Data Processing Addendum

Scope

This addendum is part of the Terms of Service between Thora Cloud LLC and each business using Crewbird Pro. It covers personal data your business puts into Crewbird about other people: your customers, staff, job applicants and contacts (“your personal data”).

For that data your business is the controller (or a processor for its own clients), and we are your processor, called a “service provider” or “processor” under US state privacy laws. If this addendum and the Terms disagree about personal data, this addendum wins.

What we process

• Purpose: to provide Crewbird Pro to you: store and show your records, send the emails you ask for, take card payments through your Stripe account, run AI features when someone in your business uses them, keep the service secure, and support you.
• People: your customers and their contacts, your staff, and people who apply for your jobs or send you requests.
• Data: names, emails, phone numbers and addresses; jobs, visits, notes, checklists and files; hours worked and, if you turn it on, the location at clock-in and clock-out; quotes, invoices and payment records (never full card numbers); messages; applications; typed signatures.
• Sensitive data: none is needed, and you agree not to store it (see the Terms).
• Duration: while your account is open, then until deletion as the Terms describe.

Our commitments

• We process your personal data only on your instructions: these terms and how you use and set up Crewbird. If we think an instruction breaks the law, we’ll tell you.
• Everyone at Crewbird who can reach your data is bound to keep it confidential and reaches it only to support you or keep the service secure.
• We protect it with the measures on the Security page.
• We use only the providers on the Subprocessors list, under written terms that protect data at least as well as this addendum. We’ll email owners at least 14 days before adding or replacing one. If you object for a reasonable data protection reason and we can’t resolve it, you may cancel and we’ll refund prepaid fees for the time left.
• We help you answer people’s requests to see, correct, export or delete their data. Most you can do yourself: edit or delete the record, or export the business. We pass on any request we receive about your data rather than answering it ourselves.
• We help, as reasonably needed, with your data protection assessments and with regulators.
• If we become aware of a breach affecting your personal data, we’ll tell owners without undue delay, and within 72 hours, with what we know and what we’re doing about it.
• When your account closes, we delete your personal data as the Terms describe, unless the law requires us to keep it.
• Once a year, or after a breach, we’ll answer your reasonable written questions about how we meet this addendum.

US state privacy laws

As your service provider we won’t sell or share your personal data, use or keep it for any purpose other than providing Crewbird to you, or combine it with data from other sources except as those laws allow. We’ll tell you if we can no longer meet these obligations.

International transfers

Crewbird runs in the United States and on our providers’ global networks. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred, the European Commission’s Standard Contractual Clauses (modules two and three), with the UK Addendum and the Swiss changes where they apply, are part of this addendum, with you as data exporter and us as data importer.

Your responsibilities

You have a lawful basis for the data you put into Crewbird, give people the notices the law requires (such as telling crew about clock-in locations), and make sure your instructions to us are lawful.

Liability

Each side’s liability under this addendum is subject to the limits in the Terms.