Version 2.0 · Between the Customer (the yacht, yacht owning company, yacht management company or fleet operator subscribing to the Platform) and Yacht Watchkeeper. Yacht Watchkeeper is a trading name of Roebuck AI Agency Ltd, a company registered in England and Wales under company number 16868241, with registered office at 124 City Road, London, EC1V 2NX, United Kingdom. References in this DPA to "Yacht Watchkeeper", "we", "us" and "our" mean that company.
This DPA is a legal document prepared to reflect the Platform as operated at the date of publication. It is subject to review by the Customer's own advisers.
This DPA is incorporated into and forms part of the Terms and Conditions (the "Terms") and applies automatically to every Customer, in every subscription tier, wherever Yacht Watchkeeper processes personal data on the Customer's behalf. It is not an enterprise-only benefit, and no separate request, negotiation, execution or signature is required for it to apply.
A counter-signed copy will be provided on request for the Customer's records. The absence of a signed copy does not affect the application of this DPA.
Where the Customer has entered into a separate written agreement with us containing supplementary or replacement data-processing terms that are expressly agreed in writing, those terms prevail over this DPA to the extent of any conflict. In all other cases this DPA governs.
"Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, and, where applicable to the processing, Regulation (EU) 2016/679 (EU GDPR) and the ePrivacy rules implemented in the relevant jurisdiction. "Controller", "processor", "data subject", "personal data", "special category data", "processing", "personal data breach" and "supervisory authority" have the meanings given in those laws.
"Customer Personal Data" means personal data contained in or generated from data that the Customer or its authorised users enter into, upload to, or cause the Platform to generate. "Services" means the Yacht Yacht Watchkeeper platform and related support. "Subprocessor" means a processor engaged by us to process Customer Personal Data.
In respect of Customer Personal Data, the Customer is the controller (or, where the Customer is itself a processor for a third party such as an owning company or employer of record, the processor) and we are the processor (or subprocessor, as applicable). The Customer is responsible for the accuracy of the instructions it gives and for its own relationship with the underlying controller.
We act as an independent controller in respect of a limited set of data processed for our own purposes: account administration and authentication; billing, payment and subscription records; platform security, fraud and abuse prevention; error, performance and capacity monitoring; service communications; product telemetry that does not depend on Customer Personal Data content; and compliance with our own legal obligations. That processing is described in our Privacy Policy and is not governed by this DPA.
The parties do not intend to create a joint controller relationship. Compliance calculations, alerts and scheduling logic performed by the Platform are performed as part of the contracted service and on the Customer's instruction; we do not determine the purpose for which those outputs are used. Where the Customer considers a particular processing activity raises a joint controller question, it should raise it with us so the position can be assessed and, if required, documented.
The subject matter, duration, nature, purpose, categories of data subject and categories of personal data are set out in Annex I. Processing continues for the duration of the subscription and for so long thereafter as is permitted or required under section 15 and the Terms.
We process Customer Personal Data only on the Customer's documented instructions, which comprise: the Terms; this DPA; the configuration, settings and permissions the Customer applies within the Platform; the actions of the Customer's authorised users; and any further written instructions we agree to accept.
We will not sell Customer Personal Data, use it for advertising or behavioural profiling, disclose it to data brokers, or use it to train our own or any third party's general-purpose AI models.
If we are required by UK or EU law to process Customer Personal Data otherwise than on the Customer's instructions, we will inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest. We will inform the Customer if, in our opinion, an instruction infringes Data Protection Laws.
The Customer warrants and undertakes that it will:
We do not determine, and cannot determine on the Customer's behalf, the lawful basis or Article 9 condition applicable to the Customer's processing.
We ensure that persons authorised to process Customer Personal Data are subject to binding confidentiality obligations that survive termination of their engagement, are made aware of the confidential and often sensitive nature of vessel, crew and guest data, and receive access only to the extent required for their role.
Administrative access to production data is restricted to a limited number of authorised personnel, controlled through platform roles and privileged super-administrator status, and is exercised for support, incident investigation, security and maintenance purposes only.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to data subjects, we implement appropriate technical and organisational measures as described in Annex II. We keep those measures under review and may update them provided the overall level of security is not reduced.
The Customer grants a general written authorisation for us to engage Subprocessors for the provision of the Services. Our current Subprocessors are listed in the Subprocessor Register, which forms Annex III to this DPA.
Each Subprocessor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA in respect of the processing it performs. We remain fully liable to the Customer for the performance of each Subprocessor's obligations.
Change notification. We will give at least thirty (30) days' notice before a new or replacement Subprocessor begins processing Customer Personal Data, by updating the Subprocessor Register (which records the date of each change) and by notifying the Customer's registered administrative contact by email or in-app notice. Customers may subscribe to notifications by emailing info@yachtwatchkeeper.com.
Objection. The Customer may object on reasonable data protection grounds within fourteen (14) days of notice by writing to info@yachtwatchkeeper.com, stating its grounds. We will work in good faith to make available a change in the Services or a commercially reasonable alternative that avoids the objected-to processing. If no such alternative can be made available within a reasonable period, the Customer may terminate the affected part of the Services on written notice, with a pro-rata refund of pre-paid fees for the unused remainder of the then-current term. Where a Subprocessor must be appointed urgently to preserve security or continuity of the Services, we may do so immediately and will notify the Customer without undue delay.
The platform database is hosted in AWS Europe (Ireland), eu-west-1. Our hosting provider documents sign-in and document storage as running in the same project region; we are obtaining its written confirmation. Amazon Web Services Europe (Ireland) region, eu-west-1. Certain Subprocessors listed in the Subprocessor Register may process limited categories of Customer Personal Data outside the United Kingdom or the European Economic Area.
Where a transfer of Customer Personal Data is made to a country not covered by UK adequacy regulations or an EU adequacy decision, that transfer is made pursuant to an appropriate safeguard under Article 46, being the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement, as applicable to the transfer, supplemented by any measures required following a transfer risk assessment. The Customer authorises us to enter into such transfer mechanisms with Subprocessors on its behalf and in its name for this purpose.
The specific transfer mechanism relied upon for each Subprocessor is recorded in the Subprocessor Register. Where a mechanism is shown as requiring confirmation, it has not yet been verified from documentation and is being confirmed with the relevant provider.
The Platform provides the Customer's administrators with self-service access, correction, export and deletion functionality for the majority of Customer Personal Data. Taking that functionality into account, we will provide reasonable assistance, by appropriate technical and organisational measures and insofar as possible, to enable the Customer to respond to requests to exercise rights of access, rectification, erasure, restriction, portability and objection.
If a data subject contacts us directly in relation to Customer Personal Data, we will not respond substantively other than to direct them to the Customer, and will inform the Customer without undue delay unless prohibited by law.
We will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it; and a contact point for further information. Where the information is not available at once, it will be provided in phases without further undue delay.
We will take reasonable steps to contain and remediate the breach, preserve relevant evidence, and provide reasonable cooperation and information to enable the Customer to meet its own notification obligations to supervisory authorities and data subjects. Notification is not, and will not be construed as, an admission of fault or liability.
Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to the Customer with data protection impact assessments under Article 35 and with prior consultation of a supervisory authority under Article 36, and with the Customer's obligations under Articles 32 to 34. Assistance beyond the provision of information already available to us may be charged at our then-current professional rates where the request is substantial or repeated.
We will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 and this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.
Audits will take place on at least thirty (30) days' written notice, during normal business hours, no more than once in any twelve (12) month period unless required by a supervisory authority or following a personal data breach affecting the Customer, must be subject to confidentiality obligations, and must not unreasonably disrupt our business or compromise the security or confidentiality of other customers' data. We may satisfy an audit request by providing written responses, security documentation and evidence of our controls where that reasonably addresses the request.
Export window. On expiry, cancellation or termination, and where technically and legally appropriate, Customer data is made available for export for up to thirty (30) days from the effective date of termination, in the formats then available, in accordance with the Terms. The export window may be shortened or withheld in the circumstances set out in the Terms, including suspension for security risk, suspected unlawful activity or serious breach.
The export window is not a retention period. It defines how long the Customer may retrieve data after termination. It does not define, limit or extend how long data may lawfully remain retained by us. Retention after termination is governed by the retention provisions of the Terms and, once approved, our published Retention Schedule. Some data may be deleted sooner and some may lawfully be retained for longer where a legal obligation, limitation period, legal hold or other legitimate ground applies.
Following the export window, we will delete or irreversibly anonymise Customer Personal Data within a reasonable period, except to the extent that continued storage is required by applicable law, is subject to a legal hold, or is necessary to establish, exercise or defend legal claims. Where personal data is retained on that basis, we will continue to protect it under this DPA and will restrict processing to the purpose of that retention.
Backups. Backups are taken and rotated on a rolling basis and are overwritten in the ordinary course. Data deleted from the live system may persist in backups until those backups expire; we do not selectively edit backups. Restored data remains subject to the deletion obligations in this section.
We do not undertake to restore, reconstruct or recover data that has already been lawfully deleted, anonymised or overwritten.
The Platform can process health-related and other sensitive information, including seafarer medical certificate details and validity, crew medical declarations and their signed outputs, food allergy and dietary requirement information, and medical or health-related leave categories. It also processes high-risk identity information including passport, visa and immigration records and biographical data extracted from identity documents.
The Customer, as controller, is responsible for establishing the Article 9 condition (and, where applicable, the Schedule 1 Data Protection Act 2018 condition and any Appropriate Policy Document required in connection with it) for such processing, and for ensuring that such data is entered into the Platform only where necessary. We process such data solely on the Customer's instructions in order to provide the Services, and make no assertion as to which Article 9 condition applies to the Customer's processing.
We apply additional restrictions to this data within the Platform, including separated sensitive data tables and views, role-restricted access, and access controls limiting visibility to the crew member and authorised roles.
Where the Customer uploads a document for automated reading, classification or extraction, or uses in-app assistance features, the relevant content is transmitted to the AI Subprocessors identified in the Subprocessor Register for the sole purpose of returning a result to the Platform. Such content may include passport, visa, certificate, medical certificate, contract, invoice, receipt and travel document data.
We do not use Customer Personal Data to train our own models and do not permit our AI Subprocessors to use Customer Personal Data submitted through the Platform to train their models under our agreements with them. Automated extraction is presented for human review and is not a decision producing legal or similarly significant effects within the meaning of Article 22; the Customer's authorised users review and confirm extracted values.
We maintain records of processing carried out on behalf of the Customer as required by Article 30(2), and maintain internal audit, permission-audit and security-monitoring records evidencing operation of the measures described in Annex II.
Each party's liability under this DPA is subject to the exclusions and limitations of liability set out in the Terms. This DPA is governed by the laws of England and Wales and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
In the event of conflict in respect of the processing of Customer Personal Data, the order of precedence is: (1) any expressly agreed written bespoke data-processing terms; (2) this DPA; (3) the Terms; (4) any other policy referenced in the Terms.
Data protection enquiries, subprocessor objections, audit requests and breach correspondence: info@yachtwatchkeeper.com. Yacht Watchkeeper is a trading name of Roebuck AI Agency Ltd, registered in England and Wales. We have not appointed a statutory Data Protection Officer; enquiries are handled through the address above.
Subject matter. Provision of the Yacht Watchkeeper crew, compliance-support and vessel operations platform.
Duration. For the term of the subscription, plus the post-termination export window and any period during which retention is permitted or required under section 15.
Nature of processing. Collection, recording, organisation, structuring, storage, retrieval, calculation, consultation, use, automated text extraction and classification from uploaded documents, generation of documents and reports, transmission of notifications, disclosure to authorised users of the Customer, erasure and destruction.
Purposes. Hours of rest recording and MLC compliance support; watch and duty scheduling; crew records, certificates and qualification tracking; sea service records; passport, visa and immigration tracking; crew movements and travel; leave, rotation and end-of-contract administration; payroll, expenses and reimbursements; sign-on/sign-off checklists and signatures; guest and trip administration; muster and safety records; vessel documents and reporting; notifications and alerts; support, security and service administration.
Frequency. Continuous for the duration of the subscription.
Categories of data subject. Customer administrators and platform users; crew members (including permanent, rotational and archived crew); joiners and applicants; contractors and day workers; next of kin and emergency contacts named by crew; guests and occasional workers recorded by the Customer; management company personnel; individuals named in uploaded documents.
Categories of personal data.
Special category data. Health-related data comprising seafarer medical certificate details and validity, crew medical declarations and their signed outputs, medical and health-related leave categories and days, and food allergy and dietary requirement information (which may reveal health or religious belief). Special category data is only processed where the Customer causes it to be entered.
Criminal offence data. Not a designed feature of the Platform. The Customer must not enter criminal offence data into free-text fields.
Instructions. Processing is carried out only on the Customer's documented instructions as defined in section 5.
Lawful basis. Determined by the Customer as controller. We do not determine or assert a lawful basis or Article 9 condition on the Customer's behalf.
Retention and deletion. As set out in section 15 and, once approved, the published Retention Schedule.
The measures below describe controls implemented in the Platform. We do not hold, and do not claim, ISO 27001, SOC 2, Cyber Essentials, penetration-test certification, or any flag State, class or regulatory approval.
Access control and authentication. Authentication is provided by a managed authentication service supporting email and password and federated sign-in, with password policies and session management. Each user is individually identified; shared accounts are not a supported model.
Authorisation and role-based access. Access is governed by vessel membership and platform roles (including administrator, head of department and crew roles), with roles stored in dedicated role tables and evaluated by security-definer database functions rather than client-supplied values. Privileged super-administrator access is separately identified and evaluated.
Tenant isolation. Data is partitioned by vessel. Access is restricted to the vessels a user is a member of, enforced in the database rather than only in the application.
Row-level security. Row-level security is enabled on all 294 tables in the application schema, with policies governing read and write access. Database views are audited for unsafe execution modes.
Least privilege and sensitive data restriction. Sensitive crew data (including identity, contact, payroll and medical-declaration data) is separated into restricted tables and views with narrower access than general crew records. Database triggers prevent self-service modification of privilege-bearing and financially sensitive fields such as roles and pay rates.
Audit logging. The Platform records audit trails for access-role changes, certificate review and validity decisions, hours-of-rest amendments and repairs, calendar lock changes, permission findings and administrative actions, including the acting user and timestamp. Signed and locked compliance records are protected against silent alteration by database guards.
Automated security and permission auditing. Scheduled jobs perform permission audits, permission-drift detection, system health checks, backend capacity checks and hours-of-rest integrity checks, with findings surfaced to privileged administrators.
Change control and CI gating. Database migrations are version controlled. A continuous integration workflow runs a view-exposure audit against database migration changes to prevent an unsafe view reaching production.
Encryption in transit. All connections to the Platform, its API, its database endpoints and its storage endpoints are made over TLS/HTTPS.
Encryption at rest. The database and object storage are provided by our managed hosting Subprocessor on Amazon Web Services infrastructure, which applies encryption at rest at the storage layer.
Storage security. All twenty document storage buckets used by the Platform are private. Files are served through short-lived signed URLs; there is no public object storage bucket.
Secrets management. Third-party API credentials and service keys are held in the managed secret store of the hosting platform and injected into server-side functions as environment variables. They are not stored in source control and are not exposed to the browser.
Server-side processing boundary. Operations requiring elevated privileges, third-party credentials or AI processing are executed in server-side edge functions rather than in the browser.
Backups and availability. Backups are performed by the managed database provider on a rolling basis and are overwritten in the ordinary course. Platform capacity and health are monitored, with alerting thresholds for database capacity and connection utilisation.
Incident detection and monitoring. Application error events, edge function logs, authentication diagnostics and system health snapshots are captured and reviewable by privileged administrators.
Data minimisation and deletion. Certain operational logs are purged automatically on a rolling thirty (30) day schedule. Account deletion functionality removes the user account, cancels associated subscriptions and clears associated references.
Personnel. Access to production data is limited to authorised personnel bound by confidentiality obligations, granted only as required for support, security and maintenance.
Subprocessor management. Subprocessors are engaged under written terms and recorded in the Subprocessor Register.
The current list of Subprocessors forms Annex III and is maintained at the Subprocessor Register, together with the date of the last change.
© 2026 Yacht Watchkeeper. All rights reserved.