Last Updated: 14 August 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between The Muster App Ltd, a company registered in England and Wales ("we", "us", "our", the "Processor") and the vessel operator who subscribes to the Service ("you", the "Controller").
This DPA applies whenever we process personal data on your behalf in the course of providing the Service. It takes effect automatically when you accept the Terms of Service — you do not need to sign it or ask us for it. If your procurement process requires a countersigned copy, or a copy on your own paper, email support@themusterapp.com and we will provide one.
Where this DPA conflicts with the Terms of Service or the Privacy Policy, this DPA prevails in respect of the processing of personal data.
You are the Controller of Vessel Data. We are the Processor. Each party will comply with its own obligations under Data Protection Laws.
You are responsible for establishing and maintaining a lawful basis for the collection and processing of Vessel Data, for providing the required information to visitors, crew and other data subjects, and for the accuracy and legality of the data you enter into the Service.
Where we determine the purposes and means of processing — for example, in relation to our own account, billing and security records, or the aggregated and anonymised information described in clause 13 — we act as a Controller in our own right, and that processing is governed by our Privacy Policy rather than by this DPA.
We will process Vessel Data only on your documented instructions, including in relation to transfers to a third country, unless we are required to process it by law that applies to us. Where we are required to process by law, we will inform you of that requirement before processing, unless the law prohibits us from doing so.
Your documented instructions are:
We will inform you if, in our opinion, an instruction infringes Data Protection Laws. We may decline to act on an instruction that we reasonably believe would put us in breach of Data Protection Laws, and we may charge for work required to implement an instruction that goes beyond the standard functionality of the Service.
We restrict access to Vessel Data to the members of our personnel who need it to perform this agreement.
Purposes. Our personnel access Vessel Data only in order to:
We do not access Vessel Data for any other purpose. In particular, we do not access it to build profiles of individuals, to market to your crew or visitors, or to inform any commercial dealing concerning your vessel.
Least privilege. Access is limited to the individuals who need it for the task in hand, and to the data needed for that task. Administrative and infrastructure access is held by a small number of named individuals and is reviewed when a person's role changes or their engagement ends.
Confidentiality. Every person we authorise to access Vessel Data is bound by a written confidentiality obligation, or is under an appropriate statutory obligation of confidentiality. That obligation survives the end of their engagement with us.
Recorded. Actions taken through the admin interface are recorded in your vessel's audit trail, which your vessel administrators can inspect. Direct administrative access to our servers and databases is restricted to authorised personnel and is recorded in our infrastructure access logs.
Notice. Where we access an identifiable individual's records in order to investigate a fault, we will normally tell your vessel administrator what we accessed and why. We may not be able to do so where telling you would prejudice an active security investigation, or where we are prohibited by law.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to data subjects, we will implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk. Our current measures are described in Annex 2.
We may update those measures over time, provided that the level of protection is not reduced.
You give us general written authorisation to engage Sub-processors. Our current Sub-processors are listed in Annex 3.
Before a new Sub-processor begins processing Vessel Data, we will:
You may object to a new Sub-processor on reasonable data protection grounds within that notice period. If you do, we will work with you in good faith to find a solution. If we cannot, you may terminate your subscription for the affected part of the Service, and we will refund any fees you have paid covering the period after termination.
We remain fully liable to you for the performance of each Sub-processor's obligations.
The Service gives your vessel administrators the ability to access, correct, export and delete Vessel Data directly. In the first instance, you should use those tools to respond to a data subject request.
Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as this is possible, to fulfil your obligation to respond to requests to exercise a data subject's rights.
If we receive a request directly from a data subject relating to Vessel Data, we will not respond to it substantively. We will tell the data subject to contact the vessel operator, and we will inform you of the request without undue delay.
Taking into account the nature of processing and the information available to us, we will provide you with reasonable assistance in relation to:
We may charge a reasonable fee for assistance that goes materially beyond what the Service provides as standard, and we will tell you before any charge is incurred.
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Vessel Data.
Our notification will describe, so far as we know it at the time: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures we have taken or propose to take; and a point of contact for further information. Where we cannot provide all of that information at once, we will provide it in phases without further undue delay.
Notifying you of a breach is not an admission of fault or liability.
Vessel Data is stored in the United Kingdom / European Economic Area, in the AWS eu-west-2 (London) region.
Where a transfer of Vessel Data outside the UK or EEA is necessary — including any transfer to a Sub-processor listed in Annex 3 — we will ensure that an appropriate transfer mechanism under Data Protection Laws is in place, such as an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, along with any supplementary measures required.
You may export or delete Vessel Data at any time through the Service.
On termination or expiry of your subscription, we will, at your choice, delete or return Vessel Data to you. You may request an export within 30 days of termination. After that period we may delete Vessel Data.
We may retain Vessel Data to the extent required by law, and Vessel Data will persist in routine encrypted backups until those backups age out on the rolling retention cycle stated in Annex 2. Retained data remains subject to this DPA for as long as we hold it.
We will make available to you the information necessary to demonstrate compliance with Article 28 UK GDPR and with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.
In practice:
We may create and use aggregated and anonymised information derived from use of the Service, for the purposes of operating, securing, analysing and improving the Service, and for producing statistics about the Service as a whole.
Before such information is used for those purposes, it is aggregated across customers and stripped of anything that identifies a vessel, a person, or an individual record, so that it is no longer personal data and cannot reasonably be used to re-identify any individual or vessel.
We will not publish, disclose or otherwise use a named vessel's figures, or figures attributable to an identifiable vessel, without that vessel operator's prior written agreement. This clause survives termination.
Subject matter. Provision of The Muster App and Muster Mate — a maritime safety, visitor management and crew administration platform — to the vessel operator.
Duration. For the term of the subscription, plus the deletion and backup periods described in clause 11 and Annex 2.
Nature and purpose of the processing. Collection, recording, organisation, structuring, storage, retrieval, consultation, use, transmission, erasure and destruction of Vessel Data, for the purpose of: recording who is aboard a vessel; visitor check-in, check-out and badge generation; crew records and the crew board; muster and drill records; hours of rest records; safety documents, policies, checklists and forms; deliveries; notifications to crew devices; and support, fault diagnosis and security of the Service.
| Category | Data |
|---|---|
| Visitors | Name, company or organisation, photograph, image of a government-issued identity document, host, reason for visit, check-in and check-out timestamps, vehicle details where captured, signed visitor agreements |
| Crew | Name, role and department, email address, phone number, profile photograph, muster and abandon-ship duties, hours of rest records, certificates and onboarding records where used, training and checklist records, signed policies and forms |
| Muster Mate account holders | Name, email address, hashed password, phone number (optional), profile photograph (optional), vessels joined, push notification token, device platform and app version |
| Vessel administrators | Name, email address, hashed password, role, audit trail of actions taken |
| Devices | Device identifier (UUID), device name, app version and platform, last active timestamp |
| Audio | Where the vessel enables it, audio recorded during an active muster or drill session |
| Content | Any personal data contained in documents, photographs, checklists, forms or free-text notes that you or your crew upload or enter |
Categories of data subjects. Visitors and contractors attending the vessel; crew members; guests where recorded; vessel administrators and other authorised users; recipients of deliveries.
Special category data. The Service is not designed for, and we do not ask you to enter, special category data as defined in Article 9 UK GDPR. Identity documents and photographs are processed for identification purposes only; we do not perform biometric facial recognition on them. If you choose to enter special category data in a free-text or document field, you are responsible for having a lawful basis and an Article 9 condition for doing so.
Frequency. Continuous, for the duration of the subscription.
Our current measures include:
eu-west-2 (London) region.We may change these measures as the Service develops, provided the level of protection is not reduced.
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, file storage, email delivery (SES), logging and monitoring | United Kingdom (eu-west-2), with support access from other AWS regions under AWS's own transfer safeguards |
| Anthropic PBC | AI processing for the AI-assisted features described in the Privacy Policy, invoked only when an administrator uses one of those features. Data submitted is not used to train AI models | United States, under Standard Contractual Clauses / UK Addendum |
| Stripe Payments Europe Ltd | Subscription billing and payment processing. Stripe processes billing contact and payment data; it does not receive visitor or crew records | European Economic Area / United States, under Standard Contractual Clauses / UK Addendum |
| Apple Inc. (Apple Push Notification service) | Delivery of push notifications to iOS devices. Payloads do not contain sensitive personal data | United States, under Standard Contractual Clauses / UK Addendum |
| Google Ireland Ltd (Firebase Cloud Messaging) | Delivery of push notifications to Android devices. Payloads do not contain sensitive personal data | European Economic Area / United States, under Standard Contractual Clauses / UK Addendum |
The Muster App Ltd
support@themusterapp.com