Data Processing Agreement

2.1 Personal Information — “Personal Information” means information about an identifiable individual, including information considered personal information or personal data under applicable privacy laws. Examples may include:

• name
• email address
• phone number
• address
• rental records
• equipment assignments
• customer profiles
• measurements
• booking history
• account information

2.2 Customer Data — “Customer Data” means all information submitted, uploaded, transmitted, or stored by Customer through Basecrew, including renter information, employee information, inventory records, rental transactions, and operational information.

2.3 Applicable Privacy Laws — May include the Personal Information Protection and Electronic Documents Act (PIPEDA), provincial privacy legislation, U.S. state privacy laws, and other applicable privacy regulations.

The parties acknowledge that Customer operates the rental business and determines why and how personal information is collected, while Basecrew provides software infrastructure.

For Customer Data, Customer acts as the organization responsible for determining the purposes of processing. Basecrew acts as a service provider, processor, or equivalent role depending on applicable law.

Basecrew may process Customer Data only as necessary to provide the Services. Processing activities may include storing information, organizing records, retrieving information, displaying information, generating reports, enabling workflows, providing customer support, maintaining security, and improving platform reliability.

Customer Data may relate to:

• rental customers
• reservation holders
• employees
• contractors
• business contacts
• authorized users

Customer may submit information including identity information (first name, last name, customer ID, contact details), rental information (rental dates, equipment rented, rental history, customer notes), equipment assignment information (depending on the rental industry: height, weight, age, shoe size, equipment size, ability level, compatibility information), and business user information (employee names, login credentials, account roles, activity records).

Customer agrees that it is responsible for determining lawful purposes for collection, providing privacy notices, obtaining consent where required, ensuring accuracy of information, respecting customer rights, and complying with industry regulations.

Customer must not use Basecrew to store unlawful information.

Basecrew agrees to process Personal Information only to provide Services, follow Customer instructions where applicable, maintain reasonable security measures, limit access to authorized personnel, and protect confidentiality.

Basecrew will not sell Customer Data, use Customer Data for unrelated advertising, or disclose Customer Data except as permitted.

Basecrew maintains reasonable safeguards designed to protect Customer Data.

Technical controls may include encryption during transmission, secure hosting environments, authentication controls, access management, and system monitoring.

Organizational controls may include employee confidentiality obligations, security procedures, vendor review practices, and incident response processes.

Security measures may evolve as technology changes.

Customer authorizes Basecrew to engage subprocessors necessary to provide the Services, including providers for cloud hosting, databases, payments, authentication, analytics, and communications.

Basecrew remains responsible for requiring appropriate confidentiality and security obligations from subprocessors.

Customer acknowledges that information may be processed in Canada, the United States, or other locations used by Basecrew service providers. Basecrew will take reasonable steps to ensure transferred information receives appropriate protection.

Basecrew will ensure that individuals authorized to process Customer Data understand confidentiality obligations, access information only when necessary, and maintain confidentiality after employment or contract termination.

If Basecrew becomes aware of a security incident involving Customer Data, Basecrew will investigate the incident, take reasonable mitigation steps, and notify Customer where required. Notification may include a description of the incident, affected information, mitigation actions, and recommended next steps.

Basecrew is not responsible for incidents caused by Customer’s systems, employees, or misuse of credentials.

Where legally required and reasonably possible, Basecrew may assist Customer with requests from individuals regarding access, correction, deletion, and privacy inquiries. Customer remains responsible for responding directly to its customers.

Customer may request deletion of Customer Data after termination of Services. Basecrew may retain limited information where necessary for legal obligations, security purposes, accounting records, or dispute resolution. Backups may be deleted according to standard backup schedules.

Upon reasonable written request, Basecrew may provide information about its privacy and security practices. Customer audits must occur during reasonable business hours, avoid disrupting operations, and protect Basecrew confidential information.

This DPA does not transfer ownership of Customer Data. Customer retains all ownership rights in Customer Data. Basecrew retains ownership of software, systems, infrastructure, and technology.

The liability limitations contained in the Basecrew Terms of Service apply to this DPA. Nothing in this DPA increases Basecrew’s liability beyond those limitations.

This DPA remains effective while Basecrew processes Customer Data. It terminates when the Services agreement ends, Customer Data is deleted, or processing obligations no longer apply.

This DPA is governed by the laws of Ontario, Canada, without regard to conflict-of-law principles.

This DPA forms part of the agreement between Basecrew and Customer. Together with the Basecrew Terms of Service, Privacy Policy, and subscription agreement, it represents the complete agreement regarding personal information processing.

Privacy and security inquiries:

• Basecrew Technologies Inc.
• Privacy Team
• Email: privacy@basecrew.ca
• Canada