Data Processing Addendum

About this addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between Atrim LLC, a Nevada limited liability company doing business as First Mate ("First Mate", "we") and a business that uses First Mate ("you") — for example a charter, delivery or yacht management company. It applies when you put personal information about other people (crew, guests, clients, staff or contacts) into First Mate and the UK GDPR, the EU GDPR or a similar law applies to it. You accept it by accepting the Terms; nothing needs to be signed.

It doesn't apply to an owner keeping a record of their own boat for personal use. For your account and the information we collect to run the Service, we are the controller, as described in our Privacy Policy.

1. Roles and instructions

You are the controller of the personal information you put into First Mate, and we process it on your behalf as your processor. We process it only on your documented instructions: these Terms, this DPA and your use and settings of the Service are those instructions. If we think an instruction breaks data protection law, we will tell you. If the law requires us to process it otherwise, we will tell you first unless the law forbids it.

You are responsible for having a lawful basis for the information you put in, and for telling the people it is about.

2. What we process

• Subject matter and purpose: hosting your boats' records and running the Service for you, including AI answers, search, document reading and email.
• Duration: while you use the Service, then until deletion under section 8.
• People: your crew, guests, clients, staff, and vendor and other contacts.
• Information: names, contact details, roles, and the personal details in records, documents, receipts, photos and chats you add (for example on ship's papers).
• Sensitive information: none is expected. Our Acceptable Use Policy asks you not to add health information, payment card numbers or government ID numbers beyond what a ship's paper shows.

3. Our people and security

Everyone at First Mate who can reach your information is bound to keep it confidential. We keep appropriate technical and organisational security measures in place, including:

• encryption in transit and at rest;
• database access rules that fence off each boat's data so only its crew and the agents they connect can reach it;
• role-based access for crew, and agent tokens stored only as one-way hashes;
• access to production systems limited to the people who run the Service;
• daily backups kept for 7 days, so we can recover from a failure.

We may improve these measures, but we won't reduce the overall level of protection.

4. Subprocessors

You authorise us to use the providers on our Subprocessors page. We send each only what it needs, and we remain responsible for them. We will update that page at least 14 days before a new provider receives your boats' data, and email you if you ask us to. If you object on reasonable data protection grounds and we can't address it, you may stop using the affected part of the Service or end the agreement.

5. Helping you

You can access, correct, export and delete most information yourself in the app. Where you can't, we will help you answer requests from the people the information is about, and pass on any request we receive directly. We will also give you reasonable help with security, breach notifications, data protection impact assessments and consulting a regulator, as far as our role and the information available to us allow.

6. Personal data breaches

If we become aware of a personal data breach affecting your information, we will tell you without undue delay, along with what we know about its nature, likely consequences and what we are doing about it, and keep you updated as we learn more.

7. International transfers

We process your information in the United States, and our providers process it mainly there. Where your transfer of personal information to us is a restricted transfer under the EU GDPR, the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) apply, with you as data exporter and us as data importer: Module Two (controller to processor), or Module Three if you are yourself a processor. For them: clause 7 (docking) does not apply; under clause 9 you give general authorisation for subprocessors on the notice set out in section 4; the optional wording in clause 11 does not apply; clauses 17 and 18 choose the law and courts of Ireland; the competent supervisory authority is the one for your establishment or representative; and Annexes I and II are completed by sections 2 and 3 of this DPA and our Subprocessors page.

For a restricted transfer under the UK GDPR, the UK Addendum to those clauses issued by the Information Commissioner applies as well, with the same choices. If these clauses and the rest of this DPA or the Terms conflict, the clauses win.

8. Return and deletion

You can export your boats' records at any time (see our Data Retention page). When you close your account or the agreement ends, we delete your information as described on our Data Retention page, unless the law requires us to keep it; deleted data leaves our backups within 7 days.

9. Audits

We will answer your reasonable written questions about our compliance with this DPA and give you the information you need to show your own compliance. If that isn't enough, or a regulator requires it, you may audit us (or have an independent auditor do so) on reasonable notice, during business hours, no more than once a year unless there has been a breach, and at your own cost.

10. Liability and changes

Each party's liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or the law don't allow it — for example, rights the clauses give to the people the information is about. We may update this DPA to reflect changes in the law or the Service, following the notice rules in our Terms; we won't reduce the protection it gives your information.

Contact

Questions, requests and reports: support@atrim.ai