Data Processing Agreement (DPA) — Appointment as Data Processor under Art. 28 GDPR

Version: 1.0 · Date: 16/10/2026 · In case of discrepancy the Italian version prevails.

This agreement governs the processing of the personal data of end customers (passengers/participants) that the nautical Operator enters into the Easea platform or collects through the widget. In that processing the Operator is the Controller and Easea is the Processor. It forms an integral part of the Terms & Conditions and is deemed accepted upon subscription to the Service. In case of discrepancy, the Italian version prevails.

Between

The Controller — the nautical Operator (the "Controller" or "Operator"), the natural or legal person subscribing to the Easea Service, whose identifying data result from the account and billing details provided;

and

The Processor — Luca La Marca, Italian Tax Code LMRLCU98L02F943F, VAT No. 07543890482, Via De Amicis 2, 50018 Scandicci (FI), Italy, e-mail info@easea.app, owner of the "Easea" platform (the "Processor" or "Easea").

Together the "Parties".

Recitals

(a) The Processor provides the Operator with the "Easea" SaaS platform for managing the bookings, customers, vessels, activities, staff and payments of the Operator's nautical business;

(b) in delivering the Service, the Processor processes personal data of the Operator's end customers on behalf of the Operator, who remains the autonomous Controller thereof;

(c) the Parties wish to govern such processing pursuant to Art. 28 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 ("Privacy Code").

1. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "sub-processor" have the meaning set out in Art. 4 GDPR. "Data" means the personal data covered by this Agreement, described in Annex A.

2. Subject matter, duration and roles of the Parties

2.1 This Agreement governs the processing of the Data carried out by the Processor on behalf of the Controller in the context of the Service.

2.2 The Operator is the Controller; Easea is the Processor and acts solely on the Controller's documented instructions (Art. 5).

2.3 The Agreement lasts for the term of the Service contract (Terms & Conditions) and ends with it, without prejudice to the obligations under Art. 11 (return/deletion).

2.4 The subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects are specified in Annex A.

3. Nature and purpose of the processing

The Processor processes the Data solely to deliver the Service (management of the Operator's bookings and customers, transactional communications, payment handling through the providers listed in Annex B), in accordance with the purposes described in the Terms & Conditions and the Service documentation.

4. Processor's obligations (Art. 28(3) GDPR)

The Processor undertakes to:

(a) process the Data only on documented instructions from the Controller (including as regards transfers outside the EEA), unless required by EU/Member State law, in which case it informs the Controller before processing unless the law prohibits it;

(b) ensure that persons authorised to process the Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality;

(d) respect the conditions for engaging sub-processors (Art. 8);

(e) assist the Controller by appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise data subjects' rights (Arts. 12–23);

(f) assist the Controller in ensuring compliance with the obligations under Arts. 32–36 (security, breach notification, DPIA, prior consultation), taking into account the nature of the processing and the information available;

(g) at the Controller's choice, delete or return all the Data at the end of the Service and delete existing copies, unless retention is required by EU/Member State law (Art. 11);

(h) make available to the Controller all information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits and inspections (Art. 10).

5. Documented instructions

5.1 The following constitute the Controller's documented instructions: this Agreement, the Terms & Conditions, the Service documentation and the configurations made by the Controller through the interface.

5.2 The Processor immediately informs the Controller if it considers that an instruction infringes the GDPR or other applicable law.

6. Confidentiality

The Processor ensures that anyone acting under its authority who has access to the Data is bound by confidentiality and processes the Data only on the Controller's instructions.

7. Security of processing (Art. 32)

Taking into account the state of the art, the costs, the nature/context/purposes of the processing and the risks, the Processor implements the technical and organisational measures described in Annex C, including encryption in transit (TLS) and at rest, pseudonymisation where appropriate, RBAC access control, backups, logging and recovery procedures.

8. Sub-processors

8.1 The Controller grants general authorisation to engage the sub-processors listed in Annex B.

8.2 The Processor informs the Controller of any intended addition or replacement of sub-processors with at least 15 days' notice, giving the Controller the opportunity to object on reasonable data-protection grounds.

8.3 The Processor imposes on sub-processors, by contract, equivalent data-protection obligations to those of this Agreement and remains fully liable to the Controller for the sub-processors' performance.

9. Assistance, data subject rights and breaches

9.1 Data subject requests. The Processor forwards to the Controller without undue delay any request received from data subjects and assists the Controller in responding; it does not respond directly to the data subject unless instructed by the Controller.

9.2 Personal data breaches. The Processor notifies the Controller without undue delay and in any event within 48 hours of becoming aware of a breach affecting the Data, providing the information under Art. 33(3) so the Controller can meet its obligations towards the Authority and data subjects.

9.3 DPIA / prior consultation. The Processor assists the Controller with data protection impact assessments (Art. 35) and prior consultations (Art. 36) within its remit.

10. Audits

10.1 The Processor makes available the information necessary to demonstrate compliance and allows for audits, including through third-party certifications/reports (e.g. ISO 27001, SOC 2) of the infrastructure providers.

10.2 On-site audits upon reasoned request, with reasonable notice, no more than once a year save in the event of an incident or an Authority request, respecting confidentiality and Service continuity.

11. Return and deletion of the Data

At the end of the Service, the Processor, at the Controller's choice, deletes or returns the Data within 30 days and deletes existing copies, save for retention obligations under EU/Member State law. The Controller's account-deletion mechanism provides for a 15-day grace period, after which the data is permanently erased (cascading deletion and file-store cleanup).

12. Transfers outside the EEA

12.1 The Data is hosted in the EU/EEA. Some sub-processors (Annex B) may process data in the United States: such transfers take place on the basis of the adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework, Art. 45 GDPR) for certified entities and/or the Standard Contractual Clauses (Art. 46.2.c), with supplementary measures where necessary.

12.2 The Processor does not transfer the Data outside the EEA without a valid transfer basis and without the Controller's instruction/authorisation.

13. Liability

The Parties' liability is governed by Art. 82 GDPR and the relevant clauses of the Terms & Conditions. Nothing in this Agreement limits data subjects' rights or the powers of the supervisory authority.

14. Governing law and jurisdiction

This Agreement is governed by Italian law. The Court of Florence has exclusive jurisdiction over any dispute, save for any mandatory venue.

Annex A — Processing details

Subject matter: Processing of the Operator's end-customer data to deliver the Easea Service
Duration: For the term of the Service contract
Nature: Collection, recording, storage, consultation, organisation, disclosure to sub-processors, deletion
Purpose: Booking and customer management; transactional communications; deposit/payment collection via Stripe
Categories of data subjects: End customers / passengers / participants in the Operator's activities
Categories of data: First/last name; e-mail; phone; language; booking details (dates, activity, vessel, number/type of participants); free-text notes; documents uploaded by the Operator (passport, ID card, driving licence, rental contract); if enabled by the Controller: invoicing data (tax code, VAT number, company name, address, SDI code, PEC) and consent records (privacy notice acknowledgement, marketing consent)
Special categories (Art. 9): Not envisaged: the document type enum does not include health data. Residual: free-text note field — minimisation recommended (do not enter health data)
Payments: Card data is processed solely by Stripe; Easea neither processes nor stores it

Annex B — Authorised sub-processors

Amazon Web Services, Inc. (AWS) — Service: Infrastructure hosting, file storage (S3, eu-west-2); Location / processing: EU (Ireland) + US; Transfer mechanism: DPF / SCC
Stripe, Inc. — Service: Payment processing (Connect, deposits); Location / processing: US; Transfer mechanism: DPF / SCC
Google LLC — Service: Google Analytics, APIs, Maps, Cloud Translate; Location / processing: US / EU; Transfer mechanism: DPF / SCC
Expo (Expo / EAS) — Service: Push notifications (device token); Location / processing: US; Transfer mechanism: SCC
Apple Inc. — Service: Sign in with Apple (authentication); Location / processing: US; Transfer mechanism: DPF / SCC
Resend, Inc. — Service: Transactional e-mail delivery; Location / processing: US; Transfer mechanism: DPF where certified / SCC

Annex C — Technical and organisational measures (Art. 32)

Encryption of data in transit (TLS/HTTPS) and at rest;
cryptographic password hashing (bcrypt);
role-based access control (RBAC) with least-privilege; data segregation per Operator;
audit trail of admin impersonation sessions with IP, user agent and limited duration;
periodic encrypted backups; access logging and monitoring;
infrastructure on AWS with ISO 27001 and SOC 2 certifications;
breach-management procedure with notification to the Controller within 48 hours.