Privacy Policy for NextCrew

1. Who this policy covers

NextCrew Corporation ("NextCrew", "we", "us") is an Illinois corporation with its principal place of business at 2700 Patriot Blvd #250, Glenview, IL 60026, United States. We build and operate staffing software used by staffing agencies to recruit, onboard, schedule, credential, pay and invoice their temporary workforce.

This policy applies to:

• www.nextcrew.com and the forms, downloads and demo requests on it;
• the NextCrew platform, including agency portals, client portals and Crew Member portals;
• the NextCrew mobile apps, including apps published under an agency's own brand; and
• sales, onboarding, support and marketing communications with businesses and their staff.

It does not cover the privacy practices of the staffing agencies that use our platform, of the clients those agencies place people with, or of any third-party product you reach through an integration. Those organizations have their own policies.

2. Our two roles

What we may do with personal information depends on which of two roles we are in.

We decide (we are the controller)

For information we collect for our own purposes: website visitors, people who request a demo or download a guide, the administrators and staff at our customers who hold NextCrew accounts, and people who contact support or sales. This policy describes what we do with that information and you can exercise your rights with us directly.

Our customer decides (we are a service provider and processor)

For the information a staffing agency puts into its NextCrew account or collects through it — Crew Member records, client records, credentials, timesheets, pay and billing data — the agency is the controller and we are its service provider. We handle that information under our written agreement with the agency, on its documented instructions, and we do not use it to market to anyone or sell it.

Crew Members and candidates are not NextCrew employees or workers. Their employment or engagement relationship is with the staffing agency that engaged them, or with that agency's client, and every obligation an employer owes them — wages, taxes, eligibility verification, licensing, workplace protections — belongs to that agency or client, not to NextCrew.

If you are a Crew Member, a candidate or a client contact and you want to see, correct or delete your information, contact the agency you work with. If you contact us instead, we will refer you to them, or act on their instructions where our agreement requires it.

Where the agency's clients fit

Staffing agencies place their Crew with their own clients — hotels, hospitals, venues, warehouses — and may give those clients access to a client portal. That does not create a third role for us. The client's contact details are part of the agency's Customer Data, and what a client sees in the portal — assigned Crew Members, check-in status, timesheets awaiting approval, ratings — is shown at the agency's direction. In both directions, we remain the agency's service provider.

Once information leaves the portal — a printed roster, an exported report, a rating a client writes down — what that client does with it is governed by the client's own privacy practices and legal obligations, not by this policy and not by NextCrew. If you are a client contact and want your details corrected or removed, ask the agency that gave you portal access.

3. Information we collect

From website visitors and prospects

• Contact and business details you enter in a form: name, work email, phone number, company, job title, agency size, vertical, and anything you write in a message field.
• Marketing and event details: how you heard about us, the content you downloaded, webinar and trade-show registrations.
• Device and usage data: IP address, browser and device type, operating system, referring page, pages viewed, and the dates and times of those visits.

From customer administrators and staff

• Account details: name, work email, phone, job role, branch or location, permissions and group memberships.
• Authentication data: credentials, single sign-on identifiers, multi-factor codes, session and device records, and trusted-device status.
• Usage and audit records: sign-in history, actions taken in the platform, configuration changes, and support tickets and their attachments.
• Billing contacts and payment administration details for the subscription itself.

Customer Data we process for staffing agencies

Agencies configure what they collect. Depending on which modules an agency turns on, Customer Data can include:

• Identifiers and contact details for Crew Members, candidates and client contacts.
• Employment records: applications, resumes, work history, assignments, availability, shift history, ratings, no-show and disciplinary records, and messages exchanged through the platform.
• Government and tax identifiers, including Social Security or taxpayer numbers, where an agency uses onboarding, payroll or employment-eligibility features. These fields are masked by default and access to them is controlled by the agency's own permission settings.
• Payment details such as bank routing and account numbers, where an agency uses payroll or on-demand pay features.
• Credentials and compliance records: professional licenses and their expiry dates, certifications, competency and skills assessments, training completions, and results returned by background screening or license verification partners.
• Time and attendance records, including clock-in and clock-out times, and — where the agency enables geo-fenced clock-in — the device location captured at the moment of a punch. We do not track location continuously or between shifts.
• Documents the agency or the Crew Member uploads, such as signed forms, certificates and identification documents.

Some of this is treated as sensitive personal information under United States state privacy laws. We process it only to provide the service to the agency, and we do not use it to infer characteristics about anyone.

From our mobile apps

• Device identifiers, app version, operating system and crash diagnostics.
• Push notification tokens, so shift offers and reminders reach the right device.
• Location at clock-in and clock-out, only when the agency has enabled geo-fencing and only with the permission you grant your device. You can withdraw that permission in your device settings; if you do, your agency may require you to clock in another way.

4. Where the information comes from

• From you, when you fill in a form, create a profile, upload a document, or write to support.
• From the staffing agency that holds the account, including data it imports from a previous system.
• From integrations the agency connects, such as background screening, license verification, payroll, accounting, messaging, job distribution and vendor management platforms. The agency chooses which of these to enable.
• Automatically, from your device and browser when you use the website, the platform or the apps.
• From business data providers and public professional sources, for business-to-business marketing to companies we believe fit our customer profile.

5. How we use information

• To provide, configure, support and maintain the platform and the apps.
• To authenticate users, apply the permissions an agency has set, and keep audit records of activity.
• To detect, investigate and prevent fraud, abuse, security incidents and violations of our agreements.
• To run features the agency has turned on, including matching available Crew Members to open shifts, flagging expiring credentials, and surfacing exceptions for a person to review. Our AI features flag, rank, recommend and monitor. A person at the agency makes the decision.
• To invoice customers and collect payment for subscriptions.
• To respond to questions, provide training and publish support material.
• To improve and develop our products, including by analyzing de-identified and aggregated data that does not identify any individual, agency or client.
• To market to businesses, including sending information about products, events and content to business contacts. Every marketing email has an unsubscribe link.
• To comply with law, respond to lawful requests, and establish or defend legal claims.

6. Who we share information with

• Service providers that host our infrastructure, deliver email and text messages, process payments, provide analytics, and run our support and CRM systems. They act on our instructions and may not use the information for their own purposes.
• Integration partners the agency connects, and only the data that integration needs. These currently include payroll and pay providers, accounting platforms, messaging providers, background screening and license verification services, employment-eligibility services, job distribution networks and vendor management systems. The agency's own agreement with each partner governs what that partner does next.
• The staffing agency that holds the account, and the users it authorizes.
• The agency's clients, where the agency grants them portal access — they see the assignment, check-in, timesheet and rating information the agency chooses to show them, and their further use of it is their own responsibility.
• Professional advisors such as lawyers, auditors and insurers, under confidentiality obligations.
• Authorities and other parties, where we believe in good faith that disclosure is required by law, necessary to protect someone's safety, or necessary to establish or defend legal claims.
• A buyer or successor, in connection with a merger, acquisition, financing or sale of assets. Customer Data transfers subject to the customer agreement that covers it.

7. Selling, sharing and targeted advertising

We do not sell personal information for money, and we never sell or share Customer Data.

On our public website we use advertising and analytics cookies that pass identifiers to advertising and analytics partners so we can measure campaigns and reach business audiences. Under several United States state privacy laws, that activity can count as "sharing" for cross-context behavioral advertising or as "targeted advertising", and in some states as a "sale" even when no money changes hands. You can opt out at any time:

• through the cookie controls described in our Cookie Policy;
• by sending an opt-out request to the address in section 16; or
• by enabling a Global Privacy Control signal in your browser, which we treat as an opt-out request for that browser where state law requires it.

None of this applies inside the platform. The platform carries no advertising and we run no advertising trackers in it.

8. Cookies and similar technology

We use cookies and similar technology to keep you signed in, remember preferences, measure how the website performs, and support our marketing. What we set, who sets it, and how to control it is described in our Cookie Policy. Blocking cookies that are strictly necessary will stop parts of the platform from working.

9. How long we keep information

• Customer Data is kept for as long as the agency's account is active, and after that for the period set out in our agreement with the agency. On termination, standard exports are available during the term and for a limited period afterwards, after which the data is deleted or de-identified.
• Records an agency must keep by law — payroll, tax and employment-eligibility records, for example — are retained on the agency's instructions for as long as its own obligations require, even where an individual has asked for deletion. The agency decides this, not us.
• Website and marketing data is kept while you are engaged with us and for a reasonable period afterwards, unless you ask us to delete it sooner.
• Security, audit and billing records are kept for as long as we need them for security, accounting and legal purposes.
• Backups age out on our normal backup cycle after a record is deleted from the live system.

10. How we protect information

We use administrative, technical and physical safeguards appropriate to the data we hold. These include encryption of data in transit and at rest, role-based access control with field-level permissions on sensitive fields such as government identifiers and pay rates, single sign-on and multi-factor authentication for platform administrators, configurable password and session policies, user-activity audit logs with force-logout, least-privilege access for our own staff, and monitoring of our infrastructure.

No system is completely secure, and we cannot guarantee that information will never be accessed without authorization. Agencies control their own users, roles and permissions, and are responsible for how those are configured.

11. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use it;
• get a copy of it, in a portable format;
• correct information that is inaccurate;
• ask us to delete it;
• opt out of targeted advertising, of the sale or sharing of personal information, and of profiling that produces legal or similarly significant effects;
• limit the use of sensitive personal information to what is necessary to provide the service; and
• appeal a decision we make about your request.

We will not discriminate against you for exercising any of these rights.

How to make a request

Write to us at the email or postal address in section 16. Tell us what you are asking for and give us enough detail to find your records. We will verify your identity before we act, using information we already hold — we will not ask for more sensitive information than the request requires. An authorized agent may act for you with written permission, and we may ask you to confirm it directly.

We respond within the time the applicable law allows, normally 45 days, and will tell you if we need an extension. If we decline, we will say why, and you may appeal by replying to our response. If your request concerns information we process for a staffing agency, we will forward it to that agency and tell you we have done so.

12. California disclosures

This section is for California residents and uses the categories set out in the California Consumer Privacy Act as amended. In the twelve months before the date at the top of this page, we collected the following categories, for the purposes in section 5, and disclosed them for business purposes to the recipients in section 6.

We do not sell personal information for money and we do not knowingly sell or share the personal information of anyone under 16. Website advertising and analytics cookies may constitute sharing for cross-context behavioral advertising, and section 7 explains how to opt out. We use sensitive personal information only to provide our services, secure them and comply with law — never to infer characteristics — so no further limitation right applies, though you may still ask us to stop.

California residents may also ask once a year for a list of any personal information disclosed to third parties for their direct marketing purposes under California Civil Code section 1798.83. We do not make disclosures of that kind.

13. If you are outside the United States

NextCrew is based in the United States and our systems are operated there. If you use our services from another country, your information is transferred to and processed in the United States, where data protection law differs from that of your own country.

Where the General Data Protection Regulation or United Kingdom data protection law applies to information we hold as a controller, we rely on one of the following legal bases: performance of a contract with you or your employer; our legitimate interests in operating, securing and marketing a business-to-business service, balanced against your rights; your consent, where we ask for it; and compliance with a legal obligation. You may object to processing based on legitimate interests, withdraw consent at any time, and complain to your local supervisory authority. Where we transfer personal data out of the European Economic Area or the United Kingdom, we use the European Commission's standard contractual clauses or the United Kingdom addendum, together with additional safeguards where they are needed.

Where we process personal data on behalf of a customer established outside the United States, the customer is the controller and our data processing terms with that customer apply.

14. Children

Our website and our platform are built for businesses and are not directed to children. We do not knowingly collect personal information directly from anyone under 16 through our website. Where an agency employs workers below the age of majority and records them in its account, the agency is responsible for obtaining any consent its own law requires and for complying with the child labor rules that apply to it. If you believe a child's information has reached us in a way that is not covered by an agency's own obligations, contact us and we will work with the agency to resolve it.

15. Changes to this policy

We update this policy when our practices, our products or the law change. The effective date at the top shows when the current version took effect. If a change materially affects how we use information about you, we will give notice through the website or by email before it takes effect. Continuing to use our website, platform or apps after that date means the updated policy applies.

16. How to contact us

See also our Terms of Use and our Cookie Policy.