Data Processing Agreement

Data Processing Agreement pursuant to Article 28(3) of Regulation (EU) 2016/679 (GDPR)

between

Geek Techware UG (haftungsbeschränkt), Berner Str. 6, 27809 Lemwerder, Germany, registered at the commercial register of the Amtsgericht Bochum under HRB 16597 ("Processor", "Geek Divers")

and

the customer identified in the Principal Agreement ("Controller", "Customer")

This DPA forms an integral part of the Geek Divers Terms and Conditions (the "Principal Agreement"). Where they conflict on the processing of personal data, this DPA prevails.

1. Roles and subject matter

1.1 The Customer operates a dive centre and determines the purposes and means of processing personal data relating to its divers, staff and business contacts. The Customer is therefore the Controller.

1.2 Geek Divers provides a software-as-a-service dive centre management platform and processes that personal data solely on the Customer's behalf. Geek Divers is therefore the Processor.

1.3 "Customer Data" means personal data entered or uploaded by the Customer, its users, or data subjects acting at the Customer's invitation, and personal data generated or collected by the platform in providing the service on the Customer's behalf, including account sign-in data. The categories are set out in Annex 1.

1.4 Geek Divers acts as an independent Controller for its own business records concerning the Customer as a paying customer, including subscription, invoicing and payment records. Those records fall outside this DPA and are governed by the Geek Divers Privacy Policy. Customer Data disclosed in a support request remains Customer Data under this DPA.

1.5 The Customer is responsible for the lawfulness of the processing it instructs, including a legal basis under Article 6 GDPR and, for the health data in Annex 1, a ground under Article 9(2) GDPR such as the data subject's explicit consent, and for informing its data subjects.

1.6 Subject matter: provision of the Geek Divers platform. Duration: the term of the Principal Agreement, plus the return/deletion period in clause 10. Nature and purpose: collection, authentication, hosting, storage, organisation, retrieval, display, email transmission, optional price-list extraction and erasure of Customer Data for the purpose of operating the Customer's dive centre. Types of personal data and categories of data subjects: see Annex 1.

2. Instructions

2.1 Geek Divers processes Customer Data only on the Customer's documented instructions, including as to international transfers, unless required otherwise by Union or Member State law. In that case Geek Divers informs the Customer before processing, unless that law prohibits it on grounds of important public interest.

2.2 The Principal Agreement, this DPA, and the Customer's use of the platform's features constitute the Customer's initial documented instructions. The Customer may give further documented instructions in writing or by email at any time. Where a further instruction goes beyond the agreed service, the Parties agree on its implementation and any cost beforehand.

2.3 Geek Divers informs the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection law. Geek Divers may suspend the affected processing until the instruction is confirmed or withdrawn.

3. Confidentiality

3.1 Geek Divers ensures that persons authorised to process Customer Data are bound by a contractual or statutory duty of confidentiality, and that access is limited to those who need it to provide the service.

3.2 That duty survives the end of their engagement.

4. Security (Article 32)

4.1 Geek Divers implements appropriate technical and organisational measures ("TOMs") to ensure a level of security appropriate to the risk. The measures in force are described in Annex 2.

4.2 Geek Divers may update the TOMs, provided the level of protection is not reduced.

4.3 The Parties acknowledge that the Customer Data includes special categories of personal data within the meaning of Article 9 GDPR (health information collected via the diver medical questionnaire) and identity document data (passport numbers, nationality, validity dates and scanned documents), and that the TOMs take this into account.

5. Sub-processors

5.1 The Customer grants general written authorisation for Geek Divers to engage sub-processors. Those engaged at the date of this DPA are listed in Annex 3.

5.2 Geek Divers informs the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance by email to the Customer's account address. The Customer may object on reasonable data protection grounds within 14 days of that email. If the Parties cannot resolve the objection, the Customer may terminate the Principal Agreement on notice without penalty for the affected service.

5.3 Geek Divers imposes on each sub-processor, by contract, data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for the sub-processor's performance.

6. Assistance with data subject rights

6.1 Taking the nature of the processing into account, Geek Divers assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

6.2 Where the platform provides a suitable function, the Customer may use it to view, correct, export or delete individual records. Where a request cannot be fulfilled through the platform, Geek Divers assists on request without undue delay and provides an initial response within 10 working days. The Parties coordinate any earlier deadline required by law.

6.3 If a data subject contacts Geek Divers directly, Geek Divers does not respond substantively but forwards the request to the Customer without undue delay.

7. Assistance with Articles 32 to 36

7.1 Geek Divers assists the Customer in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to it.

7.2 Personal data breach. Geek Divers notifies the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Data, providing the information available under Article 33(3) and updating it as the investigation proceeds.

8. Audit and information

8.1 Geek Divers makes available to the Customer all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

8.2 The Parties coordinate the timing, scope and safeguards of an audit in good faith. Routine on-site inspections ordinarily take place during business hours on 30 days' written notice, without unreasonable disruption. The Customer ordinarily conducts no more than one routine inspection per calendar year. Those arrangements do not restrict an audit needed because of reasonable grounds to suspect non-compliance, a personal data breach, a supervisory authority's request, or another compelling compliance need. An independent auditor is bound by confidentiality and must avoid conflicts of interest.

8.3 Geek Divers may first answer an audit request by providing existing documentation, certifications or third-party reports. Where these do not reasonably address the Customer's questions, the Customer's right under 8.1 remains.

9. Location of processing and international transfers

9.1 The primary application database is hosted on STRATO infrastructure stated to be in Frankfurt am Main, Germany. Uploaded documents and images are held in a Cloud Storage for Firebase bucket configured for the EU multi-region. These statements concern the specified storage systems; they do not describe every place where Customer Data is processed.

9.2 Geek Divers engages the service providers and processing locations described in Annex 3. Any further third-country disclosure or access by those providers is subject to clause 9.5. Customer-directed communications, including email to a diver or another recipient, may be received outside the EEA. The Customer determines the recipients and must assess any transfer arising from its instructions.

9.3 Sign-in (Firebase Authentication). Platform account holders sign in through Firebase Authentication, which Google operates from data centres in the United States. The service processes sign-in identifiers and credentials, and may process IP addresses and device or browser information. The Google Cloud Platform Terms of Service and the incorporated Cloud Data Processing Addendum govern this processing. Restricted transfers are subject to the transfer mechanism applicable under that Addendum, including Standard Contractual Clauses where required. Geek Divers documents the transfer chain and applicable transfer mechanism in its vendor records and makes that information available to the Customer on request.

9.4 Optional price list import (Anthropic). If a Customer user invokes this function, Geek Divers sends the selected PDF as a document in an Anthropic API request for extraction of price list items. The function does not intentionally add diver, booking or billing records, but any personal data contained in the selected PDF is included in the request. The Customer must not upload health data or other Article 9 data through this function. Anthropic's Commercial Terms prohibit training on Customer Content, and its Data Processing Addendum incorporates Module Two or Module Three of the EU Standard Contractual Clauses where required. Anthropic states that API inputs and outputs are ordinarily deleted within 30 days, subject to its published exceptions. The Customer decides whether to use the function and which document to upload.

9.5 A provider's EU storage location does not by itself exclude remote access or onward processing outside the EEA. Geek Divers assesses those possibilities under the applicable provider terms and Chapter V GDPR and provides the Customer with relevant information on request. The mere location of a provider's parent company does not itself establish a transfer.

10. Return and deletion at end of service

10.1 On termination or expiry of the Principal Agreement, Geek Divers, at the Customer's choice, returns the Customer Data to the Customer, deletes it, or does both, and deletes existing copies, unless Union or Member State law requires storage.

10.2 For 30 days after termination takes effect the Customer may request an export, the deletion, or first one and then the other. The Customer may also request either at any time during the term.

10.3 Return is provided as a structured, commonly used and machine-readable export comprising the Customer's database records in JSON, one file per record type, together with all documents and images uploaded to the account in their original formats, and a manifest listing each record type and its count. Geek Divers provides this within 14 days of the request at no charge for a single export. Alternative formats may be agreed.

10.4 Deletion from live systems takes place within 14 days after a written deletion request. If the Customer requests an export before deletion, that period begins when the export is delivered; the Customer may request earlier deletion after confirming receipt. If the Customer makes no request during the 30-day period in clause 10.2, Geek Divers deletes the live Customer Data within 14 days after that period ends. Geek Divers confirms completion of live-system deletion in writing and identifies any data retained under clauses 10.5 or 10.6.

10.5 Backups. Geek Divers takes daily database and server backups and keeps copies on a second server. Backup copies containing Customer Data deleted under clause 10.4 are protected against ordinary access, used only for disaster recovery and overwritten under the documented backup rotation. If a backup is restored before expiry, Geek Divers reapplies the deletion before returning the affected data to normal use. Under the backup rotation currently specified by Geek Divers, deleted Customer Data expires from the database and server backup copies, including the second-server copy, within 2 days. Geek Divers updates this clause before changing the rotation or adding longer-lived copies.

10.6 Statutory retention. Geek Divers retains its own invoicing and accounting records relating to the Customer for the periods required by German tax and commercial law (§ 147 AO, § 257 HGB): currently 8 years for accounting vouchers such as invoices, 10 years for books and annual financial statements, and 6 years for business correspondence. Those records concern the commercial relationship only and contain no diver, booking or operational data of the Customer.

11. Liability, term and governing law

11.1 Liability is governed by the Principal Agreement and by Article 82 GDPR.

11.2 This DPA takes effect when the Customer accepts the Principal Agreement and remains in force for as long as Geek Divers processes Customer Data.

11.3 This DPA is governed by the law of Germany, without prejudice to mandatory data protection law. The competent courts are determined under applicable procedural law.

11.4 Should any provision be invalid, the remainder is unaffected.

ANNEX 1 — Categories of data subjects and personal data

Categories of data subjects

• The Customer's divers and guests, including minors where a guardian has registered them
• The Customer's staff, instructors, divemasters and freelance personnel
• The Customer's business partners, agents and hotel contacts

Categories of personal data

• Identity and contact: name, date of birth, gender, email, telephone, postal address, nationality, languages, emergency contact
• Identity documents: passport or ID number, validity date, nationality, uploaded copies
• Signatures: handwritten signature and guardian signature captured electronically
• Diving qualifications: certification agency, level, certification number and dates, dive count, date of last dive, nitrox and other specialities
• Operational: bookings, trips, courses, equipment rentals, sizes (height, weight, shoe), accommodation, hotel and room, pick-up/drop-off, check-in and check-out, flight details, dietary requirements
• Financial: bills, payments, refunds, quotes, prices, payment method, outstanding balances
• Staff: employment and role data, permissions, payslip and commission records, sign-in data (email address, password hash, IP address)
• Communications: messages, notes and internal remarks recorded against a record
• Consent records: newsletter and third-party consent flags with timestamps

Special categories (Article 9 GDPR)

• Health data collected through the diver medical questionnaire: declarations regarding cardiac, pulmonary and circulatory conditions, neurological conditions, surgery, ongoing treatment, prescription medication, pregnancy and related matters, together with the associated signature and, where applicable, physician's approval.
• Dietary requirements and free-text notes may also reveal health conditions or religious beliefs where the Customer or a data subject enters such information.

The Customer is responsible for the Article 9(2) ground for this data (clause 1.5).

ANNEX 2 — Technical and organisational measures (Article 32)

Encryption

• In transit: all connections between browser and server use TLS. Connections between the application and the database require TLS.
• At rest: uploaded documents and images are encrypted at rest by Google Cloud Storage.
• The application database and the database and server backups are not encrypted at rest. Access to them is restricted as described below; the risk and any compensating measures must be assessed in light of the health and identity document data processed by the service.

Confidentiality

• Access control: personal user accounts with permissions per user and per location; authentication via Firebase Authentication; passwords are not stored by Geek Divers
• Tenant isolation: each dive centre's data is held in a separate database, selected by the application using the authenticated user's account
• Uploaded files are not publicly listed; access is provided through the application or through links carrying an access token
• Administrative access to servers and databases is limited to one person, a managing director
• Server administration is possible only over SSH with key-based authentication; password login is disabled
• The database accepts only TLS connections from clients that present a certificate issued by Geek Divers' own certificate authority, and additionally requires a user name and password
• Physical security: delegated to the hosting providers in Annex 3

Integrity

• All changes to the software are version-controlled
• Automated unit tests and end-to-end tests are run before a release

Availability and resilience

• Daily backup of the database and a full backup of the server (clause 10.5)
• A copy of the backups is kept on a second server; the copy is transferred encrypted (SFTP)
• Restoring from a backup has been tested; tests are not on a fixed schedule

Communications

• Where the Customer enables email delivery of a completed medical form, the application sends the completed PDF as an email attachment to the address supplied for the diver and, if selected, a copy to the Customer's address. Further transport and storage by the recipient's mail provider are outside Geek Divers' control.
• Generating a completed medical form also creates a PDF copy on the application server before upload and, where enabled, email delivery. The application removes the local copy after processing.

Evaluation

• Third-party software dependencies are checked for known vulnerabilities (npm audit)

ANNEX 3 — Sub-processors

Not sub-processors under this DPA:

• Google Maps Platform (address autocomplete). Google offers Maps APIs under Controller-Controller Data Protection Terms. The specific integration and the data disclosed to Google are described in the Geek Divers Privacy Policy; the Customer informs its own users where applicable.

Version: October 2026 — Effective: on acceptance of the Principal Agreement