Annex · Data Processing Agreement (DPA)

Informative translation. In case of discrepancy, the Spanish version prevails.

Version v0-DIY-2026-07 · mandatory annex to the DEKKO Terms of Service

This Data Processing Agreement (hereinafter, the “DPA”) governs the processing of personal data between ENES Estrategia Conjunta SL (hereinafter, “DEKKO”) and the signatory dive club or school (hereinafter, the “Club”) under the SaaS services agreement entered into between them. It is a mandatory annex to the DEKKO Terms of Service and is supplemented by the Privacy Policy. Base model: standard contractual clauses of Decision (EU) 2021/914, adapted to DEKKO's joint controllership model (Art. 26 GDPR).

1 · Parties and definitions

The terms “Controller”, “Processor”, “Joint Controllers”, “Personal data”, “Processing”, “Data subject” and “Special categories” shall be interpreted in accordance with the GDPR (Regulation (EU) 2016/679).

• DEKKO · ENES Estrategia Conjunta SL · CIF B22468284 · Partida Valls, s/n · 43350 Les Borges del Camp, Tarragona (Spain) · privacidad@dekko.club
• The Club · the natural or legal person identified in the specific agreement, operating professionally in recreational or technical diving.

2 · Subject matter and nature of the processing

The data of divers (the Club's end customers) is processed under joint controllership (Joint Controller · Art. 26 GDPR): the Club determines the operational purposes (the dive, the course, the activity), and DEKKO determines the purposes of the cross-club service, the persistent diver profile and statistical analysis, subject to the diver's explicit consent.

• The data of the Club operator is processed by DEKKO as sole Controller.
• The data of the Club's other staff is processed by the Club as Controller, with DEKKO as Processor when it is stored in the dashboard.

3 · Categories of data and data subjects

Data subjects: divers (end customers), Club operators and Club staff.

Data processed: identification data (name, DNI/passport, date of birth), contact data (email, telephone, address), diving data (certification, insurance, rental equipment, dive history), financial data (payment metadata · payments are processed by Stripe), communication data (WhatsApp, emails, images of documents) and special category data (Art. 9 GDPR): the medical statement from the SSI/PADI/RSTC questionnaire and, where applicable, the medical certificate.

4 · Allocation of responsibilities

The Club is primarily responsible for: informing the diver of the processing in the booked service; collecting consent via the first checkbox at checkout; processing medical data in order to provide the service; complying with the legal obligations of the activity (manifests, lists, local regulations); collecting payments and invoicing; and keeping invoices for 6 years.

DEKKO is primarily responsible for: providing information on cross-club processing; collecting opt-in consent via the second checkbox; maintaining the diver profile where there has been opt-in; communications issued on behalf of DEKKO; and the technical security of the shared infrastructure.

Both parties are jointly responsible for: technical and organisational measures; notifying breaches to the AEPD (<72 h) and to data subjects where appropriate; handling data subject rights requests (<30 days); the record of processing activities; and data protection impact assessments (DPIA) where applicable.

5 · Single point of contact for the data subject

Data subjects may exercise their rights before either party: by writing to privacidad@dekko.club (or to the DPO at dpo@dekko.club) or to the Club's email address. The party receiving the request shall notify the other within 48 hours and they shall coordinate to give a single response within the statutory period.

6 · Granular double opt-in consent

At the diver's first booking (public website, WhatsApp agent or sign-up), the diver gives two separate, granular and NOT pre-ticked consents: (1) mandatory, for managing the booking and the Club's legal obligations; (2) optional, for the cross-club DEKKO profile. Inviolable rules: not pre-ticked, not bundled, not hidden, and each consent is recorded with a timestamp, anonymised IP address, user-agent, document version and diver identifier.

7 · Technical and organisational measures (Art. 32 GDPR)

• Encryption in transit (TLS 1.3 · HSTS) and at rest (AES-256).
• Multi-tenant isolation at database level (PostgreSQL Row Level Security).
• Separation of datasets between the Club's operational data and the DEKKO diver profile.
• Magic link authentication (no stored passwords) and role-based access control.
• Monitoring of access to special categories (medical data) with auditable logs kept for 12 months.
• Daily backups on EU infrastructure with 30-day retention and a documented recovery plan.
• Designated DPO (dpo@dekko.club), annual staff training and an incident response procedure.

8 · Authorised sub-processors

DEKKO uses the following sub-processors, all with a signed DPA. The Club expressly authorises them by signing this DPA; changes are notified 30 days in advance and the Club may object on reasonable grounds.

9 · Retention periods

10 · Data subject rights

Both parties guarantee the exercise of all GDPR rights (access, rectification, erasure, restriction, portability, objection, withdrawal) within a maximum of 30 days, extendable by 2 months in complex cases with notice to the data subject. The right to erasure (Art. 17) is inviolable, except where there is a legal obligation to retain data (accounting data) or for defence against claims: in any other case it is carried out without dispute, deleting the data from production within 30 days and from backups within the following 90.

11 · Personal data breach notification

The party that detects a breach shall notify the other immediately and they shall coordinate to notify the AEPD within 72 hours (Art. 33 GDPR) and, where it is likely to result in a high risk, the affected data subjects without undue delay (Art. 34). Every breach, including those that are not notifiable, is documented internally.

12 · Audit

The Club may audit compliance with this DPA once a year, with 30 days' prior notice and respecting the confidentiality of DEKKO's other clients, by means of a documentary questionnaire, an external auditor (at its own expense) or a review of SOC2/ISO27001 reports once DEKKO obtains them.

13 · Termination

Upon termination of the SaaS agreement, this DPA ceases to apply to new processing, but the obligations of confidentiality, statutory retention, handling of rights requests and breach notification in respect of pre-existing data remain in force. DEKKO shall deliver to the Club, within a maximum of 30 days, all its operational data in structured CSV or JSON format. The data in the cross-club DEKKO profile (where there has been opt-in) remains with DEKKO in accordance with the diver's consent, until the diver exercises their right to erasure.

14 · Transparency, amendments and governing law

In accordance with Art. 26(2) GDPR, the essence of this DPA is made available to data subjects through the Privacy Policy. This DPA may be amended by agreement of the parties or where required by regulation, with 30 days' notice. It is governed by Spanish law and the GDPR; for any disputes, the parties submit to the Courts and Tribunals of Tarragona.