Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Aventaryk Pty Ltd (ABN 86 628 196 921) (“Crewnly”, “we”) and the Organisation that subscribes to Crewnly (“the Organisation”, “you”). It applies automatically whenever we process personal information on your behalf in providing the Service. You do not need to sign it. It is written to meet Article 28 of the UK GDPR and works as the data processing agreement for the Australian, New Zealand, Canadian and United States privacy laws that apply to you (together, “Data Protection Law”). Words defined in the Terms have the same meaning here.

1. Roles

For the personal information you put into the Service about your workers, your clients and their contacts, and any other individuals (“Customer Personal Data”), you are the controller (under the California Consumer Privacy Act, the “business”; in Australia, New Zealand and Canada, the organisation responsible for the information) and we are your processor (or “service provider”). For our own account, billing and website data we are responsible as described in our Privacy Policy, and this DPA does not apply to it.

2. Details of the processing

• Subject matter and purpose: providing the Service to you: rostering, GPS site verification at clock-in and clock-out, digital timesheets, worker compliance tracking, contract and site management, quotes and invoices, notifications, support and security.
• Duration: the period you use the Service, plus the retention period in Section 9.
• Nature of processing: storing, organising, displaying, transmitting, backing up, deleting and otherwise handling data as the Service is used.
• Categories of individuals: your workers and job applicants, your users, and your clients’ and sites’ contacts.
• Types of personal data: names and contact details; employment and pay details; shift, timesheet and leave records; GPS coordinates captured at clock-in and clock-out; the IP address of a clock event; clock-in photos where you switch on photo verification; compliance records you choose to enter (including the outcome of background checks and right-to-work information); messages and attachments; invoice and payment status.
• Special categories: only what you choose to enter. You are responsible for having a lawful basis and any condition the law requires for it (for example under UK GDPR Articles 9 and 10).

3. Our obligations

• We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use of the Service’s features and settings, unless the law requires otherwise (in which case we tell you first where the law allows). We will tell you if we think an instruction breaks Data Protection Law.
• We do not sell Customer Personal Data, share it for cross-context behavioural advertising, or use it outside our direct business relationship with you, and we do not combine it with other personal information except as the law allows.
• Everyone we authorise to process Customer Personal Data is bound by confidentiality.
• We keep Customer Personal Data secure as described in Section 4.
• We help you, as reasonably needed and taking into account the nature of the processing, to respond to requests from individuals (access, correction, deletion, portability and similar rights), to carry out data protection impact assessments, to consult regulators, and to meet your breach-notification duties. If an individual contacts us about data we hold for you, we refer them to you and do not respond on your behalf unless you tell us to.
• We tell you without undue delay after we become aware of a personal data breach affecting Customer Personal Data, and give you the information we have so that you can assess it and meet your own duties to regulators and individuals.

4. Security

We apply measures appropriate to the risk, including those below. More detail is on our Security page. No system is completely secure, and we do not guarantee otherwise.

• Data encrypted at rest (AES-256) and in transit (TLS 1.2 or later)
• Passwords stored only in hashed form
• Role-based access inside the Service, and two-factor authentication available to users
• Access to production systems restricted and logged
• Security events (sign-ins, password changes, two-factor and session events) recorded in an audit trail kept for 730 days
• Regular automated backups with point-in-time recovery

5. Sub-processors

You authorise us to use the sub-processors listed at crewnly.com/subprocessors.html. We give you at least 30 days’ notice (by email or in the Service) before adding or replacing one. You may object in writing within that time on reasonable data protection grounds. If we cannot resolve your objection, you may cancel the affected Service and we will refund the unused part of any prepaid period. We bind each sub-processor to data protection terms no less protective than this DPA, and we remain responsible for their performance.

6. International transfers

Customer Personal Data is stored in AWS Sydney, Australia. Some sub-processors process data in the United States and other countries (see the sub-processor list).

• United Kingdom: Australia has no UK adequacy decision. Where UK GDPR applies to a transfer to us, the parties adopt the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner (version B1.0), incorporated by reference, with the EU Standard Contractual Clauses Module Two (controller to processor) applying. You are the exporter and we are the importer. The optional docking clause is not used. The details required by the Addendum are in Sections 2, 4 and 5 of this DPA and the sub-processor list. Neither party may end the Addendum merely because the Information Commissioner revises it.
• New Zealand: we hold New Zealand personal information as your agent (Privacy Act 2020, section 11) on the terms of this DPA.
• Canada: this DPA is the contractual means by which we provide a comparable level of protection while the information is processed outside Canada (PIPEDA Principle 1, clause 4.1.3).
• United States: this DPA and Section 19 of the Terms are the service-provider terms required by laws such as the California Consumer Privacy Act.

7. Audits and information

We give you the information reasonably needed to show we meet this DPA, including written answers to a security questionnaire. If that is not enough, you may audit us once in any 12 months on 30 days’ written notice, during business hours, at your cost, subject to confidentiality, and without access to other customers’ data.

8. Personal data breaches

Section 3 sets out how we tell you about a breach. We keep a record of breaches of security safeguards for at least 24 months.

9. Return and deletion

While your subscription is active you can export your data. After you cancel, your data stays available in read-only mode for at least 30 days so you can export it. Your standing instruction to us is that we keep Customer Personal Data for 7 years after cancellation, so that records you may need for tax, employment, audit or dispute purposes can be provided to you on request, and then delete it. You may instead instruct us to delete it earlier: the Organisation’s owner can ask in writing at privacy@crewnly.com, and we delete it within 90 days after verifying the request, except for records the law requires us to keep.

10. Liability and changes

Each party’s liability under this DPA is subject to Sections 12 and 13 of the Terms. If this DPA conflicts with the Terms about personal data, this DPA prevails. We may update this DPA under Section 20 of the Terms (30 days’ notice).

11. Contact

Questions about this DPA: privacy@crewnly.com.