Customer Data Processing Agreement

This Customer Data Processing Agreement (“DPA”) forms part of the contract between the organisation using Cross (“Customer”) and the Cross entity identified in the applicable account, order, or invoice (“Cross”). It applies where Cross processes personal data on the Customer’s behalf in connection with the service. Capitalised terms not defined here have the meaning given in the Terms of Service or applicable data-protection law.

The Customer is the controller and Cross is the processor for Customer-controlled workforce, company-contact, compliance, attendance, and document data entered into the workspace. If the Customer processes personal data for another controller, Cross acts as the Customer’s subprocessor.

Cross remains an independent controller for account administration, security, billing, service communications, legal claims, and compliance with obligations that apply directly to Cross. Those activities are explained in the Privacy Notice.

• Subject matter: providing the Cross sponsor-compliance platform, including storage, retrieval, organisation, display, export, support, security, and authorised advisor workflows.
• Duration: for the subscription and afterwards only for return, deletion, backup expiry, legal retention, payment disputes, and other obligations described in this DPA.
• People: Customer users, employees and workers, candidates recorded as employees, company officers and key contacts, emergency contacts, advisors, and people mentioned in compliance records or attachments.
• Data: identity, contact, employment, salary, attendance, absence, location, immigration, Right to Work, sponsor-licence, document, communication, audit, and related metadata.
• Sensitive data: health information may be inferred from sickness or absence records, and uploaded material may contain other special category data. The service is not intended for unnecessary medical or criminal-offence records.

Cross will process Customer personal data only on documented instructions, unless UK law requires otherwise. The contract, use of configured features, authorised user actions, and written support requests are documented instructions. Cross will inform the Customer if it believes an instruction infringes applicable data-protection law, unless prohibited from doing so.

Cross will not sell Customer personal data or use it for third-party advertising. It may create aggregated or irreversibly anonymised information that no longer identifies an individual or Customer.

The Customer must ensure that its instructions and use of Cross comply with law. It must provide required privacy information, identify a lawful basis and any special-category condition, collect only necessary data, keep records accurate, control user access, and respond to individuals exercising their rights. The Customer must not instruct Cross to process information that is unlawful or unnecessary for the service.

Cross limits access to people who need it for their role and who are subject to confidentiality obligations. Cross maintains measures appropriate to the risk, including tenant- and role-based access, secure authentication, encryption in transit, encrypted private file storage, short-lived document links, access and change auditing, backups, and tested application controls.

Security is a shared responsibility. The Customer must protect credentials and devices, review memberships and advisor assignments, and safeguard documents or exports after they leave Cross.

The Customer gives Cross general written authority to appoint subprocessors needed to run the service. Cross remains responsible for their processing to the extent required by law and will require data-protection obligations appropriate to the services they provide.

• Vercel Inc. (United States): delivery of the public web application and associated visitor-request and security data through a distributed network. The current frontend does not use a Next.js application backend to store authenticated workspace records.
• Railway Corporation (United States): operation of the Cross API. The selected European runtime region is Amsterdam, Netherlands; Railway identifies its primary processing operations as taking place in the United States.
• Cloudflare, Inc. (United States): private encrypted storage of employee documents and case attachments under an immutable European Union jurisdiction restriction.
• Neon, LLC, a Databricks affiliate (United States): managed PostgreSQL database service, with the production project selected for London, United Kingdom.
• Twilio Inc. (United States):SendGrid transactional and compliance email using its EU data-residency service. Provider support or engineering access may occur outside the EU under Twilio's contractual safeguards.
• Stripe Payments Europe, Limited (Ireland), together with applicable Stripe affiliates: Checkout, subscriptions, payment administration, invoices, tax, refunds, fraud prevention, and payment disputes. Stripe may act as processor or independent controller depending on the activity.

Cross may replace or add a subprocessor where reasonably necessary. It will provide notice of a material new subprocessor through the service, email, or an updated published list before the change where required, so the Customer can raise a reasonable data-protection objection.

Cross does not currently appoint an artificial-intelligence or large-language-model provider to process Customer Personal Data. Compliance reminders, statuses, and suggested next steps use predetermined dates, record states, and product rules. Cross will complete the required data-protection assessment and update its subprocessor information before enabling any AI service to process Customer Personal Data.

The production database is selected for London and private file storage is restricted to the European Union. The service is not wholly UK-hosted: Railway identifies United States primary processing operations, Vercel uses a distributed network, and provider support teams may access data from other countries. Cross will ensure that a restricted transfer uses a lawful mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another mechanism recognised by UK law, and will apply supplementary measures where proportionate.

Taking account of the nature of the processing and information available to it, Cross will reasonably assist the Customer with access, correction, deletion, restriction, objection, and portability requests; security obligations; breach notifications; data-protection impact assessments; and regulator consultations. The Customer remains responsible for deciding how to respond to a request unless law requires Cross to act directly.

Cross will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. The notice will include available information reasonably needed for the Customer’s assessment and notification duties. Cross may provide details in stages and will take reasonable steps to contain, investigate, and mitigate the incident.

At the end of the service, Cross will make available the export capabilities included in the Customer’s plan and, on documented request, delete or return Customer Personal Data as required by law. Cross will verify the requester, authority, scope, and any applicable retention exception before acting. Cross will respond without undue delay and within the period required by data-protection law.

Approved deletion is a coordinated manual process across the live database, private file storage, email records, and relevant service providers; Cross does not currently offer self-service whole-workspace erasure. Data removed from ordinary live use may remain beyond use in protected recovery copies for the provider-specific periods stated in the Data Retention and Deletion Policy. Such copies are not restored for ordinary use. If a recovery copy is restored, the deletion instruction will be reapplied. Cross may retain data required for sponsor compliance, taxation, security, legal claims, or another binding legal requirement and will restrict it to that purpose.

Cross will provide information reasonably necessary to demonstrate compliance with its processor obligations. The parties will first use current security documentation, certifications, and written responses. If those are insufficient, the Customer may request a proportionate audit on reasonable notice, subject to confidentiality, security, and operational safeguards and no unreasonable disruption to other customers.

If this DPA conflicts with the Terms on the protection of Customer personal data, this DPA takes priority. Mandatory transfer terms take priority where required. We may update this DPA to reflect changes in law or processing and will identify the current version and effective date above.