CrewTango

CrewTango privacy policy

The information part of the CrewTango Terms and Agreement, also available separately.

Document version:

Download full agreement with policy (HTML)

Scope of the Privacy Policy

This Policy explains processing connected with CrewTango. It is the information part of the Terms and Agreement and is also available separately for convenience. Reading it is not consent to all processing operations and does not replace lawful bases required by the GDPR.

Who is the controller

For employee and other personal data processed within the Customer’s organisation, the Customer, such as the employer or care facility operator, is controller. STAFFMONITOR SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, the CrewTango provider, acts as processor under the data processing agreement included in the Terms. Account administrators act within permissions assigned by the organisation.

The company identified above is a separate controller for its own purposes: establishing the Customer relationship, billing, correspondence, handling requests, and protecting its own rights and website security. Its address and identification details appear at the start of this document; data enquiries: [email protected]. Customer-account data accessed to resolve a support request remains entrusted data where processed solely on the Customer’s instructions.

Provider purposes and lawful bases

  • Concluding and performing an Agreement with an individual Customer: identification, contact and order data — Article 6(1)(b) GDPR. Contact with organisation representatives: name, role and business details — Article 6(1)(f), the legitimate interest in establishing and managing the organisation relationship.
  • Handling subscription payments and renewals: customer, transaction and subscription identifiers, billing contact, amount, currency, payment date and status, and payment method identifier — Article 6(1)(b) GDPR for an individual party to the Agreement; for an organisation representative, Article 6(1)(f), the legitimate interest in collecting and reconciling payments. Providing Stripe with data needed for payment serves this purpose; authorisation to charge a card is not general consent to personal data processing.
  • Invoicing, tax and accounting: purchaser details, tax identifiers, address and billing information — Article 6(1)(c) GDPR in connection with applicable statutory duties.
  • Responding to correspondence and requests and establishing, exercising or defending claims: contact details and necessary correspondence — Article 6(1)(f) GDPR, the legitimate interest in handling requests and protecting rights; Article 6(1)(b) where fulfilling a contractual duty to an individual party.
  • Website security, abuse detection and diagnostics: necessary technical data and event logs — Article 6(1)(f) GDPR, the legitimate interest in safe and proper operation. This does not permit unrestricted use of content entrusted by an employer.
  • Where a particular optional operation requires consent, we obtain it separately for a specific purpose. It can be withdrawn without affecting the lawfulness of earlier processing. Acceptance of the Terms and device application permissions do not replace such consent.

Data processed on Customer instructions

Depending on the features used, this includes profile and account data, business details, time and absence records, schedules, tasks, projects, settlements, contacts, documents, signatures, photographs and other files, comments, GPS data and computer-use information where the Customer enables those features. Industry modules may include care history, resident information, warehouse operations and cleaning feedback. The data processing part of the Terms specifies the categories.

The Customer establishes the lawful purpose, basis and scope and provides individuals with its own notice under Article 13 or 14 GDPR. Health data in care features and justified absence records requires an additional Article 9(2) GDPR condition. The Provider does not establish this for the Customer or treat general employee consent as the basis for every workflow.

Data sources and provision requirements

We receive data from the person using the Service, the Customer or authorised Users, and devices when enabled features are used. An organisation representative’s details may come from that organisation. Technical data is transmitted by the browser or application.

Data necessary for account creation, contracting and billing is required for those operations or by law; not providing it may prevent service delivery. Other data depends on selected features and Customer instructions. The employer explains to employees any requirement to provide data, its source and the consequences of refusal.

Location and device permissions

GPS features may process precise coordinates, recording times and accuracy, movement and device data and links to work records within the scope enabled by the Customer. The Customer defines the purpose and rules and explains them to Users beforehand. Location permissions can be changed in device settings; restricting access may prevent location-dependent features from working. It does not automatically erase previous records.

Camera and file access supports photographs, documentation or scanning, while notifications communicate Service events. Permissions depend on the feature and device system. Optional screenshots, application and website information and keyboard and mouse activity information depend on desktop application configuration. Users should receive information from the Customer about enabled features and who can access the records.

Recipients, hosting and payment provider

The named external hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; registration court in Ansbach, HRB 6089; EU VAT DE812871812; [email protected]. Hetzner is a sub-processor for data entrusted to CrewTango and, within the relevant scope, a processor for data handled by the Provider for its own purposes.

The subscription payment provider is Stripe: Stripe Payments Europe, Limited (Ireland), with Stripe Technology Europe, Limited providing regulated payment services. Stripe Technology Europe, Limited is located at One Wilton Park, Wilton Place, Dublin 2, Ireland; its Central Bank of Ireland reference number is C187865. Payment handling covers necessary payer and billing contact details, customer and subscription identifiers, the transaction amount, currency, date and status, and payment method details supplied when paying. Stripe may also collect device and connection data for transaction security. This data concerns billing with the Provider, separately from records entrusted by an employer.

When Stripe handles a payment on the Provider’s instructions, it acts as its processor. For its own legal obligations, fraud prevention and other independent purposes set out in Stripe’s documents, it acts as a controller. Depending on the activity, Stripe entities may act as joint controllers; Stripe Technology Company, Limited is the main European establishment for GDPR purposes. Stripe’s documents explain the allocation of roles and individual rights. Privacy contact: [email protected]; Stripe Technology Company Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, marked “Stripe Legal”.

Stripe Privacy Policy · Stripe roles and contact · Stripe Data Processing Agreement

Organisation account data is accessible to people authorised by the Customer and recipients designated in its instructions, according to their permissions. Authorised Provider personnel access it only as necessary to perform their duties. Public authorities may receive data where required by law. Naming these providers does not exclude such mandatory disclosures or Customer-instructed sharing.

Location and retention periods

Entrusted CrewTango application data is stored on Hetzner Online GmbH servers in Germany. The Agreement does not authorise the Provider to transfer entrusted data outside the EEA; any change requires prior fulfilment of the conditions in the data processing part.

Entrusted data is processed during Service use on Customer instructions. Following closure of the organisation’s account, it is deleted from the system and backups within 30 days, after ensuring a choice between return and deletion. The only exception is a specific retention duty under Union or Member State law. Closing an individual employee account does not necessarily delete records maintained by the employer. Suspension of access for non-payment alone does not start this 30-day period.

In the separate scope where the Provider is controller: Agreement and contact data is kept while managing the relationship and then only as necessary until applicable limitation periods expire; accounting and tax records for the period required by applicable law; correspondence as needed to resolve the matter and protect potential claims. Diagnostic and security data is kept only as long as necessary to identify and resolve the issue or handle the incident, with periodic review of that need. This does not justify retaining the Customer’s entire records.

The statement about hosting in Germany does not determine the location of all payment data handled by Stripe. Its services may involve transferring billing data outside the EEA, including to the United States. Stripe describes using adequacy decisions and standard contractual clauses, depending on the transfer. Safeguard details and the clauses are available in the Stripe documents linked below; a copy may also be requested using Stripe’s privacy contact above. For its own purposes, Stripe determines retention periods according to payment handling, fraud prevention and legal, accounting and financial obligations. The 30-day deadline for entrusted data following account closure does not mean all Stripe transaction data is deleted within that period.

Stripe data transfers · Stripe data retention and safeguards

Individual rights and making a request

Subject to GDPR conditions, individuals have rights of access and a data copy, rectification, erasure, restriction and portability. Where processing relies on legitimate interests, they may object on grounds relating to their particular situation; objection to direct marketing is unconditional. Consent may be withdrawn at any time without affecting the lawfulness of earlier processing.

Requests concerning employee data or data within an organisation should be addressed to the Customer acting as controller. CrewTango forwards received requests to the relevant Customer without undue delay and assists it with individuals’ rights. Where the Provider is controller, requests may be sent to [email protected] or the registered address. No specific form is required. Where there are reasonable identity doubts, necessary verification information may be requested.

A response is provided without undue delay, generally within one month. In GDPR-permitted cases this may be extended by two months, with reasons given during the first month. Erasure may be limited, for example by a statutory duty or the need to protect claims; any refusal must be explained. The right to make a request does not depend on who manages the account.

A complaint may be lodged with the competent supervisory authority, in Poland the President of the Personal Data Protection Office (UODO). Filing information is available at uodo.gov.pl. This does not limit the right to a judicial remedy.

Reports and decisions about individuals

Time, cost and productivity reports support the Customer’s work. Generating a report does not authorise a solely automated decision with legal or similarly significant effects on an individual. If the Customer intends such a process or profiling, it is responsible for establishing its basis, complying with Article 22 GDPR and providing required information and safeguards, including human involvement where required. Entrusted data is not intended for the Provider’s own profiling of individuals.

Data protection measures

Commitments concerning permissions, personnel confidentiality, encrypted communications, backups, incidents and security reviews are described under “Confidentiality and security measures” in the Terms. Users should protect devices, update applications and not share passwords. Suspected breaches can be reported to [email protected].

Minors

CrewTango is an organisational service and is not directed at children as independent Customers. If a Customer lawfully processes a minor’s data, such as that of a young worker or care recipient, it must take account of applicable law, representatives’ authority and particular protection needs. Concerns about such data should be raised with the relevant controller or CrewTango’s contact address.

Policy updates and contact

The current version and date appear in the document heading. The Provider informs affected individuals of material processing changes as appropriate before the changed processing starts. A policy update does not create a new lawful basis, replace required consent or expand entrusted-data instructions. Contractual changes follow the Agreement’s amendment rules.

Questions about this Policy, party roles and forwarding requests may be sent to [email protected] or by post to the address at the beginning of this document.