Data Processing Addendum (DPA) for Tenants

This DPA forms part of the Agreement between Creveto Pro ("Processor") and the Tenant ("Data Fiduciary").

1. Scope: Applies to personal data of End Users and Tenant staff processed by Creveto Pro on behalf of the Tenant (scan data, location, IP, device data, any submitted details).
2. Instructions: Creveto Pro processes personal data only on documented instructions of the Tenant, as given through the Service settings and the Agreement, and as needed to provide the Service and prevent fraud, unless law requires otherwise.
3. Tenant Obligations: The Tenant is responsible for: lawful purpose; providing notice and obtaining valid consent from End Users; handling End User rights requests and grievances; configuring retention; and not uploading sensitive or children's data without lawful basis.
4. Confidentiality & Security: Creveto Pro ensures personnel with access are bound by confidentiality and maintains reasonable security safeguards (encryption in transit, access control, tenant isolation, logging, backups).
5. Sub-processors: The Tenant authorises the use of sub-processors (cloud, storage, messaging, payments, mapping).
6. Assistance & Breach: Creveto Pro will reasonably assist the Tenant with rights requests and notify the Tenant without undue delay on becoming aware of a personal data breach affecting Tenant data.
7. Return / Deletion: On termination, the Tenant may export data during the retention window; thereafter Creveto Pro deletes data as per the Terms.
8. Audit, Liability & Indemnity: The Tenant may request reasonable written compliance information once a year. Liability under this DPA is subject to the Terms & Conditions. The Tenant indemnifies Creveto Pro for claims arising from the Tenant's failure to give notice, obtain consent, or from unlawful instructions.