Data Processing Agreement
Effective date: 2026-05-11 Last updated: 2026-05-11
Working draft · only send to enterprise prospects after lawyer review. Drafted to align with GDPR Article 28, UK GDPR, and CCPA's service-provider provisions. Search for
[BRACKETED]values to identify the only-Chris fields. Don't rely on this for an actual EU enterprise contract until counsel signs off.
1. Purpose
This Data Processing Agreement ("DPA") supplements the CrewPush Terms of Service between Emercive Marketing LLC ("Processor," "CrewPush") and the customer ("Controller," "Customer") and governs CrewPush's processing of personal data on the Customer's behalf.
This DPA applies when:
- Customer is established in the EEA, UK, or Switzerland, OR
- Customer's end users (e.g. crew members, lead-form submitters) include EEA / UK / Swiss residents, OR
- Customer is a California business required to enter a service- provider DPA under CCPA/CPRA
For all other customers, the Privacy Policy is sufficient.
2. Definitions
Terms used here have the meanings given in the GDPR (EU 2016/679), UK GDPR, and CCPA/CPRA where applicable.
- Personal Data — any information relating to an identified or identifiable natural person processed by CrewPush on behalf of the Customer
- Sub-processor — any third party engaged by CrewPush to process Personal Data (listed in Annex II)
- Data Subject — the individual to whom the Personal Data relates (typically the Customer's crew members, leads, or end users)
3. Scope and roles
3.1 Roles
- Customer is the Controller of Personal Data uploaded to or generated within CrewPush
- CrewPush is the Processor acting on Customer's documented instructions
3.2 Subject matter, duration, nature, purpose
| Element | Detail |
|---|---|
| Subject matter | Provision of the CrewPush software service |
| Duration | The lifetime of the Customer's CrewPush account, plus the 30-day post-cancellation grace period |
| Nature + purpose | Processing photos + posts + crew/lead/customer data to enable the Customer to publish social media posts and manage related business workflows |
| Categories of Data Subjects | Customer's crew members, customers' clients (lead submitters), customer's photographed individuals, customer's end users |
| Categories of Personal Data | Names, email addresses, phone numbers, photos (which may include faces and identifiable property), social media identifiers, lead/customer notes |
| Sensitive categories | None intended. Customer should not upload special-category data (health, biometrics, racial/ethnic data) to CrewPush. |
4. Customer instructions
4.1 Documented instructions
CrewPush processes Personal Data only on Customer's documented instructions, which consist of:
- These Terms of Service + Privacy Policy
- This DPA
- The actions Customer takes within the CrewPush interface (uploading, publishing, exporting, deleting)
- Any further instructions Customer provides in writing
If CrewPush believes an instruction violates GDPR / applicable law, CrewPush will notify Customer immediately and may pause processing of that instruction pending resolution.
4.2 No independent processing
CrewPush will not process Personal Data for any purpose other than those listed in section 5 of the Privacy Policy. CrewPush will not:
- Sell Personal Data
- Share Personal Data for cross-context behavioral advertising
- Combine Personal Data with data from other sources to build profiles
- Train AI models on Customer's Personal Data for general use (AI caption drafting per-Customer is excepted; the model does not retain learnings across customers)
5. Confidentiality
CrewPush ensures that personnel authorized to process Personal Data:
- Are bound by written confidentiality agreements
- Have received privacy + security training
- Process Personal Data on a need-to-know basis only
- Use audit-logged access (see Privacy Policy section 12)
6. Security measures
CrewPush implements appropriate technical and organizational measures ("TOMs") set out in Annex I below.
If a Personal Data Breach occurs, CrewPush will:
- Notify Customer without undue delay (target: within 48 hours of confirming the breach)
- Provide details: nature of breach, categories + approximate number of Data Subjects affected, likely consequences, measures taken
- Cooperate fully with Customer's response, including any required Data Subject notifications
7. Sub-processors
7.1 General authorization
Customer authorizes CrewPush to engage Sub-processors to provide the Service, subject to the requirements in this section. The current Sub-processor list is in Annex II.
7.2 New Sub-processors
When CrewPush adds or replaces a Sub-processor:
- We post the change at crewpush.com/subprocessors
- We notify active enterprise customers via email at least 30 days before the change takes effect
- Customer can object in writing within 30 days; if objection cannot be reasonably resolved, Customer may terminate the affected services on a pro-rata refund basis
7.3 Sub-processor obligations
CrewPush ensures that each Sub-processor is bound by data protection obligations equivalent to those in this DPA, by written contract.
CrewPush remains fully liable to Customer for the performance of its Sub-processors.
8. Data subject rights
Customer is responsible for handling Data Subject requests directed to it (Customer is the Controller).
CrewPush will assist Customer in fulfilling Data Subject rights requests by:
- Providing tools in the operator app for export, correction, deletion
- Responding to specific requests for assistance within 5 business days
- Forwarding Data Subject requests received directly by CrewPush to Customer within 5 business days
This assistance is provided at no additional charge for reasonable volumes (under 50 requests/year per customer).
9. International transfers
CrewPush is hosted in the United States. Personal Data may be transferred to and processed in the US.
For EEA, UK, and Swiss data:
- CrewPush relies on the EU-US Data Privacy Framework (DPF) certification of its Sub-processors where applicable
- Where DPF is unavailable, CrewPush uses the EU Standard Contractual Clauses (SCCs) — the 2021 modules — incorporated by reference here
- For UK data, the UK International Data Transfer Addendum to the SCCs applies
- For Swiss data, the SCCs apply with Swiss adaptations
The signed SCCs / IDTA are available upon request: legal@crewpush.com
10. Audits
CrewPush will:
- Make available to Customer all information necessary to demonstrate compliance with this DPA
- Allow for and contribute to audits, including inspections, conducted by Customer or another mandated auditor
- Provide responses to reasonable security questionnaires within 15 business days
- Make available a SOC 2 Type II report when one is obtained (currently in-progress; CrewPush will pursue SOC 2 within 12 months of public launch)
Customer may exercise audit rights once per year, with 30 days' written notice, during normal business hours, at Customer's expense. Audit findings are confidential.
11. Deletion + return of data
Upon termination of the CrewPush service:
- Customer has 30 days from cancellation to export all data via Settings → Export
- After 30 days, CrewPush deletes all Personal Data except: - Audit logs (12-month retention for security) - Stripe transaction records (7-year retention for tax) - Backups (rolling 30-day deletion lag)
- Customer may request immediate deletion (waiving the grace period) by emailing privacy@crewpush.com
CrewPush will provide written confirmation of deletion within 30 days of completion.
12. Liability
The limitation of liability in the Terms of Service applies to this DPA. To the extent there's any conflict, the Terms of Service governs except where required otherwise by GDPR.
13. Term
This DPA takes effect when Customer accepts the Terms of Service or signs a separate enterprise agreement, and continues for as long as CrewPush processes Personal Data on Customer's behalf.
14. Order of precedence
In case of conflict, the order of precedence is:
- Any signed enterprise master agreement between CrewPush and Customer
- This DPA
- The Terms of Service
- The Privacy Policy
ANNEX I · Technical and Organizational Measures (TOMs)
CrewPush implements the following measures:
Access control
- All admin access requires hardware security key (YubiKey) + 2FA
- Tenant data isolated at the database query layer (every query scopes by user_id / tenant_id)
- Customer credentials stored as salted scrypt hashes
- OAuth refresh tokens for connected platforms encrypted at rest (AES-256-GCM)
Network security
- All traffic over HTTPS (TLS 1.2+) with HSTS preload
- Cloudflare edge protection (DDoS, WAF)
- Rate limiting on auth + write endpoints
- IP-based admin access restrictions
Application security
- Strict Content-Security-Policy headers
- Parameterized SQL queries everywhere (no string interpolation)
- Webhook signature verification on all inbound events
- Audit log on every authenticated request
- Secrets stored in Coolify's environment-variable store (self-hosted, encrypted at rest), never in code or plaintext config
Data protection
- Encryption in transit (TLS) and at rest (provider-managed block-storage encryption + application-level AES-256-GCM for sensitive tokens)
- PII redacted from logs (configurable via LOG_REDACT_PII env var)
- 30-day soft-delete window on customer data
- Daily encrypted backups, 30-day retention
Operational security
- Quarterly security review
- Annual penetration test (when commercially feasible)
- Incident response runbook + on-call rotation
- Subprocessor monitoring (status pages + breach notifications contractually required from each)
Personnel
- Background checks on staff with production access
- Confidentiality agreements
- Security training on hire + annually thereafter
ANNEX II · Sub-processors
| Sub-processor | Service | Data accessed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing | Email, name, billing address, payment metadata | USA |
| Hetzner Cloud GmbH | App + database hosting (managed via Coolify, self-hosted) | All Personal Data | USA (Ashburn, VA) |
| Resend, Inc. | Transactional email | Email addresses, names | USA |
| Anthropic, PBC | AI caption drafting | Photos + caption context | USA (DPF-certified) |
| OpenAI, Inc. | AI caption drafting (alternative) | Photos + caption context | USA (DPF-certified) |
| Cloudflare, Inc. | DNS, DDoS, CDN | IP addresses, request metadata | Global |
| Twilio, Inc. (SMS feature, opt-in) | SMS notifications | Phone numbers | USA |
| Sentry (Functional Software, Inc.) | Error monitoring | Stack traces, request URLs (PII filtered) | USA |
Updated list: crewpush.com/subprocessors
ANNEX III · Standard Contractual Clauses
For EEA / UK / Swiss data transfers, the following are incorporated:
- EU SCCs (2021), Modules 1, 2, 3 as applicable, with optional clause 7 (docking clause) and optional clause 11 (independent resolution body) elected
- UK IDTA (March 2022) for UK data
- Swiss FADP-adapted SCCs for Swiss data
The signed agreements are available at legal@crewpush.com.
_This DPA was prepared by CrewPush staff with the assistance of generative AI. It has been finalized to align with GDPR Article 28 requirements but must be reviewed by qualified legal counsel before any enterprise contract is signed. The above is a working draft, not legal advice._