When a DPA applies
Crewzy is a product of CODER VIEW LTD. Where an organisation or sole trader decides how and why workspace personal data is used, it generally acts as controller and Crewzy processes the agreed data on its documented instructions. A customer acting for another controller must have authority to appoint Crewzy.
A private individual using Crewzy solely for personal or household purposes does not need an organisational DPA merely because they open an account. The relationship depends on how the information is used. Our privacy policy and terms and conditions explain personal use and Crewzy’s separate responsibilities for account and service information.
Scope of the agreement
The DPA identifies the customer, agreed services, processing purposes and activities, duration, categories of personal data and people concerned. It also records the relevant security, provider, international-transfer and return or deletion arrangements.
The scope can include people management and employee lifecycle workflows, document expiry tracking, leave, time and projects, expenses, invoices, recruitment, compliance evidence and audit history. AI processing is included where agreed for the service.
See the information categories in our privacy policy and the service provider page. Retention and account closure are explained in our retention information; the DPA records the arrangements for the agreed service.
What the processing terms cover
| Area | Protection |
|---|---|
| Instructions | Process personal data on documented lawful instructions and identify instructions that may breach data protection law. |
| Confidentiality | Limit authorised personnel to necessary access and require confidentiality. |
| Security | Set out measures appropriate to risk, including access, availability, recovery and regular assessment. |
| Subprocessors | Require prior written authorisation, equivalent obligations and Crewzy’s continuing responsibility. General authorisation includes advance notice of changes and an opportunity to object. |
| Individual rights | Assist with applicable access, correction, deletion, portability and other rights requests. |
| Incidents and assistance | Notify the customer without undue delay after awareness of a personal data breach, and assist with security, impact assessments and regulatory consultation. |
| Return or deletion | At the customer’s choice, return or delete personal data and copies when services end, subject to legally required retention. |
| Accountability | Provide relevant compliance information and allow and contribute to customer audits and inspections. |
These protections reflect the ICO’s Article 28 contract guidance.
Agree processing terms
A written DPA covering the agreed service must be in place before Crewzy processes live personal data on an organisation’s behalf. This page explains the agreement; viewing it does not execute one.
To request processing terms, email privacy@crewzy.io with your organisation’s name, intended services and contact details. Please do not send employee records or identity documents with an initial enquiry.
You can also write to Privacy enquiries, CODER VIEW LTD, 31 Little Dodden, Basildon, England, SS16 5TZ.