Jobcard Data Processing Agreement

This Data Processing Agreement ("DPA") is between the shop that subscribes to Jobcard ("you", the controller) and Jobcard by IAIG (Inevitable AI Group) ("Inevitable AI Group", "IAIG", "Jobcard", "we", the processor), an Israeli company. It is part of the Terms of Service. If this DPA and the Terms conflict on a privacy point, this DPA wins for that point.

Jobcard is field-service software for US shops, at $249 per month. You decide what customer data goes into it. We process that data to provide the service.

1. Definitions

• Data protection law means the GDPR, the UK GDPR, and US state privacy laws that apply to the data, including the CCPA where it applies to a service provider.
• Personal data means information about an identified or identifiable person that we process for you under the Terms.
• Processing means any operation on that data, including collecting, storing, using, disclosing and deleting it.
• Sub-processor means a third party we engage to process personal data for you.
• Data subject means the person the data is about.
• Security incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to personal data.

2. Scope

This DPA covers personal data we process for you while you use Jobcard. It does not make us the controller of that data. We are the controller only of our own account, billing and website data, as the Privacy Policy describes.

3. Our duties as processor

We will:

• process personal data on your documented instructions, including the instructions in the Terms and this DPA, unless the law requires something else, in which case we tell you unless the law forbids that;
• make sure people we authorise to process the data are bound to keep it confidential;
• keep the measures described in section 5 and on the Security page;
• help you respond to data-subject requests, as section 7 describes;
• help you with a data-protection impact assessment or a consultation with an authority, where the law requires it and you ask, taking into account the nature of the processing;
• tell you before we add or replace a sub-processor, as section 4 describes;
• delete or return the data at the end, as section 9 describes;
• make available the information you reasonably need to show this DPA is being followed.

We will not sell personal data, and we will not use customer data for our own marketing.

4. Sub-processors

You authorise the sub-processors below. We will tell you at least 30 days before we add or replace one, by email or in the product, except where a change is needed sooner to keep the service secure, in which case we tell you as soon as we can. If you object, you may stop using the affected part of the service or cancel the subscription. We put data-protection duties on each sub-processor that are no less protective than this DPA.

Subscription billing for Jobcard's plan is handled by a third-party payment provider, which will be named here before billing begins. The others below are who the service actually sends data to.

A provider you connect (QuickBooks, Google Calendar, Stripe) also has its own terms for the data it receives.

5. Security

We keep each shop in its own database schema. Sign-in is Google or an emailed code, through Supabase Auth. Traffic uses the host's transport encryption. Google Calendar and QuickBooks connection tokens are stored as AES-256-GCM ciphertext. We do not store card numbers. The measures we actually run are described on the Security page. No system is perfectly secure.

6. Security incidents

We will tell you without undue delay after we become aware of a security incident that affects your personal data, and within 72 hours where the GDPR's notice clock applies to that incident. The notice will say, as far as we know it, what happened, which kinds of data are involved, what we are doing about it, and how to reach us. You notify authorities and people where the law puts that duty on you. We will help you with the information you reasonably need for that notice.

7. Requests from people

If a person asks us for access, correction, deletion, restriction, portability or an objection, and the data is yours, we will point them to you and not answer the request ourselves, unless the law requires us to. We will help you answer it, including by using the export and delete tools in the product. If we are the controller of the data (account and billing data about your users), we answer as the GDPR page and the Privacy Policy describe.

8. International transfers

We are in Israel. Sub-processors operate in the United States and in other countries where their services run. Where a transfer from the EEA or the United Kingdom needs a transfer tool, the parties incorporate the European Commission's standard contractual clauses, module two (controller to processor), decision 2021/914, and the UK international data transfer addendum where the UK GDPR applies. If a court or an authority strikes down a tool we rely on, we will work with you on another lawful tool or stop the transfer.

9. Deletion and return

When the subscription ends, you can export your data for 30 days. We then delete it within 30 days. Copies in backups roll off within 30 days. We can confirm deletion in writing if you ask. We may keep records the law requires us to keep, such as billing records, and we use those only for that purpose.

10. Audits

We will give you the information you reasonably need to show this DPA is being followed. You may ask written questions. With 30 days' notice, you may have an independent auditor review the processing during business hours, under confidentiality, without disrupting the service.

11. Liability and term

Liability under this DPA follows the limitation in the Terms of Service. This DPA starts when you accept the Terms and lasts while we process personal data for you. The duties that by their nature should survive, including confidentiality, deletion and this section, do survive.

12. Contact

Jobcard by IAIG (Inevitable AI Group) Email: legal@jobcard.tech