Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between Doable Link Inc. ("Doable Link", "we") and the Business using crewduo ("Business", "you"). It applies whenever we process personal information contained in Customer Data on the Business's behalf. It takes effect when the Business accepts the Terms; no separate signature is needed. If a Business needs a countersigned copy, email [email protected].

1. Definitions

• "Data Protection Laws" means privacy and data protection laws that apply to the processing of Customer Data under the Terms. In Canada these include PIPEDA and substantially similar provincial laws, including Quebec's Act respecting the protection of personal information in the private sector. In the United States they include state consumer privacy laws such as the California Consumer Privacy Act, as amended (CCPA).
• "Personal Information" means information about an identified or identifiable individual that is contained in Customer Data.
• "Security Incident" means a breach of security leading to accidental or unlawful access to, or loss, disclosure, alteration or destruction of, Personal Information that we process.
• "Subprocessor" means a third party we engage to process Personal Information.
• Other capitalized terms have the meanings given in the Terms.

2. Roles and instructions

• The Business is the organization in control of Personal Information (the "business" or "controller" under Data Protection Laws). Doable Link is its service provider (a "service provider", "contractor" or "processor").
• We process Personal Information only on the Business's documented instructions. Those instructions are the Terms and this DPA; the Business's configuration and use of crewduo, including the integrations and messaging it turns on; and other reasonable written instructions consistent with the Terms. We will tell the Business if we believe an instruction breaks Data Protection Laws.
• We may also process Personal Information where the law requires it. If so, we will tell the Business first, unless the law prohibits that.

3. The Business's obligations

• The Business is responsible for having a lawful basis for the Personal Information it puts into crewduo. That includes giving individuals the notices, and obtaining the consents, that Data Protection Laws and messaging laws require.
• If the Business turns on live crew tracking, it decides when its Users' locations are collected and how long the history is kept, and it is responsible for telling its Users, and obtaining any consent or putting in place any written monitoring policy, that employment and privacy laws require, such as Ontario's electronic monitoring policy requirement.
• The Business must not instruct us to process Personal Information in a way that breaks the law.
• The Business must not put sensitive information into crewduo that the Service is not designed for, as described in the Acceptable Use Policy.

4. Our obligations

• Purpose limitation. We process Personal Information only to provide, secure, support and maintain crewduo for the Business.
• U.S. service provider terms. We will not sell or share Personal Information, as those terms are defined under the CCPA. We will not keep, use or disclose it for any purpose other than providing the Service, including any other commercial purpose, or outside our direct business relationship with the Business. We will not combine it with personal information we receive from other sources, except as Data Protection Laws permit. We will comply with the obligations that apply to us under the CCPA, provide the same level of privacy protection, and notify the Business if we can no longer meet those obligations. The Business may take reasonable steps to stop and fix unauthorized use. We certify that we understand and will comply with these restrictions.
• Confidentiality. Our personnel with access to Personal Information are bound by confidentiality obligations, and have access only as needed for their role.
• Security. We maintain the technical and organizational measures described in Annex B. We may update them, as long as the update does not lower overall protection.
• Assistance. Taking into account the nature of the processing, we will help the Business respond to individuals' requests to access, correct, delete or port their information. Much of this can be done by the Business directly in crewduo. If we receive such a request directly, we will pass it to the Business and will not respond ourselves unless the Business authorizes us to. We will also give reasonable help with privacy impact assessments, cross-border transfer assessments and regulators' enquiries about our processing.
• De-identified data. If we de-identify Personal Information, we will keep it de-identified, will not try to re-identify it, and will contractually require any recipient to do the same.

5. Subprocessors

• The Business authorizes us to engage the Subprocessors listed on our Subprocessors page.
• We will update that page at least 15 days before a new Subprocessor starts processing Personal Information, and email Businesses that have asked to be notified.
• The Business may object to a new Subprocessor on reasonable data protection grounds by emailing [email protected] within that period. We will try in good faith to resolve the objection. If we cannot, the Business may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.
• We impose data protection obligations on each Subprocessor that are no less protective than this DPA, and we remain responsible for its performance.

6. Security Incidents

We will notify the Business without undue delay, and where feasible within 72 hours, after confirming a Security Incident that affects its Personal Information. Our notice will describe, as far as we know, the nature of the incident, the information and individuals affected, the steps we have taken to contain it, and a contact for more information. We will reasonably help the Business meet its obligations to keep records of the incident and to notify regulators and individuals. Notifying the Business is not an admission of fault.

7. Location and transfers

We host Customer Data in Canada, on Microsoft Azure in the Canada Central region (Toronto). Some subprocessors, including those for email, text messages and calls, process data in the United States. Subprocessors process data in the locations shown on the Subprocessors page. The Business acknowledges that Personal Information may be processed outside Canada, and outside the province where it was collected, and may be accessible to foreign authorities under local law. We will provide information the Business reasonably needs for any transfer assessment required by Data Protection Laws, including under Quebec law.

8. Return and deletion

During the Subscription Term, the Business can delete Customer Data in crewduo, export many kinds of it, and ask us for a copy of the rest. When the account closes, we keep Customer Data for 30 days. During that time the Business may ask us for a copy in a commonly used format. We then delete it from active systems, database backup copies are overwritten within a further 7 days, and deleted files may remain in backups for up to 14 days. At the account owner's written request to [email protected], we will delete it sooner. We may keep Personal Information where the law requires it, and it stays protected under this DPA for as long as we keep it.

9. Audits and information

Once a year, on written request, we will provide information reasonably needed to show our compliance with this DPA, such as answers to a security questionnaire and a description of our controls. If that information is not enough, or a regulator requires it, the Business may conduct an audit at its own cost. The audit must be on at least 30 days' notice, during business hours, subject to confidentiality, and in a way that does not disrupt our operations or compromise other customers' data.

10. General

• Each party's liability under this DPA is subject to the limitations and exclusions in the Terms.
• If this DPA conflicts with the Terms on the processing of Personal Information, this DPA prevails.
• This DPA lasts for as long as we process Personal Information for the Business.
• This DPA covers Canadian and U.S. Data Protection Laws. If a Business needs terms for another jurisdiction, such as the GDPR or UK GDPR, it should contact [email protected] before putting that data into crewduo.

Annex A: Details of processing

Annex B: Security measures

• Encryption: TLS for all data in transit; encryption at rest for databases, file storage and backups using provider-managed keys.
• Network: the database has no public endpoint and is reachable only from the application over a private network; public traffic passes through a web application firewall and DDoS protection.
• Secrets: credentials and keys are held in a managed key vault, not in source code.
• Tenant isolation: every Business's data is scoped to that Business at the data-access layer.
• Access control: role- and permission-based access within each Business; two-factor authentication and recovery codes for Users; passwords stored as salted hashes; rate limiting on sign-in; sessions can be revoked.
• Staff access: limited to personnel who need it, through a separate administration application restricted to approved staff.
• Logging: an activity log of changes within each Business; security and application logs for monitoring.
• Resilience: automated database backups with point-in-time restore.
• Payments: card data is collected and stored by Stripe, a PCI DSS Level 1 service provider; crewduo never stores full card numbers.
• Mobile: sign-in tokens stored in the device's secure keychain or keystore; optional biometric app lock; local data removed on sign-out.
• Vendors: Subprocessors are bound by contracts with confidentiality and security obligations.