Data Processing Agreement

Parties

This Data Processing Agreement ("DPA") is between (1) Crewlix Ltd, a company registered in England and Wales under number 11781962, whose registered office is at 161 Brading Crescent, London, England, E11 3RU ("Crewlix"); and (2) the business or organisation that enters into the Main Agreement with Crewlix for the Services, as identified in that business's account details or Order Form (the "Customer"). Crewlix and the Customer are each a "party" and together the "parties".

How this DPA applies: for Team and Business plans, this DPA takes effect automatically, as part of the Main Agreement, from the date the Customer starts using the Services — no separate signature is needed. For Enterprise plans, it takes effect from the date of the Customer's Order Form, and Crewlix will countersign a copy on request.

Background

(A) Crewlix provides cloud-based HR, rota, shift and workforce management software and related services (the "Services") to the Customer under an agreement between them (the "Main Agreement").

(B) In providing the Services, Crewlix processes personal data on behalf of the Customer. The Customer is the controller of that personal data and Crewlix is its processor.

(C) Article 28 of the UK GDPR requires a written contract between a controller and its processor. This Data Processing Agreement (the "DPA") is that contract and forms part of the Main Agreement.

1. Definitions And Interpretation

1.1 In this DPA, the following terms have these meanings:

"Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and any other law relating to the protection of personal data that applies to the processing under this DPA, each as amended or replaced from time to time, including any changes made by the Data (Use and Access) Act 2025 as they come into force.

"AWS" means Amazon Web Services, Inc. and its relevant affiliates.

"Axilweb" means Axilweb Limited, a company registered in Bangladesh under number C-143750/2018, which provides engineering, operational, maintenance, billing and development support services to Crewlix under a written services agreement, and which holds the AWS hosting account referred to in this DPA as nominee for Crewlix.

"Crewlix Personnel" means Crewlix's employees, individual contractors and other individuals who work for Crewlix and who have access to Customer Personal Data.

"Customer Personal Data" means the personal data that Crewlix processes on behalf of the Customer in connection with the Services, as described in Schedule 1.

"Data Subject Request" means a request from an individual to exercise a right they have under Applicable Data Protection Law in relation to their personal data.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

"Restricted Transfer" means a transfer of Customer Personal Data to a separate legal entity or person located outside the United Kingdom, where the country is not covered by UK adequacy regulations or by the UK Extension to the EU-US Data Privacy Framework.

"Sub-processor" means any third party (including a Crewlix group company, Axilweb and AWS) appointed by Crewlix, directly or through another Sub-processor, to process Customer Personal Data.

"Transfer Mechanism" means the International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, or any other mechanism permitted by Applicable Data Protection Law.

"UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.

1.2 The terms "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in Applicable Data Protection Law.

1.3 If there is a conflict between this DPA and the Main Agreement on the subject of personal data, this DPA prevails. Any Transfer Mechanism entered into under clause 8 prevails over both.

2. Scope, Roles And Duration

2.1 This DPA applies to all processing of Customer Personal Data by Crewlix (and its Sub-processors) while providing the Services.

2.2 For Customer Personal Data, the Customer is the controller and Crewlix is the processor. Where the Customer is itself a processor acting for another controller, Crewlix acts as a sub-processor and the Customer confirms it has the authority to give the instructions in this DPA.

2.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Schedule 1.

2.4 This DPA starts on the date it applies to the Customer under "How this DPA applies" above (or, if earlier, when Crewlix first processes Customer Personal Data) and continues for as long as Crewlix processes Customer Personal Data, including during any period after the Main Agreement ends in which Crewlix holds that data under clause 13.

2.5 Crewlix acts as a controller for its own account data, billing, website and marketing data, and for security and product analytics that do not identify the Customer's workforce. Those activities are described in Crewlix's Privacy Policy and are outside this DPA.

3. Crewlix's Obligations

3.1 Crewlix will process Customer Personal Data only on the Customer's documented instructions, including on transfers to a third country, unless the law requires otherwise. If the law requires Crewlix to process the data in another way, Crewlix will tell the Customer before doing so, unless the law prohibits it from doing that.

3.2 The Customer's instructions are: (a) this DPA and the Main Agreement; (b) the Customer's and its authorised users' use and configuration of the Services; and (c) any further written instructions the Customer gives that are consistent with the Main Agreement. Instructions that need work outside the ordinary operation of the Services may be charged for at Crewlix's then-current rates, agreed in advance.

3.3 Crewlix will tell the Customer promptly if, in its opinion, an instruction would breach Applicable Data Protection Law. Crewlix is not required to carry out that instruction until the Customer confirms or changes it.

3.4 Crewlix will not sell Customer Personal Data, and will not use it for its own purposes, including to build profiles, train machine-learning models for other customers, or for advertising.

3.5 Crewlix will keep records of its processing activities as required by Article 30(2) of the UK GDPR and will make them available to the Customer or the Information Commissioner's Office (the "ICO") on request.

4. Customer's Obligations

4.1 The Customer is responsible for making sure that it:

(a) has a lawful basis under Article 6 (and, for special category data, a condition under Article 9) of the UK GDPR for the processing it instructs Crewlix to carry out;

(b) gives its workers, candidates and other data subjects the privacy information required by Articles 13 and 14 of the UK GDPR;

(c) has the right to give Crewlix the Customer Personal Data and to have it processed as described in this DPA; and

(d) keeps user credentials confidential, manages who has access to the Services, and configures the Services (including access permissions and retention settings) to suit its own compliance needs.

4.2 The Customer will only put into the Services the categories of personal data listed in Schedule 1. This includes any documents and data the Customer chooses to upload using the Services’ document and credential expiry tracking feature, whatever the document type and whatever category of data it contains, provided the Customer has a lawful basis (and, where relevant, an Article 9 or Schedule 1 DPA 2018 condition) for uploading it. Outside that feature, the Customer will not use free-text or other document fields to store special category data, criminal offence data or government identification numbers unless Crewlix has agreed in writing that the Services are suitable for that purpose.

5. Confidentiality And Personnel

5.1 Crewlix will make sure that everyone it authorises to process Customer Personal Data is bound by a written duty of confidentiality (or is under an appropriate statutory duty), and that the duty continues after their engagement ends.

5.2 Crewlix will limit access to Customer Personal Data to those personnel who need it to provide the Services, and will make sure they receive appropriate data protection and information security training and are supervised appropriately.

6. Security

6.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to individuals, Crewlix will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR. The measures in place at the effective date are set out in Schedule 2.

6.2 Crewlix may update the measures in Schedule 2 from time to time as technology and threats change, provided the update does not reduce the overall level of protection.

7. Sub-Processors

7.1 The Customer gives Crewlix general written authorisation to appoint Sub-processors, including the Sub-processors listed in Schedule 3 at the effective date.

7.2 Crewlix will give the Customer at least 30 days' notice of any intended addition or replacement of a Sub-processor, by email to the Customer's account administrator.

7.3 The Customer may object to a new Sub-processor on reasonable data protection grounds by writing to Crewlix within 30 days of the notice. The parties will then work in good faith to find a solution. If they cannot agree one within a reasonable period, the Customer may end the affected Services on written notice and Crewlix will refund any prepaid fees for the period after termination.

7.4 Crewlix will:

(a) carry out appropriate due diligence on each Sub-processor before appointing it;

(b) enter into a written contract with each Sub-processor that imposes data protection obligations no less protective than those in this DPA; and

(c) remain fully liable to the Customer for the acts and omissions of its Sub-processors in relation to Customer Personal Data.

7.5 The Customer acknowledges that Crewlix uses Axilweb to operate and maintain the Services, and that Axilweb in turn uses AWS to host the Services. Crewlix will make sure that:

(a) Axilweb is bound by a written services agreement that meets clause 7.4(b) and requires it to impose the same obligations on AWS and any other Sub-processor it uses;

(b) under that services agreement, Axilweb holds the AWS hosting account, and the crewlix.com and crewlix.co.uk domains, as nominee for and on trust for Crewlix, and must transfer administrative control of them to Crewlix (or Crewlix's nominee) immediately on request, so that Customer Personal Data can be accessed, exported, returned and deleted as this DPA requires; and

(c) Crewlix remains fully liable to the Customer under clause 7.4(c) for the acts and omissions of Axilweb and AWS.

8. International TransfersInternational Transfers

8.1 The Customer acknowledges that the Services are hosted on Amazon Web Services in the United States, in the US-East region. Crewlix will give notice under clause 7.2 before it moves the primary hosting location.

8.2 The transfer of Customer Personal Data to AWS in the United States relies on the UK Extension to the EU-US Data Privacy Framework for as long as AWS is certified. If that ceases to be available, Crewlix will put in place another Transfer Mechanism before the transfer continues, as set out in Schedule 4, Part A.

8.3 Axilweb is a separate legal entity in Bangladesh, which is not currently covered by UK adequacy regulations. Access to Customer Personal Data by Axilweb is therefore a Restricted Transfer. Crewlix has put in place a Transfer Mechanism with Axilweb and has completed a transfer risk assessment, as described in Schedule 4, Part B.

8.4 Some Crewlix Personnel work from Bangladesh. Access by Crewlix's own employees is not a Restricted Transfer but is subject to the security measures in Schedule 2. Access by individual contractors and by people engaged through another company is a Restricted Transfer and is dealt with in Schedule 4, Part C.

8.5 For any other Restricted Transfer, Crewlix will make sure that a Transfer Mechanism, or another safeguard permitted by Chapter V of the UK GDPR, is in place before the transfer takes place.

8.6 Where a Transfer Mechanism relies on the Customer being a party to it, the Customer authorises Crewlix to enter into it on the Customer's behalf, or Crewlix will provide it to the Customer for signature, as the parties agree. The Customer may ask for a copy of the relevant safeguards, with commercially sensitive terms redacted.

8.7 If a Transfer Mechanism is invalidated, or Applicable Data Protection Law changes so that a transfer is no longer lawful, the parties will work together promptly to put in place an alternative lawful basis. Crewlix will suspend the affected transfer until it does.

9. Data Subject Rights

9.1 Taking into account the nature of the processing, Crewlix will assist the Customer, by appropriate technical and organisational measures, to respond to Data Subject Requests. The Services include self-service tools for access, correction, export and deletion that the Customer can use for most requests.

9.2 If Crewlix receives a Data Subject Request relating to Customer Personal Data directly, it will not respond to the request itself except to tell the individual that it has passed the request to the controller, and it will send the request to the Customer within 5 business days, unless the law requires otherwise.

9.3 Crewlix may charge reasonable fees for assistance that goes beyond the functionality of the Services and is not caused by Crewlix's own breach of this DPA.

10. Personal Data Breach

10.1 Crewlix will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will go to the Customer's account administrator.

10.2 The notice will include, as far as Crewlix then knows: (a) the nature of the breach, including the categories and approximate numbers of data subjects and records concerned; (b) the likely consequences; (c) the measures Crewlix has taken or proposes to take; and (d) a contact point for more information. Where all of this information is not yet available, Crewlix will provide it in stages, without further undue delay.

10.3 Crewlix will take reasonable steps to contain and investigate the breach, and will give the Customer the information and help it reasonably needs to meet its own obligations to notify the ICO under Article 33 and, where required, the affected individuals under Article 34.

10.4 Unless the law requires it, Crewlix will not tell any third party (other than its advisers, insurers and Sub-processors) that the Customer is affected by a breach without first consulting the Customer. Notification of a breach is not an admission of fault or liability by Crewlix.

11. Assistance With Compliance

11.1 Taking into account the nature of the processing and the information available to it, Crewlix will give the Customer reasonable assistance with the Customer's obligations under Articles 32 to 36 of the UK GDPR, including data protection impact assessments and prior consultation with the ICO.

11.2 Crewlix will give reasonable help if a supervisory authority or a court asks for information about the processing of Customer Personal Data, and will tell the Customer promptly of any such request that it receives directly, unless the law prevents it from doing so.

12. Information And Audit

12.1 Crewlix will make available to the Customer the information reasonably necessary to show that it complies with Article 28 of the UK GDPR and this DPA. Crewlix will do this by answering the Customer's reasonable written questions about its security and data-handling practices, and by providing any security documentation or audit results it holds at the time of the request.

12.2 If that information does not reasonably satisfy the Customer, or a supervisory authority requires it, the Customer (or an independent auditor bound by confidentiality that it appoints and that Crewlix reasonably accepts) may audit Crewlix's compliance with this DPA, on these conditions:

(a) the Customer gives at least 30 days' written notice, and the parties agree the scope and timing in advance;

(b) the audit takes place during normal business hours, no more than once in any twelve-month period (unless a Personal Data Breach or a regulator requires otherwise), and does not unreasonably disrupt Crewlix's business;

(c) the auditor may not access data belonging to Crewlix's other customers or information that is privileged or confidential to Crewlix beyond what the audit requires; and

(d) the Customer bears its own costs and reimburses Crewlix's reasonable costs of supporting the audit, unless the audit shows a material breach of this DPA by Crewlix.

13. Return And Deletion

13.1 When the Main Agreement ends, the Customer may export its Customer Personal Data, using the Services' export tools for 30 days. If the Customer needs help exporting it, Crewlix will assist on request, and may charge reasonable fees.

13.2 After that period Crewlix will delete Customer Personal Data from its live systems within 30 days, and from backups within 90 days as they are overwritten in the ordinary cycle, and will confirm deletion in writing if the Customer asks. Crewlix will delete the data earlier if the Customer instructs it to do so in writing.

13.3 Crewlix may keep Customer Personal Data after the end of the Main Agreement to the extent the law requires, and will then continue to protect it under this DPA and use it only for that purpose.

14. Liability

14.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Main Agreement, which apply to this DPA as if it were part of the Main Agreement.

14.2 Nothing in this DPA limits liability that cannot be limited by law, or affects the rights of a data subject against either party under Article 82 of the UK GDPR. As between the parties, each is liable for its share of any compensation paid to a data subject in proportion to its responsibility for the damage, as Article 82(4) and (5) provide.

15. Changes And Termination

15.1 Crewlix may amend this DPA from time to time by giving the Customer at least 30 days' written notice (which may be by email or by notice within the Services) before the change takes effect, including to reflect a change in Applicable Data Protection Law, a decision of the ICO or a court, an approved Transfer Mechanism, or otherwise. Crewlix may give shorter notice where a change is required for legal, regulatory or security reasons. If the Customer does not agree to a change, the Customer may terminate the Main Agreement by written notice before the change takes effect.

15.2 If a provision of this DPA is found to be invalid or unenforceable, the rest of it stays in force, and the parties will replace the provision with a valid one that comes as close as possible to the original intention.

15.3 This DPA ends automatically when Crewlix stops processing Customer Personal Data, subject to clause 13. Clauses that by their nature are meant to survive termination (including clauses 10, 12, 13 and 14) will do so.

16. Governing Law And Jurisdiction

16.1 This DPA, and any dispute or claim arising out of or in connection with it (including non-contractual disputes), is governed by the law of England and Wales.

16.2 The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim, without prejudice to the rights of data subjects and supervisory authorities.

17. Agreement

This DPA takes effect automatically as part of the Main Agreement, as described under "How this DPA applies" above — no separate signature is required. If the Customer needs a copy countersigned by Crewlix for its own records (for example, as part of an Enterprise Order Form or a procurement process), contact hello@crewlix.com.

Schedule 1 | Details Of The Processing

This Schedule sets out the details required by Article 28(3) of the UK GDPR.

Schedule 2 | Technical And Organisational Measures

Crewlix maintains at least the following measures.

Schedule 3 | Authorised Sub-Processors

At the effective date, the Customer authorises Crewlix to use the following Sub-processors.

Schedule 4 | International Transfers

Part A: Hosting in the United States

A1. The Services are hosted on Amazon Web Services in the United States, in the US-East region. Customer Personal Data is stored there and in backups in the same region.

A2. The AWS account is held by Axilweb as nominee for Crewlix. Crewlix has a contractual right to require immediate administrative access to, export from, and deletion from, that account, as set out in clause 7.5.

A3. The transfer to AWS relies on the UK Extension to the EU-US Data Privacy Framework for as long as AWS remains certified. If it stops being certified, or the UK Extension ceases to apply, Crewlix will rely on the UK International Data Transfer Agreement or UK Addendum in AWS's data processing addendum, or another Transfer Mechanism, before the transfer continues.

Part B: Axilweb

B1. Axilweb Limited is a company registered in Bangladesh (No. C-143750/2018) and is a separate legal entity from Crewlix. Its personnel access Customer Personal Data remotely to provide engineering, operational, maintenance and development support. Customer Personal Data is not stored on Axilweb's own systems, except transient support data and logs, as described in Schedule 2.

B2. Crewlix has entered into a UK International Data Transfer Agreement with Axilweb, and a written services agreement that meets clause 7.4(b).

B3. Crewlix has carried out, and will keep up to date, a transfer risk assessment under the ICO's guidance, covering the laws and practices of Bangladesh that may affect the protection of the data, and has concluded that the safeguards give data subjects a level of protection that is not materially lower than in the United Kingdom. Crewlix will give the Customer a summary of the assessment on request.

B4. Crewlix will limit Axilweb's access to named individuals with a need to know, and will make sure Axilweb tells Crewlix promptly of any legal request from a public authority for Customer Personal Data, so that Crewlix can tell the Customer unless the law prevents this.

Part C: Crewlix Personnel working from Bangladesh

C1. Some Crewlix Personnel work remotely from Bangladesh. Where they are employees of Crewlix, they are part of the same legal entity as Crewlix, and their access is not a Restricted Transfer, but Crewlix applies the same security measures to them (Schedule 2, "Remote and offshore working").

C2. Where they are individual contractors or are engaged through another company, Crewlix treats their access as a Restricted Transfer and will have in place a written contract with confidentiality and data protection terms and a Transfer Mechanism before they have access.

C3. Crewlix will only allow access from managed, encrypted devices with multi-factor authentication, will not allow Customer Personal Data to be stored on personal devices, and will keep a record of who has access.