Data Processing Addendum

2.1 Processing Activities

Ship Captain processes Customer Data solely to provide the shipping and warehouse management services described in the Agreement, including:

• Creating and managing shipping labels
• Processing shipment tracking and delivery notifications
• Managing warehouse inventory and order fulfillment
• Synchronizing orders from connected e-commerce platforms
• Processing payments and maintaining transaction records
• Providing customer support related to shipments

2.2 Categories of Data Subjects

• Your customers (shipping recipients)
• Your employees and team members
• Your suppliers and business contacts

2.3 Types of Personal Data

• Contact Information: Names, addresses, email addresses, phone numbers
• Shipping Information: Package contents descriptions, delivery instructions, signature requirements
• Order Information: Order IDs, product details, quantities, pricing
• Commercial Information: Transaction history, payment records (excluding full card numbers)

2.4 Processing Duration

Ship Captain will process Customer Data for the duration of the Agreement and thereafter only as required to fulfill legal obligations or as specified in our data retention policy.

Ship Captain, as the Data Processor, agrees to the following obligations:

3.1 Documented Instructions

We will process Customer Data only on your documented instructions, unless required by applicable law. If we believe an instruction infringes Data Protection Laws, we will inform you.

3.2 Confidentiality

All personnel authorized to process Customer Data are bound by confidentiality obligations. Access is limited to employees who require it to perform their duties.

3.3 Security Measures

We implement and maintain appropriate technical and organizational measures to protect Customer Data against unauthorized access, loss, or destruction, as detailed in Annex A (Security Measures).

3.4 Sub-processor Management

We will impose data protection obligations on Sub-processors that are substantially equivalent to those in this DPA. We maintain a list of current Sub-processors in Annex B and will provide notice of any changes.

3.5 Assistance

We will assist you in fulfilling your obligations regarding data subject rights, security incident response, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of processing.

3.6 Return or Deletion

Upon termination of the Agreement, we will, at your choice, delete or return all Customer Data and delete existing copies unless retention is required by applicable law.

Ship Captain maintains comprehensive security measures to protect Customer Data. These measures are detailed in Annex A and include:

4.1 Access Controls

• Role-based access control (RBAC) limiting data access to authorized personnel
• Two-factor authentication (2FA) for all employee and user accounts
• API key authentication with granular permission scopes
• Regular access reviews and prompt deprovisioning of terminated personnel
• Temporary access by Ship Captain personnel to Customer accounts (for support and troubleshooting) is restricted to authorized staff through role-based access controls, requires multi-factor authentication, is time-limited, and is recorded in audit logs; personnel are bound by confidentiality obligations

4.2 Encryption

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Secure key management with regular rotation

4.3 Infrastructure Security

• Hosted on Amazon Web Services, whose infrastructure services are SOC 2 Type II compliant. Ship Captain's own SOC 2 certification is on our roadmap
• AWS Shield Standard DDoS protection; rate limiting and abuse prevention at the application layer
• Network segmentation (private subnets, security-group-based ingress control) and AWS GuardDuty threat detection
• Automated vulnerability scanning in our CI pipeline (Trivy filesystem scanning and dependency advisory audit); third-party penetration testing program in development

4.4 Operational Security

• 24/7 infrastructure monitoring and alerting
• Documented incident response procedures
• Security expectations documented in acceptable-use and onboarding materials; formal security awareness training program in development
• Secure software development lifecycle (SDLC)

4.5 Business Continuity

• Automated daily backups with multi-AZ durability in our primary AWS region (us-west-1) and automated cross-region snapshot replication to a secondary AWS region (us-east-1), each encrypted at rest with separate KMS-managed keys
• Documented restore procedures with defined RTO and RPO targets, supported by point-in-time recovery on the primary database
• Cross-region active failover capability for critical services is on our roadmap

5.1 Authorization

You authorize Ship Captain to engage Sub-processors to process Customer Data as necessary to provide the services. A current list of Sub-processors is maintained in Annex B and at shipcaptain.com/legal/subprocessors.

5.2 Sub-processor Obligations

Before engaging a Sub-processor, Ship Captain will enter into a written agreement imposing data protection obligations that are substantially equivalent to those in this DPA. Ship Captain remains liable for the acts and omissions of its Sub-processors.

5.3 Notification of Changes

Ship Captain will provide at least 30 days' advance notice before adding or replacing a Sub-processor by updating the Sub-processor list and sending notice to your account email. You may subscribe to Sub-processor change notifications at [email protected].

5.4 Objection Right

You may object to a new Sub-processor by notifying us within 14 days of receiving notice. Your objection must be based on reasonable grounds relating to data protection. We will work with you to address your concerns. If we cannot reasonably accommodate your objection, you may terminate the affected services without penalty.

5.5 Current Sub-processors (Summary)

Full Sub-processor list with processing details available in Annex B and at /legal/subprocessors.

6.1 Assistance with Requests

Ship Captain will assist you in responding to requests from data subjects exercising their rights under Data Protection Laws, including requests for access, rectification, erasure, restriction, portability, and objection.

6.2 Request Handling

If Ship Captain receives a request directly from a data subject regarding Customer Data, we will promptly notify you and await your instructions, unless required by law to respond directly. We will not respond to such requests without your prior authorization, except to acknowledge receipt and inform the data subject that we are the processor.

6.3 Self-Service Tools

The Ship Captain platform provides self-service tools that allow you to access, export, correct, and delete Customer Data. You may use these tools to fulfill data subject requests directly without requiring our assistance.

6.4 Response Timeline

We will provide reasonable assistance within 10 business days of your request, or sooner if required by applicable law. Complex requests may require additional time, which we will communicate promptly.

7.1 Transfer Mechanisms

When Customer Data is transferred from the EEA, UK, or Switzerland to countries that have not received an adequacy decision, Ship Captain relies on the following lawful transfer mechanisms:

• Standard Contractual Clauses (SCCs): The EU Commission-approved SCCs are incorporated into this DPA as Annex C
• UK International Data Transfer Addendum: For UK transfers, the UK Addendum to the EU SCCs applies
• Swiss Data Protection Addendum: For Swiss transfers, modified SCCs apply as required by Swiss law

7.2 Data Privacy Framework

Where applicable, Ship Captain relies on service providers certified under the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework.

7.3 Supplementary Measures

In addition to contractual protections, Ship Captain implements supplementary technical and organizational measures including:

• End-to-end encryption for data in transit
• Encryption at rest for stored data
• Access controls limiting who can view transferred data
• Regular security assessments of transfer processes

7.4 Government Access Requests

If Ship Captain receives a legally binding request from a government authority for access to Customer Data, we will: (a) challenge requests that appear unlawful; (b) notify you unless legally prohibited; (c) provide only the minimum data legally required; and (d) pursue available appeals or exemptions.

8.1 Breach Definition

A "Personal Data Breach" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data.

8.2 Notification Timeline

Ship Captain will notify you of a confirmed Personal Data Breach without undue delay and in any event within 48 hours of becoming aware of the breach. Initial notification may be provided with incomplete information, followed by supplementary details as they become available.

Where Personal Data processed under this DPA is also Amazon Information received via the Amazon Selling Partner API, Ship Captain additionally notifies Amazon's security team within 24 hours of confirming the incident, in accordance with the Amazon Selling Partner API Data Protection Policy.

8.3 Notification Content

Breach notifications will include, to the extent known:

• Description of the nature of the breach, including categories and approximate number of data subjects affected
• Categories and approximate number of data records concerned
• Name and contact details of Ship Captain's privacy contact
• Description of likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate its effects

8.4 Cooperation

Ship Captain will cooperate with you and provide reasonable assistance in investigating the breach, fulfilling your notification obligations to supervisory authorities and data subjects, and mitigating the effects of the breach.

8.5 Documentation

Ship Captain maintains documentation of all Personal Data Breaches, including facts, effects, and remedial actions taken, and will make this documentation available to you upon request.

9.1 Audit Information

Ship Captain will make available to you information necessary to demonstrate compliance with this DPA and applicable Data Protection Laws. This includes:

• Documentation of Ship Captain's technical and organizational security measures (Annex A)
• SOC 2 compliance documentation for Ship Captain's cloud infrastructure provider (AWS)
• Documentation of access controls, including role-based access control and multi-factor authentication for privileged access
• Security questionnaire responses
• Penetration testing summaries, as available
• Relevant certifications and compliance documentation, as available

9.2 On-Site Audits

If the information provided is reasonably insufficient to demonstrate compliance, you may request an on-site audit subject to the following conditions:

• Audits are limited to once per 12-month period
• At least 30 days' advance written notice is required
• Audits must be conducted during normal business hours
• Auditors must execute confidentiality agreements
• Audit scope is limited to facilities and records relevant to Customer Data processing
• Audits may be conducted by a mutually agreed independent third party

9.3 Audit Costs

You are responsible for your own costs associated with conducting audits. Ship Captain may charge reasonable fees for staff time required to support audits beyond the scope of standard compliance documentation.

9.4 Regulatory Audits

Ship Captain will permit and contribute to audits conducted by supervisory authorities or their authorized representatives as required by Data Protection Laws.

10.1 Effective Date

This DPA becomes effective upon your acceptance of the Ship Captain Terms of Service and remains in effect for the duration of the Agreement.

10.2 Survival

The obligations in this DPA survive termination of the Agreement to the extent Ship Captain continues to process Customer Data.

10.3 Data Return and Deletion

Upon termination of the Agreement:

• Export: You may export your Customer Data using our self-service export tools for up to 30 days following termination
• Deletion: After the export period, Ship Captain will delete all Customer Data within 90 days, except as required for legal compliance
• Certification: Upon request, Ship Captain will provide written certification of data deletion

10.4 Legal Retention

Notwithstanding the above, Ship Captain may retain Customer Data as required by applicable law, including for tax, legal, or regulatory purposes. Such retained data will continue to be protected in accordance with this DPA.

Full annexes are available upon request by contacting [email protected] or for enterprise customers, through your account manager.