GDPR & Data Processing

1) Who We Are & Our Roles

Contractor Plus, Inc. ("Contractor+," "we," "us") provides field service management software, Contractor+ Voice (telephony), and related services.

• Controller for account, billing, usage, marketing, and website analytics data.
• Processor for customer/end‑customer data you upload or connect (e.g., contacts, jobs, invoices, recordings) where you are the Controller.

Primary contact for EU/UK privacy matters: gdpr@contractorplus.app (or legal@contractorplus.app).

2) EU/UK Representative (Article 27)

If Article 3(2) GDPR or the UK GDPR applies to us (i.e., we offer services to or monitor individuals in the EEA/UK while not established there), we will appoint a formal EU/UK Representative and update this page with their name, address, and email. Note: a simple inbox is not enough—the rep must be a person or company established in the EEA/UK and authorized in writing to act for us before regulators and data subjects.

3) Legal Bases (GDPR Art. 6)

• Contract – to provide the Services you request (accounts, core app features, integrations).
• Legitimate Interests – service security, fraud prevention, product improvement, quality assurance for Voice (e.g., call routing/analytics).
• Consent – marketing communications; optional features like certain call recordings where local law requires consent.
• Legal Obligation – payments, tax/AML/KYC compliance, recordkeeping.

4) Your EU/UK Rights

Email gdpr@contractorplus.app to exercise your rights:

• Access/Portability (Art. 15/20)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction/Objection (Arts. 18–21)
• Withdraw Consent at any time
• Object to direct marketing at any time

We will respond within one month (extendable in complex cases). You may also lodge a complaint with your local supervisory authority.

5) Sub‑Processors (we use to run the Service)

These vendors process personal data on our behalf. We vet them, sign data‑processing terms, and use transfer safeguards where needed. We'll update this list and, where contractually required, give prior notice before additions.

6) International Transfers

We host primarily in the United States. For EEA personal data we use the European Commission 2021 Standard Contractual Clauses (SCCs), plus supplementary measures where necessary. For UK personal data we use the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.

7) Security

We implement technical and organizational measures appropriate to risk, including:

• Encryption in transit (TLS 1.2+) and at rest (e.g., AES‑256)
• Access controls (RBAC/least‑privilege), audit logging
• Network isolation, key management, and regular third‑party testing
• Secure SDLC, vulnerability management, and employee training

8) Retention

We keep personal data for the life of the account and as needed for our legal/operational obligations (e.g., tax/AML). Call recordings default to 24 months unless you delete sooner. Backups are time‑bound and purge on a rolling basis.

9) Breach Notification

If we become aware of a personal‑data breach, we will notify the relevant supervisory authority within 72 hours when required, and affected customers without undue delay, including information necessary to help you meet your own obligations.

10) Automated Decision‑Making & Profiling

We do not make decisions producing legal or similarly significant effects solely by automated means. We may use risk signals (e.g., fraud/abuse flags) to protect the Service; you can contact us to contest or request human review where applicable.

11) Data Processing Addendum (DPA)

Need a signed DPA (Art. 28/46)? Email dpa@contractorplus.app and we'll provide our standard DPA with SCCs/UK Addendum.

12) Changes

We'll update this page as our data practices evolve and will provide advance notice of material changes where legally required.