FieldFlow Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the FieldFlow Licence Terms between the customer business ("Controller") and FIXFLEX LTD, company no. 08944523, registered office 170 Connell Crescent, London, W5 3BP, United Kingdom ("Processor"). It sets out the terms required by Article 28(3) of the UK GDPR.
1. Details of the processing
| Subject matter | Relaying the Controller's FieldFlow data between the Controller's devices, and operating the licence and device registry. |
|---|---|
| Duration | The term of the licence, plus the deletion period in section 9. |
| Nature and purpose | Receiving, storing and forwarding sync packets that are end-to-end encrypted on the Controller's devices (AES-256-GCM). The key is generated on the Controller's device and passed between devices by QR code only; the Processor never holds it and cannot decrypt the packets. Maintaining device tokens and roles so the server can enforce who may send and receive which packets. |
| Types of personal data | Inside encrypted packets (not readable by the Processor): employee identity and contact details, date of birth, National Insurance number, UTR, address, pay rates and payments, CIS data, attendance times, GPS position at clock-in and clock-out, photos, leave requests (which can include sickness absence — health data, a special category), messages, client contact details, invoices. Readable by the Processor: device tokens, roles, internal employee and client ID numbers, device labels, timestamps. |
| Data subjects | The Controller's employees and subcontractors, site managers, clients and client contacts. |
2. Controller's instructions
The Processor processes personal data only on the Controller's documented instructions — these terms and the Controller's use of the app are those instructions — including with regard to transfers outside the UK, unless UK law requires otherwise (in which case the Processor will tell the Controller first, unless the law prohibits that). The Processor will tell the Controller if it believes an instruction infringes data protection law.
3. Confidentiality
Everyone the Processor authorises to access the service infrastructure is bound by confidentiality.
4. Security (Article 32)
- End-to-end encryption of all business data; the Processor holds no decryption key.
- Encrypted database on each device, with its key held in the device's secure storage.
- TLS for all traffic; server-side role allowlists that decide which device may send or receive which data; device revocation for lost phones or leavers; single-use invite tokens that expire after 15 minutes; rate limiting.
- Licence keys are stored only as hashes.
5. Sub-processors
The Controller authorises these sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| OVHcloud | Server hosting | United Kingdom |
| Cloudflare, Inc. | Network security and delivery (sees encrypted traffic only) | Global / USA |
The Processor will give at least 30 days' notice (by email to the licence holder or on this page) before adding or replacing a sub-processor, so that the Controller can object. It will impose the same data protection obligations on each sub-processor by contract, and it remains liable to the Controller for them. Transfers to the USA rely on the UK–US Data Bridge or the UK International Data Transfer Agreement / UK Addendum.
6. Helping with data subject requests
Because the Processor cannot read the encrypted data, the Controller answers access, correction and deletion requests directly in the app. The Processor will pass on any request it receives and will help with anything relating to data it can read (device and licence records).
7. Breaches, DPIAs and consultation
The Processor will notify the Controller without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs for its own notifications. It will reasonably assist with data protection impact assessments and prior consultation with the ICO. Location and attendance monitoring of workers is the kind of processing for which the ICO recommends a DPIA.
8. Audits
The Processor will make available the information needed to demonstrate compliance with Article 28 and will allow, and contribute to, reasonable audits by the Controller or its auditor, on reasonable notice and at the Controller's cost.
9. End of processing
When the licence ends, the Processor will, at the Controller's choice, delete the Controller's sync packets and device records within 30 days of a request to [email protected], and in any case within 90 days of the licence ending, unless UK law requires it to keep them. Because the packets are encrypted, the Controller's own copy of its data is on its devices; the Controller can export it from the app before deleting the app.
10. Contact
Data protection contact for the Processor: [email protected].