Data Processing Agreement

Between the Customer (“Controller”) and Navio Maritime OÜ (“Processor”)

Version: 1.3
Date: 13 August 2026

1. Parties

Processor:
Navio Maritime OÜ
Registered in Estonia (EU)
Email: privacy@mantis-ihm.com

Controller:
The organisation entering into a subscription agreement for the MANTIS IHM compliance management service, as identified in the applicable service agreement.

2. Background and Scope

2.1. This Data Processing Agreement (“DPA”) forms part of the MANTIS service agreement between the Controller and the Processor. It governs the processing of personal data by the Processor on behalf of the Controller in connection with the MANTIS IHM compliance management service.

2.2. This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

2.3. In the event of any conflict between this DPA and the service agreement, this DPA shall prevail with respect to data protection matters.

3. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
• “Processing” means any operation performed on Personal Data, as defined in Article 4(2) GDPR.
• “Data Subject” means the identified or identifiable natural person to whom the Personal Data relates.
• “Sub-processor” means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

4. Data Processed

4.1. The Processor processes the following categories of Personal Data on behalf of the Controller:

4.2. The Processor does not determine the purposes or means of processing. The Controller instructs the Processor to process Personal Data solely for the purpose of providing the MANTIS service.

5. Obligations of the Processor

The Processor shall:

5.1. Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data outside the EU/EEA, unless required to do so by applicable law.

5.2. Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.3. Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Section 7.

5.4. Respect the conditions for engaging sub-processors as set out in Section 6.

5.5. Assist the Controller with Data Subject requests under Chapter III GDPR.

5.6. Assist the Controller in ensuring compliance with Articles 32 to 36 GDPR.

5.7. At the choice of the Controller, delete or return all Personal Data after the end of the provision of services, unless applicable law requires storage.

5.8. Make available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 GDPR and allow for audits as set out in Section 10.

6. Sub-processors

6.1. The Controller provides general authorisation for the Processor to engage the following sub-processors:

6.2. Primary Customer Personal Data is stored in the EU regions stated above. A sub-processor may perform limited international processing for service delivery, security, support, or control-plane operations. Where processing involves a transfer outside the EU/EEA, the Processor shall ensure an appropriate transfer mechanism under Chapter V GDPR, such as an adequacy decision or Standard Contractual Clauses, together with supplementary measures where appropriate.

6.3. The Processor shall inform the Controller of intended sub-processor changes by email at least 30 days in advance.

6.4. The Processor shall impose equivalent data protection obligations on any sub-processor by contract.

6.5. The Processor remains liable to the Controller for the performance of the sub-processor’s obligations.

6.6. Stripe, PostHog, Plausible, Cal.com, and Microsoft Clarity support billing, MANTIS-controlled analytics, scheduling, or other processing for which the Processor acts as controller. They are disclosed in the Privacy Policy and Service Provider Register but are not included in the Controller-authorised sub-processor list above because they are not engaged to process Customer Personal Data on the Controller’s behalf under this DPA.

6.7. The Processor maintains a current public Service Provider Register describing provider roles, primary processing locations, and transfer safeguards. If the register conflicts with Section 6.1 as to the identity of a Customer Personal Data sub-processor, the more recently dated register applies only after the notice period in Section 6.3 has elapsed.

7. Security Measures

7.1. The Processor implements the following technical and organisational measures:

Encryption

• AES-256 encryption at rest at the storage layer
• TLS 1.2 or higher for data in transit
• Encrypted database connections via SSL

Access control

• Supabase Auth with bcrypt password hashing and per-user salts
• Multi-factor authentication support
• Role-based access control at the organisation level
• Rate-limited authentication endpoints

Data isolation

• PostgreSQL Row Level Security (RLS)
• RLS policies scoped by organisation and vessel membership
• No intentional shared access between customer organisations

Monitoring and audit

• Audit trail for data modifications
• Application and infrastructure logging

Backup and recovery

• Daily encrypted database exports to Cloudflare R2
• 30-day R2 retention
• User-initiated data export for inventory records and full archive exports including uploaded evidence documents
• Point-in-time recovery is not included in the standard plan

Organisational

• Access to production systems limited to authorised personnel
• Confidentiality obligations for personnel with access to Personal Data

8. Data Breach Notification

8.1. The Processor shall notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a Data Breach, in accordance with Article 33 GDPR.

8.2. The notification shall include, to the extent available:

• A description of the nature of the Data Breach
• The name and contact details of the Processor’s contact point
• A description of likely consequences
• A description of measures taken or proposed to address the breach

8.3. Where it is not possible to provide all information at the same time, the Processor shall provide information in phases.

8.4. The Processor shall cooperate with the Controller and take reasonable steps to assist in investigation, mitigation, and remediation.

9. Data Subject Requests

9.1. The Processor shall promptly notify the Controller if it receives a Data Subject request.

9.2. The Processor shall not respond directly unless instructed by the Controller or required by law.

9.3. The Processor shall provide reasonable technical assistance to the Controller in fulfilling Data Subject requests.

10. Audit Rights

10.1. The Controller may audit the Processor’s compliance with this DPA once per calendar year, with at least 30 days’ written notice.

10.2. Audits shall be conducted during normal business hours and shall not unreasonably interfere with operations.

10.3. The Controller shall bear its own audit costs. If significant Processor personnel involvement is required, the parties shall agree reasonable compensation in advance.

10.4. The Processor shall make available information reasonably necessary to demonstrate compliance with this DPA.

10.5. If an audit reveals material non-compliance, the Processor shall remediate the issues within a reasonable timeframe.

11. Data Deletion and Return

11.1. Upon termination, the Processor shall, at the Controller’s choice:

• Return Personal Data in a structured, commonly used, machine-readable format; or
• Delete Personal Data and certify deletion in writing.

11.2. Deletion shall be completed within 30 days of the termination date unless applicable law requires retention.

11.3. Personal Data in automated backups shall age out in accordance with the Processor’s backup rotation schedule.

12. International Data Transfers

12.1. The Processor does not intentionally transfer Personal Data outside the EU/EEA.

12.2. If a transfer outside the EU/EEA becomes necessary, the Processor shall ensure appropriate safeguards under Chapter V GDPR.

13. Liability

13.1. Each party’s liability under this DPA is subject to the limitations of liability set out in the service agreement, except where prohibited by applicable data protection law.

14. Term and Termination

14.1. This DPA remains in effect for the duration of the service agreement.

14.2. Processor obligations survive termination until Personal Data is deleted or returned under Section 11.

15. Governing Law and Jurisdiction

15.1. This DPA is governed by the laws of Estonia.

15.2. Disputes arising under this DPA shall be submitted to the courts of Tallinn, Estonia.

16. Signatures

This DPA is entered into as of the date specified in the service agreement.

For the Processor (Navio Maritime OÜ):

Name: ____________________________
Title: ____________________________
Date: ____________________________
Signature: ________________________

For the Controller:

Name: ____________________________
Title: ____________________________
Organisation: _____________________
Date: ____________________________
Signature: ________________________

Contact for data protection matters: