responsible for our processing under role 2, and we are not the Controller of anything under role 1.

2. Scope and instructions

ArcNautical processes Personal Data only on the Controller's documented instructions, including as to international transfers, unless required otherwise by Union or Member State law — in which case we inform the Controller before processing, unless that law forbids it on important grounds of public interest.

The Terms of Service, this Addendum, and the Controller's use of the platform and API constitute the Controller's complete documented instructions. We will tell the Controller if, in our opinion, an instruction infringes Applicable Data Protection Law.

We do not sell Personal Data, do not use it for advertising, do not disclose it for any purpose other than performing the service, and do not use it to train machine learning models. No customer Personal Data is transmitted to any third-party artificial intelligence or large language model service; the screening and scoring engines are deterministic.

3. Confidentiality

Every person authorised to process Personal Data is bound by an obligation of confidentiality that survives termination of their engagement, and has access only to the data their role requires. Production database and host access is limited to the founder.

4. Security

We implement and maintain the technical and organisational measures set out in Annex II, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by Article 32. We may update those measures provided the level of protection is not reduced.

5. Sub-processors

The Controller gives general written authorisation for ArcNautical to engage the Sub-processors listed in Annex III, and to appoint others on the terms below.

• We give the Controller at least 30 days notice before a new Sub-processor begins processing, by email to the Controller's notified contact and by updating the Trust & Security page.
• The Controller may object on reasonable data protection grounds within that period. If we cannot offer a change that resolves the objection, the Controller may terminate the affected service on written notice, with a pro rata refund of prepaid fees for the unused term.
• Each Sub-processor is engaged under a written contract imposing data protection obligations no less protective than this Addendum. ArcNautical remains fully liable to the Controller for each Sub-processor's performance.

6. International transfers

ArcNautical processes Personal Data in India, which is not the subject of an adequacy decision. Where the Controller is established in the EEA, the UK or Switzerland, the transfer is made under:

• The Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this Addendum by reference and completed as set out in clause 6.1;
• For UK transfers, the International Data Transfer Addendum (version B1.0) to those Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018;
• For Swiss transfers, the Clauses as amended by the Federal Data Protection and Information Commissioner, reading references to the GDPR as references to the FADP and including Swiss residents in the definition of data subject.

6.1 How the Clauses are completed

Where this Addendum and the Clauses conflict, the Clauses prevail.

6.2 Transfer impact assessment, in summary

We have assessed the legal environment of the destination country as required by Clause 14. In summary:

• Indian law contains government access powers, principally under section 69 of the Information Technology Act 2000 and rules made under it, and section 92 of the Code of Criminal Procedure. Access is directed at defined categories of investigation rather than bulk collection of foreign business data.
• ArcNautical is a small software provider with no telecommunications licence and no obligation to maintain interception capability. We have never received a government request for customer data of any kind. Were we to receive one, section 7 below applies.
• The Personal Data at issue is B2B contact and usage data belonging to shipping and compliance professionals, and vessel and cargo information. It is not special category data and is of no plausible intelligence interest.
• Supplementary measures in place: encryption in transit; off-site backups encrypted under keys we hold rather than the storage provider's; strict data minimisation at collection; and the retention limits in Annex I.

The full assessment is available on request.

7. Government and law enforcement requests

If we receive a legally binding request from a public authority for Personal Data we process for the Controller, we will:

• notify the Controller before disclosing, unless legally prohibited, and if prohibited, use reasonable efforts to obtain a waiver and to notify as soon as permitted;
• challenge the request where we have reasonable grounds to consider it unlawful under Applicable Data Protection Law, including seeking interim measures where available;
• disclose only the minimum amount of data reasonably necessary; and
• keep and, on request, make available to the Controller a record of the requests received and our responses.

We do not grant any authority direct or unrestricted access to Personal Data, and we hold no encryption key or back door provided for that purpose.

8. Assistance to the Controller

• Data subject rights. Taking account of the nature of the processing, we assist the Controller by appropriate technical and organisational measures in responding to requests to exercise rights under Chapter III. Where a Data Subject contacts us directly about data we process for the Controller, we refer them to the Controller and do not respond substantively unless instructed.
• Articles 32 to 36. We assist the Controller in ensuring compliance with security, breach notification and communication, data protection impact assessments, and prior consultation, taking into account the nature of processing and the information available to us.
• Deletion and export. The platform provides self-service deletion of accounts and export of customer records. Assistance beyond that is provided at no charge for reasonable volumes.

9. Personal Data Breach

We notify the Controller without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Personal Data processed for the Controller. The notification describes, to the extent known, the nature of the breach and the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at the time is supplied in phases as it becomes available, without further undue delay.

Our notification is not an admission of fault or liability.

10. Deletion and return

On termination or expiry, at the Controller's election, we delete or return all Personal Data processed for the Controller and delete existing copies, within 30 days, unless Union, Member State or Indian law requires storage.

One deliberate exception. Screening records and their evidence are retained for ten years, because sanctions screening records are subject to a ten-year recordkeeping requirement under 31 CFR 501.601 as amended effective 12 March 2025, and destroying them on request would remove the Controller's own ability to answer a regulator. On termination we will export them to the Controller in full. If the Controller nonetheless directs deletion, we will comply and record the instruction.

11. Audit

We make available to the Controller the information necessary to demonstrate compliance with Article 28 and this Addendum, and we allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates. In practice this means:

• the documentation published at Trust & Security, kept current;
• completion of a reasonable security questionnaire, once per twelve months, at no charge;
• written responses to specific follow-up questions and evidence of the controls in Annex II.

An on-site inspection is available on reasonable notice, no more than once per twelve months, and at the Controller's cost, except following a Personal Data Breach affecting the Controller, when it is at ours. We may require an auditor who is not our competitor to sign a reasonable confidentiality undertaking.

12. Liability and precedence

Each party's liability under this Addendum is subject to the limitations and exclusions of liability in the Terms of Service, except that nothing limits either party's liability to a Data Subject under the third-party beneficiary provisions of the Standard Contractual Clauses. In the event of conflict, the Standard Contractual Clauses prevail over this Addendum, and this Addendum prevails over the Terms of Service in respect of the processing of Personal Data.

13. Acceptance

This Addendum is incorporated into the Terms of Service and takes effect when the Controller accepts those Terms. A countersigned copy is available on request from [email protected]; we will return it executed within two business days.

---

Annex I — Description of the processing

A. Parties

Data exporter / Controller: the customer entity accepting the Terms of Service. Contact details as given at account registration. Role: Controller.

Data importer / Processor: ArcNautical, maritime intelligence platform, arcnautical.com. Contact: [email protected]. Role: Processor.

B. Description of the transfer

C. Competent supervisory authority

The supervisory authority of the EU Member State in which the data exporter is established. Where the data exporter is not established in the EEA but falls within the GDPR under Article 3(2), the authority of the Member State in which its Article 27 representative is established.

Annex II — Technical and organisational measures

These are the Article 32 measures the importer applies. They are the same measures described on the Trust & Security page and are contractual here.

Measures not implemented, stated so the Controller can assess residual risk rather than discover it later: no SOC 2 or ISO 27001 certification; no third-party penetration test; no customer-managed encryption keys; no private networking or IP allowlisting; no formally exercised disaster recovery drill beyond the automated restore verification above; no multi-region failover.

Annex III — Authorised Sub-processors

Current as of the version date above. The authoritative list is maintained on the Trust & Security page.

Sentry (error tracking) and ntfy (operational alerting) are self-hosted on ArcNautical infrastructure and are therefore not Sub-processors.

Related: Trust & Security · Service Level Agreement · Privacy Policy · Terms of Service