Data Rights

1. Overview

This addendum supplements the CW Timer Privacy Policy and describes your rights under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). CW Timer, LLC is committed to transparency and to honoring the data rights of every individual whose personal data we process.

2. Personal Data We Collect

When you use CW Timer, we may collect and process the following categories of personal data:

• Identity data — name, email address, company name
• ConnectWise member information — member identifiers, roles, and associated metadata synced from your ConnectWise Manage instance
• Usage data — IP address, browser type, device information, pages visited, feature usage patterns
• Time entry data — timer sessions, time entries, ticket references, charge codes, and related metadata
• GPS / location data — collected only when you explicitly grant permission for the ticket map feature; entirely optional
• Billing data — payment information processed by Stripe; we do not store full card numbers

3. Lawful Basis for Processing (GDPR)

Under the GDPR, we process personal data on the following lawful bases:

• Contract performance — processing is necessary to provide the CW Timer service as agreed in our Terms of Service
• Legitimate interest — processing for service security, fraud prevention, usage analytics, and service improvement, where our interests do not override your rights
• Consent — for optional data collection such as GPS location data; you may withdraw consent at any time
• Legal obligation — where processing is required to comply with applicable law

4. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete personal data
• Right to erasure — request deletion of your personal data, subject to legal retention requirements
• Right to restriction — request that we restrict the processing of your personal data in certain circumstances
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format
• Right to object — object to processing based on legitimate interest or direct marketing
• Right to withdraw consent — withdraw consent for optional processing at any time without affecting the lawfulness of prior processing

5. Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to delete — request deletion of your personal information, subject to certain exceptions
• Right to correct — request correction of inaccurate personal information
• Right to opt out of sale — we do not sell your personal information to third parties. We have never sold personal data and have no plans to do so.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights

6. How to Exercise Your Rights

To exercise any of the rights described above, submit a request by email to privacy@cwtimer.com. Please include:

• Your full name and the email address associated with your CW Timer account
• A clear description of the right you wish to exercise
• Any information that helps us locate your data (e.g., company name or ConnectWise instance)

We will verify your identity before processing any request. We will respond within 30 days for GDPR requests and within 45 days for CCPA requests, as required by law. If we need additional time, we will notify you of the extension and the reason.

If you are a technician or employee whose MSP uses CW Timer, your MSP is the data controller. We may direct your request to your MSP for fulfillment, as described in our Data Processing Agreement.

7. Data Retention

We retain your personal data for as long as your account is active and as needed to provide the CW Timer service. Upon account closure or deletion request:

• Personal data is deleted within 30 days of account closure
• Billing records may be retained as required by tax and accounting obligations
• Time entries previously synchronized to your ConnectWise Manage instance remain in ConnectWise and are governed by your own retention policies

8. International Data Transfers

CW Timer is operated from the United States. Your data is processed and stored in the US using Vercel (application hosting) and Neon (database hosting) infrastructure.

If you are located outside the United States, your personal data is transferred to the US for processing. We rely on appropriate transfer mechanisms, including standard contractual clauses and the EU-U.S. Data Privacy Framework, to ensure that your data receives adequate protection in accordance with applicable data protection laws.

9. Do Not Sell My Personal Information

CW Timer, LLC does not sell, rent, or trade your personal information to third parties. We share data only with the sub-processors listed in our Privacy Policy and Data Processing Agreement, and only as necessary to provide the CW Timer service.

10. Supervisory Authority

If you are located in the EEA or UK and believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with your local supervisory authority. We encourage you to contact us first at privacy@cwtimer.com so we can try to resolve your concern directly.

11. Changes to This Addendum

We may update this addendum from time to time. We will notify you of any material changes by posting the updated version on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated addendum.

12. Contact Us

For questions about your data rights or to submit a request, contact us:

• Email: privacy@cwtimer.com
• Contact page: cwtimer.com/contact