Privacy Policy

KWT Holdings LLC, operating DSP System (dspsystem.com) ("we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use DSP System, a workforce scheduling and compliance management platform for IDD group home agencies.

We collect information you provide directly to us, including:

• Name, email address, and account credentials
• Phone number (used for SMS notifications and two-factor authentication)
• GPS location data (collected at the time of clock-in to verify location for compliance purposes)
• Shift data, including scheduled shifts, worked hours, and time-clock records
• Compliance and certification records
• Payment and billing information (processed securely through Stripe)
• Photos and images you upload (e.g. a profile photo)
• Device push notification token (used to deliver push notifications to your mobile device)
• Crash reports and diagnostic data (used to detect and fix technical issues)

We use the information we collect to:

• Provide, maintain, and improve our workforce scheduling and compliance services
• Process transactions and send related information
• Send transactional SMS notifications related to shift offers, shift reminders, clock-in alerts, and two-factor authentication codes
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical or security issues

By providing your phone number and creating an account on DSP System, you consent to receive transactional SMS notifications related to your employment, including shift offers, shift reminders, clock-in alerts, and two-factor authentication codes. Message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for help.

Information we collect for SMS:

• Mobile phone number, which you provide when you create your DSP System account or update your profile.
• SMS consent records, including the date, time, IP address, and method by which you opted in.
• SMS message logs, including the content of messages we send to you, your replies (such as YES/NO/STOP responses), and delivery status reports from our telecommunications provider.
• Opt-out records, including the date, time, and method of any opt-out request.

How we use SMS data:

• To send shift-offer notifications when your organization has open coverage needs that match your availability.
• To send clock-in and clock-out reminders before and after your scheduled shifts.
• To notify you of missed clock-ins, schedule changes, and callout coverage requests.
• To send two-factor authentication codes for account security.
• To maintain an audit trail of SMS communications as required by our customers' compliance obligations and applicable law.

Message frequency: Frequency varies based on your shift activity. Most active staff receive between 0 and 20 messages per month. Frequency may be higher during periods of unusually high callout activity or staffing shortages at your organization.

Carrier rates: Standard message and data rates may apply depending on your mobile carrier plan. DSP System does not charge for SMS messages; any fees are determined by your carrier.

Opt-out and HELP: You can opt out of SMS notifications at any time by replying STOP to any DSP System SMS message, or by disabling SMS notifications in your account settings. After opting out you will receive one confirmation message. You may re-subscribe by replying START. Reply HELP to any DSP System SMS for help and support information. Opting out of SMS does not affect your ability to use DSP System; in-app and email notifications remain available.

Third-party SMS provider: DSP System uses Twilio Inc. as its telecommunications provider to deliver SMS messages. Twilio processes your phone number and message content solely to deliver messages on our behalf, subject to Twilio's own privacy practices. We do not sell or share your phone number with third parties for their own marketing purposes.

SMS data retention: SMS consent records, message logs, and opt-out records are retained for the duration of your DSP System account plus seven (7) years to support compliance audits, dispute resolution, and applicable regulatory requirements.

We share data only with trusted third-party services necessary to operate DSP System:

• Stripe — for payment processing. Stripe's privacy policy governs their use of your payment data.
• Cloud hosting providers — for infrastructure and data storage
• SMS delivery providers (Twilio) — to send transactional text messages on our behalf. We do not sell or share your phone number for marketing purposes.
• Google Firebase (Firebase Cloud Messaging) — to deliver push notifications to your mobile device.
• Sentry — for crash reporting and diagnostic monitoring, to help us detect and fix technical issues.

We retain your personal data for as long as your account is active or as needed to provide you services. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes.

Depending on your location, you may have the following rights:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate personal data
• Deletion — Request deletion of your personal data
• Portability — Request a machine-readable copy of your data
• Opt-out — Opt out of the sale or sharing of your personal data (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request deletion of your data, and opt out of the sale of your personal information. We do not sell personal information. To exercise these rights, contact us at [email protected].

If you are in the European Economic Area, you have additional rights under the GDPR including the right to lodge a complaint with a supervisory authority. Our legal basis for processing your data is contract performance (to provide our services) and legitimate interests (to improve our services).

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security assessments. GPS location data is used only at the time of clock-in and is not continuously tracked.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: KWT Holdings LLC, Vancouver, WA | Email: [email protected]