Data processing agreement

This Data Processing Agreement ("Agreement") forms part of the Terms of Use between Youssef Mohamed, trading as Krew ("Krew", "we", "us", the processor) and the organisation that uses the Krew workforce management application ("you", the controller). It applies whenever we process personal data on your behalf to provide the Service. By accepting it in the app on behalf of your organisation, you confirm that you are authorised to bind your organisation. If this Agreement and the Terms disagree about personal data, this Agreement wins.

1. Roles

You decide why and how your staff's personal data is used: you are the controller. We hold and process that data only to run the Service for you: we are the processor. Where we use data for our own purposes, such as billing your account, securing the Service, or answering your support requests, we act as a controller under the Privacy Policy, not under this Agreement.

2. Subject matter, duration, nature and purpose

We process personal data to provide the Service: planning and recording work, time and location records during shifts, housekeeping and maintenance work, tasks, stock, timesheets and pay records, ratings, messages, notifications, and the AI assistant. We store, organise, display, transmit, back up and delete it as the Service requires. We process it for as long as your organisation uses the Service, and afterwards only as section 9 describes.

3. Types of personal data and data subjects

Data subjects are your administrators, managers and workers, and anyone your staff record in the Service (for example a guest's name in a note).

Personal data includes: names, roles, job titles, organisation membership, working time zone, profile photos, sign-in identifiers (mobile number, email address, or Google or Apple account); shift, clock-in and clock-out times and break records; location points recorded while a person is clocked in, where you enable it; photos, videos and files attached to tasks, jobs and checklists; pay rates, pay basis, deductions, bonuses and settlements; ratings; chat messages, voice notes and files; push notification tokens and device language; app usage (sessions, last seen, app build and kind of device); and crash diagnostics.

We do not ask for special category data. If your staff type it into free-text fields, you remain responsible for having a lawful basis for it.

4. Our obligations as processor

We will:

• process personal data only on your documented instructions, which are this Agreement, the Terms, and the settings you choose in the Service, unless the law requires otherwise; in that case we will tell you first unless the law forbids it;
• tell you if we believe an instruction breaks data protection law;
• make sure everyone we authorise to process the data is bound by confidentiality;
• keep the data secure with appropriate technical and organisational measures, including encryption in transit, access rules enforced in the database so that one organisation can never read another's data, role-based access inside your organisation, and an audit log of any support access by the operator;
• never sell the data, use it for advertising, or use it to train AI models.

5. Sub-processors

You give us general authorisation to use the sub-processors listed in section 4 of the Privacy Policy, for the purposes listed there. These include our hosting and database provider (Supabase, in the European Union), sign-in text messages (Twilio), Google and Apple sign-in and push notification services, crash reporting (Sentry), and the AI assistant's model provider (OpenRouter and the model host it routes to, used only after the person asking allows it in the app). We bind each sub-processor to data protection terms no less protective than this Agreement, and we remain responsible to you for them. We will update the Privacy Policy before adding or replacing a sub-processor; you may object by contacting us, and if we cannot resolve the objection you may stop using the Service.

6. International transfers

Your data is stored in the European Union. Some sub-processors process limited data outside the UK and the European Economic Area. Where they do, we rely on an adequacy decision or on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

7. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and in any case within 72 hours, by email to your organisation's administrators. We will describe what happened, the data and people likely affected, the likely consequences, and what we are doing about it, and keep you updated as we learn more.

8. Helping you meet your obligations

Taking into account the nature of the processing, we will help you:

• answer requests from your staff to access, correct, erase, restrict or port their data — the Service already lets you view, edit, export and delete most records yourself;
• meet your security, breach notification, data protection impact assessment and prior consultation obligations.

9. Deletion or return at the end

When your organisation stops using the Service, you may export your timesheets and pay reports and ask us to delete your organisation's data. We delete it within 30 days of your request, and from backups when they expire, unless the law requires us to keep it. Retention periods while you use the Service are listed in the Privacy Policy, and you can shorten some of them in the app.

10. Audits and information

We will make available the information reasonably needed to show that we meet this Agreement, and answer your reasonable written questions about our security and processing. Audits beyond that are by agreement, at your cost, with reasonable notice, and must not compromise other customers' data.

11. Your obligations as controller

You will:

• have a lawful basis for the processing you instruct, including location tracking and photographs;
• tell your staff how their data is used, including that their location is recorded while they are clocked in where you enable it;
• give only lawful instructions and keep your administrators' accounts secure;
• be responsible for the pay rates, deductions and ratings you record.

12. Liability and term

Each party's liability under this Agreement is subject to the limits in the Terms, except where the law does not allow liability to be limited. This Agreement lasts as long as we process personal data for you.

13. Changes and contact

We may update this Agreement to reflect changes in the law or the Service. A new version is shown in the app for an administrator to accept before the organisation continues. The version date at the top identifies the current Agreement.

Contact: [email protected]

Post: Youssef Mohamed, trading as Krew, c/o Hicham, Flat 147 Warren House, Beckford Close, London W14 8TW, United Kingdom