Data Processing Agreement

Effective October 22, 2026

This Data Processing Agreement (“DPA”) is part of the Terms of Service between Strickland & Co. Software LLC (“Strickland & Co.,” “we,” “us”) and the company that subscribes to JobFigure (“you”). It applies automatically whenever we process personal data on your behalf through the Service; you don’t need to sign anything. If you’d like a countersigned copy for your records, email us and we’ll send one.

1. Roles

For the personal data your company puts into JobFigure (for example your customers’ contact details, your crew’s names, hours and clock-in locations, and documents you upload), you are the controller and we are your processor. We process it only to provide the Service. For account and billing information about the people who sign up and pay, we act as a controller as described in our Privacy Policy.

2. What we process and why

• People: your company’s users and crew members, and your own customers, suppliers and contacts.
• Data: names, contact details, job and site addresses, hours worked, pay rates, clock-in and clock-out locations, notes, photos, receipts, invoices, quotes and other records you enter or upload.
• Purpose: storing, syncing, displaying and reporting on that data for your company, reading documents you ask the Service to read, and sending the emails you turn on.
• Duration: for as long as your account is active, then as described in section 9.

We don’t sell your data, use it for advertising, or use it to train AI models.

3. Your instructions

We process your data only on your documented instructions, which are the Terms, this DPA, and the way you use and configure the Service. If we believe an instruction breaks data protection law, we’ll tell you. If the law requires us to process data in another way, we’ll tell you first unless the law prevents it.

4. Confidentiality

Anyone at Strickland & Co. who can access your data is bound by a duty of confidentiality and accesses it only when needed to run, support or secure the Service.

5. Security

We use appropriate technical and organisational measures to protect your data, including:

• encryption in transit (HTTPS/TLS) and encryption at rest by our database provider;
• database row-level security, so each company can reach only its own records;
• role-based access inside each company, set by the owner;
• two-step sign-in available for user accounts;
• automatic daily backups;
• card details handled entirely by Stripe and never stored by us; and
• limiting our own access to what’s needed for support and security.

More detail is on our Security page.

6. Sub-processors

You authorise us to use the sub-processors listed below. We have written agreements with each one that protect your data at least as well as this DPA. We’ll announce any new sub-processor on this page and email account owners at least 30 days before it starts processing your data. If you object on reasonable data protection grounds, tell us within that time; if we can’t address your concern, you may cancel and we’ll refund any prepaid fees for the unused period.

7. Helping you

• Requests from people: you can view, correct, export and delete data in the app. If someone contacts us directly about data you control, we’ll pass the request to you, and we’ll help you answer requests you can’t handle in the app.
• Assessments: we’ll give you reasonable information you need for data protection impact assessments or questions from a regulator.

8. Data breaches

If we become aware of a breach of security that affects your data, we’ll notify the account owner without undue delay, and in any case within 72 hours. We’ll tell you what happened, what data was involved and what we’re doing about it, and update you as we learn more.

9. When your account ends

You can export your data from the app at any time. When your subscription ends we keep your data so you can return, unless you ask us to delete it. We delete it within 30 days of your request, and it leaves our backups as they expire (about a week). We may keep records we’re required to keep by law, such as billing records.

10. Audits

We’ll answer reasonable written questions about how we protect your data and give you the information needed to show we comply with this DPA. If that isn’t enough to meet a legal requirement, you may arrange an audit with reasonable notice, during business hours, at your cost, no more than once a year, under a confidentiality agreement.

11. International transfers

Your company’s data is stored in Canada. Some sub-processors are in the United States.

• UK: Canada is recognised by the UK as adequate. Transfers to the United States rely on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Ireland and the EU: Canada has an EU adequacy decision for commercial organisations. Transfers to the United States rely on the EU–US Data Privacy Framework where the recipient is certified, or on the EU Standard Contractual Clauses (module two or three as applicable), which are incorporated into this DPA by reference.
• Canada, Australia and New Zealand: we remain accountable for your data when sub-processors handle it, and require them to protect it to a comparable standard, as PIPEDA, Australian Privacy Principle 8 and New Zealand Information Privacy Principle 12 require.

12. Order of precedence

If this DPA conflicts with the Terms of Service on the handling of personal data, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win.

Sub-processors

Last changed October 22, 2026.

Microsoft Advertising’s measurement tag runs only on the public website (jobfigure.net), never inside the app, and receives none of your business data, so it isn’t a sub-processor. See the Privacy Policy.

Contact

Questions about this DPA, or a request for a countersigned copy: support@stricklandandco.net
(770) 990-0859
Strickland & Co. Software LLC, Georgia, USA