Data Processing Agreement

This Data Processing Agreement ("DPA") is incorporated into the CrewBrief Terms of Service (the "Terms") between CrewBrief LLC ("CrewBrief," the "Processor" or "Service Provider") and each business or team lead using the Service as a Contractor (the "Contractor," the "Controller" or "Business"). Capitalized terms not defined here have the meaning given in the Terms.

1.1 This DPA applies to personal information of workers and other individuals that the Contractor causes to be collected or processed through the Service — including job records, session records, GPS coordinate snapshots, photos, work notes, signature records, and dispute and approval records ("Contractor Data").

1.2 For Contractor Data, the Contractor is the controller (the "business" under the California Consumer Privacy Act as amended by the CPRA, and the "controller" under the Texas Data Privacy and Security Act and comparable state laws), and CrewBrief is the Contractor's processor ("service provider").

1.3 CrewBrief is the independent controller of account registration data, platform security and audit data, and data it processes to comply with its own legal obligations. That processing is governed by the CrewBrief Privacy Policy, not this DPA.

2.1 CrewBrief processes Contractor Data solely (a) on the Contractor's documented instructions as expressed through the Contractor's configuration and use of the Service, (b) as necessary to provide, secure, and maintain the Service as described in the Terms and Privacy Policy, and (c) as required by law, in which case CrewBrief will inform the Contractor of the legal requirement before processing unless the law prohibits that notice.

2.2 CrewBrief will not sell Contractor Data, share it for cross-context behavioral advertising, retain, use, or disclose it outside the direct business relationship with the Contractor or for any purpose other than the business purposes specified in this DPA, or combine it with personal information from other sources except as permitted for a service provider by applicable law. CrewBrief certifies that it understands and will comply with these restrictions.

2.3 The immutability of sealed records and signed documents (Terms, "Records, Retention & Exports") is a standing processing instruction from every party to those records: CrewBrief will not alter or delete a sealed record except as this DPA and the published retention schedule provide.

3.1 CrewBrief ensures that persons authorized to process Contractor Data are bound by contractual or statutory confidentiality obligations and access it only as needed to provide the Service.

4.1 The Contractor authorizes the subprocessors listed in the "Service Providers (Subprocessors)" section of the CrewBrief Privacy Policy. CrewBrief will reflect material subprocessor changes in an updated version of the Privacy Policy before the change takes effect, and remains responsible for each subprocessor's performance.

4.2 Each subprocessor is bound by a written agreement imposing data-protection obligations no less protective than this DPA.

5.1 CrewBrief implements and maintains reasonable administrative, technical, and physical safeguards appropriate to the nature of Contractor Data, including encryption in transit and at rest, scoped access controls (each party sees only their own records), hash-chained tamper-evident audit logs, secrets management, and personal-data scrubbing in error telemetry.

6.1 CrewBrief will notify the Contractor without unreasonable delay after becoming aware of a breach of security affecting Contractor Data, and will provide information reasonably available about the nature of the breach, the data involved, and the measures taken, so the Contractor can meet its own notification obligations.

7.1 Taking into account the nature of the processing, CrewBrief will assist the Contractor by appropriate technical and organizational measures in responding to verified requests to exercise privacy rights (access, correction, deletion, portability) over Contractor Data. Where a worker contacts CrewBrief directly, CrewBrief will act on the request to the extent its processor role allows and route the remainder to the Contractor.

7.2 Correction and deletion of sealed records operate by signed amendment, and deletion is subject to the sealed-record and legal-retention exceptions in the Privacy Policy; each is a disclosed limitation of the Service's design, not a refusal to assist.

8.1 Upon termination of the Contractor's account, CrewBrief will delete or return Contractor Data in accordance with the published retention schedule in the Privacy Policy, except that (a) sealed records and signed documents to which a worker is a party remain available to that worker, and (b) data CrewBrief must retain to comply with law, resolve disputes, or enforce agreements is retained only as long as required.

8.2 The Contractor may export its records at any time before account closure takes effect.

9.1 CrewBrief will make available to the Contractor information reasonably necessary to demonstrate compliance with this DPA, and will allow and cooperate with reasonable assessments by the Contractor or the Contractor's designated assessor, no more than once per 12-month period absent a breach, on reasonable notice and subject to confidentiality. CrewBrief may satisfy an assessment by providing a summary of a recent third-party audit or assessment covering the same scope.

9.2 CrewBrief will notify the Contractor if it determines that it can no longer meet its obligations under applicable privacy law, and the Contractor may then take reasonable and appropriate steps to stop and remediate unauthorized use of Contractor Data.

10.1 This DPA takes effect for a Contractor upon acceptance of the Terms and remains in effect while CrewBrief processes Contractor Data. If this DPA conflicts with the Terms as to the processing of Contractor Data, this DPA controls.

10.2 CrewBrief's liability under this DPA is subject to the Limitation of Liability section of the Terms. This DPA is governed by the same law and dispute-resolution terms as the Terms.

10.3 This DPA may be offered in languages other than English; a non-English rendering is published only as a professionally certified translation of the English text, and the English version controls in case of any conflict, to the extent permitted by applicable law.