CONSTRUCTION TOOL TRACKING
Data Processing Addendum
Customer-data processing framework for TakeMoveReturn.
CUSTOMER DATA
Data Processing Addendum
A framework for customer-controlled personal information in the business service, to the extent applicable.
1. Scope and roles
This page concerns personal information a business customer submits about workers, members and tool handoffs. To the extent applicable law assigns controller/processor or comparable roles, the customer decides the purposes and content of customer-controlled data, and TakeMoveReturn processes it to provide the service on the customer's instructions. TakeMoveReturn may have a separate role for account administration, security, support and legal obligations. No single role is claimed in every jurisdiction.
2. Processing description
Processing supports company-scoped tool records during the service relationship and any lawful return, deletion or limited-retention period. Data subjects may include account users, workers and people named in records. Categories include work identity and contact, membership, tool custody, customer-configured locations, damage and service notes, optional tool/damage photos and maintenance photos/PDFs, transaction notes, mapped spreadsheet import fields, import job results, privacy requests and support requests. Customer attachments use a dedicated private Cloudflare R2 bucket with metadata in Supabase. Paid checkout is active through Waffo as Merchant of Record; payment-card processing is handled by Waffo rather than by TakeMoveReturn.
3. Instructions and confidentiality
The customer's product use, settings and authorized requests are instructions for ordinary processing, unless law requires otherwise. The customer is responsible for the legality and accuracy of submitted data. Access should be limited to those with a service need and applicable confidentiality obligations. Customer data is not used for unrelated advertising.
4. Security and providers
Implemented controls include authentication, role checks, tenant-scoped row-level policies, restricted database mutations and derived worker PIN storage. Security is not absolute. Cloudflare, Supabase, Resend and Waffo are active providers listed at /subprocessors, with Waffo acting as Merchant of Record rather than as a general application-data processor. Planned providers are not treated as active. Provider changes are posted on that page; an advance-email objection process is not currently offered.
5. Requests, incidents and deletion
Contact contact@takemovereturn.com for customer instructions, rights requests or suspected incidents. We verify requests, investigate and cooperate as required by law and any executed agreement; no unimplemented response clock is promised. Signed-in users have limited export and a request queue. Wider export, return or deletion is reviewed with the customer, considering others' rights, security records, backups and lawful retention. Cancellation is not automatic deletion.
6. International processing and precedence
Processing may involve the United States and Cloudflare's global network as described in the Privacy Policy and /subprocessors. The parties remain responsible for any legally required cross-border terms in their circumstances. This page does not itself certify a transfer mechanism or regulatory compliance. A separately executed customer agreement governs to the extent it conflicts with this page.