Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the CrewCor Terms & Conditions (“Agreement”) between 2359555 Alberta Ltd. (“CrewCor”) and the customer using the CrewCor Service (“Customer”). It applies when CrewCor processes personal information in Customer Data on Customer’s behalf.

1. Roles and scope

Customer is the controller or business responsible for Customer Data, and CrewCor is the processor or service provider. Customer determines the purposes and means of processing. This DPA applies to personal information submitted to the Service, including client, employee, contact, job-site, photo, signature, and safety-record information.

2. Customer instructions

CrewCor will process Customer Data only to provide, secure, support, and improve the Service, as instructed by Customer through the Agreement and ordinary use of the Service. Customer is responsible for providing lawful instructions and obtaining required notices, permissions, and consents.

3. Confidentiality and security

CrewCor will ensure that people authorized to process Customer Data are subject to confidentiality obligations. CrewCor maintains reasonable technical and organizational safeguards, including encryption in transit and at rest, access controls, role-based permissions, backup controls, and security monitoring. Customer remains responsible for its users, devices, credentials, and configuration choices.

4. Subprocessors

Customer authorizes CrewCor to use service providers needed to operate the Service, including hosting, storage, email, payment, analytics, and enabled integrations. CrewCor will require subprocessors to protect Customer Data under written obligations appropriate to their services. A current vendor list is available at crewcor.com/subprocessors. CrewCor will provide notice of material additions where required and give Customer a reasonable opportunity to object.

5. Assistance with individual rights

Taking into account the nature of processing, CrewCor will reasonably assist Customer with requests to access, correct, delete, export, restrict, or object to processing of Customer Data. Customer should send requests to privacy@crewcor.com; CrewCor may require verification and may charge only reasonable costs where permitted by law.

6. Security incidents

CrewCor will notify Customer without undue delay after confirming a security incident involving Customer Data and will provide information reasonably available to help Customer assess and meet its notification obligations. Customer is responsible for notifying affected individuals or regulators where required, unless the parties agree otherwise.

7. International transfers

Customer Data may be processed in Canada, the United States, or other countries where CrewCor or its subprocessors operate. Where required, the parties will use an appropriate transfer mechanism, including applicable Standard Contractual Clauses or another lawful safeguard.

8. Audits and compliance information

On reasonable written request, CrewCor will provide available information needed to demonstrate compliance with this DPA, subject to confidentiality, security, and protection of other customers. Audits must be reasonable, proportionate, and not disrupt the Service.

9. Return and deletion

During the Agreement, Customer may export Customer Data using available Service features. After termination, CrewCor will retain Customer Data for up to 30 days to allow export, then delete it unless retention is required by law, a legal hold, or backup-cycle limitations. Safety records may be retained longer where legally required.

10. Order of precedence

If this DPA conflicts with the Agreement about processing personal information, this DPA controls to the extent of the conflict. The Agreement otherwise remains in effect. This DPA does not grant either party ownership of the other party’s data or intellectual property.

11. Contact

Privacy and DPA inquiries: privacy@crewcor.com. Legal inquiries: legal@crewcor.com. Mailing address: 16 Evanspark Cir NW, Calgary, AB T3P 0B3, Canada.