Data processing and customer responsibilities

1. Roles, purpose and instructions

The customer company normally controls its workforce information. CrewLoca processes it to provide company workspaces, clockings, breaks, reviews, approvals, exports and authorised support. Data subjects include workers, owners, managers and payroll users. Categories include identity and contact details, roles, assignments, workplace and requested clocking locations, schedules, attendance and its review history.

Processing is to follow recorded lawful customer instructions, including authorised actions and the accepted retention schedule. The proposed agreement requires CrewLoca to flag an apparently unlawful instruction and to notify the customer before processing required by UK law unless notification is prohibited.

Information used by the operator for a separate purpose, such as handling its own business enquiries or legal duties, is addressed in the privacy notice. The actual purpose determines the role; labelling a record as security information does not automatically remove processor obligations.

2. Required protections in the customer agreement

The prepared agreement requires appropriate confidentiality, access limited to need, risk-appropriate technical and organisational security, assistance with individual rights, security incidents, impact assessments and consultation, and information and audit access needed to demonstrate compliance.

For a personal-data breach affecting customer data, the processor must notify the customer without undue delay after becoming aware, provide available information in stages where needed and assist the customer. This is not permission to wait 72 hours before notifying the customer.

Subprocessors require the agreed prior authorisation and equivalent contractual protection. The customer must receive advance information about relevant changes and a meaningful opportunity to object. CrewLoca remains responsible for its subprocessor obligations under the applicable law and contract.

At the end of processing, the customer chooses return or deletion in accordance with the agreement; copies are deleted unless applicable law requires retention. Necessary holds must be specific and restricted. Required audit, rights and regulatory cooperation cannot be excluded by a general confidentiality clause.

3. Current measures and limitations

Server-side membership and role checks restrict workspace access. Original clockings and reasons for corrections support review. Customer archives exclude authentication secrets and invitation token hashes. Export and request tools support customer recordkeeping and rights handling.

The selected production recovery path uses daily managed Supabase database backups, separately protected service settings and credentials, source history and supervised restoration. A combined account/workforce restore has been tested. Provider database points do not include Storage file bytes or every service setting; custom-role passwords may need supported reset. New custom backup capture and destructive retention remain disabled. App access removal is not proof that every authentication or provider copy has been erased.

Before restoration is opened to users, current permissions, removals, holds and erasures must be reconciled. Customer downloads do not replace the operator’s proportionate security and recovery duties. No certification, fixed restoration deadline or comprehensive backup guarantee is asserted by this page.

4. Retention and company exports

The selected attendance policy retains working history while the company remains subscribed, with no rolling annual attendance expiry. Continuing retention must serve the agreed purpose; lawful deletion instructions, unresolved work and specific holds must be reviewed. Exact clocking-location minimisation has a separate intended schedule. This policy is not an unconditional guarantee against accidental loss. Customers remain responsible for securely retaining the employment and payroll records they need, with exports after each payroll period, material correction and before closure, or more often if needed.

The intended end-of-service policy provides 60 days of read-only export access after the final paid-through service end, before company deletion can become eligible. Verified dates, advance warnings, applicable instructions, unresolved work, accounting duties and specific holds must be reviewed. Cases without a paid-through date require a separate decision. Primary data and provider recovery copies have different lifecycles; the selected managed plan provides seven-day daily database-point availability, while retained older custom copies keep their existing locks and holds.

These selected arrangements do not activate destructive routines. Company downloads are exports for recordkeeping and review; there is no supported customer-facing import, company rollback or restore from those downloads. Provider-assisted disaster recovery is a separate supervised process. The final agreement and current-rights reconciliation must be accepted before affected customer access is enabled.

5. Provider register and transfers

The current provider review covers Cloudflare for website/application hosting and protected connections, Supabase for the production workforce database, authentication and managed database backups, Resend for configured transactional delivery, Microsoft 365 for business correspondence, and OpenStreetMap Foundation services for maps and address search. Stripe remains a separate fictional-data billing test.

The final contractual schedule must identify the correct legal entities, actual roles, functions, countries or access locations, transfer safeguards, relevant copy-retention periods and change-notification arrangements. A provider’s published DPA alone does not establish that every part of CrewLoca’s configuration has been verified.

The service must not be described as UK-only hosting. Appropriate transfer terms and assessment are required wherever applicable. Copies of the relevant arrangements can be requested through support, with necessary redactions.

6. Before using workforce data

The company must establish lawful purposes and a lawful basis, inform workers, assess proportionate location use and any required impact assessment, limit permissions, review records and set a secure export process. CrewLoca’s notice is not the employer’s own workforce privacy notice.

The operator must complete the contracting identity, provider and security schedules and obtain recorded acceptance of the applicable agreement before onboarding real customer workforce records. These requirements apply to a free pilot as well as a paid subscription. Existing real-data processing, if any, also needs valid coverage now; incorporation is not a reason to postpone that duty.

For a processing-agreement copy, a rights request, a security concern or a closure request, contact support@crewloca.com.

• Contact support
• Read the privacy notice