Data Processing Agreement

1. Introduction & scope

This DPA is entered into between Yacht Workers Council ("YWC", "we", "us"), a company with its registered office at 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF, and the Customer (an employer or recruitment agency) that accepts it.

YWC operates the Professional Yacht Crew Registry. The roles of the parties depend on the context of the processing:

• Crew users: where YWC determines how and why crew members' personal data is processed for the registry, YWC is the Data Controller and that processing is governed by our Privacy Policy, not this DPA.
• Employer / agency customers: where YWC processes personal data on behalf of an employer or recruitment-agency Customer who determines the purposes and means of that processing, the Customer is the controller and YWC acts as Processor under this DPA.

This DPA applies whenever, and only to the extent that, YWC processes Customer Personal Data as a processor. In the event of a conflict between this DPA and the main agreement, this DPA prevails on data-protection matters.

2. Definitions

Capitalised terms used in this DPA have the meanings given in the UK GDPR and the EU GDPR (Regulation (EU) 2016/679). In particular:

• "GDPR" means the UK GDPR and/or the EU GDPR as applicable, together with the Data Protection Act 2018.
• "Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Supervisory Authority" have the meanings given in the GDPR.
• "Customer Personal Data" means personal data processed by YWC on behalf of the Customer under this DPA.
• "Sub-processor" means any third party engaged by YWC to process Customer Personal Data.
• "Special-category data" means the categories of personal data set out in Article 9 GDPR.
• "SCCs" means the relevant standard contractual clauses for international transfers (the UK IDTA / Addendum and/or the EU SCCs).

3. Roles & responsibilities

For Customer Personal Data processed under this DPA, the Customer is the controller and YWC is the processor. The Customer:

• determines the purposes and means of processing and is responsible for the lawfulness of the data it provides or instructs YWC to process;
• warrants that it has a valid lawful basis (and, where required, explicit consent for special-category data) for the processing it instructs;
• is responsible for the accuracy of its instructions to YWC.

YWC processes Customer Personal Data only on documented instructions from the Customer, including those given through the YWC platform, unless required to do otherwise by law (in which case YWC will inform the Customer unless legally prohibited).

4. Subject matter, duration, nature & purpose of processing

Subject matter & nature: the provision of the YWC registry, recruitment, document-verification and related services to the Customer.

Purpose: enabling the Customer to recruit, verify, manage and communicate with yacht crew through the YWC platform.

Duration: for the term of the main agreement and any period required to comply with legal obligations or to return/delete data under Section 12.

Categories of data subjects

• Crew members and candidates who interact with the Customer through YWC;
• the Customer's authorised users and representatives.

Categories of personal data

• Identity and contact data (name, email, phone, nationality);
• Professional data (CVs, certifications, qualifications, sea-service records, employment history);
• Account and usage data;
• Special-category crew data where applicable, for example health/medical-fitness information (such as ENG1 medical certificates), processed only on the Customer's instructions and lawful basis.

5. YWC obligations as processor

YWC shall:

• process Customer Personal Data only on the Customer's documented instructions;
• ensure persons authorised to process the data are bound by confidentiality;
• implement appropriate technical and organisational security measures (see Section 8);
• respect the conditions for engaging sub-processors (see Section 6);
• assist the Customer in responding to data-subject requests (see Section 9);
• assist the Customer with security, breach notification, data-protection impact assessments and prior consultation (Articles 32–36 GDPR);
• at the Customer's choice, return or delete Customer Personal Data on termination (see Section 12);
• make available the information necessary to demonstrate compliance and allow for audits (see Section 11).

6. Sub-processors

The Customer provides general authorisation for YWC to engage the sub-processors listed below to process Customer Personal Data. YWC imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable for their performance.

Change notification: YWC will give the Customer prior notice of any intended addition or replacement of a sub-processor, giving the Customer the opportunity to object on reasonable data-protection grounds within [placeholder: notice period].

7. International transfers

Where processing under this DPA involves a transfer of Customer Personal Data outside the UK or EEA, YWC ensures an appropriate transfer mechanism is in place, namely an adequacy decision/regulations, or the relevant SCCs, the UK International Data Transfer Agreement (or the UK Addendum to the EU SCCs) and/or the EU Standard Contractual Clauses, together with any supplementary measures required.

8. Security measures

YWC implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, including encryption in transit and at rest, access controls, network security, logging, and regular testing of measures. Further detail is published on our Security page.

9. Data-subject requests assistance

Taking into account the nature of the processing, YWC will assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests by data subjects exercising their rights under the GDPR (access, rectification, erasure, restriction, portability and objection). Where YWC receives such a request directly, it will, unless legally required to act, refer the data subject to the Customer.

10. Personal-data breach notification

YWC will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and will provide the information reasonably required to enable the Customer to meet its own notification obligations to the Supervisory Authority and, where applicable, to data subjects.

11. Audits & inspections

YWC will make available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable notice, confidentiality, and frequency limits set out in the main agreement. Where available, YWC may satisfy audit requests through third-party certifications or reports.

12. Return / deletion on termination

On termination or expiry of the main agreement, YWC will, at the Customer's choice, delete or return all Customer Personal Data and delete existing copies, unless storage is required by law. YWC will carry this out within [placeholder: deletion period] of termination.

13. Liability & governing law

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the main agreement. This DPA is governed by the laws of England & Wales, and the parties submit to the exclusive jurisdiction of the courts of England & Wales, consistent with our Terms & Conditions.

14. How to execute

To put this DPA in place:

• Download the standard DPA (PDF) for your records and review by your legal counsel.
• Request a signed copy counter-signed by Yacht Workers Council via our contact form or by email to [placeholder: [email protected]].