Version 1.0 · Effective 19 August 2026

Data Processing Addendum (Template)

This Data Processing Addendum ("DPA") forms part of the agreement between Yacht Masters Hub, Inc. ("Processor", "YMH") and the customer ("Controller") for the Yacht Masters Hub Service.

1. Roles

For Customer Content that Controller uploads, Controller is the controller and YMH is the processor. YMH processes personal data only on documented instructions from Controller, including those in the Service and this DPA.

2. Subject matter and details

• Subject matter: provision of the Service.
• Duration: the term of the agreement.
• Nature and purpose: hosting, storage, and AI assisted processing of vessel records and documents.
• Data subjects: Controller's personnel, vessel owners, and individuals named in uploaded content.
• Data types: contact data, vessel identifiers (HIN), records, and any personal data in documents.

3. YMH obligations

YMH will:

• process personal data only on Controller's instructions,
• ensure persons authorized to process are bound by confidentiality,
• implement appropriate technical and organizational security measures,
• assist Controller with data subject requests and with security, breach, and impact assessment obligations,
• delete or return personal data at the end of the term, subject to legal retention,
• make available information to demonstrate compliance and allow audits within reason.

4. Sub-processors

Controller authorizes YMH to use the sub-processors listed in the Sub-processor List. YMH will impose data protection obligations on each and give notice of changes, allowing Controller to object on reasonable grounds.

5. International transfers

Where personal data is transferred outside the EEA/UK, the parties incorporate the EU Standard Contractual Clauses and the UK Addendum as applicable.

6. Breach

YMH will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller's data, with the information Controller reasonably needs to meet its obligations.

7. Liability

Liability under this DPA is subject to the limitations in the agreement.

Note: attach the current EU SCCs and UK Addendum as annexes, and complete the annex describing processing details and security measures.