Data Processing Agreement (DPA) — Okeanun Manager

Parties and recitals

On the one part, the dive center subscribing to Okeanun Manager, identified by its legal name, tax ID, address and representative in the sign-up and subscription flow (the «Controller» or «Center»); and on the other part, Munaeko Development Software Solutions, S.L., tax ID B88989868, registered at Calle Gran Vía 1, 2º, 30180 Bullas (Murcia), Spain, contact [email protected] (the «Processor» or «Okeanun»). Both Parties acknowledge sufficient capacity to bind themselves.

The Center subscribes to Okeanun Manager to manage its activity, which means the Center may enter, host, organise and consult in the Service personal data of divers, clients, booking contacts and Center staff, potentially including special categories such as health data, depending on the Center’s use of the Service. For such data, the Center determines the main purposes and means and acts as controller, while Okeanun processes it on the Center’s behalf and acts as processor, with the arrangement to be set out in writing, including electronic form.

This Agreement is integrated into the Service subscription and accepted by the Center in the sign-up/subscription flow through an affirmative action (checkbox) with version and date recorded, constituting the legal instrument governing third-party data access as required under data-protection law. The Center may authorize Okeanun to use sub-processors to provide the Service, under the agreed authorization and objection regime, imposing on the sub-processor obligations equivalent to those assumed by Okeanun.

1. Subject matter, nature, purpose and duration

This Agreement governs the personal-data processing Okeanun carries out on the Center’s behalf in providing Okeanun Manager, including collection, recording, organisation, structuring, storage, consultation, disclosure to authorized sub-processors (where needed for provision) and deletion or return at the end of provision. The nature of the arrangement is instrumental processing necessary to let the Center manage its operations (bookings, participants, staff, person-linked inventory where applicable, certifications, insurance and associated documentation) through a SaaS platform. Its purpose is solely to provide the Service to the Center per its documented instructions (these Terms, this Agreement and ordinary use of the Service), and Okeanun may not process the data for its own purposes other than provision. The arrangement lasts for the term of the Center’s subscription and for the time strictly necessary to carry out the applicable termination, return/export and deletion or blocking operations.

2. Categories of data subjects and data

The categories of data subjects whose data may be processed on the Center’s behalf mainly include: (i) the Center’s divers and clients (registered or not, including «guest divers»); (ii) booking-related contacts; and (iii) Center staff to the extent the Center manages them in the Service. Data categories may include, depending on what the Center enters or manages: identification and contact data; booking, activity and course-participation data; diving certifications; insurance data; and, where the Center adds it, health data and medical documentation (special category), plus payment-related information as needed for operations (without prejudice to the payment provider handling card data under its own regime). The Center is responsible for entering only data necessary and relevant to its purposes, per the minimisation principle and privacy by design and by default in its processes.

3. The Center’s documented instructions and use limits

Okeanun processes personal data only following the Center’s documented instructions. For this purpose, documented instructions are: (i) this Agreement, (ii) the Center’s configuration and use of the Service within the enabled features, and (iii) documented communications the Center sends Okeanun through the established support channels for processing-related requests. Okeanun will not use the data for its own purposes or establish relationships with data subjects in its own name regarding the Center’s processing; if Okeanun were to determine purposes and means in breach of this framework, it could be considered controller for that processing. Where Okeanun considers an instruction infringes applicable data-protection law, it will inform the Center without delay.

4. Confidentiality of authorized staff and processing under authority

Okeanun will ensure that persons authorized to process personal data on the Center’s behalf are bound by confidentiality and professional-secrecy commitments, and that processing takes place under Okeanun’s authority and per instructions, preventing unauthorized access, disclosure or misuse. The Center acknowledges this obligation is essential, particularly when the Center enters sensitive documentation or special-category data, requiring Okeanun’s authorized staff to act with strict diligence and access limitation.

5. Technical and organizational security measures

Okeanun will apply appropriate technical and organizational measures to ensure a level of security appropriate to the risk, considering the state of the art, costs, and the nature, scope, context and purposes of processing, and in particular where special-category data is processed. These measures generally include access and authentication controls, role- and profile-based segregation, and mechanisms to preserve confidentiality, integrity, availability and restoration capability after incidents. Where processing is automated, Okeanun will implement controls to prevent unauthorized access, restrict access by authorization, and enable reasonable traceability of input, consultation and disclosure, as needed to ensure security and control of processing. The Center acknowledges the technical detail of the measures may evolve for security reasons, and Okeanun may update them to maintain an adequate level of protection.

6. Assistance to the Center with data-subject rights

Taking into account the nature of the processing and where possible, Okeanun will assist the Center through appropriate technical and organizational measures so the Center can meet its obligation to respond to data-subject rights requests (access, rectification, erasure, restriction, portability or objection, where applicable), including, where relevant, locating and extracting data, executing deletions or restrictions, or providing technical information needed to respond to the data subject. This assistance is provided to the extent the Center cannot do it itself through the Service’s features, and without prejudice to the Center being primarily bound towards the data subject as controller.

7. Assistance with security, breaches, impact assessments and prior consultation

Okeanun will help the Center ensure compliance with its obligations on security of processing, breach notification and documentation, and impact assessments where applicable, considering the nature of the processing and the information available to Okeanun. In particular, where the Center processes special-category data or processing that, by scope or context, may entail a high risk, the Center may request from Okeanun reasonable information on security measures and architecture, sub-processor flows and transfers, to integrate it into its risk analysis or impact assessment. Where prior consultation with the supervisory authority is appropriate under the applicable framework, Okeanun may provide the Center with technical information to assess the lawfulness of the processing and the safeguards applied.

8. Notification of security breaches

Okeanun will notify the Center, without undue delay, of any personal-data breach it becomes aware of affecting data processed on the Center’s behalf in the Service, providing sufficient information for the Center to meet its risk-assessment, documentation and, where applicable, supervisory-authority notification and data-subject communication obligations, per applicable law. Okeanun will document incidents as needed for traceability and to give the Center essential information on facts, effects and corrective measures taken or planned.

9. Authorized sub-processors and general authorization regime

The Center grants Okeanun general authorization to use sub-processors necessary to provide the Service (for example, hosting, database, document-storage, transactional-email, error-diagnostics, payment and notification or map providers where applicable), provided Okeanun: (i) imposes on the sub-processor, by contract or other legal instrument, the same data-protection obligations set out in this Agreement; (ii) keeps reasonable control of guarantees, security measures and compliance; and (iii) informs the Center of any intended addition or replacement of sub-processors, giving it the chance to object on justified grounds. The Center acknowledges that, if a sub-processor fails its obligations, Okeanun remains fully liable to the Center for meeting those obligations within the arrangement.

10. International transfers linked to sub-processors

Where providing the Service involves transfers of personal data to third countries or international organisations, Okeanun will process that data on the Center’s behalf only per the Center’s documented instructions and with the applicable appropriate safeguards, and will make available to the Center reasonable information on the existence of transfers and the safeguard framework used, as needed for the Center’s compliance documentation as controller, including its records of processing and, where applicable, impact assessments.

11. Prohibition on disclosing data to third parties and disclosure limits

Okeanun will not assign or disclose personal data processed on the Center’s behalf to third parties, except to the extent necessary to provide the Service through authorized sub-processors or where a legal obligation applies to Okeanun. The Center acknowledges that engaging a processor creates no direct legal link between Okeanun and the Center’s data subjects, so communications to data subjects, privacy information and the legal basis are the Center’s responsibility, except for processing where Okeanun acts as controller on its own account.

12. Fate of data at the end of provision

On termination of the Service for any reason, and at the Center’s choice, Okeanun will (i) delete the personal data processed on the Center’s behalf, or (ii) return it to the Center or a third party designated by the Center, in a reasonable format and per the Service’s technical capabilities, and delete existing copies, unless EU or Spanish law requires retention. This Agreement establishes that the default operational choice is deletion/return, without prejudice to the Center requesting the alternative within the export period enabled by the Service. Where there is a legal obligation to retain certain data (for example, minimum security logs or information strictly necessary to defend claims), such data will be limited, blocked or restricted as appropriate and not used for incompatible purposes.

13. Compliance information, audits and inspections

Okeanun will make available to the Center the information necessary to demonstrate compliance with the obligations under this Agreement and will allow and contribute to reasonable audits, including inspections, by the Center or an auditor it authorizes, provided that (i) there is reasonable notice, (ii) the scope is limited to what is strictly necessary to verify compliance with the arrangement, (iii) the security and confidentiality of Okeanun’s other customers and systems is preserved, and (iv) operational access conditions, schedules and security measures are agreed in good faith. Documentation may be delivered electronically and may include evidence of sub-processor contracts, applicable security policies and general descriptions of technical and organizational measures, to the extent compatible with Service security.

14. Processor’s records of processing and traceability

Okeanun will keep the records of processing activities corresponding to its role as processor for processing carried out on the Center’s behalf, with the applicable content and scope, and will cooperate with the supervisory authority when required, without prejudice to the documentation and record obligations that fall on the Center as controller. The Center acknowledges the need for documentary traceability to evidence diligence and accountability in complying with data-protection law.

15. Center obligations as controller

The Center warrants it has a sufficient legal basis to process the personal data it enters or manages in the Service and that it has met its obligations to inform data subjects, including, where it processes special-category data (e.g., health data), obtaining the reinforced legitimation required and implementing appropriate safeguards. The Center is responsible for defining and documenting its purposes, keeping its records of processing, handling rights requests, and setting internal procedures for breach notification and risk management, and may request from Okeanun the assistance agreed in this Agreement.

16. Contact point and data-protection communications

For operational coordination of the arrangement, Okeanun’s contact point for matters relating to this Agreement is [email protected]. The Center will designate an internal contact point for operational requests related to the arrangement, via the email it provides at sign-up or in its communications. Communications may be made electronically, keeping reasonable traceability of requests and instructions.

17. Integration, precedence and amendments

This Agreement forms an integral part of the Okeanun Manager Terms and specifically governs processing on the Center’s behalf. In case of conflict between this Agreement and other contractual terms regarding processing under the arrangement, this Agreement prevails. Okeanun may update this Agreement where necessary to adapt it to regulatory, security or service changes, notifying the new version to the Center on reasonable notice, with its validity tied to keeping the subscription and with version and acceptance date recorded.

18. Standard contractual clauses as a basis for the Agreement

Where appropriate, this Agreement may rely, wholly or partly, on the standard contractual clauses approved by the European Commission for controller-processor relationships, which will be integrated as a standardised element and will prevail, where applicable, over conflicting provisions on the arrangement, keeping consistency with the rest of the clauses.

19. Formalisation and reinforced detail of the controller’s instructions

The Parties may complete this Agreement with a technical annex of processing and flows detailing, per Manager module, the data processed, the sub-processors involved and the communications that occur, reinforcing the precision of the Center’s documented instructions and the traceability of both Parties’ diligence. Such annex, where it exists, forms an integral part of the Agreement.