Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between OneWordCrew and a business customer where OneWordCrew processes personal data on that customer's behalf — for example where an organisation submits warranty claims, after-sales requests or order data that include personal data of its own staff or customers. It does not cover processing for which OneWordCrew is the controller, which is described in the Privacy Policy.

Roles and scope

The customer is the controller and OneWordCrew is the processor. OneWordCrew processes personal data only on the customer's documented instructions, including as set out in the agreement and this DPA, and only for the duration, purpose and categories of data described there.

Processor obligations

OneWordCrew will: process personal data only on instructions; ensure that personnel authorised to process the data are bound by confidentiality; implement appropriate technical and organisational security measures; assist the customer in responding to data subject requests; assist with security, breach notification and impact assessments; and delete or return personal data at the end of the engagement unless storage is required by law.

Sub-processors

The customer grants general authorisation for OneWordCrew to engage sub-processors for hosting, email delivery, payment processing and support tooling. OneWordCrew imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and will inform the customer of changes so that objections can be raised.

International transfers

Where personal data is transferred outside the region in which it was collected, OneWordCrew relies on an appropriate transfer mechanism, such as standard contractual clauses or an equivalent legal basis, together with supplementary measures where required.

Security and breach notification

Security measures include encryption in transit, access control, logging, and periodic review of systems that store personal data. OneWordCrew will notify the customer without undue delay after becoming aware of a personal data breach affecting data processed on the customer's behalf, and will provide information reasonably needed for the customer to meet its own notification duties.

Audits

OneWordCrew will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for audits conducted by the customer or an auditor mandated by the customer, at reasonable intervals, subject to confidentiality.

Execution and contact

To execute this DPA as part of a business agreement, contact us through the business page.