Data Processing Addendum
Parties and roles
This addendum is between MyCrew (the "Processor") and MyCrew (the "Controller"). The Controller decides why and how personal data is processed; the Processor processes it only to provide the service.
Scope and purpose
The Processor processes personal data solely to operate the field service platform for the Controller: scheduling, dispatch, memberships, invoicing, notifications and related tools. The Processor does not use the Controller's customer data for its own purposes and does not sell it.
Categories of data
Processing covers the Controller's team and customer records: names, contact details, service addresses, appointment and job history, technician location at check-in, job site photos, signatures, and payment metadata (never full card numbers, which are handled by the payment provider).
Instructions
The Processor acts only on the Controller's documented instructions, which are given through the use of the service itself, unless required by law to act otherwise, in which case the Processor will inform the Controller unless the law forbids it.
Confidentiality
People authorized to process the data are bound by confidentiality obligations and access it only as needed to operate and support the service.
Subprocessors
The Processor uses vetted subprocessors to run the service: cloud hosting and storage, email delivery, SMS delivery and payment processing. The Processor remains responsible for its subprocessors and will inform the Controller of material changes.
Security
The Processor applies technical and organizational measures appropriate to the risk: encryption in transit, tenant isolation enforced at the data layer, role based access, audit logging, and hashed credentials. No measure guarantees absolute security.
Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a breach affecting the Controller's data, and will provide the information reasonably needed for the Controller to meet its own notification duties.
Assistance
Taking into account the nature of the processing, the Processor will reasonably assist the Controller in responding to data subject requests (access, correction, deletion) and in meeting security and assessment obligations.
Return and deletion
Upon termination, the Controller may export its data from the service. After a reasonable grace period the Processor deletes the Controller's personal data, unless the law requires longer retention.
International transfers
Where processing involves transfers across borders, the Processor relies on lawful transfer mechanisms appropriate to the regions involved.
Term
This addendum applies for as long as the Processor processes personal data on the Controller's behalf and supplements, and forms part of, the Terms of Service.