Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of and is incorporated into the CREWERC Terms of Service. It applies where CREWERC ("CREWERC," "Processor," "we," or "us") processes personal data on behalf of a subscribing business ("Customer," "Controller," or "you") in providing the Platform.

Capitalized terms not defined here have the meaning given in the Terms or Privacy Policy. This DPA reflects the parties' agreement regarding the processing of personal data subject to applicable data protection laws, including the EU/UK General Data Protection Regulation (collectively, "Data Protection Laws").

Roles: Customer is the Controller (or, where Customer processes personal data of its own clients, a Processor acting on its clients' behalf, in which case Customer remains responsible for its clients' instructions). CREWERC is a Processor acting on Customer's documented instructions.

Subject matter: provision of the Platform services to Customer.

Duration: the term of the underlying subscription, plus any data-export or deletion period described in the Terms.

Nature and purpose: hosting, storing, and processing Customer data so the Platform can deliver its features (CRM, bids, scheduling, invoicing, payments, marketing, and reporting).

Categories of data: contact details of Customer's leads and customers; commercial records such as bids, jobs, invoices, and payments; employee, crew, vehicle, and equipment records; marketing content; and usage/log data including IP addresses.

Categories of data subjects: Customer's customers and leads, Customer's personnel and authorized users, and individuals whose information Customer submits to the Platform.

CREWERC will process personal data only as necessary to provide the Platform and as documented in the Terms, this DPA, and Customer's configuration of the Platform. We will not process personal data for our own purposes except as permitted by Data Protection Laws (for example, to provide and improve the Platform, ensure security, and comply with legal obligations). We will not sell personal data. Customer is responsible for the legality of its instructions and for the personal data it submits.

We ensure that personnel authorized to process personal data are bound by confidentiality obligations, receive appropriate training, and access personal data only as necessary to provide the Platform. We limit access on a need-to-know basis.

We implement and maintain appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include: encryption in transit (TLS) and at rest; per-Tenant data isolation and access controls; audit logging; secure credential handling and hashing; rate limiting and abuse protection on public endpoints; and incident-response procedures. We review and update these measures as appropriate.

We engage sub-processors to deliver the Platform (for example, cloud hosting, payments, email/SMS delivery, AI services, maps, and connected advertising platforms). We enter written agreements with sub-processors providing protections at least equivalent to those in this DPA, and we remain liable for their performance where they act on our behalf. Customer authorizes our use of the sub-processor categories listed in the Privacy Policy. We provide notice of new or replacement sub-processors, and Customer may object as provided by Data Protection Laws.

Where Customer connects its own accounts (for example, its own Stripe, Square, Twilio, or email provider), those providers act for Customer under the Customer's own agreement with them for that integration.

We will assist Customer, where reasonably possible, in fulfilling Customer's obligations to respond to data-subject requests (access, rectification, erasure, restriction, portability, and objection). Because Customer controls the data and is the direct point of contact for its data subjects, Customer is generally responsible for responding directly. We will take reasonable steps to assist, including by making relevant data available for export within the Platform.

Upon reasonable request, we will provide information to assist Customer in conducting data protection impact assessments or prior consultations with regulators, to the extent the Platform and processing activities require it.

We will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data, and will provide reasonable information to help Customer meet any obligation to notify the relevant supervisory authority and affected individuals. We will take reasonable steps to investigate, contain, and remediate the breach.

Where personal data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the standard contractual clauses adopted by the European Commission, or another lawful transfer mechanism, and require sub-processors to do the same.

Upon termination, we will make Customer data available for export for a reasonable period (as described in the Terms). After that period, we will delete or anonymize Customer data, except where retention is required by law (for example, tax or accounting records), in which case the data is kept only as long as needed and protected appropriately.

Customer may audit our compliance with this DPA where required by Data Protection Laws, subject to reasonable notice, confidentiality, and no undue disruption. Customer may instead rely on independent third-party audit reports or certifications we make available. Customer is responsible for its own audit costs except where an audit reveals a material breach attributable to us.

For any matter under this DPA, contact us at legal@crewerc.com.