Data Processing Addendum

For customer operational data submitted to the service, the subscriber is the controller or business, as applicable, and Cranes Agency acts as processor or service provider to the extent required by applicable law. Each party may act as an independent controller or business for its own account, billing, security, fraud-prevention, and legal-compliance data.

We process customer operational data only on the subscriber’s documented instructions, including use of configured product features, and as needed to provide, support, secure, maintain, and improve the service or comply with law. We will notify the subscriber if an instruction appears unlawful unless prohibited from doing so.

Personnel and contractors authorized to process customer operational data are subject to appropriate confidentiality obligations and receive access only as reasonably needed for their duties.

We maintain reasonable administrative, technical, and organizational measures designed to protect customer operational data against unauthorized access, use, alteration, loss, or disclosure, taking account of the nature of the data and service. No security measure provides an absolute guarantee.

Subscriber authorizes subprocessors needed for categories such as hosting and database infrastructure, AI processing, telephony and SMS, email delivery, payment processing, and error monitoring and observability. Material category changes may be communicated through an update to this published page or written notice. We remain responsible for requiring applicable data-protection obligations from subprocessors.

Taking account of the nature of processing, we will provide reasonable assistance when a subscriber must respond to an applicable data-subject or consumer request. If we receive a request concerning subscriber-controlled data, we may direct the requester to the subscriber unless law requires a different response.

We will notify the affected subscriber without undue delay after confirming a security incident involving customer operational data and provide information reasonably available to support the subscriber’s obligations. Notice is not an admission of fault or liability.

At termination or on a valid instruction, we will make available existing export and deletion controls and delete or return customer operational data as reasonably applicable. Legal, tax, accounting, security, fraud-prevention, dispute, and backup retention may delay or limit deletion; retained data remains protected and is not used for unrelated purposes.

Data may be processed in the United States and other locations where authorized service providers operate. The parties will use a lawful transfer mechanism when applicable law requires one. This Addendum does not represent that any particular certification or standard contractual clauses have been executed.

We will make reasonably available information needed to demonstrate compliance with this Addendum. If that information is insufficient, the parties will discuss a proportionate review that protects security, confidentiality, other customers, and service availability. This Addendum does not promise any certification or unrestricted on-site audit.

Where the CCPA or CPRA applies, Cranes Agency acts as a service provider or contractor for customer operational personal information. We will not sell or share that information for cross-context behavioral advertising, retain, use, or disclose it outside the direct business relationship, or combine it with unrelated personal information, except as permitted by law and the parties’ agreement. We process it only to provide, improve, support, and secure the contracted service and for legally permitted purposes.

This Addendum controls over conflicting personal-data processing terms in the Subscriber Agreement. Other terms remain unchanged. Contact info@cranesagency.com with privacy or data-processing questions.