Addendum to the JumpMaster Terms & Conditions

Effective date: 1 January 2026 Last updated: 16 July 2026

This Data Processing Agreement (“DPA”) forms part of, and is incorporated by reference into, the JumpMaster Terms & Conditions (the “Agreement”) between:

• The Dropzone (the operator that has subscribed to the Dropzone Manager features of JumpMaster) — the “Controller”; and
• PVC Digital Designs, 33 Arum Road, Tableview, Cape Town, 7441, South Africa — the “Processor”,

together, the “Parties.”

By subscribing to a paid Dropzone Manager account, the Dropzone agrees to this DPA, which governs PVC Digital Designs’ processing of personal data on the Dropzone’s behalf via the JumpMaster Service.

1. Subject matter and duration

This DPA applies for as long as PVC Digital Designs processes personal data on the Dropzone’s behalf under the Agreement — i.e. for the duration of the Dropzone’s active subscription, plus any post-termination retention period described in Section 8.

2. Roles of the parties

• The Dropzone is the data controller for personal data relating to its own staff, jumpers, tandem customers, and other individuals it manages through JumpMaster (e.g. its own waiver text, staff records, manifest data).
• PVC Digital Designs is the data processor, processing that data solely on the Dropzone’s documented instructions, as set out in this DPA and the Agreement, and for the purpose of providing the Service.
• Nothing in this DPA affects PVC Digital Designs’ role as an independent controller for account and platform-level data it processes for its own purposes (e.g. billing, service security, and its own legal obligations), as described in the JumpMaster Privacy Policy.

3. Nature and purpose of processing

PVC Digital Designs processes personal data to provide the Service, specifically: load building and manifesting, staff and gear tracking, digital logbooks, indemnity/waiver form storage, payment facilitation, and related dropzone administration functions within the JumpMaster platform.

4. Categories of data subjects

• The Dropzone’s staff (instructors, manifest, ground crew, admins)
• Jumpers and tandem customers registered with, or checking in at, the Dropzone
• Guardians/parents of minor jumpers (aged 12–17), where applicable

5. Categories of personal data

Name, contact details, date of birth, skydiving license/association numbers (PASA/USPA), jump history/logbook entries, gear/equipment records, staff role and scheduling data, waiver/indemnity acknowledgements, and payment/transaction records relating to jumps or subscriptions. No health or medical data is collected as part of standard waiver forms.

6. Sub-processors

The Dropzone authorizes PVC Digital Designs to engage the following sub-processors in connection with the Service:

PVC Digital Designs will:

• maintain this list and make it available to the Dropzone on request or via [a sub-processor page/URL];
• ensure each sub-processor is bound by data protection obligations equivalent to those in this DPA; and
• give the Dropzone 30 days’ notice of any intended change to sub-processors, during which the Dropzone may object on reasonable data protection grounds.

7. Processor obligations

PVC Digital Designs shall:

• process personal data only on the Dropzone’s documented instructions (including those given via normal use of the Service’s features), unless required to do otherwise by law;
• ensure persons authorized to process the data (including PVC Digital Designs staff) are subject to confidentiality obligations;
• implement appropriate technical and organizational security measures (see Section 10);
• assist the Dropzone, at the Dropzone’s reasonable request, in responding to data subject rights requests (access, rectification, erasure, restriction, portability, objection) relating to data the Dropzone controls;
• assist the Dropzone in meeting its obligations regarding data breach notification and, where applicable, data protection impact assessments;
• not engage a new sub-processor without providing notice as set out in Section 6;
• make available to the Dropzone information reasonably necessary to demonstrate compliance with this DPA.

8. Deletion or return of data

On termination of the Dropzone’s subscription, PVC Digital Designs will, at the Dropzone’s choice, delete or make available for export the personal data processed on the Dropzone’s behalf from live/production systems within 30 days, except for data PVC Digital Designs is required to retain by law (e.g. payment/transaction records — see the JumpMaster Privacy Policy for applicable retention periods). Because the underlying database uses scheduled backups (retained for up to 60 days) and point-in-time recovery (retained for 7 days), residual copies of deleted data may persist in backup storage — not accessible through normal use of the Service — for up to 60 days after deletion from production systems, after which they are automatically overwritten/purged in the ordinary backup rotation cycle.

9. International transfers

Where personal data is transferred outside the EU/EEA (specifically: to PVC Digital Designs’ South Africa-based staff and systems, and to sub-processors such as Payfast and PASA, both South Africa-based), the Parties incorporate the EU Standard Contractual Clauses (Module Two: Controller to Processor), Commission Implementing Decision (EU) 2021/914, as completed in Annex IV to this DPA, to ensure an adequate level of protection for that data. USPA (United States) is excluded from this transfer mechanism, as it acts as an independent controller rather than a sub-processor — see Section 6. Where PVC Digital Designs onward-transfers data to any other non-EU sub-processor, it will ensure an equivalent transfer mechanism (e.g. Module Three SCCs, Processor to Sub-processor) is in place with that sub-processor.

10. Security measures

PVC Digital Designs implements technical and organizational measures including:

• encryption of data in transit (TLS/HTTPS) and at rest;
• role-based access controls within each Dropzone’s account, limiting personal data visibility to Admin and Manifest roles only;
• Firebase security rules enforcing data isolation between different Dropzones on the platform;
• mandatory staff check-in to a Dropzone before that Dropzone’s data can be accessed through the app;
• audit trail tagging: all documents/records (e.g. waivers, manifest entries) are tagged with the identity of the user who created them and a timestamp, supporting traceability and accountability;
• Firestore Point-in-Time Recovery, with a 7-day recovery window, protecting against accidental data loss or corruption;
• scheduled weekly backups, retained for 60 days, supporting disaster recovery;
• [add: MFA for admin accounts, access logging/review cadence — confirm current practice]

11. Data breach notification

PVC Digital Designs will notify the Dropzone without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach affecting data processed on the Dropzone’s behalf, providing the information reasonably necessary for the Dropzone to meet its own notification obligations (including to supervisory authorities within 72 hours, where required).

12. Audit rights

On reasonable request, and no more than once per 12 months (except following a security incident), PVC Digital Designs will provide the Dropzone with reasonable information to demonstrate compliance with this DPA, which may include a summary audit report, completed security questionnaire, or (where reasonably necessary) a mutually scheduled audit.

13. Liability

Liability under this DPA is subject to the limitations of liability set out in the main JumpMaster Terms & Conditions, except where such limitations are not permitted under applicable data protection law.

14. Precedence

In the event of a conflict between this DPA and the JumpMaster Terms & Conditions concerning the processing of personal data, this DPA prevails.

15. Contact

Data protection queries relating to this DPA: info@jumpmaster.app EU representative: Phillip van Coller, 35 Mollstraße, 10405 Berlin, Germany — pvcdesigns@gmail.com — +49 152 31657861

---

Annex IV — Standard Contractual Clauses (Module Two: Controller to Processor)

This Annex incorporates the operative text of the EU Standard Contractual Clauses, Module Two (Controller to Processor), as set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “Clauses”), between the Dropzone (as “data exporter”) and PVC Digital Designs (as “data importer”). The Clauses are incorporated in their official, unmodified operative wording below (Modules One, Three, and Four have been removed, leaving only Module Two and the common clauses that apply to it), reflecting the selections agreed in Section A above. The Clauses take precedence in the event of any inconsistency with the summary in Section A or the Annexes below.

A. Module and clause selections

B. Operative clause text (Module Two, as completed)

SECTION I

Clause 1 — Purpose and scope

(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 (General Data Protection Regulation) for the transfer of personal data to a third country.

(b) The Parties: (i) the entity/ies transferring the personal data, as listed in Annex I.A (each “data exporter”), and (ii) the entity/ies in a third country receiving the personal data (each “data importer”), have agreed to these standard contractual clauses (the “Clauses”).

(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2 — Effect and invariability of the Clauses

(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) GDPR and, with respect to data transfers from controllers to processors, standard contractual clauses pursuant to Article 28(7) GDPR, provided they are not modified, except to select the appropriate Module or to add or update information in the Appendix. This does not prevent the Parties from including these Clauses in a wider contract, or adding other clauses or safeguards, provided they do not contradict these Clauses or prejudice data subjects’ fundamental rights.

(b) These Clauses are without prejudice to obligations to which the data exporter is subject under the GDPR.

Clause 3 — Third-party beneficiaries

(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions: (i) Clauses 1, 2, 3, 6, 7; (ii) Clause 8 – Module Two: Clause 8.1(b), 8.9(a),(c),(d) and (e); (iii) Clause 9 – Module Two: Clause 9(a),(c),(d) and (e); (iv) Clause 12 – Modules Two: Clause 12(a),(d) and (f); (v) Clause 13; (vi) Clause 15.1(c),(d) and (e); (vii) Clause 16(e); (viii) Clause 18 – Module Two: Clause 18(a) and (b).

(b) This paragraph is without prejudice to rights of data subjects under the GDPR.

Clause 4 — Interpretation

Where these Clauses use terms defined in the GDPR, those terms have the same meaning as in the GDPR. These Clauses shall be read and interpreted in light of the GDPR, and shall not be interpreted in a way that conflicts with the GDPR.

Clause 5 — Hierarchy

In the event of a contradiction between these Clauses and related agreements between the Parties, existing or entered into thereafter, these Clauses prevail.

Clause 6 — Description of the transfer(s)

The details of the transfer(s), including the categories of personal data transferred and the purpose(s) of transfer, are specified in Annex I.B.

Clause 7 — Docking clause (Optional — Included)

(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or data importer, by completing the Appendix and signing Annex I.A.

(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity becomes a Party and has the rights and obligations of a data exporter or data importer in accordance with its designation.

(c) The acceding entity has no rights or obligations under these Clauses from the period prior to becoming a Party.

SECTION II — OBLIGATIONS OF THE PARTIES

Clause 8 — Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

MODULE TWO: Transfer controller to processor

8.1 Instructions (a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract. (b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2 Purpose limitation The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3 Transparency On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. The data exporter may redact business secrets, confidential information, or personal data from the Appendix, but shall provide a meaningful summary where needed for the data subject to understand its content or exercise their rights. This Clause is without prejudice to the data exporter’s obligations under Articles 13 and 14 GDPR.

8.4 Accuracy If the data importer becomes aware that personal data it has received is inaccurate or outdated, it shall inform the data exporter without undue delay and cooperate to erase or rectify the data.

8.5 Duration of processing and erasure or return of data Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on its behalf and certify this to the data exporter, or return all such data and delete existing copies. Until deleted or returned, the data importer shall continue to ensure compliance with these Clauses. Where local law applicable to the data importer prohibits return or deletion, the data importer warrants it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

8.6 Security of processing (a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a personal data breach. In assessing appropriate security, the Parties shall consider the state of the art, cost of implementation, nature/scope/context/purpose of processing, and risk to data subjects, and shall in particular consider encryption or pseudonymisation where appropriate. In complying with this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II, and carry out regular checks to ensure these measures continue to provide an appropriate level of security. (b) The data importer shall grant access to personal data only to personnel for whom access is strictly necessary, and shall ensure such personnel are bound by confidentiality. (c) In the event of a personal data breach concerning personal data processed under these Clauses, the data importer shall take appropriate measures to address it, including mitigating adverse effects, and shall notify the data exporter without undue delay, providing a contact point, a description of the breach, its likely consequences, and measures taken or proposed. Where not all information is available at once, it may be provided in phases without undue further delay. (d) The data importer shall cooperate with and assist the data exporter to enable it to comply with its obligations under the GDPR, including notifying the competent supervisory authority and affected data subjects.

8.7 Sensitive data Where the transfer involves special category data (health, biometric, genetic, racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, sex life/orientation, or criminal offence data), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

8.8 Onward transfers The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. The data may only be disclosed to a third party located outside the EU if that third party is or agrees to be bound by these Clauses under the appropriate Module, or if: (i) the onward transfer is to a country covered by an Art. 45 adequacy decision; (ii) the third party otherwise ensures appropriate safeguards under Art. 46 or 47 GDPR; (iii) the onward transfer is necessary for the establishment, exercise, or defence of legal claims; or (iv) the onward transfer is necessary to protect the vital interests of the data subject or another natural person. Any onward transfer remains subject to all other safeguards in these Clauses, in particular purpose limitation.

8.9 Documentation and compliance (a) The data importer shall promptly and adequately deal with enquiries from the data exporter relating to processing under these Clauses. (b) The Parties shall be able to demonstrate compliance with these Clauses; the data importer shall keep appropriate documentation of processing activities carried out on the data exporter’s behalf. (c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance, and shall, at the data exporter’s request, allow for and contribute to audits of the processing activities, at reasonable intervals or where there are indications of non-compliance, taking into account relevant certifications held by the data importer. (d) The data exporter may conduct the audit itself or mandate an independent auditor; audits may include inspections of the data importer’s premises, carried out with reasonable notice where appropriate. (e) The Parties shall make information referred to in (c) and (d), including audit results, available to the competent supervisory authority on request.

Clause 9 — Use of sub-processors

MODULE TWO: Transfer controller to processor

(a) OPTION 2: GENERAL WRITTEN AUTHORISATION. The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, giving the data exporter sufficient time to object to such changes prior to engagement. The data importer shall provide the data exporter with the information necessary to exercise its right to object.

(b) Where the data importer engages a sub-processor to carry out specific processing activities on behalf of the data exporter, it shall do so by way of a written contract providing, in substance, the same data protection obligations as those binding the data importer under these Clauses, including third-party beneficiary rights for data subjects. The data importer fulfils its Clause 8.8 obligations by complying with this Clause, and shall ensure the sub-processor complies with the obligations to which the data importer is subject.

(c) The data importer shall provide, at the data exporter’s request, a copy of the sub-processor agreement and any amendments (which may be redacted to protect business secrets/confidential information).

(d) The data importer remains fully responsible to the data exporter for the sub-processor’s performance, and shall notify the data exporter of any sub-processor failure to fulfil its obligations.

(e) The data importer shall agree a third-party beneficiary clause with the sub-processor so that, if the data importer has factually disappeared, ceased to exist in law, or become insolvent, the data exporter may terminate the sub-processor contract and instruct erasure or return of the data.

Clause 10 — Data subject rights

MODULE TWO: Transfer controller to processor

(a) The data importer shall promptly notify the data exporter of any request it receives from a data subject, and shall not respond to it unless authorised to do so by the data exporter.

(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ rights requests under the GDPR. The Parties shall set out in Annex II the appropriate technical and organisational measures for providing this assistance, and its scope and extent.

(c) In fulfilling its obligations under (a) and (b), the data importer shall comply with the data exporter’s instructions.

Clause 11 — Redress

(a) The data importer shall inform data subjects, in a transparent and easily accessible format (through individual notice or on its website), of a contact point authorised to handle complaints, and shall deal promptly with any complaints it receives.

MODULE TWO: Transfer controller to processor

(b) In case of a dispute between a data subject and either Party regarding compliance with these Clauses, that Party shall use best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed of such disputes and cooperate in resolving them where appropriate.

(c) Where the data subject invokes a third-party beneficiary right under Clause 3, the data importer shall accept the data subject’s decision to: (i) lodge a complaint with the supervisory authority in the Member State of their habitual residence or place of work, or the competent supervisory authority under Clause 13; or (ii) refer the dispute to the competent courts under Clause 18.

(d) The Parties accept that the data subject may be represented by a not-for-profit body under Article 80(1) GDPR conditions.

(e) The data importer shall abide by a decision binding under applicable EU or Member State law.

(f) The data importer agrees the data subject’s choice of forum will not prejudice their substantive and procedural rights to seek remedies under applicable law.

Clause 12 — Liability

MODULE TWO: Transfer controller to processor

(a) Each Party is liable to the other for damages caused by any breach of these Clauses.

(b) The data importer is liable to the data subject, and the data subject is entitled to compensation, for material or non-material damages the data importer or its sub-processor causes by breaching the third-party beneficiary rights under these Clauses.

(c) Notwithstanding (b), the data exporter is liable to the data subject, and the data subject is entitled to compensation, for material or non-material damages the data exporter or the data importer (or its sub-processor) causes by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the data exporter’s liability, and, where the data exporter is a processor acting on behalf of a controller, to that controller’s liability under the GDPR.

(d) Where the data exporter is held liable under (c) for damages caused by the data importer (or its sub-processor), it is entitled to claim back from the data importer the part of compensation corresponding to the data importer’s responsibility.

(e) Where more than one Party is responsible for damage to the data subject, all responsible Parties are jointly and severally liable, and the data subject may bring an action against any of them.

(f) A Party held liable under (e) may claim back from other Parties the part of compensation corresponding to their responsibility.

(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

Clause 13 — Supervision

MODULE TWO: Transfer controller to processor

(a) Where the data exporter is established in an EU Member State: the supervisory authority responsible for ensuring the data exporter’s compliance with the GDPR as regards the transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

(b) The data importer agrees to submit itself to the jurisdiction of, and cooperate with, the competent supervisory authority in any procedure aimed at ensuring compliance with these Clauses, including responding to enquiries, submitting to audits, and complying with remedial and compensatory measures, and shall provide written confirmation that necessary actions have been taken.

SECTION III — LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14 — Local laws and practices affecting compliance with the Clauses

MODULE TWO: Transfer controller to processor

(a) The Parties warrant they have no reason to believe that laws and practices in the third country of destination applicable to the data importer’s processing — including requirements to disclose data or measures authorising public-authority access — prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices respecting the essence of fundamental rights and not exceeding what is necessary and proportionate in a democratic society (per Article 23(1) GDPR objectives) do not contradict these Clauses.

(b) The Parties declare that, in giving this warranty, they have taken due account of: (i) the specific circumstances of the transfer (length of the processing chain, number of actors, transmission channels, onward transfers, type of recipient, purpose, categories/format of data, economic sector, storage location); (ii) the laws and practices of the third country of destination relevant to the transfer, including those on disclosure to or access by public authorities, and applicable limitations/safeguards; and (iii) any relevant contractual, technical, or organisational safeguards supplementing these Clauses.

(c) The data importer warrants it has made best efforts to provide the data exporter with relevant information for this assessment, and agrees to continue cooperating to ensure compliance.

(d) The Parties agree to document the assessment and make it available to the competent supervisory authority on request.

(e) The data importer agrees to promptly notify the data exporter if, after agreeing to these Clauses, it has reason to believe it is or has become subject to laws or practices not in line with paragraph (a), including a change in the law or a disclosure request indicating such an application.

(f) Following such a notification, or if the data exporter otherwise has reason to believe the data importer can no longer fulfil its obligations, the data exporter shall promptly identify appropriate measures to address the situation, and shall suspend the transfer if no appropriate safeguards can be ensured or if instructed by the competent supervisory authority. The data exporter may then terminate the contract insofar as it concerns processing of personal data under these Clauses. Where terminated under this Clause, Clause 16(d) and (e) apply.

Clause 15 — Obligations of the data importer in case of access by public authorities

MODULE TWO: Transfer controller to processor

15.1 Notification (a) The data importer agrees to notify the data exporter and, where possible, the data subject, promptly (with the data exporter’s help if necessary) if it: (i) receives a legally binding request from a public authority for disclosure of personal data transferred under these Clauses, including information about the data requested, requesting authority, legal basis, and response given; or (ii) becomes aware of any direct access by public authorities to such data.

(b) If prohibited from notifying, the data importer agrees to use best efforts to obtain a waiver of the prohibition, to communicate as much information as possible as soon as possible, and to document these efforts.

(c) Where permissible, the data importer agrees to provide the data exporter, at regular intervals, with as much relevant information as possible on requests received (number, type of data, requesting authorities, whether challenged, and outcome).

(d) The data importer agrees to preserve this information for the duration of the contract and make it available to the competent supervisory authority on request.

(e) Paragraphs (a)–(c) are without prejudice to the data importer’s obligation under Clause 14(e) and Clause 16 to promptly inform the data exporter where it is unable to comply with these Clauses.

15.2 Review of legality and data minimisation (a) The data importer agrees to review the legality of any disclosure request and to challenge it where there are reasonable grounds to consider it unlawful, pursuing appeal where relevant, seeking interim measures to suspend the request’s effect, and not disclosing data until required under applicable procedural rules. This is without prejudice to the data importer’s obligations under Clause 14(e).

(b) The data importer agrees to document its legal assessment and any challenge and, where permissible, make this available to the data exporter and, on request, to the competent supervisory authority.

(c) The data importer agrees to provide the minimum amount of information permissible when responding, based on a reasonable interpretation of the request.

SECTION IV — FINAL PROVISIONS

Clause 16 — Non-compliance with the Clauses and termination

(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b) Where the data importer is in breach of, or unable to comply with, these Clauses, the data exporter shall suspend the transfer of personal data until compliance is restored or the contract is terminated (without prejudice to Clause 14(f)).

(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns processing of personal data under these Clauses, where: (i) it has suspended transfer under (b) and compliance is not restored within a reasonable time and in any event within one month; (ii) the data importer is in substantial or persistent breach; or (iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses. In such cases, it shall inform the competent supervisory authority of such non-compliance.

(d) Personal data transferred prior to termination of the contract under (c) shall, at the data exporter’s choice, immediately be returned to the data exporter or deleted in its entirety, including any copies, and the data importer shall certify the deletion. Until deleted or returned, the data importer shall continue to ensure compliance with these Clauses. Where local law applicable to the data importer prohibits return or deletion, the data importer warrants it will continue to ensure compliance and will only process the data to the extent and for as long as required under that local law.

(e) Either Party may revoke its agreement to be bound by these Clauses where the European Commission adopts an Art. 45(3) adequacy decision covering the transfer, or the GDPR becomes part of the legal framework of the destination country — without prejudice to other obligations applying to the processing under the GDPR.

Clause 17 — Governing law

MODULE TWO: Transfer controller to processor

OPTION 2 (for Modules Two and Three, as selected): These Clauses are governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does. The Parties agree that this shall be the law of the EU Member State in which the relevant Dropzone (as data exporter) is established — deliberately variable rather than a single fixed jurisdiction, given JumpMaster’s Dropzone customers are located across many different EU Member States.

Clause 18 — Choice of forum and jurisdiction

MODULE TWO: Transfer controller to processor

(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(b) The Parties agree that those shall be the courts of the same EU Member State identified under Clause 17 for the relevant Dropzone (i.e. the Member State in which that Dropzone, as data exporter, is established).

(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which they have their habitual residence.

(d) The Parties agree to submit themselves to the jurisdiction of such courts.

---

Footnotes carried over from the official text, relevant to Module Two clauses above:

• Re Clause 8.6 (Security): encryption/pseudonymisation should be considered wherever it does not defeat the processing purpose.
• Re Clause 8.8 / onward transfers: “third country” here excludes the EEA (Iceland, Liechtenstein, Norway), as the EEA Agreement incorporates the GDPR — disclosures to the EEA are not “onward transfers” for these Clauses.
• Re Clause 9(b): the sub-processor contract requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module (Clause 7).
• Re Clause 10(a) (data subject request timing, referenced via Clause 8.9/GDPR): the standard one-month response period may be extended by up to two further months for complex or numerous requests, with the data subject informed of the extension.
• Re Clause 11: an optional independent dispute-resolution mechanism is available under the official template but has not been included here, per Section A above.
• Re Clause 14(b)(ii): relevant elements for assessing local-law impact include documented practical experience with (or absence of) prior disclosure requests from public authorities, covering a representative timeframe.

C. Annex I.A — List of parties

Data exporter: The Dropzone entering into the JumpMaster Terms & Conditions and this DPA, identified by the legal entity name, registered address, and contact details recorded in its JumpMaster account at the time of subscription. Activities relevant to the transfer: operating a skydiving dropzone and using JumpMaster to manage staff, jumpers, and related administration. Role: Controller.

Data importer: PVC Digital Designs 33 Arum Road, Tableview, Cape Town, 7441, South Africa Contact: info@jumpmaster.app Activities relevant to the transfer: provision of the JumpMaster software-as-a-service platform. Role: Processor.

D. Annex I.B — Description of the transfer

• Categories of data subjects: the Dropzone’s staff; jumpers and tandem customers; guardians/parents of minor jumpers aged 12–17 (see DPA Section 4).
• Categories of personal data transferred: as listed in DPA Section 5 (identity, contact, license/credential numbers, jump history, gear records, staff scheduling, waiver acknowledgements, payment/transaction records).
• Sensitive data: none. No special category (Art. 9 GDPR) data — including health or medical information — is collected as part of standard JumpMaster waiver forms.
• Frequency of transfer: continuous, for as long as the Dropzone’s subscription is active.
• Nature of processing: storage, hosting, retrieval, and administration of the data described above via the JumpMaster platform.
• Purpose(s): provision of the JumpMaster Service to the Dropzone, as described in DPA Section 3.
• Duration of processing: for the duration of the Dropzone’s subscription, plus applicable post-termination retention periods (DPA Section 8; Privacy Policy Section 10).
• Onward transfers: to the sub-processors listed in Annex III below, on the basis set out in DPA Section 6 and Clause 9 above.

E. Annex I.C — Competent supervisory authority

As set out in Section A above: the supervisory authority of the EU Member State in which the relevant Dropzone (data exporter) is established.

F. Annex II — Technical and organizational measures

As set out in DPA Section 10, including: encryption in transit and at rest; role-based access controls limiting visibility to Admin and Manifest roles; Firebase security rules enforcing data isolation between Dropzones; mandatory staff check-in before data access; audit-trail tagging of records by user and timestamp; Firestore Point-in-Time Recovery (7-day window); weekly scheduled backups (60-day retention). [Add MFA/access-logging details once confirmed, per DPA Section 10.]

G. Annex III — List of sub-processors

As set out in DPA Section 6: Google Firebase/Google Cloud Platform (EU, eur3 — confirmed for all services including Auth, Functions, and Analytics), Stripe EU processing region (EU; non-South African Dropzones), Payfast (South Africa; South African Dropzones only), PASA (South Africa; credential verification via direct API, used only for South African-licensed jumpers). Apple App Store, Google Play, and USPA are not included as sub-processors, as they act as independent controllers for the data they respectively handle (see DPA Section 6).