Why this exists. Your workers' location, hours and photos are personal data. You decide what is collected and why, so you are the controller. We only hold and process it to run the service for you, so we are the processor. UK and EU data protection law requires that relationship to be written down. This is that document.
1. Parties and roles
Between the customer identified in the workspace account (“Controller”) and Fieldproxy Pvt Ltd, Chennai, India (TODO: full registered address and CIN) (“Processor”).
The Processor processes personal data only on the Controller's documented instructions. Using the product is the instruction: the settings a Controller chooses — collection hours, retention, who may see whom — are instructions the Processor's systems enforce.
2. The Processor's obligations
- Process personal data only on documented instructions, including on transfers, unless required otherwise by law — in which case we tell you first, unless the law forbids that.
- Ensure everybody authorised to process it is bound by confidentiality.
- Apply the measures in Annex B.
- Engage sub-processors only as set out in §3.
- Help you respond to data subject requests. The product does most of this itself: any worker can see and export everything held about them, and an administrator can erase one person's record on request.
- Help you with security, breach notification and impact assessments, taking account of what we know that you cannot.
- On the end of the service, delete the personal data — which is what the product already does — unless the law requires us to keep it.
- Make available the information needed to demonstrate compliance, and allow audits as set out in §6.
3. Sub-processors
You give general authorisation for the sub-processors listed in Annex C. We will tell you before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may terminate the affected service without penalty.
4. International transfers
Personal data is stored in the region your workspace is provisioned in. Where a sub-processor requires a transfer outside that region, it is made under UK/EU standard contractual clauses or an equivalent lawful mechanism.
5. Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with what we know, what we are doing, and what we recommend. We will not notify your supervisory authority or your workers on your behalf: that is the Controller's decision to make.
6. Audit
We will answer reasonable written questions about this agreement, and once per year (or after a breach) allow an audit on reasonable notice, during business hours, without access to other customers' data.
7. Deletion and return
You can export the whole workspace at any time without asking us. On termination, data is deleted on the schedule in the terms of service; we keep a content-free record that deletion happened, and the invoicing records the law requires.
Annex A — the processing
| Subject matter | Provision of the VisitsTracker field-work record |
|---|---|
| Duration | The term of the subscription, plus the deletion window in the terms |
| Nature and purpose | Recording attendance, dispatched visits, location trails and derived evidence; producing reports and documents for the Controller |
| Data subjects | The Controller's workers and administrators; named contacts at the Controller's own customers where the Controller records them |
| Categories | Name; work email and/or phone; role and team; device location during declared working hours, with accuracy, speed and a trust verdict; attendance times and the positions they were made from; optional punch selfies; visit photos and signatures; free-text answers the Controller chooses to collect; expense claims and receipts; leave records; audit records of who did what in the product |
| Special categories | None required or requested. The Controller must not use free-text or photo fields to record special category data. |
Annex B — technical and organisational measures
These are statements about how the system is actually built, each of which is verifiable in the product:
- Tenant isolation. Every table carrying customer data has row-level security forced on it, keyed to the workspace of the verified session, in addition to explicit filters in every query. A forgotten filter returns nothing rather than somebody else's rows.
- Encryption. In transit throughout; at rest by the managed database and object storage.
- Access control. Five fixed roles; visibility follows the team hierarchy; anything beyond it requires an explicit, expiring grant. Two-factor authentication is available and can be required for privileged roles.
- Collection limits. Location outside the declared working window is refused by the server at ingest, not filtered on the device.
- Transparency to data subjects. Every worker can see what is held about them, who can see it — by name, with expiry — and export their own record from the app.
- Integrity. Each day's location record is sealed with a hash chain; verification recomputes rather than trusting. Corrections to attendance are appended with author and reason, never overwritten.
- Audit. Administrative actions are recorded with actor, subject and time, append-only.
- Retention. Per-workspace windows for raw location, audit records and media; a daily sweep enforces them and records what it deleted.
- Erasure. One person's record can be erased on request: the movement record is deleted, statutory payroll records are retained with the identity removed, and a receipt is written.
- Deletion of a workspace. Automated, verified by counting rows, with a content-free tombstone as proof.
Annex C — sub-processors
| Sub-processor | Purpose | Data |
|---|---|---|
| Managed cloud hosting TODO: name + region | Running the service and its database | All of Annex A |
| Microsoft (Azure Maps) | Map tiles and geocoding | Coordinates and addresses, no identity |
| Google (Firebase Cloud Messaging) | Push notifications to the app | Device token, notification text |
| Resend or Postmark | Transactional email | Name, email address, message content |
| Stripe | Subscription billing | Billing contact and payment details — we never see card numbers |