This Data Processing Addendum (the “DPA”) forms part of the agreement between the customer identified in that agreement (“Customer”) and GESIC Computers USA LLC, doing business as Contractors Flow Pro (“Contractors Flow”). It applies only where Contractors Flow processes Personal Data on Customer’s behalf in connection with Contractors Flow Pro (the “Service”) and applicable data-protection law requires a data-processing agreement.
This DPA is incorporated into the applicable Terms of Service, order, or other written service agreement (the “Agreement”). Capitalized terms not defined here have the meanings given in the Agreement.
1. Roles and instructions
As between the parties, Customer is the Controller or Business, and Contractors Flow is the Processor or Service Provider, as those terms are defined under applicable data-protection law, for Customer Personal Data processed under this DPA. Contractors Flow will process Customer Personal Data only on Customer’s documented instructions, including the Agreement and this DPA, unless otherwise required by applicable law. If law requires processing beyond Customer’s instructions, Contractors Flow will notify Customer unless law prohibits that notice.
Customer is responsible for ensuring that its instructions and its collection and use of Customer Personal Data comply with applicable data-protection law, including obtaining required notices, consents, and other legal grounds for processing.
2. Details of processing
The subject matter, duration, nature, purpose, categories of data subjects, and categories of Customer Personal Data are described in Schedule 1. Contractors Flow will not sell or share Customer Personal Data as those terms are defined by applicable U.S. state privacy laws, and will not retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer except as permitted by the Agreement, this DPA, or applicable law.
3. Confidentiality
Contractors Flow will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations or statutory duties of confidentiality.
4. Security measures
Contractors Flow will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The measures must be evaluated against the nature, scope, context, purposes, and risks of processing.
Contractors Flow maintains measures designed to protect Customer Personal Data that are appropriate to the nature of the Service and the risks presented. These include serving the public website over HTTPS and maintaining account and backup processes for the Service. Contractors Flow will continue to evaluate and adjust its measures as the Service and applicable risks change. Detailed security information may be requested at legal@contractorsflowusa.com. No certification, audit, regulatory compliance, or security outcome is implied unless Contractors Flow states it separately in a written agreement.
5. Assistance with data-subject rights
Taking into account the nature of processing, Contractors Flow will provide reasonable assistance, through appropriate technical and organizational measures where available, to help Customer respond to valid data-subject requests. If Contractors Flow receives a request relating to Customer Personal Data, it will direct the requester to Customer when appropriate and lawful, unless Customer instructs otherwise.
6. Personal-data incidents
Contractors Flow will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data, taking into account the information available and the needs of the parties to comply with applicable law. Contractors Flow will provide information reasonably available to support Customer’s investigation, mitigation, and notification obligations.
7. Subprocessors
Customer authorizes Contractors Flow to engage subprocessors that provide infrastructure, hosting, customer support, communications, payment processing, security, monitoring, or other services necessary to provide the Service, provided that Contractors Flow imposes data-protection obligations on each subprocessor that are substantially similar to those in this DPA as appropriate to the subprocessor’s role.
Contractors Flow will make a current subprocessor list available at ./subprocessors.html and will provide a reasonable mechanism for Customer to receive notice of material subprocessor additions. Customer may object on reasonable data-protection grounds within thirty (30) days after notice. If the parties cannot resolve the objection in good faith, Customer may terminate the affected Service on written notice without penalty for the unused prepaid portion, if any.
8. Audits and information
Upon reasonable written request and no more than once per year unless a material incident or legal obligation requires otherwise, Contractors Flow will make available information reasonably necessary to demonstrate compliance with this DPA. If documentation is insufficient, Customer may conduct an audit or inspection under mutually agreed scope, timing, confidentiality, security, and cost-allocation terms, provided it does not unreasonably disrupt Contractors Flow’s operations or expose other customers’ information.
9. Return and deletion
At the end of the Service, Customer may retrieve Customer Personal Data using available export functionality during the applicable export period. Following that period, Contractors Flow will delete or return Customer Personal Data in accordance with the Agreement, except to the extent retention is required by law or information remains in secure backups until overwritten in the ordinary course.
Following termination, Customer may export available Customer Personal Data for thirty (30) days. Contractors Flow will delete Customer Personal Data from active systems within sixty (60) days after that export period ends, except to the extent retention is required by law. Secure backup copies may remain until deleted or overwritten in the ordinary course, for up to ninety (90) days after deletion from active systems.
10. International transfers
The Service is offered to U.S. customers and is not currently offered to customers in the EEA or United Kingdom. If Contractors Flow later offers the Service to those customers or otherwise undertakes a restricted transfer that requires an approved transfer mechanism, the parties will cooperate in good faith to implement the applicable mechanism before that processing begins.
11. CCPA / CPRA and similar U.S. state privacy laws
Where applicable, Contractors Flow acts as a Service Provider or Processor. Contractors Flow will process Customer Personal Data only for the business purposes specified in the Agreement and this DPA; will not combine it with personal information received from other sources except as permitted by law; and will comply with applicable obligations imposed directly on service providers or processors. Customer may take reasonable and appropriate steps to ensure Contractors Flow uses Customer Personal Data consistently with Customer’s obligations. Contractors Flow will notify Customer if it determines it can no longer meet its obligations under applicable law.
12. Priority and termination
In the event of a conflict between this DPA and the Agreement, this DPA controls with respect to the processing of Customer Personal Data. This DPA terminates automatically when Contractors Flow no longer processes Customer Personal Data, unless law requires an obligation to survive.
Schedule 1 — Processing details
| Subject matter | Provision of Contractors Flow Pro field-service workspace and related support, security, billing, and administration. |
|---|---|
| Duration | For the subscription term and any documented post-termination export/deletion period, subject to lawful retention. |
| Nature of processing | Collection, recording, organization, storage, retrieval, consultation, transmission, support, security monitoring, backup, deletion, and other processing necessary to provide the Service. |
| Purpose | To provide and support Customer’s use of the Service, including customer management, quotes, job administration, invoicing, payment-status tracking, and service configuration. |
| Data subjects | Customer’s users, employees, contractors, prospects, customers, customer contacts, property occupants, and other individuals whose information Customer submits to the Service. |
| Personal-data categories | Names, contact details, business details, property addresses, service and scheduling information, quote and invoice details, payment-status records, user-account data, communications, and technical/log information. |
| Special categories | Not intentionally required for the Service. Customer must not submit special-category, health, payment-card, government-ID, or similarly sensitive data unless the parties expressly agree in writing and appropriate safeguards are documented. |
Contact
For DPA questions, contact Contractors Flow at legal@contractorsflowusa.com or 3161 Ala Ilima St #2012, Honolulu, HI 96818.