# Records of Processing (Art. 30-style) — SEA Fleet

**Controller/Processor role:** VoxDuru acts as **processor** for tenant Customer data; **controller** for own account/billing contacts.  
**Date:** 2026-07-31

| # | Activity | Categories | Recipients | Transfers | Retention |
|---|----------|------------|------------|-----------|-----------|
| 1 | Account auth | email, name, org role | Supabase Auth | Cloud region per project | Account life + logs |
| 2 | Fleet ops records | vessel/cert/WO/NC/media | Supabase DB/Storage | Cloud | ≥5y class policy / SoW |
| 3 | Shore marketing site | IP (server logs) | Hosting | EU server | Short nginx/log rotate |
| 4 | Transactional OTP mail | email | SMTP provider | As configured | Transient |

**TOMs (summary):** TLS; RLS; role gates; backups/retention policy; security.txt.