Data Processing Agreement
Version 1.0. Last updated: November 8, 2026.
Effective date: November 23, 2026.
This Data Processing Agreement (“DPA”) forms part of the agreement between Crewscope Inc. (“Crewscope”) and the customer identified in the applicable Order Form or Online Subscription Form (“Customer”) for Crewscope’s Services (the “Agreement”). Capitalized terms not defined in this DPA have the meanings given in the Terms of Service or, where applicable, the master software-as-a-service agreement signed by the Parties.
This DPA applies automatically to the Processing of Personal Information in Customer Data and requires no signature. Customers whose procurement process requires a countersigned copy may request one from privacy@crewscope.com; the countersigned copy will be identical to the version published at https://crewscope.com/data-processing-agreement on the date of signature.
1. Definitions
(a) “Applicable Data Protection Law” means all laws relating to the privacy, security or protection of Personal Information that apply to the Processing of Customer Personal Information under the Agreement, which may include Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and substantially similar provincial laws (including Quebec’s Act respecting the protection of personal information in the private sector), the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws, the EU and UK General Data Protection Regulations (“GDPR”), and any laws implementing or supplementing them.
(b) “Controller”, “Processor”, “Data Subject”, “Processing” and “Personal Data Breach” have the meanings given in Applicable Data Protection Law. “Controller” includes a “business” and “Processor” includes a “service provider” or “contractor” under the CCPA. “Processing” includes collecting, recording, storing, using, disclosing, transmitting and deleting.
(c) “Customer Personal Information” means Personal Information contained in Customer Data that Crewscope Processes on behalf of Customer in providing the Services. It does not include Account Information.
(d) “Account Information” means Personal Information that Crewscope collects and Processes for its own purposes as a Controller, such as the business contact details of Customer’s personnel used for account administration, billing, support and security of the Services, and information about visitors to Crewscope’s website. Account Information is governed by the Privacy Policy, not by this DPA.
(e) “Sub-processor” means a third party engaged by Crewscope to Process Customer Personal Information in connection with the Services.
(f) “Security Measures” means the technical and organizational measures described in Annex 2.
2. Roles of the Parties
(a) Customer as Controller. As between the Parties, Customer is the Controller of Customer Personal Information and Crewscope is the Processor. Customer decides what Customer Personal Information is submitted to the Services and for what purposes, and is responsible for the lawfulness of that Processing, including obtaining any consents and giving any notices to Authorized Users and other Data Subjects that Applicable Data Protection Law requires.
(b) Crewscope as Processor. Crewscope shall Process Customer Personal Information only as a Processor on behalf of Customer and in accordance with this DPA.
(c) Crewscope as Controller of Account Information. Crewscope is an independent Controller of Account Information and shall Process it in accordance with the Privacy Policy and Applicable Data Protection Law.
(d) Customer instructions through Authorized Users. Actions taken by Customer’s Authorized Users within the Services, including actions requested from the AI Features, are Customer’s instructions for the purposes of this DPA.
3. Processing on Instructions
(a) Crewscope shall Process Customer Personal Information only on Customer’s documented instructions, including with regard to transfers to another country, unless required to do so by law, in which case Crewscope shall inform Customer of that legal requirement before Processing unless the law prohibits such notice.
(b) Customer’s documented instructions are: (i) the Agreement, including this DPA and any Order Form; (ii) the configuration of the Services and the actions of Authorized Users within the Services; and (iii) any further written instructions agreed by the Parties. Crewscope shall promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
(c) Authorized uses. Customer instructs and authorizes Crewscope to Process Customer Personal Information for the following purposes, and no others:
- (i) to provide, maintain, secure and support the Services, including the AI Features, in accordance with the Documentation;
- (ii) to detect, prevent and investigate security incidents, fraud, abuse and violations of the Agreement;
- (iii) to comply with applicable law and lawful requests from public authorities, subject to Section 3(a);
- (iv) to compile Aggregated Statistics, as defined in the Terms of Service, provided that Aggregated Statistics are de-identified so that they do not identify, and cannot reasonably be used to identify, Customer, any Authorized User or any other individual, and Crewscope shall not attempt to re-identify them; and
- (v) to review inputs to and outputs from the AI Features for quality, safety and support purposes, by Crewscope personnel bound by confidentiality obligations, limited to what is necessary for that purpose.
(d) Prohibited uses. Crewscope shall not: (i) sell or share Customer Personal Information, or disclose it for cross-context behavioral advertising or any monetary or other valuable consideration; (ii) retain, use or disclose Customer Personal Information for any purpose other than those in Section 3(c), including for any commercial purpose of its own; (iii) retain, use or disclose Customer Personal Information outside the direct business relationship between the Parties; (iv) combine Customer Personal Information with Personal Information received from another source, except as needed to provide the Services; or (v) use Customer Personal Information or Customer Data to train, fine-tune or otherwise improve artificial intelligence or machine learning models, whether its own or any third party’s. Crewscope certifies that it understands and will comply with these restrictions.
(e) No training by AI providers. Crewscope shall only use third-party AI service providers under terms that prohibit the provider from using Customer Data to train or improve their models and that limit the provider’s retention of Customer Data to what is needed to provide the service, including any abuse monitoring that the provider is legally required to perform. The AI providers currently engaged and their retention terms are listed in Annex 3.
4. Confidentiality
Crewscope shall ensure that every person it authorizes to Process Customer Personal Information is bound by a written obligation of confidentiality, limits access to those who need it to perform the Services, and receives privacy and security training appropriate to their role.
5. Security
(a) Crewscope shall implement and maintain the Security Measures. The Security Measures take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, and the risks to Data Subjects. Crewscope may update the Security Measures from time to time, provided that the updates do not materially reduce the overall level of protection.
(b) Crewscope maintains a SOC 2 Type II attestation covering the Services and shall maintain that attestation or a materially equivalent one during the Term.
(c) Customer is responsible for configuring and using the Services securely, including managing Authorized User accounts, roles and permissions, enforcing single sign-on and two-factor authentication where available, and keeping credentials confidential.
6. Sub-processors
(a) General authorization. Customer authorizes Crewscope to engage the Sub-processors listed in Annex 3, and further Sub-processors as set out in this Section.
(b) Flow-down. Crewscope shall enter into a written agreement with each Sub-processor that imposes data protection obligations no less protective of Customer Personal Information than those in this DPA, to the extent applicable to the services the Sub-processor performs. Crewscope remains liable to Customer for the performance of each Sub-processor’s obligations.
(c) Notice of changes. Crewscope shall give Customer at least fifteen (15) days’ notice before authorizing a new Sub-processor to Process Customer Personal Information, by updating Annex 3 and sending a Digital Notification to Customer’s designated administrators. Customers may also subscribe to notice of Sub-processor changes at privacy@crewscope.com.
(d) Objection. Customer may object to a new Sub-processor on reasonable data protection grounds by written notice within the fifteen-day period. The Parties shall discuss the objection in good faith. If Crewscope cannot reasonably accommodate the objection within thirty (30) days of receiving it, Customer may terminate the affected Services on written notice, and Crewscope shall refund any pre-paid Fees for the unused portion of the Term for those Services. This is Customer’s sole remedy for an objection.
(e) Emergency replacement. Crewscope may replace a Sub-processor without the notice period in Section 6(c) where the replacement is needed to maintain the security or availability of the Services, provided that Crewscope notifies Customer as soon as reasonably practicable and Customer retains the objection right in Section 6(d).
(f) Pilot and optional features. Where a Sub-processor Processes Customer Personal Information only in connection with a pilot, beta or optional feature that Customer must enable or opt into, and does not Process the Customer Personal Information of customers who have not enabled that feature, Crewscope may give the notice in Section 6(c) only to the customers who enable the feature, before or at the time they enable it, instead of by updating Annex 3. By enabling the feature after receiving that notice, Customer authorizes the Sub-processor for that feature. Customer may withdraw that authorization at any time by disabling the feature, and Section 6(d) does not apply. If the feature later becomes generally available or enabled by default, Crewscope shall add the Sub-processor to Annex 3 and the notice and objection process in Sections 6(c) and 6(d) applies to all other customers.
7. Assistance to Customer
(a) Data Subject requests. Taking into account the nature of the Processing, Crewscope shall assist Customer by appropriate technical and organizational measures in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Law, including access, correction, deletion, portability and restriction. The Services include self-service tools that allow Customer’s administrators to view, correct, export and delete Customer Personal Information. Where a request cannot be fulfilled through those tools, Crewscope shall assist on request within a reasonable time.
(b) Requests received by Crewscope. If Crewscope receives a request directly from a Data Subject relating to Customer Personal Information, Crewscope shall not respond except to acknowledge receipt and direct the Data Subject to Customer, unless Applicable Data Protection Law requires Crewscope to respond, and shall promptly notify Customer of the request.
(c) Assessments and consultations. Crewscope shall provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities that Applicable Data Protection Law requires, to the extent they relate to the Services and the information is not otherwise available to Customer.
(d) Costs. Assistance under this Section is included in the Fees, except that Crewscope may charge reasonable fees for assistance that is excessive, repetitive or outside the normal operation of the Services, and will notify Customer before incurring such fees.
8. Personal Data Breach
(a) Crewscope shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Information, and in any event within twenty-four (24) hours after confirming the Personal Data Breach and within seventy-two (72) hours after first becoming aware of it.
(b) The notice shall describe, to the extent known at the time, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed to address the breach, and a contact point. Crewscope may provide the information in phases as it becomes available.
(c) Crewscope shall take reasonable steps to contain and remediate the breach and shall cooperate with Customer’s reasonable requests for information needed to meet Customer’s own notification obligations. Unless required by law, Crewscope shall not notify Data Subjects or authorities of a breach affecting Customer Personal Information without first consulting Customer.
(d) A notification under this Section is not an admission of fault or liability.
9. Audit and Information Rights
(a) Crewscope shall make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, which consists of: (i) Crewscope’s most recent SOC 2 Type II report and any other third-party certifications or penetration test attestations Crewscope holds, under confidentiality; (ii) Crewscope’s current sub-processor list and security documentation; and (iii) written responses to a reasonable security questionnaire, no more than once per year unless a Personal Data Breach has occurred or a supervisory authority requires otherwise.
(b) If the information in Section 9(a) is not sufficient to meet a requirement of Applicable Data Protection Law or a demand of a supervisory authority, Customer or an independent auditor bound by confidentiality may conduct an audit, no more than once per year, on at least thirty (30) days’ written notice, during normal business hours, in a manner that does not disrupt Crewscope’s operations or compromise the security of other customers’ data, and at Customer’s expense. Crewscope may require the auditor to sign a confidentiality agreement. Audits do not extend to Sub-processors’ facilities; Crewscope shall instead provide the Sub-processors’ certifications and audit reports available to it.
10. Data Residency and International Transfers
(a) Hosting locations. Crewscope hosts and Processes Customer Data in Canada and the United States. Unless a hosting region is specified in an Order Form, Crewscope may store and Process Customer Data in either or both countries at its discretion and may move it between them.
(b) Data residency. Where an Order Form specifies a hosting region (Canada or the United States), Crewscope shall store Customer Data, including its database, files and routine backups, in that region and shall not move it to another region without Customer’s prior agreement, except for a transient failover or restoration needed to maintain the availability of the Services, after which Customer Data will be returned to the specified region. Data residency is available for the subscription plans and contract sizes identified by Crewscope, and the applicable fees, if any, are set out in the Order Form.
(c) Sub-processor locations. Certain Sub-processors Process Customer Personal Information outside the hosting location or specified region, as described in Annex 3. In particular, AI inference, voice transcription, SMS delivery, email delivery and push notifications may be performed in the United States regardless of any specified region. Customer authorizes these transfers subject to this Section.
(d) Transfer safeguards. Where Applicable Data Protection Law restricts a transfer of Customer Personal Information to a country outside the country of origin, the Parties shall rely on an adequacy decision where one applies, and otherwise on: (i) for transfers subject to the EU GDPR, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914, Module Two (controller to processor), which are incorporated by reference, with Customer as data exporter and Crewscope as data importer, the optional docking clause included, option 2 of Clause 9 (general authorization) with the notice period in Section 6(c), Clause 11 optional language excluded, the law of Ireland governing and the courts of Ireland having jurisdiction, and Annexes 1, 2 and 3 to this DPA serving as the Annexes to the clauses; (ii) for transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner, completed with the information in this DPA; and (iii) for transfers subject to the Swiss Federal Act on Data Protection, the clauses in (i) with the adaptations required by the Swiss Federal Data Protection and Information Commissioner. If a transfer mechanism relied upon is invalidated, the Parties shall cooperate in good faith to implement a replacement.
(e) Government access requests. If Crewscope receives a legally binding request from a public authority for access to Customer Personal Information, Crewscope shall, unless legally prohibited, promptly notify Customer, review the legality of the request, and disclose only the minimum information required. Crewscope has never received a request of this kind and publishes any change to that statement.
11. Deletion and Return
(a) During the Term, Customer may export and delete Customer Data using the Services’ self-service tools.
(b) Deactivation. On expiration or termination of the Agreement, Crewscope shall deactivate Customer’s account and its Authorized Users’ accounts so that the Services can no longer be accessed, and shall retain Customer Data in that deactivated state subject to this Section.
(c) Export. At Customer’s written request made within the Export Request Period defined in the Terms of Service, Crewscope shall provide an export of Customer Data in a commonly used electronic format.
(d) Deletion on instruction. Customer may instruct Crewscope in writing, at any time after expiration or termination, to delete Customer Personal Information. Crewscope shall remove it from its live environment within ten (10) days after receiving the instruction, and from routine backups within one hundred (100) days after receiving the instruction, as those backups expire in the normal course of Crewscope’s backup cycle. Crewscope shall confirm deletion in writing on request.
(e) Retention absent an instruction. If Crewscope receives no deletion instruction, Customer instructs and authorizes Crewscope to retain Customer Data and Customer’s deactivated environment, at Crewscope’s discretion and for as long as Crewscope chooses, solely so that the Services can be reactivated if Customer subscribes again, or to delete them at any time without notice. Crewscope shall not access or use Customer Personal Information retained under this Section for any other purpose and shall continue to protect it under Sections 4 to 6 and 8 of this DPA.
(f) Exceptions. Crewscope may retain copies of Customer Personal Information that it must retain under applicable law, and records of Fees, reward purchases and redemptions that it needs for its own accounting and tax records, for as long as that law or those needs require. Such copies remain subject to this DPA until deleted.
(g) Aggregated Statistics compiled in accordance with Section 3(c)(iv) are not Customer Personal Information and are not subject to deletion under this Section.
12. Restricted Data
Customer shall not submit to the Services the categories of information listed in the Restricted Data section of the Terms of Service, including government identification numbers, payment card data, health information regulated by health privacy laws, biometric data, and special categories of data under the GDPR. Crewscope has no obligation under this DPA in respect of such information, except to delete it on request.
13. Liability
Each Party’s liability arising out of or related to this DPA is subject to the exclusions and limitations of liability in the Agreement, except as otherwise required by Applicable Data Protection Law or expressly agreed in an Order Form. Where the Agreement excludes liability for breach of data or system security, that exclusion does not apply to Crewscope’s breach of its obligations under Sections 3, 5, 6 or 8 of this DPA, and Crewscope’s aggregate liability for such breaches shall not exceed two (2) times the total Fees paid or payable under the Agreement in the twelve (12) months preceding the event giving rise to the claim.
14. General
(a) Order of precedence. In the event of a conflict regarding the Processing of Customer Personal Information, the following order applies: (i) the Standard Contractual Clauses, where they apply; (ii) a term of an Order Form that expressly amends this DPA; (iii) this DPA; (iv) the remainder of the Agreement.
(b) Updates. Crewscope may update this DPA to reflect changes in Applicable Data Protection Law or in the Services, in accordance with the amendment procedure in the Agreement. Updates shall not materially reduce the protection of Customer Personal Information. Changes to Annex 3 follow Section 6. The current version and the date of its last update appear at the top of this page, and prior versions are available on request.
(c) Term. This DPA takes effect when the Agreement takes effect, or on the Effective Date above if later, and remains in force for as long as Crewscope Processes Customer Personal Information.
(d) Governing law. This DPA is governed by the law governing the Agreement, except where the Standard Contractual Clauses require otherwise.
(e) Contact. Questions about this DPA, requests for a countersigned copy, and privacy requests should be sent to Crewscope’s privacy officer at privacy@crewscope.com, or by mail to Crewscope Inc., 4711 Yonge St., 10th Floor, Toronto, ON, Canada, M2N 6K8.
Annex 1: Description of Processing
Subject matter and duration. The Processing of Customer Personal Information necessary to provide the Services under the Agreement, for the Term and any retention under Section 11.
Nature and purpose. Hosting, storage, transmission, display, analysis and deletion of Customer Data to provide a field coordination and workforce engagement platform, including task and goal tracking, check-ins, recognition and rewards, photo and document capture, messaging by SMS, email, web and mobile app, and AI Features (an AI assistant, image description and classification, voice transcription and spoken responses, including transcription of phone calls to the AI assistant).
Categories of Data Subjects. Customer’s employees, consultants, contractors, sub-contractors and agents designated as Authorized Users; personnel of Customer’s clients, suppliers and other third parties who appear in Customer Data; and other individuals who appear in photos, recordings or records submitted by Authorized Users.
Categories of Customer Personal Information.
- Identity and contact details: name, email address, phone number, employer or firm, job title, role and permissions, language preference, profile photo.
- Work records: projects, tasks, goals, check-ins, schedules, certifications and qualifications, recognition, reward points and redemptions, attendance and performance information Customer chooses to record.
- Communications: messages exchanged with the AI assistant and other users by SMS, email, web chat, mobile app and voice, including transcripts and generated responses.
- Media: photos, videos, audio recordings and documents, with embedded metadata such as capture time and device model.
- Location: precise geolocation, altitude, heading and barometric pressure at the moment an Authorized User captures a photo, submits a record or sends a message through the mobile app.
- Device and usage information: device identifiers, operating system and app version, push notification tokens, IP address, and logs of actions taken in the Services.
Special categories of data. None intended. Customer shall not submit Restricted Data (Section 12).
Frequency. Continuous, for the Term.
Annex 2: Security Measures
Crewscope maintains an information security program attested under SOC 2 Type II. The measures below summarize the program; the SOC 2 report describes the controls and their testing in detail and is available under confidentiality on request.
- Governance. A named security lead, documented policies reviewed at least annually, a risk register, and background checks and security training for all personnel with access to production systems.
- Access control. Role-based access to production systems on a least-privilege basis, single sign-on and multi-factor authentication for Crewscope personnel, prompt removal of access on role change or departure, and periodic access reviews.
- Tenant isolation. Every request to the Services is scoped to Customer’s workspace before any record is read. Isolation is enforced in code and verified by automated tests on every release and by annual external penetration testing.
- Encryption. Customer Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent. Credentials and secrets are stored in a managed secret store.
- Customer access controls. Role-based permissions, single sign-on with Google Workspace or Microsoft Entra ID with per-domain enforcement, two-factor authentication, session controls tiered by role, and immediate termination of all sessions when an account is deactivated or credentials change. The AI Features act only within the permissions of the Authorized User who is using them.
- Secure development. Code review for every change, automated testing, dependency vulnerability scanning, and separation of development, staging and production environments. Production data is not used in development environments.
- Logging and monitoring. Audit logs of administrative and security-relevant actions, retained for at least one year, available to Customer through the Services and as a SIEM feed for enterprise customers; monitoring and alerting for security events. A full record of each AI input and action (the prompt, the tools called and their results) is retained for three (3) months for investigations and quality review, after which it is deleted; the AI's resulting messages and the records it created or changed remain part of Customer Data.
- Vulnerability management. Regular vulnerability scanning, remediation on a risk-based schedule, and an annual external penetration test.
- Incident response. A documented incident response plan, tested at least annually, with the notification commitments in Section 8.
- Business continuity. Daily encrypted backups stored in Canada or the United States (in the specified region where the Order Form specifies one), with tested restoration procedures and a recovery point objective of 24 hours.
- Sub-processor management. Due diligence before engagement, written data protection terms with every Sub-processor, and annual review of each Sub-processor’s certifications.
- Data handling. Data minimization in the design of the Services, deletion in accordance with Section 11, and secure disposal of media.
Annex 3: Sub-processors
Crewscope uses the following Sub-processors to provide the Services. Each is bound by a written agreement containing data protection obligations consistent with this DPA, and each holds a current SOC 2 Type II attestation, ISO 27001 certification, or both. Customers may subscribe to notice of changes to this list at privacy@crewscope.com.
Infrastructure
| Sub-processor | Purpose | Location of Processing | Data Processed |
|---|---|---|---|
| DigitalOcean, LLC | Application hosting, database and backups | Canada (Toronto) and United States; a single region where one is specified in the Order Form | All Customer Data |
| Cloudflare, Inc. | File and media storage, edge security and content delivery | Canada and United States for storage; a single region where one is specified in the Order Form; global edge network for delivery | Photos, documents and media; request metadata |
AI Features
| Sub-processor | Purpose | Location of Processing | Retention and training terms |
|---|---|---|---|
| Anthropic, PBC | Language and vision models for the AI assistant, image description and classification, and document understanding | United States | No training on Customer Data. Inputs and outputs are not retained beyond the request except for abuse monitoring required by the provider’s terms. |
| Google LLC (Google Cloud) | Language and vision models for the AI assistant, image description and classification, and document understanding; speech-to-text and text-to-speech | United States or Canada | No training on Customer Data. No retention beyond the request under the provider’s enterprise terms. |
| OpenAI, L.L.C. | Voice transcription, live voice conversations with the AI assistant (speech-to-text and text-to-speech), and language models for the AI assistant | United States | No training on Customer Data. No retention beyond the request under the provider’s API terms. |
Crewscope uses these providers interchangeably. Models are upgraded and replaced continuously, so Crewscope may at any time change which provider serves as the primary or fallback model for a given AI Feature, or route a feature to a different listed provider, without notice and without this being a change to Annex 3, provided that the provider is listed in this table and the Processing stays within the purpose, location and terms described for it. Adding a provider that is not listed, or expanding a listed provider’s purpose, location or terms, is a Sub-processor change subject to Section 6.
Communications
| Sub-processor | Purpose | Location of Processing | Data Processed |
|---|---|---|---|
| Twilio Inc. | SMS delivery and voice calls to the AI assistant | United States | Phone numbers, message content, call audio |
| ActiveCampaign, LLC (Postmark) | Transactional email delivery | United States | Email addresses, email content |
| Apple Inc. and Google LLC | Mobile push notifications | United States | Device push tokens, notification content |
Other services
| Sub-processor | Purpose | Location of Processing | Data Processed |
|---|---|---|---|
| Tango Card, Inc. | Fulfilment of gift cards and other rewards redeemed by Authorized Users | United States | Name, email address, reward amount |
Crewscope also uses mapping, geocoding and weather data providers that receive location coordinates without any identifier linking them to an individual, and app analytics and crash reporting providers that receive device and diagnostic information. These providers do not receive Customer Personal Information other than as described and are listed in the detailed sub-processor register available on request.