1. Roles and Instructions

Where ATS acts as controller, Operator acts as processor. Where ATS acts as processor on behalf of a Cruise Line or another controller, Operator acts as subprocessor. Any different characterization required by applicable law will apply.

Operator will process Personal Data only on ATS’s documented instructions, including Tour Confirmations and written operational instructions. Operator will immediately inform ATS if it believes an instruction infringes applicable data protection law.

Operator may not use Personal Data for its own marketing, retain guest lists for solicitation, or sell Personal Data. Disclosure requires ATS’s authorization or a legal requirement.

2. Purpose, Duration, and Data Types

Processing is limited to arranging and performing Tours, transfers, accessibility accommodations, safety communications, incident response, invoicing, and legal compliance.

Processing may include receiving, accessing, recording, storing, using, transmitting, returning, and deleting Personal Data as necessary for these purposes. Processing continues only as long as necessary for these purposes, subject to Section 8.

The individuals concerned may include guests, accompanying travelers, emergency contacts, and personnel involved in arranging or delivering the Services.

Personal Data may include names, contact details, booking details, ship information, emergency contacts, language needs, disability-related accommodation needs, Mobility Device specifications, and incident information. Some information may reveal health or disability details and must receive safeguards appropriate to its sensitivity.

3. Confidentiality and Access

Operator will ensure that personnel authorized to process Personal Data are bound by confidentiality obligations and receive access only as needed to perform the Services.

4. Security

Operator will implement reasonable technical and organizational safeguards appropriate to the risk to protect Personal Data against unauthorized access, use, disclosure, loss, alteration, or destruction.

These safeguards will include access controls, secure devices, secure transmission practices, timely software updates, and secure deletion practices.

Where applicable, these safeguards must meet the requirements of Article 32 GDPR and equivalent applicable data protection laws, taking account of the sensitivity of the Personal Data and the risks to affected individuals.

5. Subprocessors

Operator may not authorize a subcontractor or subprocessor to process Personal Data without ATS’s prior written approval.

Approved subprocessors must be bound by written data protection obligations that provide at least equivalent protection to this Addendum. Operator remains responsible for their compliance with those obligations.

6. Individual Rights and Cooperation

Operator will promptly forward to ATS any request, complaint, inquiry, or legal demand relating to Personal Data processed for ATS.

Taking into account the nature of the processing and the information available to Operator, Operator will reasonably assist ATS with data-subject rights requests, security reviews, impact assessments, regulator inquiries, and other applicable data protection obligations.

This assistance will include the technical and organizational measures and cooperation required by applicable data protection law, including assistance with required breach notifications and prior consultation with supervisory authorities.

Operator will not independently respond on ATS’s behalf unless authorized by ATS or required by law. Where legally permitted, Operator will notify ATS before making a legally required disclosure.

7. Security Incidents

Operator will notify ATS without undue delay and no later than 24 hours after discovering a suspected or actual Personal Data breach, including unauthorized access, disclosure, loss, alteration, or destruction.

The notice will describe the known facts, affected data, affected individuals, mitigation steps, and contact person. Operator will provide updates as information becomes available and will not delay the initial notice because information is incomplete.

Operator will cooperate with ATS in investigating, containing, and addressing the incident.

8. Return and Deletion

At ATS’s request, or after the Services and ATS-authorized follow-up are complete, Operator will return or securely delete Personal Data, including existing copies, at ATS’s choice, unless retention is required by law.

Where Personal Data is returned, Operator will securely delete any remaining copies unless retention is required by applicable law.

Any retained data must be limited to what is legally necessary, isolated and protected, used only for the legally required retention purpose, and securely deleted when that requirement ends.

9. Audit Information

Upon reasonable request, Operator will provide information necessary to demonstrate compliance with this Addendum and will allow and cooperate with reasonable audits or assessments, including inspections, conducted by ATS or an auditor appointed by ATS in relation to processing performed for ATS.

10. International Transfers

Operator will not transfer Personal Data across national borders except as authorized by ATS and permitted by applicable law.

Where a transfer mechanism is required, the Parties will execute the applicable standard contractual clauses or another approved mechanism before the relevant transfer takes place.

11. Applicable Version and Precedence

The version identified in the Agreement is the applicable version of this Addendum. Any replacement requires both Parties’ written agreement; website updates alone do not amend the applicable version.

This Addendum prevails over conflicting provisions of the Agreement concerning the processing of Personal Data.