CrewTango

CrewTango terms and agreement

One document: service terms, data processing agreement and privacy policy.

Document version:

Download full agreement with policy (HTML)

§ 1. Agreement and parties

These Terms constitute the CrewTango service agreement between the company identified under “Service provider” (Provider) and the business or organisation identified during registration or in the order (Customer). They include the service terms, the data processing agreement and the Privacy Policy reproduced in the final part of this same document. No separate data processing agreement between the Customer and the Provider is required for the scope described here.

The person entering into the Agreement must be authorised to represent the Customer. An account administrator is a User who manages application settings and access; that permission alone does not make the person a controller under the GDPR. Users are people granted access by the Customer, including employees and contractors.

The Agreement is concluded when an authorised Customer representative expressly accepts these Terms and the Provider activates the account, or when both parties confirm an order referring to an identified version of these Terms, including by email. The Terms are made available before conclusion in a form that can be saved and reproduced. Merely browsing the website or an employee accepting an invitation does not conclude an Agreement on the employer’s behalf.

CrewTango supports Customers’ professional and organisational activities. These Terms do not exclude mandatory rights, including protections available to individual entrepreneurs where applicable to the particular Agreement.

§ 2. Service and trial

The Service includes access to the web application and the mobile and desktop applications available under the selected plan. Features support work organisation, time records, schedules, tasks, projects, documents, reporting and industry workflows. The pricing page and accepted order specify the features, limits and required activations.

The free trial lasts 14 days from account activation. It includes all modules except those requiring manual activation under the pricing page. Care homes, cleaning operations and warehouse require activation at the Customer’s request, including during the trial. Activating a module does not replace establishing lawful grounds or authorisation to process data.

Use requires an internet connection, an email address and a device with up-to-date software compatible with the relevant application. Access to the camera, files, location and notifications depends on the feature being used and device settings. Users obtain applications from the official channels indicated by CrewTango.

§ 3. Subscription and billing

Paid service requires an order specifying the plan, price, commitment period, billing cycle, payment method and deadline, and renewal terms. The Customer receives this information before accepting the order. The mere expiry of the trial does not constitute consent to charges that have not been ordered.

For plans billed by active accounts, the subscription is calculated from the number of active accounts and the plan rate, subject to the minimum subscription value shown on the pricing page. The minimum is not a bundle of included accounts. The order specifies how accounts are counted within a billing period. Applicable VAT is added to net prices.

At the end of each monthly period, a monthly subscription automatically renews for another monthly period, and the fee for that period is automatically charged to the payment card through Stripe. When ordering a monthly subscription, the Customer authorises recurring charges to the designated card under the accepted pricing terms. Renewals continue until cancellation takes effect, subject to the agreed commitment period. Cancellation of the next renewal must be submitted before the next period starts, through billing settings or the Provider’s contact address; it takes effect at the end of the current period, subject to the agreed commitment and mandatory law.

With annual billing, prices shown per month are monthly equivalents of the annual fee. Each annual fee is a one-time payment made by the Customer in advance. Payment for one year does not authorise an automatic card charge for the next year. Continued access in the next annual period requires a separate one-time payment for that period by the deadline specified in the order or payment document. If payment for the next annual period is not made, account access may be suspended after the paid period ends. Suspension is not account closure; its effect on data is described under “Duration and termination”.

Migration discount terms for SCHEDULES & ATTENDANCE must be confirmed in the order: a 30% discount for up to 12 months, no longer than the documented period of using the previous paid system, annual payment and a 24-month commitment. The regular price agreed in the order applies after the discount.

Payments are handled by Stripe. Stripe Payments Europe, Limited (Ireland) is the contracting entity providing Stripe services to a business in Poland, and regulated payment services are provided by Stripe Technology Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, Ireland — an electronic money institution supervised by the Central Bank of Ireland, reference number C187865. The Privacy Policy forming part of this Agreement explains how billing data is processed.

Stripe contracting entities · Central Bank of Ireland register

Changing the website pricing does not automatically change the price of an accepted order. Plan changes and additional paid services require agreement with the Customer.

§ 4. Accounts and acceptable use

  • The Customer provides accurate details, appoints authorised account administrators, maintains current contact information and revokes access when authorisation ends. Users protect login credentials and report suspected unauthorised access.
  • Unlawful content, infringement of third-party rights, sharing accounts with unauthorised people, bypassing safeguards and disrupting the Service are prohibited.
  • The Customer is responsible for using GPS, screenshots, application and website information and other work-monitoring features in compliance with applicable law, including employment law. Before enabling them, the Customer defines the purpose, necessary scope and access to data and provides the required information to individuals. Technical availability does not establish that a particular use is lawful.
  • Account, service and security communications are separate from marketing. Accepting these Terms does not constitute consent to marketing or an employee’s consent to every form of monitoring.
  • The Customer checks reports and calculations before use and retains records required by law. Feature restrictions or account closure do not remove these obligations.

§ 5. Licence and Customer materials

For the Agreement’s duration, the Provider grants the Customer a non-exclusive right for authorised Users to use CrewTango within the ordered scope. This does not include reselling the Service, distributing its source code or copying or modifying the software beyond what the law permits. Rights to the software and brand remain with their respective holders.

The Customer retains its rights in materials it submits and authorises the Provider to process them technically only as needed to perform the Agreement. This does not imply ownership of personal data or restrict individuals’ rights. Suspected infringement involving materials can be reported to the Provider’s contact address, identifying the material, the right concerned and the reasons for the report.

§ 6. Support, complaints and availability

Support requests and service complaints may be sent to [email protected]. A request should identify the account, describe the problem and explain the requested resolution; passwords and unnecessary employee or resident data should not be sent. The Provider reviews requests without undue delay, communicates the outcome to the requester and observes deadlines required by applicable law.

The Provider maintains the Service with due care, remedies identified faults and supplies necessary updates. It gives advance notice of planned work affecting access where possible. Immediate work may be necessary for security or incident recovery. Guaranteed availability, support hours and response times apply only where expressly agreed in the order; this does not limit GDPR obligations or mandatory legal duties.

§ 7. Duration and termination

The trial lasts 14 days, and the paid service period follows the accepted order. The Customer may submit cancellation or an account-closure request to the contact address. The end date takes account of the agreed commitment period and mandatory law. Closing an employee account is not the same as closing the organisation’s account or automatically deleting its records.

The Provider may restrict access to the extent necessary to stop unlawful activity or a real security threat. For a breach of the Agreement, including overdue payment, it asks the Customer to remedy the breach within a reasonable period before terminating, unless immediate action is legally required or necessary to protect data. It explains the reason and scope of the restriction unless prohibited by law.

If payment for the next annual period is not made, the Provider may suspend access under “Subscription and billing”, informing the Customer of the reason. Suspension for non-payment alone does not terminate the Agreement, close the organisation’s account or start the 30-day data deletion period. During suspension, obligations to protect data, assist with individual rights and ensure return or deletion remain in force; the Customer may contact the Provider to exercise them.

Ending the Service does not remove the duty to return or delete entrusted data securely. Export, the choice between return and deletion, and the 30-day deadline are governed by “Return and deletion of data”. Fees are settled under the accepted order and applicable law; these Terms do not impose an unconditional exclusion of refund rights.

§ 8. Liability

Each party is responsible for performing its obligations under applicable law. The Provider is responsible for the processing entrusted to it, including its sub-processor’s performance of data protection obligations under Article 28(4) GDPR. The Customer’s duties concerning proper system use do not relieve the Provider of its own obligations.

Nothing excludes liability for intentional harm, liability that cannot lawfully be excluded, or individuals’ rights to compensation under Article 82 GDPR.

§ 9. Changes to the Agreement

The Provider may propose changes to these Terms because of changes in law, features, service conditions or security requirements. It supplies the Customer with the new version, an explanation of material changes and the proposed application date in a form that can be saved. Website publication alone does not amend an existing Agreement or documented data instructions.

Changes require agreement with the Customer, subject to mandatory law. Until a change is validly agreed, the existing provisions continue to apply to the extent permitted by law. Changing a sub-processor requires prior written authorisation, including in electronic form, under “Sub-processor and data location”.

§ 10. Governing law and interpretation

The Agreement is governed by Polish law and directly applicable European Union law, particularly Regulation (EU) 2016/679 (GDPR). This choice does not deprive a party of protection under mandatory provisions applicable to it. Jurisdiction is determined by applicable law.

The Polish and English versions describe the same obligations. Any discrepancies are to be resolved consistently with the purpose of the Agreement and the GDPR, without restricting individuals’ rights. Invalidity of an individual provision does not invalidate the remainder. Individually agreed commercial terms may supplement these Terms but cannot displace GDPR obligations.

§ 11. Data processing agreement — roles and priority

For personal data entered or collected in CrewTango for the Customer’s activities, the Customer is the controller and the Provider acts as processor on its behalf. This applies in particular to an employer and its employees’ data. This part, from “Data processing agreement” through “Return and deletion of data”, constitutes a binding data processing agreement under Article 28(3) GDPR, including in electronic form.

If the Customer itself processes particular data for another controller, it must inform the Provider and obtain the controller’s required authorisation before entrusting that data. For that scope, the Provider acts as a sub-processor and the Customer’s instructions must reflect the controller’s instructions. The data protection obligations below remain applicable.

Entrusted processing does not include the Provider’s processing for its own purposes of data needed to conclude and bill the Agreement, communicate and protect its own rights. The Privacy Policy describes that separate scope. In the event of conflict, the data processing part takes priority for entrusted data; commercial terms and the policy do not expand the Customer’s instructions.

§ 12. Subject matter, scope and duration of processing

The subject matter is handling the Customer organisation’s data in CrewTango. The purpose is to deliver the work processes and service features selected by the Customer. Operations include collection, recording, organisation, storage, retrieval, disclosure to authorised recipients as instructed, reporting, export, updating, backup, restoration and deletion. Processing continues during the Service and the necessary wind-down period described below.

The following catalogue defines the permitted scope depending on activated modules and Customer instructions; it does not require collection of every listed category. The Customer limits data to what is necessary and does not submit data outside the agreed scope.

  • Individuals: Customer Users, employees and contractors; its clients, business partners, their representatives and contact people; care recipients or residents, guardians and emergency contacts; people submitting service feedback and signing documents.
  • Basic data: names, account and employee identifiers, business contact details, roles, teams, positions and permissions; contact and organisation details entered by the Customer.
  • Work data: work and break times, attendance, schedules, availability, absences, tasks, projects, rates and settlement components, reports, comments and operation history; where relevant features are enabled, GPS location, QR/NFC identifiers, application and website usage information, keyboard and mouse activity information and screenshots.
  • Materials and technical data: documents, signatures and verification information, files and photographs, correspondence within Customer workflows, timestamps, IP addresses and device identifiers related to Service use.
  • Special categories: health data within justified absence records and, following manual activation of the care homes module, residents’ health conditions, allergies, medication, care plans and delivered care. Entrusting such data requires the Customer to establish an applicable Article 9(2) GDPR condition in addition to an Article 6 basis and the required safeguards before processing begins. Other special categories, Article 10 GDPR data and biometric identification are not within this Agreement’s standard scope.

§ 13. Instructions and Customer obligations

The Customer determines the purposes and essential means of processing, lawful bases, access scope and retention during Service use. It provides required information to individuals, checks the lawfulness of collection and informs the Provider of particular risks and requirements. It may issue instructions, obtain information and monitor processing compliance.

Documented instructions comprise this Agreement, the agreed order, settings and commands made by authorised people in the application, and verified correspondence sent to [email protected]. The Provider verifies the instructing person’s authority and processes data only on those instructions, including for transfers outside the EEA, unless Union or Member State law requires otherwise. In that event, it informs the Customer before processing unless the law prohibits this on important public-interest grounds.

The Provider does not use entrusted data for its own marketing, sale of data or training AI models. It immediately informs the Customer if it considers an instruction to infringe data protection law and suspends the disputed part pending clarification. A change of purpose or material scope requires prior agreement.

§ 14. Confidentiality and security measures

The Provider undertakes to maintain technical and organisational measures appropriate to risk under Article 32 GDPR. The measures below define the required standard of performance. Before processing begins and when the scope changes materially, the Provider assesses their adequacy, documents safeguards and makes information needed to assess them available to the Customer. It must not lower the agreed protection level.

  • Access and confidentiality: individual permissions based on duties, staff access limited to need, revocation of unnecessary access, confidentiality obligations imposed on authorised personnel by commitment or law, and data protection instruction.
  • Account and transmission protection: encryption of Service communications and administrative access, secure password hashing, protection of credentials and verification of account and organisation permissions. Provider staff access to administrative systems requires additional authentication protection appropriate to risk.
  • Separation and minimisation: restricting access across organisations, separate permissions for documents and health data, limiting diagnostic data and avoiding real personal data in tests where unnecessary.
  • Continuity and recovery: backups protected against unauthorised access, a recovery procedure and periodic checks that data and availability can be restored. Backup rotation and deletion must meet the 30-day deadline after account closure.
  • Maintenance and accountability: security updates, limited system privileges, recording material administrative operations and security events, vulnerability and incident handling, and regular evaluation of safeguard effectiveness.
  • Health data: access only for people authorised for the relevant workflow, protection from disclosure in general reports and support requests, and consideration of increased risk in the security assessment. Processing this scope must not begin if the required safeguards are absent.

§ 15. Sub-processor and data location

The Customer gives specific authorisation to use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; registration court in Ansbach, HRB 6089, EU VAT DE812871812, [email protected]. This is the external hosting and data storage provider named in this Agreement. Entrusted application data is stored on Hetzner servers in Germany.

The Provider entrusts data to this supplier only as needed for hosting, storage and infrastructure operation. Before doing so, it must ensure a binding agreement imposing data protection obligations corresponding to this Agreement. The Customer’s agreement with CrewTango does not replace the Provider’s agreement with Hetzner.

Adding or replacing a sub-processor requires the Customer’s prior written authorisation, including electronically, after receiving information about the entity, operations, location and safeguards. Silence does not constitute consent. This rule also covers onward sub-processing of entrusted data. The Provider remains responsible to the Customer for sub-processors’ obligations.

This authorisation does not permit moving hosting outside Germany or transferring entrusted data outside the EEA. Such changes require the Customer’s prior documented instructions, and transfers outside the EEA additionally require compliance with Chapter V GDPR. Updating a webpage alone cannot authorise a transfer.

Stripe handles separate subscription payment data described in the Privacy Policy. Using Stripe for billing does not in itself authorise the Provider to disclose employee records, care recipient data or other content entrusted by the Customer for running its organisation.

§ 16. Individual requests and assistance to the controller

Individuals may request the exercise of their GDPR rights. For data processed on an employer’s instructions, the employer assesses the request as controller. If the Provider receives it, it forwards it to the relevant Customer without undue delay and informs the requester how it will be handled.

The Customer is responsible for identity verification, assessing the legal conditions and responding. Taking account of the processing nature, the Provider assists by locating data, preparing copies or exports, correcting, restricting or deleting as documented instructions require. The parties minimise data needed for identity checks. The Provider does not independently decide whether an entrusted-data request is justified unless expressly authorised by lawful instructions.

Assistance is provided without undue delay so the Customer can meet GDPR deadlines: a response is generally due within one month, with a statutory extension of two further months where applicable and notice during the first month. Erasure is not unconditional, particularly where law requires continued retention. The 30-day account-closure period below does not replace individual-request deadlines.

The Provider also assists the Customer with Articles 32–36 GDPR as appropriate to the processing and information available to it, by supplying descriptions of operations, safeguards, risks and incidents and cooperating on data protection impact assessments, authority consultations and required notifications.

§ 17. Personal data breaches

After becoming aware of a breach of entrusted personal data, the Provider notifies the Customer without undue delay at the current account contact address or agreed security contact. It does not wait for the entire investigation to finish. It supplies available details of the breach nature, categories and approximate numbers of people and records, likely consequences, measures taken or proposed and a contact for follow-up; missing information is supplied progressively.

The Provider preserves evidence, mitigates effects, documents its actions and cooperates with the Customer. The Customer assesses notification duties towards the authority and individuals. The controller’s 72-hour period under Article 33 GDPR is not an additional period during which the Provider may withhold notification to the Customer.

§ 18. Information, audits and inspection

The Provider makes available the information necessary to demonstrate compliance with Article 28 GDPR and allows and contributes to audits, including inspections, by the Customer or its authorised auditor. Information may include security, access-authorisation and confidentiality documentation, review results, sub-processing details and deletion confirmations.

The parties coordinate the practical inspection arrangements while protecting confidentiality and other Customers’ data. These arrangements must not exclude or unduly impede inspection, cap it at a fixed number of audits or prevent urgent inspection after an incident. Organisational arrangements do not restrict supervisory authority powers.

§ 19. Return and deletion of data

During Service use, the Customer sets retention periods according to purposes and law and issues deletion or restriction instructions. Before the organisation’s account closes, it chooses return or deletion. Return uses available exports and, for data not covered by them, an agreed secure electronic delivery in a readable format. The Customer may request preparation of the return at the contact address.

Account closure means the agreed end of service for the organisation, confirmed to the Customer. The Provider arranges return so it can be completed before that date. After closure it deletes entrusted data from the system and backups within 30 days, including after returning it, unless Union or Member State law requires continued storage. Any exception applies only to the data and period covered by the specific duty, of which the Customer is informed unless prohibited by law.

Until deletion, data remains protected and is processed only to wind down the Service, delete it or fulfil a statutory duty. Backups are not used for routine operations; if restoration is necessary, earlier deletion instructions are reapplied. The Provider ensures these obligations are also fulfilled by its sub-processor and confirms completion on request. Confidentiality and security duties continue until final deletion.

Separate billing and contact data for which the Provider is controller follows the Privacy Policy. This is not a general permission to retain employee records or residents’ data after entrusted processing ends.

§ 20. Privacy Policy: Scope of the Privacy Policy

This Policy explains processing connected with CrewTango. It is the information part of the Terms and Agreement and is also available separately for convenience. Reading it is not consent to all processing operations and does not replace lawful bases required by the GDPR.

§ 21. Privacy Policy: Who is the controller

For employee and other personal data processed within the Customer’s organisation, the Customer, such as the employer or care facility operator, is controller. STAFFMONITOR SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, the CrewTango provider, acts as processor under the data processing agreement included in the Terms. Account administrators act within permissions assigned by the organisation.

The company identified above is a separate controller for its own purposes: establishing the Customer relationship, billing, correspondence, handling requests, and protecting its own rights and website security. Its address and identification details appear at the start of this document; data enquiries: [email protected]. Customer-account data accessed to resolve a support request remains entrusted data where processed solely on the Customer’s instructions.

§ 22. Privacy Policy: Provider purposes and lawful bases

  • Concluding and performing an Agreement with an individual Customer: identification, contact and order data — Article 6(1)(b) GDPR. Contact with organisation representatives: name, role and business details — Article 6(1)(f), the legitimate interest in establishing and managing the organisation relationship.
  • Handling subscription payments and renewals: customer, transaction and subscription identifiers, billing contact, amount, currency, payment date and status, and payment method identifier — Article 6(1)(b) GDPR for an individual party to the Agreement; for an organisation representative, Article 6(1)(f), the legitimate interest in collecting and reconciling payments. Providing Stripe with data needed for payment serves this purpose; authorisation to charge a card is not general consent to personal data processing.
  • Invoicing, tax and accounting: purchaser details, tax identifiers, address and billing information — Article 6(1)(c) GDPR in connection with applicable statutory duties.
  • Responding to correspondence and requests and establishing, exercising or defending claims: contact details and necessary correspondence — Article 6(1)(f) GDPR, the legitimate interest in handling requests and protecting rights; Article 6(1)(b) where fulfilling a contractual duty to an individual party.
  • Website security, abuse detection and diagnostics: necessary technical data and event logs — Article 6(1)(f) GDPR, the legitimate interest in safe and proper operation. This does not permit unrestricted use of content entrusted by an employer.
  • Where a particular optional operation requires consent, we obtain it separately for a specific purpose. It can be withdrawn without affecting the lawfulness of earlier processing. Acceptance of the Terms and device application permissions do not replace such consent.

§ 23. Privacy Policy: Data processed on Customer instructions

Depending on the features used, this includes profile and account data, business details, time and absence records, schedules, tasks, projects, settlements, contacts, documents, signatures, photographs and other files, comments, GPS data and computer-use information where the Customer enables those features. Industry modules may include care history, resident information, warehouse operations and cleaning feedback. The data processing part of the Terms specifies the categories.

The Customer establishes the lawful purpose, basis and scope and provides individuals with its own notice under Article 13 or 14 GDPR. Health data in care features and justified absence records requires an additional Article 9(2) GDPR condition. The Provider does not establish this for the Customer or treat general employee consent as the basis for every workflow.

§ 24. Privacy Policy: Data sources and provision requirements

We receive data from the person using the Service, the Customer or authorised Users, and devices when enabled features are used. An organisation representative’s details may come from that organisation. Technical data is transmitted by the browser or application.

Data necessary for account creation, contracting and billing is required for those operations or by law; not providing it may prevent service delivery. Other data depends on selected features and Customer instructions. The employer explains to employees any requirement to provide data, its source and the consequences of refusal.

§ 25. Privacy Policy: Location and device permissions

GPS features may process precise coordinates, recording times and accuracy, movement and device data and links to work records within the scope enabled by the Customer. The Customer defines the purpose and rules and explains them to Users beforehand. Location permissions can be changed in device settings; restricting access may prevent location-dependent features from working. It does not automatically erase previous records.

Camera and file access supports photographs, documentation or scanning, while notifications communicate Service events. Permissions depend on the feature and device system. Optional screenshots, application and website information and keyboard and mouse activity information depend on desktop application configuration. Users should receive information from the Customer about enabled features and who can access the records.

§ 26. Privacy Policy: Recipients, hosting and payment provider

The named external hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; registration court in Ansbach, HRB 6089; EU VAT DE812871812; [email protected]. Hetzner is a sub-processor for data entrusted to CrewTango and, within the relevant scope, a processor for data handled by the Provider for its own purposes.

The subscription payment provider is Stripe: Stripe Payments Europe, Limited (Ireland), with Stripe Technology Europe, Limited providing regulated payment services. Stripe Technology Europe, Limited is located at One Wilton Park, Wilton Place, Dublin 2, Ireland; its Central Bank of Ireland reference number is C187865. Payment handling covers necessary payer and billing contact details, customer and subscription identifiers, the transaction amount, currency, date and status, and payment method details supplied when paying. Stripe may also collect device and connection data for transaction security. This data concerns billing with the Provider, separately from records entrusted by an employer.

When Stripe handles a payment on the Provider’s instructions, it acts as its processor. For its own legal obligations, fraud prevention and other independent purposes set out in Stripe’s documents, it acts as a controller. Depending on the activity, Stripe entities may act as joint controllers; Stripe Technology Company, Limited is the main European establishment for GDPR purposes. Stripe’s documents explain the allocation of roles and individual rights. Privacy contact: [email protected]; Stripe Technology Company Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, marked “Stripe Legal”.

Stripe Privacy Policy · Stripe roles and contact · Stripe Data Processing Agreement

Organisation account data is accessible to people authorised by the Customer and recipients designated in its instructions, according to their permissions. Authorised Provider personnel access it only as necessary to perform their duties. Public authorities may receive data where required by law. Naming these providers does not exclude such mandatory disclosures or Customer-instructed sharing.

§ 27. Privacy Policy: Location and retention periods

Entrusted CrewTango application data is stored on Hetzner Online GmbH servers in Germany. The Agreement does not authorise the Provider to transfer entrusted data outside the EEA; any change requires prior fulfilment of the conditions in the data processing part.

Entrusted data is processed during Service use on Customer instructions. Following closure of the organisation’s account, it is deleted from the system and backups within 30 days, after ensuring a choice between return and deletion. The only exception is a specific retention duty under Union or Member State law. Closing an individual employee account does not necessarily delete records maintained by the employer. Suspension of access for non-payment alone does not start this 30-day period.

In the separate scope where the Provider is controller: Agreement and contact data is kept while managing the relationship and then only as necessary until applicable limitation periods expire; accounting and tax records for the period required by applicable law; correspondence as needed to resolve the matter and protect potential claims. Diagnostic and security data is kept only as long as necessary to identify and resolve the issue or handle the incident, with periodic review of that need. This does not justify retaining the Customer’s entire records.

The statement about hosting in Germany does not determine the location of all payment data handled by Stripe. Its services may involve transferring billing data outside the EEA, including to the United States. Stripe describes using adequacy decisions and standard contractual clauses, depending on the transfer. Safeguard details and the clauses are available in the Stripe documents linked below; a copy may also be requested using Stripe’s privacy contact above. For its own purposes, Stripe determines retention periods according to payment handling, fraud prevention and legal, accounting and financial obligations. The 30-day deadline for entrusted data following account closure does not mean all Stripe transaction data is deleted within that period.

Stripe data transfers · Stripe data retention and safeguards

§ 28. Privacy Policy: Individual rights and making a request

Subject to GDPR conditions, individuals have rights of access and a data copy, rectification, erasure, restriction and portability. Where processing relies on legitimate interests, they may object on grounds relating to their particular situation; objection to direct marketing is unconditional. Consent may be withdrawn at any time without affecting the lawfulness of earlier processing.

Requests concerning employee data or data within an organisation should be addressed to the Customer acting as controller. CrewTango forwards received requests to the relevant Customer without undue delay and assists it with individuals’ rights. Where the Provider is controller, requests may be sent to [email protected] or the registered address. No specific form is required. Where there are reasonable identity doubts, necessary verification information may be requested.

A response is provided without undue delay, generally within one month. In GDPR-permitted cases this may be extended by two months, with reasons given during the first month. Erasure may be limited, for example by a statutory duty or the need to protect claims; any refusal must be explained. The right to make a request does not depend on who manages the account.

A complaint may be lodged with the competent supervisory authority, in Poland the President of the Personal Data Protection Office (UODO). Filing information is available at uodo.gov.pl. This does not limit the right to a judicial remedy.

§ 29. Privacy Policy: Reports and decisions about individuals

Time, cost and productivity reports support the Customer’s work. Generating a report does not authorise a solely automated decision with legal or similarly significant effects on an individual. If the Customer intends such a process or profiling, it is responsible for establishing its basis, complying with Article 22 GDPR and providing required information and safeguards, including human involvement where required. Entrusted data is not intended for the Provider’s own profiling of individuals.

§ 30. Privacy Policy: Data protection measures

Commitments concerning permissions, personnel confidentiality, encrypted communications, backups, incidents and security reviews are described under “Confidentiality and security measures” in the Terms. Users should protect devices, update applications and not share passwords. Suspected breaches can be reported to [email protected].

§ 31. Privacy Policy: Minors

CrewTango is an organisational service and is not directed at children as independent Customers. If a Customer lawfully processes a minor’s data, such as that of a young worker or care recipient, it must take account of applicable law, representatives’ authority and particular protection needs. Concerns about such data should be raised with the relevant controller or CrewTango’s contact address.

§ 32. Privacy Policy: Policy updates and contact

The current version and date appear in the document heading. The Provider informs affected individuals of material processing changes as appropriate before the changed processing starts. A policy update does not create a new lawful basis, replace required consent or expand entrusted-data instructions. Contractual changes follow the Agreement’s amendment rules.

Questions about this Policy, party roles and forwarding requests may be sent to [email protected] or by post to the address at the beginning of this document.