<p>This policy describes how Crewfare LLC collects and processes personal data with respect to data subjects covered by the EU General Data Protection Regulation.  Depending on your geographic location, some parts of this statement may not apply to you. Except as described below, we are the data controller of personal data collected from our website.  Our physical address is 2678 Edgewater Court, Weston, Florida 33332, and you may reach us by emailing info@crewfare.com Our EU Representative is Osano International Compliance Services Limited and can be contacted by writing to 3 Dublin Landings North Wall Quay Dublin 1 D01C4E0.</p>

<h3>GDPR Principles</h3>

<p>The GDPR principles exist to aid companies to stay and remain within the boundaries of the regulation; they also help to understand its main objectives. Therefore, we comply with the contours and principles expressed to be the core of GDPR compliance, which are:</p>

<ul>
<li><em>Lawfulness, fairness, and transparency.</em> These first principles express the need to comply with the GDPR when required under this regulation due to our activities, as expressed in this Statement. We are to keep you as informed as possible regarding our GDPR compliance.</li>
<li><em>Purpose Limitation.</em> As is determined in the text of the GDPR, all purposes for data processing and collection must remain specific, explicit, and legitimate. The controller must use such collected personal data for the particular purposes for which you have consented to its collection and processing.</li>
<li><em>Data minimization.</em> We only collect the data which is necessary and relevant for our activities. The less personal information we collect or process, the better for every party involved.</li>
<li><em>Accuracy.</em> We keep data as up-to-date as possible and try to ensure we erase inaccurate data or if we believe data is outdated.</li>
<li><em>Storage limitations.</em> We keep personal information only as long as necessary for the purposes stated in our Privacy Policy</li>
<li><em>Integrity and confidentiality.</em> We protect and secure all personal data we store and process and have methods to anonymize personal data.</li>
<li><em>Accountability.</em> We keep committed to recording our activities and strategies, proving compliance with the GDPR, and constantly reviewing and improving the management of personal data.</li>
</ul>

<h3>Sources of Data Collection</h3>

<p>We may collect information about you during your visit and when you use our website, app, and services. To give you more information on the sources of the data we collect from you, consider that we are doing so;</p>

<ul>
<li><em>When you directly share it with us.</em> We directly collect data from you when you voluntarily give it to us, such as when you register on the website or app, when you contact us when you sign up for our services or our newsletter or promotional emails, or even when you give us information about yourself in person, by phone or text, or by email.</li>
<li><em>Automatically through your use of our services, website, or other similar activities.</em> Your personal information is collected automatically when you browse our site or app, even when you are not a registered user. For example, we gather information such as your IP address, which webpages you stay on and how long, and other user data and information about the device you use when on the website or app.</li>
<li><em>From third-party sources.</em> We may also gather personal information about you from third parties. We may receive personal information about you or your contacts if you register for our services or access our website through a social media account. The types of personal information we may receive from social media accounts will depend on your privacy settings in those accounts. We may also receive personal information about you from our partners and processors or from other third parties to whom you have given permission to share your information.</li>
</ul>

<h3>Categories of Personal Data</h3>

<p>We collect the following categories of personal data:</p>

<ul>
<li>Name and last name.</li>
<li>Phone Number.</li>
<li>Mailing Address.</li>
<li>Email Address.</li>
<li>Date of Birth.</li>
<li>Gender.</li>
<li>Usernames or handles.</li>
<li>Internet Protocol (IP) Address.</li>
<li>Geographic location data.</li>
</ul>

<p>Remember that you have the right at all times not to disclose any personal information to us. However, this may impact and possibly limit your use of the Website and App and we may not be able to provide you any Services to the extent that your personal data is required to enable us to provide such data.</p>

<h3>Special Categories of Personal Data</h3>

<p>We may collect personal data which is considered sensitive and is classified as a “special category” under the GDPR This may include:</p>

<ul>
<li>Ethnicity.</li>
<li>Racial origin.</li>
<li>Cultural or social identity.</li>
<li>Religious and philosophical beliefs.</li>
<li>Trade union membership status.</li>
<li>Information about sexual orientation or sex life.</li>
<li>Health information.</li>
<li>Biometric data.</li>
<li>Genetic data.</li>
</ul>

<h3>How We Use Your Personal Information</h3>

<p>We use your personal information for various purposes.</p>

<ul>
<li>To provide you with our products and services.</li>
<li>To Contact you.</li>
<li>To improve and optimize our products and services to make them better and easier to use by you and by our clients.</li>
<li>To better understand your preferences and use that information to develop further and update our products and services.</li>
<li>To market our solutions.</li>
<li>To detect and avoid fraud.</li>
<li>To prevent fraud</li>
<li>To comply with applicable legal obligations.</li>
<li>For various security purposes.</li>
<li>For a different specific purpose, for which you have specifically consented to.</li>
</ul>

<p>We follow the directives of the GDPR in informing you about our uses, basis, and purposes for the collection and processing of your personal data. In the event that any such purpose changes, we will make sure to inform you about any changes to the purposes of why and what we collect and process your data for.</p>

<h3>Sharing of Your Personal Information</h3>

<p>Under no circumstance will we sell, trade, or rent any of your personal information, regardless of its source or purpose. However, with your previous consent, we may share personal data with recipients under certain circumstances and with the following parties;</p>

<ul>
<li>With services providers, agents, subcontractors, and vendors to perform certain activities and functions on our behalf, and only limited to the extent they need such data to perform such activities and functions. Contractual boundaries are determined and agreed upon with these parties to protect and responsibly use your data.</li>
<li>Within our company group, to better provide you with information and services.</li>
<li>With Professional advisors of ours which we consult on different niche areas, such as legal, accounting, and banking.</li>
<li>With public and government authorities and law enforcement, pursuant to legal obligations or when we are compelled under law and authority to disclose personal data.</li>
</ul>

<h3>Legal Basis of Processing</h3>

<p>Under the GDPR, all companies must have a legal basis for processing personal information. We rely on the following legal bases for collecting and processing personal data:</p>

<ul>
<li><em>Processing is made based on your consent to the collection or processing of your personal data.</em></li>
<li><em>Processing is necessary to perform a contract with you.</em></li>
<li><em>Processing is required to comply with a legal obligation that applies to us.</em></li>
<li><em>Processing is needed to protect the vital interests of you or another person.</em></li>
<li><em>Processing is based on the performance of a task carried out in the public interest or based on the public authority.</em></li>
<li><em>Processing is based on our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights do not outweigh them.</em></li>
</ul>

<h3>International Data Transfer Mechanisms</h3>

<p>Many US companies have commercial interests and businesses inside the EU and therefore handle the personal data of EU citizens directly protected by the GDPR. As a result, EU authorities, through the EU Commission, have determined the need for valid mechanisms for companies to make such data transfers without putting any personal data protected under the GDPR at risk of infringement. These are the most important of such mechanisms.</p>

<ul>
<li><em>Standard Contractual Clauses.</em> Also known as SCCs, these clauses are part of a contract between data controllers and processors for safe and responsible data transfers between EU and non-EU countries.</li>
<li><em>Adequacy Decision.</em> The European Commission has made a finding that the country to which the data is being transferred provides a level of data protection that is equivalent to that provided by members of the European Union. When the international data transfer is based on an adequacy decision, it means that, although data is sent cross-border outside of the EU, the receiving country or territory can legally handle such information as it were within the EU.</li>
<li><em>Privacy Shield. EU-US and Swiss-US</em> Privacy Shield frameworks were designed by the US Department of Commerce, the European Commission, and the Swiss Administration and aimed to create an alternative mechanism for international personal data transmission. Privacy Shield has been judged invalid as an adequate mechanism for international data transfer by the EU Commission and the Swiss administration. However, the US participants of Privacy Shields are still under the framework and must remain compliant with its directives.</li>
<li><em>Binding Corporate Rules.</em> These are data protection policies made by companies with strict observation of GDPR and other privacy directives. Companies create BCR as a valid and legitimate mechanism for transferring personal data outside the EU within a group of companies or undertakings and enterprises. For the BCR to be compliant, it must be approved by a local Data protection authority.</li>
</ul>

<h3>Data Processing Agreement</h3>

<p>A Data Processing Agreement (DPA) is a contract between a data controller and a data processor that governs the processor’s handling of personal data. You can find our DPA <a href="https://crewfare.com/dpa" rel="noopener" target="_blank">here</a>.</p>

<h3>Your Data Subject Rights</h3>

<p>The GDPR has granted data subjects specific rights respecting their personal data. This applicability may depend on your nationality and geographic location. These are your rights:</p>

<ul>
<li><em>Right of knowledge or confirmation.</em> You have the right to obtain a confirmation of whether your personal data is being processed</li>
<li><em>Right of access.</em> You may require from the controller free information about the storage of your personal information and also obtain a copy of this information. Additionally, you  have a right to know the purposes of the processing of any personal information, the categories of personal information collected or processed and stored, and the recipients of the personal information, if any.</li>
<li><em>Right of rectification.</em> You have the right to correct or request the correction of your personal information.</li>
<li><em>Right to be forgotten (erasure).</em> You shall have the right to have your personal data erased without delay, provided that processing is unnecessary. The controller shall consider if such information is no longer necessary for the purposes it was collected for and that there are no overriding legitimate grounds for processing.</li>
<li><em>Right of restriction of processing.</em> You have the right to request that processing of your personal data be restricted when:</li>
<ul>
<li>The accuracy of personal data is contested;</li>
<li>The processing of personal information is unlawful, and you do not require its deletion;</li>
<li>The controller does not need the personal data any longer, but is required to keep it to fulfill a legal obligation or to pursue or defend a legal claim;</li>
<li>You have objected to processing their personal data during the time of verification by the controller.</li>
</ul>
<li><em>Right of Data Portability.</em> You have the right to receive their personal information in a structured and machine-readable format. You shall have the right to transmit the data to another controller without further observation by the original controller. You may also request that personal data be transferred directly from one controller to another.</li>
<li><em>Right to object.</em> You have the right to object to the processing of your personal information, at any time.</li>
<li><em>Right not to be subject to automatic decision-making, including profiling.</em> You have the right not to be subject to this kind of processing.</li>
<li><em>Right to withdraw consent.</em> If you have consented to the collection or use of your personal information, you have the right to withdraw your consent at any time.</li>
</ul>

<p>Additionally, if you feel we have failed to address any of your requests regarding your personal data, you may have the right to lodge a complaint with a Data Protection Authority. Here is a list of the contacts for them: <a href="https://edpb.europa.eu/about-edpb/about-edpb/members_en" rel="noopener" target="_blank">https://edpb.europa.eu/about-edpb/about-edpb/members_en</a> To practice your aforementioned rights, please contact us at the physical or email address provided in our Privacy Policy. Before we grant or process any requests for your rights, we may require verification of your identity.</p>

<h3>Data Protection Officer</h3>

<p>We have appointed a Data Protection Officer. You may contact him at:</p>

<p>Jordan Scheffler<br>
2678 Edgewater Court<br>
Weston, Florida 33332<br>
<a href="mailto:info@crewfare.com" rel="noopener" target="_blank">info@crewfare.com</a></p>

<p>If you think the DPO is not the correct party to address for any questions or inquiries about this Statement contact us to our provided contact data above.</p>

<h3>Subprocessors</h3>

<p>For the purposes determined within this statement and to provide complete and compliant services to you, we engage and use data processors with which we may share some categories of your collected data. These subprocessors are under an agreement with us and may use your data for the specific purposes we require and in compatibility with this statement and our privacy policy.</p>

<table>
<tbody>
<tr><td>Amazon Web Services, Inc.</td><td>aws-privacy@amazon.com</td><td>Name, contact info, IP address, usage data</td><td>Cloud Service Provider</td></tr>
 <tr><td>Freshworks Inc.</td><td>privacy@freshworks.com</td><td>Name, contact info, communication data</td><td>Customer support system and customer relationship management</td></tr>
 <tr><td>HubSpot, Inc.</td><td>privacy@hubspot.com</td><td>Name, contact info, usage data</td><td>Content Management System</td></tr>
 <tr><td>Slack Technologies, Inc.</td><td>privacy@slack.com</td><td>Name, contact info, communication data</td><td>Collaboration Tool</td></tr>
 <tr><td>Stripe, Inc.</td><td>privacy@stripe.com</td><td>Name, contact info, financial data</td><td>Payment Processing Tool</td></tr>
 <tr><td>PayPal, Inc.</td><td>privacy@paypal.com</td><td>Name, contact info, financial data</td><td>Payment Processing Tool</td></tr>
 <tr><td>Authorize.net</td><td>privacy@visa.com</td><td>Name, contact info, financial data</td><td>Payment Processing Tool</td></tr>
 <tr><td>SendGrid, Inc</td><td>privacy@sendgrid.com</td><td>Name, contact info, email address</td><td>Sending Emails</td></tr>
 <tr><td>ActiveCampaign</td><td>privacy@activecampaign.com</td><td>Name, contact info, email address, usage data</td><td>Marketing Emails</td></tr>
 <tr><td>Cloudflare, Inc.</td><td>privacyquestions@cloudflare.com</td><td>IP address, usage data</td><td>Web Infrastructure Security</td></tr>
 <tr><td>Osano, Inc.</td><td>privacy@osano.com</td><td>IP address, cookie data, usage data</td><td>Cookie Consent and Privacy Compliance</td></tr>
 <tr><td>Google LLC or its affiliates</td><td>https://policies.google.com/privacy</td><td>Name, contact info, email, IP address, location</td><td>Email, Analytics & Location</td></tr>
 <tr><td>SiteGround Hosting Ltd.</td><td>privacy@siteground.com</td><td>Name, contact info, IP address, usage data</td><td>Cloud & Hosting Service Provider</td></tr>
 <tr><td>Atlassian (JIRA/Confluence/Bitbucket)</td><td>privacy@atlassian.com</td><td>Name, contact info, project data</td><td>Project Management Infrastructure</td></tr>
 <tr><td>DynamoDB</td><td>aws-dynamo-privacy@amazon.com</td><td>Name, contact info, application data</td><td>Data Hosting</td></tr>
 <tr><td>Asana</td><td>privacy@asana.com</td><td>Name, contact info, project data</td><td>Project management infrastructure</td></tr>
 <tr><td>ZenDesk</td><td>privacy@zendesk.com</td><td>Name, contact info, communication data</td><td>Customer support system and customer relationship management</td></tr>
</tbody></table>

Contact Us