Field Suite Data Processing Agreement

Version 1 · 5 November 2026

This Data Processing Agreement ("DPA") forms part of the Agreement between the Customer (controller) and WE-DEV LTD, trading as Field Suite, company number 15878974, registered office Unit 6, Block 3, Woolwich Church Street, London SE18 5PQ (processor). It follows Article 28 of the UK GDPR.

1. Definitions

"UK GDPR", "Data Protection Act 2018", "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have their meanings in UK data protection law. "Sub-processor" means a processor we engage to process Customer Personal Data. "Customer Personal Data" means personal data in Customer Data that we process for the Customer.

2. Roles

2.1 The Customer is the controller of Customer Personal Data. We are its processor.

2.2 We are a controller of our own account, billing, support and website data. Our Privacy Notice covers that data, not this DPA.

2.3 Annex 1 sets out the details of processing.

3. Instructions

3.1 We process Customer Personal Data only on the Customer's documented instructions, including instructions given through the Agreement and through the Customer's settings and use of the Service (for example sending a message, connecting a Connected Service, or turning on location sharing), including on transfers outside the UK.

3.2 The only exception is where UK law requires otherwise. In that case we will tell the Customer first, unless the law forbids it.

3.3 We will tell the Customer at once if we believe an instruction breaks data protection law.

4. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by confidentiality, and access is limited to those who need it to provide, secure or support the Service.

5. Security

We take the measures required by Article 32 UK GDPR, including those in Annex 2. We may update them as long as overall protection is not reduced.

6. Sub-processors

6.1 The Customer gives general written authorisation for us to use the sub-processors listed in Annex 3.

6.2 We will tell the Customer of any intended addition or replacement of a sub-processor at least 30 days before it starts processing Customer Personal Data, by email to the account owner and by updating the published list.

6.3 The Customer may object on reasonable data protection grounds by emailing info@fieldsuiteapp.com within that period. We will discuss the concern in good faith and, where possible, offer a reasonable alternative. If we cannot resolve it, the Customer may end the Agreement before the change takes effect, with a pro-rata refund of prepaid Fees.

6.4 If a sub-processor must be replaced urgently for security or continuity, we may do so at once, tell the Customer as soon as possible, and the right to object in 6.3 still applies.

6.5 Each sub-processor is bound by a written contract with data protection obligations equivalent to this DPA. We remain fully liable to the Customer for each sub-processor's performance.

7. Connected Services are not our sub-processors

7.1 The Customer may connect services it contracts with directly: Stripe, GoCardless, Twilio, Xero, QuickBooks, Sage, calendar apps, and automation tools through our API and webhooks.

7.2 These providers act for the Customer under the Customer's own contract with them. When the Customer connects one, it instructs us to send the relevant Customer Personal Data to that provider and receive data back. Our role is limited to that transfer.

7.3 The Customer is responsible for its own contract and data protection terms with each provider, including any transfers outside the UK by that provider.

8. Data subject rights

We help the Customer, by appropriate technical and organisational measures and as far as possible, to respond to requests from data subjects. The Service lets the Customer find, export, correct and delete records. If we receive a request directly, we pass it to the Customer without undue delay and do not respond ourselves unless the Customer instructs us to.

9. Help with compliance

Taking into account the nature of processing and the information available to us, we help the Customer meet its obligations under Articles 32 to 36 UK GDPR.

10. Personal data breaches

10.1 We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

10.2 The notice includes what we know about the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences, and the measures taken or proposed, with details added as they become available.

11. Deletion and return

At the end of the Agreement the Customer may export Customer Personal Data during the 30-day exit window in clause 14 of the Terms. After that we delete it as set out there, unless UK law requires us to keep it.

12. Information and audits

12.1 We make available all information reasonably needed to show compliance with Article 28, including this DPA, Annex 2 and written answers to reasonable security questionnaires.

12.2 We allow and contribute to audits, including inspections, by the Customer or an auditor it appoints who is bound by confidentiality: once a year (unless after a breach or at a regulator's request), with at least 30 days' notice, in working hours and without disrupting the Service or other customers' data. The Customer pays its own costs, and our reasonable costs beyond one working day.

13. International transfers

We host Customer Personal Data in the UK. We will not transfer it outside the UK, or allow a sub-processor to, without a transfer mechanism that meets Chapter V UK GDPR.

14. Customer obligations

The Customer confirms that it has a lawful basis for the processing it instructs and, for special category data, a condition under Article 9 UK GDPR and the DPA 2018; that it has given data subjects the necessary privacy information, including engineers about location sharing; and that it will carry out any data protection impact assessment that is needed (for example for location sharing).

15. Liability and precedence

This DPA is subject to the liability terms in clause 12 of the Terms. If this DPA conflicts with the Terms on personal data, this DPA wins.

Annex 1: Details of processing

• Subject matter and purpose: providing Field Suite, a job management service for field service businesses: scheduling, job records, engineer app, certificates and forms, quotes and invoices, customer messages and portal, people management, live map and route planning, reporting, support.
• Duration: the term of the Agreement plus the exit window and the deletion periods in clause 14 of the Terms.
• Nature: hosting, storage, retrieval, display, transmission (email, SMS through the Customer's Twilio account, Connected Services), PDF generation, backup and deletion.
• Data subjects: the Customer's staff and Users; subcontractors; the Customer's customers and their contacts, tenants or occupiers at sites; people who send enquiries through the Customer's web form.
• Categories of personal data: names and contact details, site and property addresses; job details, notes, photos, signatures; certificate and inspection contents; quotes, invoices and payment status (no full card or bank details, which stay with Stripe or GoCardless); message logs and review feedback; user account data, login and audit logs; engineer location during the working hours set by the Customer, kept 30 days; holidays and absences, expenses and receipts, qualification cards and expiry dates, hourly cost, mileage; subcontractor UTR, CIS status and documents.
• Special category data: absence records marked as sickness are health data, and notes may include it. The Customer needs a condition under Article 9(2)(b) UK GDPR and DPA 2018 Schedule 1, paragraph 1, including an appropriate policy document.
• Retention: live location points are deleted automatically after 30 days; other data is kept until the Customer deletes it or the Agreement ends; backups are kept for 14 days.

Annex 2: Security measures

• Hosting: a dedicated virtual server used only for Field Suite, at Fasthosts in a UK data centre.
• Encryption: all connections over HTTPS. Stored keys for Connected Services (Stripe, GoCardless, Twilio and accounting programs) are encrypted in the database. API keys are stored only as hashes. Sessions are stored encrypted.
• Access control: each customer's data is separated in the application and every record is checked against the user's business; roles (owner, admin, office, engineer); two-step verification available, and required for our staff console; server access by SSH key only.
• Network: firewall allowing only web and administration traffic; automated blocking of repeated failed logins.
• Updates: automatic operating-system security updates.
• Files: photos and documents stored outside the public web folder and served only to users allowed to see the job.
• Backups: nightly backup of the database and uploaded files, kept 14 days.
• Testing: automated tests run before each release; changes go to a separate staging environment first, with test payment keys and email held back.

Annex 3: Sub-processors

Not sub-processors, listed for transparency: OpenFreeMap supplies map images directly to the user's browser when the live map is opened (it receives that browser's IP address and the map area; no Customer Data is sent from our servers). Google Maps opens only when a user taps "Directions", from the user's own device. Stripe bills you for Field Suite as part of our own billing (see our Privacy Notice). Connected Services under clause 7 are the Customer's own processors.