Data Processing Agreement

For new accounts, this version applies from sign-up, from Wednesday 14 October 2026. For existing accounts, it takes effect on Monday 23 November 2026; until then, the current version applies.

1. Parties, scope and priority

Helmwise (Pty) Ltd is registered in South Africa under company number 2026/258092/07. Its registered office is Flat 601, Dunhof Flats, 12 Hall Road, Cape Town, Western Cape, 8005, South Africa.

This Data Processing Agreement (DPA) forms part of the Handover service agreement between Helmwise (Pty) Ltd, South Africa, and the Customer identified in the accepted order, account arrangement or written agreement. The Customer's authorised representative accepts it through incorporation into that agreement or a separate written acceptance. Listing a vessel name alone does not identify the contracting person or organisation.

This DPA applies to personal data Helmwise processes on the Customer's behalf (Customer Data). The Customer is the controller or responsible party, or a processor acting on the instructions of an identified upstream controller. Helmwise is the processor or operator, or subprocessor respectively. A Customer acting for another controller must have authority for these arrangements and onward processing.

For the SCCs and the UK Addendum in section 5, the Customer is the data exporter, with the contact details in its account, and Helmwise is the data importer. Helmwise's contact is its Information Officer, Charl Dettmer, at hello@thehandover.app. Its activity is providing the Handover service.

This DPA does not govern the purposes for which Helmwise acts as an independent controller, as described in the Privacy Policy. Roles follow the actual activity and applicable law, not merely the labels in this agreement.

Applicable Data Protection Law means the laws governing the relevant processing, including South Africa's POPIA and, where applicable, the EU GDPR and UK data protection law. Their defined terms apply. This DPA prevails over conflicting service terms for Customer Data; mandatory law and binding transfer clauses take priority over both.

2. Instructions and the Customer's responsibilities

The agreement, Schedule 1, authorised use of the service and subsequent documented directions constitute the Customer's instructions. Helmwise will process Customer Data only on those instructions, including for transfers, unless a legally permitted requirement obliges otherwise. For processing governed by EU or UK GDPR, the exception to instructions is limited to the applicable Union or Member State law, or UK law, as required by that regime. A demand from another country does not by itself authorise a restricted transfer.

Helmwise will notify the Customer of a legal requirement before processing unless prohibited by law. For EU/UK GDPR processing, withholding that notice is limited to a prohibition under the applicable law on important grounds of public interest, as required by the respective regime. Helmwise will assess the lawfulness of disclosure and limit it to what is required. Helmwise will immediately notify the Customer if, in its opinion, an instruction infringes applicable data protection law and may suspend the affected processing while the issue is resolved.

The Customer, where it acts as controller, determines the purposes, lawful grounds, relevant data subjects and retention instructions. Where it is a processor, those decisions belong to the identified upstream controller, and the Customer must hold and convey its authorised instructions. The Customer must provide or arrange the required notices, manage user access, ensure the applicable conditions for sensitive and children's information are met, and identify the upstream controller and necessary authorisations. Helmwise processing that information on instructions does not supply those conditions. These duties do not remove Helmwise's own obligations.

Helmwise will not sell Customer Data, use it for unrelated purposes or train general-purpose AI models on it. Helmwise will not use Customer Data to score individual crew performance. Supplier processing must remain within the authorised purposes and obligations below.

3. Confidentiality and security

Helmwise will ensure that people authorised to process Customer Data are bound by confidentiality duties and receive access only as necessary for their role. It will maintain technical and organisational measures appropriate to the risk, including the measures in Schedule 2, and assess their effectiveness regularly.

Measures may evolve, but Helmwise will not materially reduce the agreed level of protection. The Customer remains responsible for its own devices, instructions, account permissions and copies it exports. Those responsibilities do not excuse failures within Helmwise's control.

4. Subprocessors and supplier changes

The Customer gives general written authorisation for the subprocessors identified for its processing in Schedule 3 and the agreed processing record. Authorisation covers only the stated purposes and relevant features, not unrelated uses of Customer Data. Helmwise will bind subprocessors by written terms providing the data-protection obligations required by applicable law and remains responsible for their performance as required by that law.

Helmwise will give the Customer at least 30 days' written notice before a new or replacement subprocessor begins processing its Customer Data, unless the Customer gives specific written authorisation for an earlier start. The notice will identify the supplier, purpose, relevant locations and intended start date, directly or through an accessible, versioned supplier list. Posting an update alone is not a substitute for the promised notice. Where one of our suppliers adds or replaces its own subprocessor on shorter notice than this, we will tell the Customer as soon as we are told, and the Customer's right to object applies from then. These are service notices, not product updates. They are sent whether or not any user has turned off Handover updates.

The Customer may object on reasonable data-protection grounds within that period. Helmwise will work in good faith to resolve the objection. It will not treat a timely unresolved objection as approval or send the affected Customer Data to the proposed supplier while the objection remains unresolved. The parties may agree another arrangement; Helmwise is not obliged to build a separate AI route for one vessel.

If the objection cannot be resolved, the Customer may stop using the affected feature or end the affected subscription. Helmwise will refund prepaid fees for the remaining period of a subscription ended under this provision, as explained in the Refund Policy. This specific remedy overrides general non-refundable-renewal wording. No subscription payment means there are no prepaid subscription fees to refund, but the right to stop the affected processing and request authorised return or deletion remains.

A change of model at the same provider does not, by itself, authorise a new company, processing purpose, country or reduction in protection. Any such accompanying change must meet the applicable notice, instruction and transfer requirements.

5. International transfers

Transfers to Helmwise. Helmwise is established in South Africa. Customer Data is stored in Ireland, and Helmwise staff in South Africa can access it to run and support the service. For Customer Data subject to the EU GDPR, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021 (the SCCs) are incorporated into this DPA by reference and apply to those transfers from the date the Customer accepts this DPA. They apply to the extent Helmwise's processing is not already directly subject to the GDPR. Where it is, Helmwise complies with the GDPR directly and keeps every commitment in this DPA. The SCCs apply as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. The Customer is the data exporter and Helmwise is the data importer.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorisation) applies, with the notice period in section 4 of this DPA.
• Clause 11(a): the optional wording does not apply.
• Clause 13(a): the competent supervisory authority is the one responsible for the Customer's compliance with the GDPR for the transfer, applying the wording in Clause 13(a) that fits the Customer's situation.
• Clause 17: Option 1 applies. The SCCs are governed by the law of Ireland.
• Clause 18(b): disputes are resolved by the courts of Ireland.
• Annex I.A (parties): the data exporter is the Customer, with the name, address and contact in its account; its activity is operating a vessel and keeping crew handover records; its role is controller, or processor where it acts for another controller. The data importer is Helmwise (Pty) Ltd, at the address in section 1, contact Charl Dettmer, Information Officer, hello@thehandover.app; its activity is providing the Handover service; its role is processor, or subprocessor where the Customer is a processor. The Customer's acceptance of this DPA, and Helmwise's provision of the service under it, count as both parties' signature, dated the day the Customer accepts.
• Annex I.B (transfer): the categories of people and data, the purposes, how long data is kept and transfers to subprocessors are in Schedule 1. Transfers are continuous while the service is used. Crew notes can contain health details; the safeguards for them are access limited by vessel and position, encryption, the limited text masking described in Schedule 2, and private AI for qualifying vessels.
• Annex I.C (supervisory authority): the authority under Clause 13(a) for the Customer's situation. Where the Customer has no establishment or representative in the EU, that is the supervisory authority of the EU member state where the crew whose data is transferred are located.
• Annex II: the technical and organisational measures are in Schedule 2.
• Annex III: the list of subprocessors is in Schedule 3.

United Kingdom. For Customer Data subject to UK data protection law, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) (the UK Addendum) is incorporated by reference from the date the Customer accepts this DPA, and the SCCs selected above also apply to transfers subject only to UK data protection law. Tables 1 to 3 are completed with the information in this section, section 1 and Schedules 1 to 3. For Table 4, neither party may end the UK Addendum under its Section 19. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

Switzerland. For Customer Data subject to the Swiss Federal Act on Data Protection, the SCCs apply with the changes Swiss law requires. References to the GDPR include the Swiss Act. For transfers subject only to the Swiss Act, the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority. For transfers subject to both the Swiss Act and the GDPR, the FDPIC is competent for the Swiss data and the EU authority under Clause 13 for the EU data. People in Switzerland can bring claims where they normally live.

Priority. If this DPA or the service agreement conflicts with the SCCs or the UK Addendum, the SCCs and the UK Addendum prevail. For UK transfers, the UK Addendum prevails over any conflicting wording in the SCCs.

Onward transfers. Helmwise transfers Customer Data to suppliers outside the EU, the UK and Switzerland only under an adequacy decision (including the EU-US Data Privacy Framework where the supplier is certified), the SCCs agreed with that supplier, or another lawful mechanism, with additional safeguards where needed. Schedule 3 lists the mechanism for each supplier.

South Africa. Transfers out of South Africa also meet section 72 of POPIA.

Information. On request, Helmwise will give the Customer the information needed to assess these transfers and a copy of the SCCs as completed for it, with lawful redactions to protect confidential information.

6. Personal-data breaches

Helmwise will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data and, in any event, within 72 hours. Where POPIA's operator-notification duty applies, it will notify the responsible party immediately upon reasonable grounds to believe that an unauthorised person has accessed or acquired the information. The 72-hour outer limit does not postpone that immediate duty.

Notification will include the available description of the incident, affected data and people, likely consequences, containment and remediation, a contact point and information needed for the Customer's reporting duties. Missing details will follow promptly in phases; the initial notice will not wait for a completed investigation. Helmwise will preserve relevant evidence and reasonably assist investigation, mitigation and legally required notifications.

7. Rights requests and compliance assistance

Helmwise will promptly tell the Customer about a request concerning Customer Data and provide appropriate assistance with access, correction, erasure, restriction, objection and portability. It will not decide the response on the Customer's behalf without instructions, except where law requires otherwise. Requests concerning Helmwise's own controller purposes are handled separately.

Taking account of the processing and information available, Helmwise will assist with security obligations, breach reporting, impact assessments and prior consultation with regulators. Assistance must be timely enough to enable applicable deadlines; there is no blanket 30-day waiting period for help. Any reasonable charges for exceptional assistance must be agreed in advance and must not prevent required cooperation or apply to work needed to remedy Helmwise's own breach.

8. Information, audits and inspections

Helmwise will make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the Customer or an independent auditor it appoints. Documentary evidence may be used first where sufficient, but does not remove an inspection right needed to verify compliance.

The parties will agree reasonable notice, confidentiality and security arrangements that protect other customers without obstructing effective scrutiny. Urgent incidents, regulatory requests or reasonable evidence of non-compliance may require faster access. Ordinary audit costs are the Customer's responsibility; Helmwise bears reasonable additional costs caused by its material non-compliance. Costs cannot be used to defeat legally required oversight.

9. Return, deletion and survival

On termination, or a valid instruction covering particular Customer Data, Helmwise will, at the Customer's choice, return the data in a commonly usable format or securely delete it, and delete remaining copies unless legally required to retain them. If return is chosen, remaining service copies are also deleted after return unless otherwise lawfully instructed or required. Active-system deletion will be completed within 30 days of the valid instruction or agreed end of the service, subject to legally required retention and any shorter applicable deadline.

Backup copies awaiting their established deletion cycle must be kept beyond ordinary use, protected and deleted as soon as that cycle permits. The current cycle is a daily backup kept for 7 days. If restored, the deletion instruction must be reapplied. Helmwise will communicate the relevant cycle and any legally required retention, instruct applicable subprocessors to return or delete data, and confirm completion and any remaining lawful exception in writing. For Customer Data governed by EU GDPR, the required-storage exception is limited to applicable Union or Member State law; for UK GDPR it is limited to UK law, as required by the respective regime. Other legal demands must be assessed consistently with section 2 and the applicable transfer rules. General convenience or an unspecified right to retain data does not create an unlimited retention exception.

The data-specific treatment of audio, imports, attachments and shared records is set out in Schedule 1 and the Privacy Policy. Copies controlled independently by the Customer, recipients or messaging users are outside Helmwise's direct deletion control. This does not remove its obligations for its own processors and processing.

This DPA remains effective for as long as Helmwise or its subprocessors hold Customer Data. Ending a user account does not extinguish the Customer's obligations or authorise deletion of another controller's records.

10. Liability, law and contact

The service agreement's liability terms apply only to the extent consistent with mandatory data-protection law and binding transfer clauses. Nothing limits a person's non-waivable rights, a regulator's powers or a liability that cannot lawfully be excluded. South African law applies subject to those requirements and any mandatory jurisdiction rules.

Privacy and DPA contact: Charl Dettmer, Information Officer, hello@thehandover.app.

Schedule 1. Processing details

The accepted order or written processing record identifies the actual Customer, any upstream controller, contacts, selected features and any additional restrictions. Processing outside this scope requires lawful documented instructions and appropriate safeguards.

Schedule 2. Security measures

Helmwise will maintain vessel-scoped access controls and database policies; authentication; restricted privileged access; confidentiality duties; encrypted network connections; appropriate protection for stored data; and controlled handling of exports and supplier access. These controls must be supported by security review, incident response, backup and restoration procedures, and verification that deletion instructions are reapplied after restoration. Database backups are taken daily and kept for 7 days.

For private AI, the client verifies the protected environment before establishing the connection used to submit content. A verification failure prevents submission through that connection. Failure to read production routing settings does not trigger standard-AI fallback; a separate private-only setting may continue to route privately. An eligible text retry stays with the same private provider. Session replay is disabled in application code.

Text masking is a limited supplementary control. Before text reaches an AI service, Handover replaces private details, such as names, numbers and addresses, with placeholders and puts them back in the answer. It is on by default and covers every AI request that sends text. A boat admin can switch it off. It can miss some details, it does not pick out health or medical details, and voice recordings and photos go as they are. Masking does not take the data outside data-protection law. Authorised Helmwise staff can reach service data where their role needs it. These measures reduce risk; they do not remove it.

Helmwise will review the appropriateness and effectiveness of its measures, address identified vulnerabilities proportionately and provide relevant security information under section 8. No independent certification of Helmwise is represented merely because a supplier has a certification.

Schedule 3. Supplier scope and processing record

The Privacy Policy's recipient table identifies the services used in providing Handover. For Customer Data, authorised supplier functions include Supabase storage and authentication (EU, Ireland); Vercel hosting (website servers in the EU, Dublin; content delivery can involve other locations); the applicable private or standard AI services (Tinfoil, Inc. for private AI and OpenAI for standard AI); Resend delivery; Twilio and the WhatsApp Business Platform for that optional feature; and Sentry where diagnostics process Customer Data on instructions. Other listed services are included only to the extent they process Customer Data on the Customer's behalf for an agreed feature or purpose.

Product analytics, billing and service-administration activities performed for Helmwise's own purposes are not automatically brought within the Customer's processor instructions by listing their providers. WhatsApp's relationship with its users and payment providers' independent activities must be distinguished from business-platform processing on behalf of the Customer.

The table below is the processing record for the suppliers that handle Customer Data. It names each contracting company, its country, the transfer basis and how Customer Data is deleted. Direct subprocessors are marked; onward suppliers are named under the supplier that uses them.

This record and this schedule are updated through section 4. They cannot be expanded merely by changing a general website list without the required notice and opportunity to object.