Data Processing Addendum

1. Roles

The marina (the customer) decides why and how boater personal information is used. In data protection terms, the customer is the controller or business. Hive Asset Group, LLC ("Bollard") is the processor or service provider.

2. What we process and why

We process the personal information the customer or its boaters enter into Bollard, such as names, contact details, emergency contacts, vessel details, slip and contract records, signed contracts, insurance certificates, payment status and messages. We process it only to provide the Bollard service to the customer and for the purposes in the Terms of Service.

Payment details such as full card and bank account numbers are collected and held by Stripe under its own terms, and are not stored by Bollard.

3. Our commitments

• We process boater information only on the customer’s documented instructions, which include using the product, and as the law requires.
• We make sure people who can access the information are bound to keep it confidential.
• We keep appropriate technical and organizational security measures. Our security page describes the main ones.
• We do not sell boater information and do not use it for our own advertising.
• We help the customer respond to requests from boaters about their information, where the customer cannot do so using the product.

4. Subprocessors

The customer agrees that we may use service providers to process boater information. Today these are Stripe (payments), Supabase (database, sign-in and file storage), Netlify (hosting), Resend (email) and Twilio (text messages), plus Intuit (QuickBooks Online) when the customer connects it. We stay responsible for their work and require them to protect the information.

We will tell customers before we add a new subprocessor that handles boater information. A customer who objects for a good reason can contact us at support@bollardmarina.com, and if we cannot resolve it, the customer may cancel.

5. Security incidents

If we learn of a security incident that affects boater information we process for the customer, we will tell the customer without undue delay and share what we know so the customer can meet its own duties.

6. Return and deletion

The customer can export its data at any time. After the customer’s account is canceled, we keep the data read-only for 90 days so it can be exported, then delete or anonymize it, unless the law requires us to keep it. Backups roll off on a regular schedule afterward.

7. Information and audits

On reasonable request, we will give the customer the information needed to show we are following this addendum. The customer may not run an on-site audit without our agreement.

8. Where data is processed

Boater information is stored and processed in the United States.

9. Order of precedence

If this addendum conflicts with the Terms of Service on the handling of personal information, this addendum controls.

10. Contact

Questions about this addendum: support@bollardmarina.com.