Data Processing Agreement

This Data Processing Agreement (“DPA”) governs crewd.’s (“crewd.”) processing of personal information and forms part of the service agreement between crewd. and its business client (the “Client”). It is written for Canadian law and maps common terminology across frameworks:

• Controller (GDPR) — the person carrying on an enterprise who determines the purposes of the processing (PIPEDA / Law 25).
• Processor (GDPR) — the service provider or mandatary that processes personal information on the controller’s behalf (Law 25 s. 18.3).

Where crewd. processes personal information on the Client’s documented instructions to deliver the dispatch service, crewd. acts as Processor and the Client as Controller. Twilio, Google, and our AI language-model provider act as Sub-processors.

This DPA governs only personal information that crewd. processes on the Client’s behalf. Personal information relating to crewd.’s own enrolled workers — including their SMS opt-in and consent records — is processed by crewd. as Controller under its Privacy Policy, not under this DPA.

crewd. processes personal information solely to provide the staffing and dispatch service: dispatching work-offer and job-dispatch SMS to enrolled workers, handling inbound calls through an automated phone assistant, resolving job-site addresses, and classifying replies and drafting operator communications. crewd. does not process the personal information for any other purpose.

crewd. processes personal information for the term of the service agreement, plus a limited wind-down period, after which it returns or deletes the information as described in Return or deletion of data.

• Workers crewd. dispatches to the Client’s jobs.
• Individuals who call the Client’s intake line.
• Business-client contacts who use the service.

The enrollment and SMS-consent records of crewd.’s own labour pool are held by crewd. as Controller under its Privacy Policy and fall outside this DPA.

The personal information processed includes:

• Name and mobile phone number.
• Worker status, service zones, skills, availability, and job assignments.
• Job-site addresses and location data resolved for dispatch.
• SMS content and replies, and call audio and transcripts.
• Consent-audit metadata (timestamp, IP address, consent-language version) and STOP/opt-out status.

crewd. processes the personal information only on the Client’s documented instructions, including with regard to transfers outside Canada, unless required to do so by law — in which case crewd. informs the Client of that legal requirement before processing, unless the law prohibits it.

Persons authorized to process the personal information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access is limited to authorized staff.

crewd. implements technical and organizational measures appropriate to the risk, including:

• Encryption of personal information in transit (HTTPS/TLS).
• Authenticated, access-controlled operator dashboard, with the application gated behind edge authentication and access limited to authorized staff.
• Signature verification on inbound messaging and call webhooks; rate limiting on the public opt-in form.
• Logging and monitoring, and contractual security terms with sub-processors.

The Client provides general written authorization for crewd. to engage the sub-processors listed below. crewd. imposes data-protection terms materially equivalent to this DPA on each sub-processor and remains fully liable for their performance.

crewd. gives the Client at least 30 days’ advance notice — by email to a subscribed contact or by a dated change to this list — before adding or replacing a sub-processor, during which the Client may object on reasonable data-protection grounds.

Taking into account the nature of the processing, crewd. assists the Client by appropriate technical and organizational measures to respond to requests to exercise data-subject rights (access, correction, portability, de-indexing, and deletion), and promptly forwards any such request it receives directly rather than responding on its own.

crewd. notifies the Client without undue delay, and in any event within 72 hours, after becoming aware of a confidentiality incident affecting the personal information, and provides the information the Client needs to meet its own reporting obligations — the nature of the incident, the categories and approximate number of individuals affected, the likely consequences, and the remedial measures taken.

crewd. assists the Client with privacy impact assessments (Law 25 PIAs) and prior consultations, and cooperates with the Commission d’accès à l’information du Québec and the Office of the Privacy Commissioner of Canada.

At the Client’s choice, on termination or expiry of the service agreement, crewd. deletes or returns all personal information and deletes existing copies within a reasonable period, unless applicable law requires it to be kept, and provides written certification of deletion on request.

crewd. makes available to the Client the information necessary to demonstrate compliance with this DPA and allows for and contributes to audits and inspections conducted by the Client or an auditor it mandates, on reasonable notice and subject to confidentiality safeguards.

crewd.’s sub-processors process personal information in the United States. Before communicating personal information outside Québec, crewd. conducts a privacy impact assessment and enters a written agreement with protective measures (Law 25 s. 17), and uses contractual and other means to ensure a comparable level of protection while the information is processed by a third party (PIPEDA Accountability). Where a Client requires them, Standard Contractual Clauses can be made available.

Because sub-processors operate in the United States, personal information may be subject to lawful access requests by U.S. government authorities and courts. crewd. does not disclose personal information to government authorities except as legally required, and — where lawful — informs the Client of any such request.

Dispatch messaging relies on an opt-in CASL consent record — web-form consent plus a confirmation text — capturing the timestamp, IP address, and consent-language version. Replying STOP or ARRÊT revokes consent and suppresses further messages. This consent metadata is held by crewd. as Controller under its Privacy Policy; it is described here for the Client’s awareness.

In case of conflict with other terms of the service agreement on matters of data protection, this DPA prevails. This DPA is governed by the laws of the Province of Ontario and, where applicable, the Province of Québec, and the federal laws of Canada applicable therein. Effective date: July 17, 2026.