Data Processing Agreement
A standing agreement we will sign on request.
This Data Processing Agreement (“DPA”) describes how Kwixas LLC (“Kwixas LLC,” “we,” “us”) processes the information a business that uses Bevr (the “Service”) keeps about its own customers. When we process that information, the business is the controller of it and we are its processor, acting for the business and under its instructions. This DPA adds to our Terms of Service and our Privacy Policy; where it and the Terms differ about how we process that information, this DPA governs.
What this DPA covers
This DPA covers the information you keep in Bevr about your own customers, such as their names, contact details, jobs, quotes, invoices, and the messages we send them for you. It does not cover your account information or the records of your use of the Service, which our Privacy Policy describes and for which we decide the purpose.
Our role and your instructions
We process your customers’ information only to provide the Service to you, to keep the Service secure, and to meet legal obligations, and only on your instructions. Your use of the Service, and this DPA, are your instructions. If the law requires us to process the information another way, we will tell you first unless the law forbids it. We do not sell your customers’ information, and we do not use it for our own purposes.
Confidentiality
We keep your customers’ information confidential. The people who work for us may access it only as they need to provide the Service, and they are bound to keep it confidential.
Security measures
We use reasonable administrative, technical, and physical safeguards to protect your customers’ information, including:
- Encryption. Information is encrypted in transit between you and the Service and at rest in our database and file storage.
- Access controls. Access to the Service requires a sign-in, our file storage is not open to the public, and the people who work for us reach your information only as they need to provide the Service.
- Backups. We back up the database so that recently deleted or changed data can be recovered for up to 35 days.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Subprocessors
We use the service providers our Privacy Policy names to help us provide the Service, and they may process your customers’ information for that purpose and under agreements that require them to protect it. They are:
- Amazon Web Services — hosting, the database, file storage, sign-in, email delivery, text messaging, AI models, voice transcription, and maps (finding addresses and drive times for businesses that use Crews, with map data from HERE Technologies).
- Stripe — subscription billing, and, for businesses that connect their own Stripe account, card and bank payments from their customers.
- Cloudflare — checking that a sign-up comes from a person.
- Plausible Analytics — counting visits to our website, but not to the app.
- Zoho — hosting the email inbox that receives what you send us.
- Google Ads — measuring our advertising, on our website only.
Our Privacy Policy describes what each provider does and where we store the information you keep in Bevr. If we add or change a provider that processes your customers’ information, we will update that list.
Security incidents
If we become aware of a security incident that affects your customers’ information, we will tell you without undue delay and give you the information you reasonably need to meet your own obligations.
Helping with your customers’ requests
If one of your customers asks you to access, correct, or delete their information, you handle the request, because the information is yours to control. We will give you reasonable help to do so, using the tools the Service provides and, where those do not reach, by acting on your written instructions. If a customer of yours contacts us directly, we will pass the request to you.
Deletion or return at the end
You can export your customers, jobs, and invoices to CSV at any time. When our agreement ends, or when you ask, we will delete your customers’ information, after giving you a chance to export it, as our Privacy Policy describes. Backups keep deleted data for up to 35 days before they age out, and some security, audit, and legal records remain as our Privacy Policy explains.
Where we process information
We store the information you keep in Bevr with Amazon Web Services in the United States, as our Privacy Policy states. The Service is offered to businesses in the United States.
Asking us to sign this DPA
If you want these terms in a signed agreement, write to us through our contact form and we will sign this DPA with you. These terms apply to your use of the Service whether or not they are separately signed.
Contact us
Questions about this DPA? Contact us.