Data processing terms

1. About these terms

These data processing terms are part of our terms of service. They apply to the personal information your business puts in Crewzy about your customers, workers and other people ("your data").

For your data, your business decides what is collected and why, and is responsible for it. We hold and process it for you, to provide Crewzy. (In European terms, you are the controller and we are the processor.) If these terms and the terms of service differ about your data, these terms apply.

2. Your part

• Collect and use your data lawfully, and only put in what you need.
• Tell your customers and workers how you handle their information, as the privacy law requires.
• Before turning on clock on locations, give your workers any notice the law requires where they work. Our notice is a starting point.
• Have permission to send the texts and emails you send through Crewzy.
• Answer requests from people to see or correct their information. We will help.

3. What we do with your data

We process your data only:

• to provide Crewzy as you set it up and use it;
• as the terms of service and these terms describe;
• as you otherwise ask us in writing, where that is reasonable; and
• where the law requires it. We will tell you before we do so unless the law forbids it.

We do not sell your data, use it for advertising, or use it to train AI models. We use counts that do not identify anyone to run and improve Crewzy, and error records to fix problems.

4. Confidentiality and our staff

Everyone who works for us and can reach your data must keep it confidential, and can reach it only as far as their work needs.

Our support staff can view your business read only, to help you. Each look needs a reason, is recorded, ends after 30 minutes and is shown to your owners, who are notified. Changes are made only when you ask, by a senior staff member, with the reason and the change recorded. Staff must use two-step sign-in, and the record of what they did cannot be edited.

5. Security measures

We take reasonable steps to protect your data. They include:

• Encrypted connections (HTTPS) for everything, with browsers told to use nothing else.
• Each business's records kept apart: every request is checked against the signed-in person's business and role, and the whole app is tested to make sure one business cannot reach another's records.
• Roles: owners, office staff and workers see different things. Workers see only their own jobs, without costs, other people's details or clock on locations.
• Sign-in through Clerk, with two-step sign-in available to everyone, owners asked to turn it on, and staff required to use it.
• Keys and tokens for your connected services stored encrypted, with the encryption key kept apart from the database.
• Customer links (quotes, payments, the customer portal and calendars) made from long random codes. Portal links expire after 90 days without use and can be cancelled at any time.
• Limits on how fast requests can be made, and checks on the files people upload.
• Error records cleaned of passwords, keys, tokens and card-like numbers before they are stored, and deleted after 30 days.
• Nightly backups, kept for [backup retention: 30 days?].
• Security reviews of the app, including a full audit before launch.

We do not hold a security certification such as ISO 27001 or SOC 2. We will not reduce the overall level of these measures while we hold your data.

6. Our service providers

We use other companies to provide parts of Crewzy, such as hosting, sign-in, texts, email and AI. They are listed, with where they hold data, on AI and data processors. You agree to us using them.

• We have agreements with each that require them to protect your data. We remain responsible to you for what they do with it.
• Some of them hold data outside Australia, as that page shows. You agree to your data going to them there.
• Before we add or replace a provider that will handle your data, we will update that page and email your owners at least 30 days ahead. If you object on reasonable grounds and we cannot address it, you can cancel and get a refund of the unused part of any period you have paid in advance.

Services you connect yourself, such as your accounting software, are not our providers: they handle your data under your own agreement with them.

7. If there is a data breach

If we become aware of unauthorised access to, disclosure of or loss of your data, we will tell your owners without undue delay. We will tell you what we know, what we are doing about it and who to talk to, and keep you updated.

We will help you work out whether it is a notifiable data breach under the Privacy Act, or a notifiable privacy breach in New Zealand, and with notifying the regulator and the people affected. Where a breach in our own systems affects many businesses, we may notify the regulator ourselves as well, and will tell you if we do.

8. Helping with requests

Owners can see, correct and download their records in Crewzy themselves. If you need more help to answer a request from a customer or worker, or from a regulator, we will give reasonable help. If a person contacts us about your data, we will pass the request on to you rather than answer it ourselves, unless the law requires us to.

9. Deletion and return at the end

• The owner can download all your data at any time, including after the plan ends.
• When the owner closes the business, your data is kept for 90 days so it can be reopened, then deleted from our systems. The owner can ask in writing for it to be deleted sooner.
• Backups are replaced within [backup retention: 30 days?], so deleted data leaves them by then.
• We keep only what the privacy policy says we keep after deletion, none of which holds your customers' or workers' details.

10. Showing we keep to these terms

We will give you the information you reasonably need to check that we keep to these terms, such as answers to a security questionnaire, up to once a year. Where a regulator or the law requires an inspection, we will allow one at a reasonable time, on reasonable notice, subject to confidentiality and at your cost.

11. How long these terms last

These terms apply for as long as we hold your data, including after your plan ends. If you need a signed copy, email hello@getcrewzy.com.