GDPR

1. Parties

• Data Controller: The Customer using the Crisphive Service.
• Data Processor: WicWac Inc. (Operating as Crisphive), Suite 1420, 99 Bank Street, Ottawa, Ontario, K1P 1H4, Canada

2. Definitions

Capitalized terms not defined in this DPA have the meaning given in the GDPR or the Agreement.

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" has the meaning set out in Article 4(2) GDPR.
• "Sub-processor" means any third party engaged by Crisphive to process Personal Data on behalf of the Customer.
• "EEA" means the European Economic Area.

3. Scope and Purpose of Processing

Crisphive processes Personal Data solely for the purpose of providing the Crisphive scheduling and workforce management platform, including:

• Account management
• Scheduling and job coordination
• Notifications and communications
• Platform support and maintenance
• Security and performance monitoring

Processing is limited to what is necessary to deliver the Service.

4. Categories of Data and Data Subjects

5. Controller and Processor Responsibilities

6. Confidentiality

Crisphive ensures that all personnel authorized to process Personal Data are subject to appropriate confidentiality obligations, whether contractual or statutory.

7. Security Measures (Article 32 GDPR)

Crisphive implements reasonable and appropriate safeguards, including:

• Role-based access controls
• Encryption in transit where applicable
• Secure infrastructure and hosting environments
• Logging and monitoring
• Incident response procedures

Security measures are reviewed periodically and adjusted as needed.

8. Sub-Processors

9. International Data Transfers

Personal Data may be processed outside the EEA, including in Canada and the United States. Where required, Crisphive relies on Standard Contractual Clauses (SCCs) and other lawful transfer mechanisms under GDPR.

10. Data Subject Rights Assistance

Crisphive will assist the Customer, where reasonably possible, in responding to requests related to:

• Access
• Rectification
• Erasure
• Restriction
• Objection
• Data portability

Crisphive does not respond directly to Data Subject requests unless legally required.

11. Data Breach Notification

Crisphive shall:

• Notify the Customer without undue delay upon becoming aware of a Personal Data Breach
• Provide available information to support compliance with Articles 33 and 34 GDPR

Notification shall include the nature of the breach, likely consequences, and mitigation steps where available.

12. Data Retention and Deletion

Upon termination of the Agreement:

• Crisphive will delete or return Personal Data within a reasonable timeframe
• Data may be retained where legally required
• Backups may persist for a limited period until overwritten

13. Audits and Compliance

Upon reasonable written notice, the Customer may:

• Request documentation demonstrating compliance
• Conduct audits limited to one per year (unless required by law)

Audits must not unreasonably disrupt Crisphive's operations.

14. Liability

Liability under this DPA is subject to the limitations set out in the Agreement, to the maximum extent permitted by applicable law.

15. Governing Law

This DPA is governed by the laws of Ontario, Canada, and applicable EU/UK data protection law where required.

16. Order of Precedence

In the event of conflict:

• 1. This DPA
• 2. The Agreement
• 3. Any other applicable documents

17. Contact for Data Protection Matters

Schedule 1 — Summary of Processing