Data Processing Agreement

1. Roles

• For the personal information you enter about your workers, contractors, and their personnel, your organisation is the controller (or, in Canadian private-sector privacy law, the organisation with responsibility for the information). Contractor ManagementPro is the processor acting on your documented instructions.
• For our own account records, billing records, and security logs, we act as a controller in our own right. The privacy notice describes that processing.
• This agreement applies to the extent it is not varied by a signed master agreement or data processing addendum between your organisation and us. A signed agreement takes precedence.

2. What we process and why

• We process the information you enter — company details, contact information, trade and insurance details, submitted form content, uploaded documents and photos, signature images, incident records, and audit entries — to provide the service you have subscribed to.
• We do not process your data for our own marketing, we do not sell it, and we do not use it to train AI models.
• We use aggregated, de-identified operational metrics (such as request counts and error rates) to run and secure the service.

3. Your instructions and limits

• We process your data only on your instructions, which include the configuration choices you make in the product and this agreement.
• If we believe an instruction would breach applicable privacy law, we will tell you and may decline that instruction. We will not be liable for a delay caused by a lawful refusal.
• We will tell you promptly if we become aware that your data has been processed in a way that breaches this agreement.

4. Confidentiality and access

• Access to customer data by our personnel is limited to what is needed to operate, secure, and support the service, is role-based, and is logged.
• Our personnel are bound by confidentiality obligations.
• Support access to your data is not standing: it is granted per task and reviewed.

5. Security measures

• Encryption in transit using TLS, and encryption at rest at the database and storage layer.
• Passwords are stored only as salted hashes. Session tokens are signed and httpOnly.
• Role-based authorisation enforced on the server, not only in the interface.
• An append-only audit log of record changes, approvals, overrides, and access to sensitive configuration.
• Segregation of production and non-production environments, with seeded demo data rotated away from known credentials.
• Regular dependency updates and a documented backup and restore process with tested restores.
• These measures are appropriate to the risk. No system is perfectly secure, and we cannot guarantee security against every possible attack.

6. Subprocessors

• You authorise the subprocessors listed below to process your data for the purposes stated. Each is bound by written terms imposing data protection obligations no less protective than this agreement.
• We will give at least 30 days’ notice before adding a subprocessor that processes personal information, giving you the chance to object. If you object on reasonable data protection grounds and we cannot offer a workaround, you may terminate the affected part of the service.
• If a subprocessor fails to meet its data protection obligations, we remain liable to you for its performance to the same extent we would be for our own.

7. International transfers

• Our subprocessors may process data outside your province or country, including in the United States.
• Where data leaves a jurisdiction with transfer restrictions, we rely on the transfer mechanism offered by the relevant subprocessor, such as standard contractual clauses, and on the contractual protections in our agreements with them.
• Because some of this information is health or safety information, we recommend you consider whether your own jurisdiction imposes additional requirements before storing it with any cloud provider.

8. Assisting you with individuals’ rights

• Your workers and contractors contact you, not us, to exercise access, correction, or deletion rights. We will support you with the technical means to respond — export, correction, and deletion inside the product — and with information you reasonably need.
• Where an individual contacts us directly about information we hold for you, we will refer the request to you without responding to its substance, unless the law requires otherwise.
• If a privacy regulator contacts us about your data, we will direct them to you and tell you promptly, unless we are legally barred from doing so.

9. Breach notification

• We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal information breach affecting your data.
• The notice will describe what happened, the information and individuals affected as far as we know, the likely consequences, the measures we have taken, and what we recommend you do.
• We will cooperate with your investigation and with any notification you must make to a regulator or to affected individuals. Deciding whether to notify is your responsibility as the controller; we will give you the information you need to decide.
• We keep a record of breaches and of the remedial action taken.

10. Audits and assurance

• We will answer reasonable security and privacy questionnaires and provide our current security documentation on request.
• Where a written agreement gives you an audit right, we will satisfy it through documentation, a completed questionnaire, or a remote assessment, at a frequency and scope that does not compromise the security of other customers’ data. On-site audits of shared infrastructure require advance written agreement.
• We will tell you about any change that materially reduces the security of the service.

11. Return and deletion

• During your subscription you can export your data at any time from inside the product.
• On termination we make a full export available and then delete your data after the wind-down period described in the Terms, including from backups on the backup rotation cycle.
• Deletion is suspended where a legal hold applies, where the law requires retention, or where we need the data to resolve a dispute. In those cases we delete it once the reason ends.
• We will confirm deletion in writing on request.

12. Liability

• Liability under this agreement is subject to the limitation of liability and indemnity in the Terms of Service. This agreement does not create a separate or additional liability cap.

Subprocessor list

We will update this list before any new subprocessor begins processing personal information, and we will email account owners who have subscribed to change notices.

Contact

Privacy and data protection enquiries: lcloon@roadrunner.com

This document is written in plain language for clarity. It is not legal advice to you, and it does not replace advice from your own counsel on your obligations as a controller.