Data processing agreement

The parties

Controller: your organisation, as identified by the account you registered.

Processor: Volodymyr Petrunin, Prästgårdsvägen 50, 439 31 Onsala, Sweden.

What is processed, and for how long

Subject matter: providing the AquaTrack service. Duration: for as long as your account exists.

Categories of people: your customers, and the colleagues you invite.

Categories of data: names, contact details, addresses, boats and their identifiers, the work carried out and the hours recorded against it, and the money documents raised for it.

We act on your instructions

We process personal data only in order to provide the service, and only on your documented instructions. Using the product is such an instruction.

If we believe an instruction breaks data protection law, we will say so.

Security

We take the measures Article 32 requires, in proportion to the risk. In practice, today, that means:

• Traffic between the browser and the server is encrypted, and the browser is told to refuse an unencrypted connection in future.
• Each yard is separated from every other, and a request for another yard is refused rather than filtered.
• Access inside a yard is by role, and it is enforced by the server rather than by hiding buttons.
• Your sign-in is never stored anywhere a script on the page could read it, and the page runs only code we published: no advertising, no analytics, and nothing loaded from anyone else.
• The application refuses to be displayed inside another website, so a copy of it cannot be dressed up to collect your password.
• Changes to records are written to an activity log that can be read but not edited.
• Passwords are held by a dedicated identity server and are never stored by the application.

Sub-processors

You give general authorisation for the sub-processors listed in our privacy policy. We will tell you before we add or replace one, and you may object.

Each of them is bound by terms no weaker than these.

When your customer asks, or an authority does

A boat owner can ask you for a copy of everything you hold about them, ask you to correct it, or ask you to delete it. Answering is your obligation rather than ours, and the law gives you one month. We will help you do it. In most cases you will not need us: the reports page exports your whole yard to a spreadsheet at any time, without asking anyone.

Two rarer duties can also land on you. Before starting anything that carries a high risk to people, a controller has to write down an assessment of that risk, and in some cases ask the Swedish Authority for Privacy Protection about it first. Running an ordinary boatyard almost never triggers either one. If it ever does, we will tell you everything we know about how AquaTrack stores and protects your data, which is the part you cannot answer without us. We cannot write the assessment for you, because it is about your business rather than about our software.

If something goes wrong

If we discover a personal data breach, we will tell you without undue delay, with what we know at the time and what we are doing about it.

Getting your data back, and its deletion

You can export your whole yard at any time, unprompted, from the reports page.

When the agreement ends we delete the personal data we hold for you, except where the law requires us to keep it.

Audit

We will give you the information you need in order to show that this agreement is being met, and allow an audit on reasonable notice.