Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Terms of Service and governs how Omaship processes personal data on your behalf when you use features that collect data from your visitors (e.g. landing page waitlist signups).

By creating a landing page ship, you ("Controller") instruct Purpose Solutions UG (haftungsbeschränkt) ("Processor", "Omaship") to process personal data as described below.

1. Scope and Roles

Controller: You, the ship owner. You determine the purposes and means of processing visitor data collected through your landing page.

Processor: Omaship (Purpose Solutions UG). We process visitor data solely on your documented instructions to provide the landing page and waitlist capture service.

2. Data Processed

3. Controller Obligations

As data controller, you are responsible for:

• Having a lawful basis (e.g. consent or legitimate interest) to collect visitor emails
• Providing visitors with adequate privacy information about your data collection
• Responding to data subject requests (access, deletion, etc.) concerning your waitlist data
• Ensuring your use of the waitlist data complies with applicable data protection laws

4. Processor Obligations

Omaship commits to:

• Process waitlist data only on your documented instructions and for the purposes described in this DPA
• Ensure that persons authorized to process the data have committed to confidentiality
• Implement appropriate technical and organizational security measures (see Section 6)
• Not engage sub-processors for waitlist data without prior notice (see Section 5)
• Assist you, taking into account the nature of processing, in responding to data subject requests
• Delete or return all waitlist data upon termination of the service, unless retention is required by law
• Make available information necessary to demonstrate compliance with Art. 28 GDPR

5. Sub-processors

Waitlist data is stored on the Omaship production server (Hetzner, Germany). The following sub-processors may access waitlist-related data as part of infrastructure operations:

We will notify you of any intended changes to sub-processors by updating this page. You may object within 14 days of notification; if we cannot accommodate your objection, you may terminate the affected service.

6. Security Measures

Omaship implements the following measures to protect waitlist data:

• TLS encryption in transit (Cloudflare edge to origin)
• Encrypted storage at rest (server disk encryption)
• Authentication-gated access (only the ship owner can view their waitlist signups)
• Honeypot and rate limiting to prevent spam and abuse
• Regular security updates and monitoring

7. International Transfers

Waitlist data is primarily stored in Germany (Hetzner). Where Cloudflare processes request data at edge locations outside the EU/EEA, this is covered by Cloudflare's DPA and Standard Contractual Clauses.

8. Data Breach Notification

Omaship will notify you without undue delay after becoming aware of a personal data breach affecting waitlist data, providing information required under Art. 33 para. 3 GDPR to the extent available.

9. Audit Rights

You may request information necessary to demonstrate compliance with this DPA. Omaship will provide reasonable cooperation for audits, subject to confidentiality and reasonable notice.

10. Term and Termination

This DPA applies for as long as Omaship processes waitlist data on your behalf. Upon deletion of your ship or account, all associated waitlist data is deleted within 30 days, unless retention is required by law.

Contact

Questions about this DPA: [email protected]