Summary of updates made to the Veson Nautical Data Processing Agreement dated July 8, 2024

Dear valued client,

We have made certain updates and improvements to the DPA, a summary of which is outlined below:

  1. Updated the version date of the DPA for accuracy.
  2. Clarified the description of and references to the parties in the preamble of the DPA to ensure that it is accurate and complete.
  3. Amended the defined terms contained in Section 1 (Definitions) of the DPA for accuracy purposes, including adding a definition for the “UK GDPR”.
  4. Updated the data processing obligations imposed on Veson under Section 2.2 (Data Processing) of the DPA to ensure compliance with the CCPA and CCPA Regulations, including by adding a new Section 2.2.2 and expanding on the obligations under Section 2.2.4.
  5. Updated the data transfer obligations in Section 4 of the DPA to adequately incorporate the data transfer mechanisms for transfers outside of the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, as identified in the updated Exhibit B.
  6. Amended Section 5.1 of the DPA to provide Veson with general authorization to continue using its existing sub-processors and to appoint new sub-processors, provided that prior notice of any new sub-processor has been provided to the client.
  7. Updated Exhibit A of the DPA to ensure compliance with the requirements of applicable data protection laws by:
    1. Including a detailed description of the parties, such as their names, data protection contacts, Data Protection Officer details, controllership roles, and data transfer roles.
    1. Clarifying the scope of the processing activities performed by Veson.
    1. Specifying the frequency of the data transfer and prohibition against further processing.
    1. Expanding on the categories of data subjects and types of personal data that may be processed by Veson.
  8. Updated Exhibit B of the DPA to:
    1. Add jurisdiction specific terms for the processing and transfer of personal data subject to EEA, Swiss, and UK data protection laws, including by incorporating, by reference, Module 2 of the EU 2021 Standard Contractual Clauses (EU 2021 SCCs) and the UK International Data Transfer Agreement.
    1. Remove the full text of the EU 2021 SCCs, which has been duly incorporated by reference under Section 1 of Exhibit B.
    1. Remove duplicative annexes from Exhibit B, which information has been included in Exhibit A of the DPA.
    1. Rename Annex II of Exhibit B to Appendix I to Exhibit B.
  9. Removed Exhibit C (List of Sub-Processors) from the DPA, which is available online at https://veson.com/subprocessors.

Should you have any questions or comments regarding the updates made to the DPA, please let us know at legalnotices@veson.com.

Thank you.