Effective Date: December 10, 2024

1. Introduction

This Data Processing Agreement (“DPA”) is an integral part of the legal terms and policies of Key West Charter Fishing. It outlines our responsibilities as a data processor, your rights as a data subject, and our commitment to ensuring the secure and lawful handling of personal data in compliance with applicable laws, including the General Data Protection Regulation (GDPR) where applicable.

2. Definitions

• Controller: The entity that determines the purposes and means of processing personal data (you, the customer, or end-user).
• Processor: The entity that processes personal data on behalf of the Controller (Key West Charter Fishing).
• Personal Data: Any information relating to an identified or identifiable individual (e.g., name, email address, phone number).
• Processing: Any operation performed on personal data, such as collection, storage, use, or disclosure.
• Data Subject: The individual to whom personal data relates.

3. Scope of Data Processing

• Types of Personal Data:

  • Name
  • Email address
  • Phone number
  • Booking details
  • Payment information (processed via secure third-party gateways)

• Purpose of Processing:

  • To provide fishing charter services.
  • To manage bookings, payments, and customer communication.
  • To analyze data for improving our services and website.

• Nature of Processing:

  • Collection, storage, use, and deletion of personal data as required for service delivery.

4. Processor Obligations

Key West Charter Fishing agrees to:

• Act on Instructions: Process personal data only on the documented instructions of the Controller unless required by law.
• Ensure Confidentiality: Ensure that all personnel authorized to process personal data are bound by confidentiality agreements.
• Implement Security Measures: Use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction.
• Assist the Controller:
  • Responding to requests from data subjects (e.g., access, rectification, erasure).
  • Ensuring compliance with data protection obligations such as data impact assessments or breach notifications.
• Delete or Return Data: Upon request or at the termination of the agreement, delete or return all personal data unless otherwise required by law.

5. Controller Obligations

As the Controller, you agree to:

• Comply with Data Protection Laws: Ensure that the collection and use of personal data are lawful, fair, and transparent.
• Provide Accurate Information: Share accurate and updated personal data to enable effective service delivery.
• Handle Data Requests: Respond to data subject requests and ensure their rights are respected.

6. Data Subject Rights

Data subjects have the following rights under this agreement:

• Access: The right to request access to their personal data.
• Rectification: The right to request corrections to inaccurate or incomplete data.
• Erasure: The right to request deletion of personal data where lawful.
• Restriction: The right to restrict processing under certain conditions.
• Portability: The right to receive their personal data in a structured, commonly used, and machine-readable format.
• Objection: The right to object to processing based on legitimate interests or direct marketing.

Requests to exercise these rights can be submitted via email to contact@flyfishkw.com.

7. Security Measures

To safeguard personal data, we implement the following:

• Encryption: Secure encryption of personal data during transmission and storage.
• Access Controls: Restrict access to personal data to authorized personnel only.
• Regular Audits: Periodic security assessments to identify and mitigate vulnerabilities.
• Data Minimization: Only collect and process data necessary for service delivery.

8. Sub-processors

We may engage third-party sub-processors to assist in providing our services, such as payment gateways or analytics providers. These sub-processors are bound by data protection obligations equivalent to those outlined in this agreement. A list of sub-processors can be provided upon request.

9. Data Transfers

If personal data is transferred outside of the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission.
• Binding corporate rules.
• Transfers to countries deemed adequate by the European Commission.

10. Breach Notification

In the event of a data breach involving personal data, Key West Charter Fishing will:

• Notify the Controller without undue delay after becoming aware of the breach.
• Provide detailed information about the breach, including its nature, scope, and mitigation measures.
• Cooperate fully to resolve the breach and prevent future occurrences.

11. Term and Termination

This DPA is effective as of the date of your use of our services and remains in effect as long as personal data is processed on behalf of the Controller. Upon termination, we will delete or return all personal data unless retention is required by law.

12. Governing Law

This agreement is governed by the laws of the State of Florida, United States, and any applicable international data protection laws, such as the GDPR, where relevant.

13. Contact Information

If you have any questions or concerns regarding this Data Processing Agreement, please contact us:

• Email: contact@flyfishkw.com
• Phone: +1 (305) 767-9828
• Address: 5710 US-1, Naval Air Station, Key West, FL 33040, United States