Data Processing Addendum

1. Scope and roles

This addendum forms part of the Operator Agreement where Yamira processes personal information on an operator’s instructions. The operator is the controller/business for that processing and Yamira is its processor/service provider. Separate platform account, billing, security, and legally required processing may involve Yamira’s independent controller role.

The subject matter is delivery of the subscribed software and authorized integrations for the contract duration and applicable retention period. Data subjects may include guests, customers, personnel, and contacts; data may include contact details, bookings, manifests, documents, payment records, and authorized location information.

2. Instructions and confidentiality

Process operator personal information only on documented instructions, including the agreed service configuration, unless applicable law requires otherwise. Notify the operator of such a legal requirement where allowed. Tell the operator if an instruction appears to infringe applicable data-protection law.

Limit access to authorized personnel bound by confidentiality and legitimate duties. Do not sell personal information or use it for unrelated advertising. The operator remains responsible for lawful instructions, notices, permissions, and appropriate collection.

3. Security and assistance

Maintain appropriate technical and organizational safeguards proportionate to the information and risks, including access restrictions, authentication, tenant separation, secure transport, protected credentials, and recovery procedures. Avoid promises of certifications or controls that have not been independently established.

Provide reasonable assistance with access, correction, deletion, objection, portability, security obligations, impact assessments, and regulator consultations, taking account of the nature of processing and information available.

4. Security incidents

Notify the operator without undue delay after becoming aware of a personal-data breach affecting its processed information. Provide available information about the nature, affected records, likely consequences, containment, and contact, with further updates as known.

Coordinate investigation and preserve evidence. The controller determines its own regulator and individual notification obligations; this addendum does not replace statutory deadlines or require public disclosure of unverified allegations.

5. Subprocessors and transfers

The operator gives general authorization to necessary providers listed in the Privacy Policy and subprocessor information, including relevant hosting, database, storage, and transactional-email services. Payment providers may act independently for regulated payment functions; roles must be assessed for the actual processing.

Before adding a new subprocessor for operator data, provide reasonable notice through the platform or account contact and an opportunity to raise a reasoned data-protection objection. Impose equivalent applicable processing safeguards by contract and remain responsible for the subprocessor obligations for which the law makes Yamira responsible.

International transfers require a lawful basis and, where necessary, recognized contractual clauses or other appropriate safeguards. The parties will execute applicable EU or UK transfer terms when required for the actual transfers; this addendum does not claim that an unsigned transfer document is already in place.

6. End of service, retention, and audit

On termination, return or delete processed operator personal data according to its lawful instructions, except records legally required to be retained. Apply the published retention procedure to backups and legal holds, restrict retained data, and explain exceptions.

Provide information reasonably needed to demonstrate compliance and allow proportionate audits or inspections required by applicable law, with arrangements protecting other tenants, security, and confidential information. Reasonable scheduling or confidentiality arrangements must not frustrate a statutory right.

7. Conflicts and contact

This addendum controls an inconsistent personal-data processing provision in the Operator Agreement. Mandatory data-protection law and any properly executed transfer clauses take precedence where applicable. Contact ramjohncapital@gmail.com for processing instructions, incidents, or requests.