Data Processing Agreement

For staff data you enter into Crewo (names, contact details, dates of birth, pay rates, National Insurance numbers, availability, absence records and clock-in records), you are the data controller and Crewo is your data processor under UK GDPR. For your own account data, Crewo is the controller, as described in our Privacy Policy.

We process staff personal data to provide staff scheduling, wage-cost calculation, time-and-attendance and payroll-export services, for as long as you hold a Crewo account, plus the retention period set out in our Privacy Policy.

We will: (a) process staff data only on your documented instructions, which you give through your use of the service; (b) ensure everyone with access is bound by confidentiality; (c) apply appropriate technical and organisational security measures, including encryption in transit and at rest, role-based access and audit logging; (d) assist you, so far as reasonably possible, in responding to staff requests to access, correct or delete their data; (e) notify you without undue delay after becoming aware of a personal data breach affecting your staff data, and provide reasonable assistance with your obligations to the ICO and affected individuals; (f) on closure of your account, delete or return staff personal data in line with our Privacy Policy, unless the law requires us to keep it; (g) make available the information reasonably necessary to demonstrate compliance with this DPA.

You authorise the sub-processors listed in our Privacy Policy. We will update that list before adding or replacing a sub-processor; if you object on reasonable data-protection grounds, you may close your account and export your data before the change takes effect.

Where a sub-processor processes data outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations, as applicable.

You confirm you have a lawful basis to process your staff's personal data in Crewo, that you will keep it accurate, and that you will only grant account access to people who need it.

Liability under this DPA is subject to the limitations set out in the Terms of Service.

You instruct and authorise us to derive aggregated and anonymised statistics from data processed under this DPA, provided that: (a) the outputs contain no personal data and cannot reasonably be used to identify any individual, business or site; (b) statistics are only produced across multiple customers, never from fewer than 5 businesses or 25 staff records; and (c) anonymisation follows ICO guidance, after which the outputs are no longer personal data. We act as an independent controller for the anonymisation step. You may exclude your organisation from future aggregation at any time in Settings.

Data protection questions about this DPA: privacy@crewo.co.uk