FieldSignal Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the FieldSignal Terms of Service (fieldsignal.com/terms, the "Agreement") between Fieldsignal LLC, a Wyoming limited liability company ("FieldSignal"), and the customer that has subscribed to a FieldSignal Team or Enterprise plan ("Customer"). It applies automatically, without signature, to all Team plan customers. Enterprise customers may execute a countersigned copy on request (info@fieldsignal.com).

This DPA applies where FieldSignal processes personal data on Customer's behalf that is subject to data protection law, including the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, Brazil's LGPD, Mexico's data protection law, and US state privacy laws ("Data Protection Law").

1. Roles and scope

For personal data that Customer and its users submit to the service — field notes, photos, checklists, locations, team member information ("Customer Data") — Customer is the controller and FieldSignal is the processor. FieldSignal acts as an independent controller only for its own account administration, billing, and service communications, as described in the FieldSignal Privacy Policy.

Where Customer is itself a processor of Customer Data on behalf of a third party, FieldSignal is a sub-processor, and this DPA applies to FieldSignal in that capacity with the necessary changes.

2. Processing details

The subject matter, duration, nature and purpose of processing, data types, and categories of data subjects are set out in Annex A.

3. FieldSignal's obligations as processor

FieldSignal will:

process Customer Data only on Customer's documented instructions, including with regard to international transfers, unless required otherwise by law (in which case FieldSignal will inform Customer unless legally prohibited). The Agreement, this DPA, and Customer's use of the service's features are Customer's complete instructions;
ensure persons authorized to process Customer Data are bound by confidentiality obligations;
implement and maintain the technical and organizational security measures described in Annex B;
assist Customer, taking into account the nature of the processing, in responding to data subject requests (access, correction, deletion, portability, objection) — primarily through the service's built-in export and deletion features, and otherwise on request;
assist Customer with its obligations regarding security, breach notification, data protection impact assessments, and consultations with supervisory authorities, taking into account the information available to FieldSignal;
notify Customer without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting Customer Data, with the information reasonably available to enable Customer to meet its own notification obligations;
at Customer's choice, delete or return Customer Data on termination of the Agreement, and delete remaining copies within 90 days unless retention is required by law. This period is the same outer limit as the account-deletion period described in section 8 of the FieldSignal Privacy Policy, and is stated as an outer limit rather than a target; and
make available information reasonably necessary to demonstrate compliance with this DPA, and allow audits as set out in Section 7.

4. Sub-processors

Customer gives general authorization for FieldSignal to use the sub-processors listed at fieldsignal.com/subprocessors. FieldSignal will give at least 30 days' notice before adding a new sub-processor, by email to the account owner, and will update that page at the same time. Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, Customer may terminate the affected subscription and receive a pro-rated refund of prepaid fees. FieldSignal imposes data protection obligations on each sub-processor materially equivalent to this DPA and remains responsible for their performance.

5. International transfers

Customer Data is processed primarily in the United States. The sub-processors engaged and the location at which each processes Customer Data are listed at fieldsignal.com/subprocessors, which forms part of Annex A and is updated as those arrangements change.

5.1 EU Standard Contractual Clauses. Where a transfer from the European Economic Area to FieldSignal requires a transfer mechanism, the parties incorporate the European Commission Standard Contractual Clauses approved by Implementing Decision (EU) 2021/914 of 4 June 2021 ("EU SCCs") into this DPA by reference, completed as follows:

Module Two (controller to processor) applies where Customer is a controller; Module Three (processor to processor) applies where Customer is itself a processor and FieldSignal is a sub-processor;
Customer is the data exporter; FieldSignal is the data importer;
Annex A of this DPA serves as Annex I to the EU SCCs, and Annex B serves as Annex II;
the optional docking clause in Clause 7 applies;
for Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in section 4 above;
for Clause 11, the optional independent dispute resolution body language does not apply;
for Clause 17, the governing law is the law of Ireland; and
for Clause 18(b), the forum is the courts of Ireland.

5.2 The UK International Data Transfer Addendum. Where a transfer is subject to the UK GDPR, the parties incorporate the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner and in force from 21 March 2022 ("UK Addendum"), completed as follows:

Table 1 is deemed completed with the parties' details as set out in Annex A and in the Agreement;
Table 2 is deemed completed by selecting the EU SCCs as incorporated at section 5.1, including the module, clauses and options selected there;
Table 3 is deemed completed by Annexes A and B of this DPA;
Table 4 is deemed completed by selecting "neither party" as the party that may end the UK Addendum under its Section 19; and
the Information Commissioner is the competent supervisory authority for transfers subject to the UK GDPR.

5.3 Switzerland. Where a transfer is subject to the Swiss Federal Act on Data Protection ("FADP"), the EU SCCs as incorporated at section 5.1 apply with the following modifications:

references to the "GDPR" are to be understood as references to the FADP;
references to a "Member State" or to "EU Member State" are to be understood as including Switzerland, and Clause 18(c) does not operate to prevent a data subject bringing proceedings in Switzerland;
the competent supervisory authority for the purposes of Clause 13 and Annex I.C is the Federal Data Protection and Information Commissioner ("FDPIC");
for Clause 17, the governing law is the law of Switzerland;
for Clause 18(b), the forum is the courts of Switzerland; and
until the entry into force of any revised position, the EU SCCs also protect the personal data of legal entities where the FADP so requires.

5.4 Order of application. Where more than one of sections 5.1 to 5.3 applies to a single transfer, each applies to the extent of the law that engages it, and the mechanism most protective of the data subject governs any conflict.

6. United States state privacy laws

This section applies where Customer Data is subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act, or to a comparable law of another US state.

6.1 Roles. Customer is a "business" (or equivalent) and FieldSignal is a "service provider" (or equivalent) with respect to Customer Data.

6.2 FieldSignal's undertakings. FieldSignal:

will not sell or share Customer Data, as those terms are defined by the applicable law;
will not retain, use or disclose Customer Data for any purpose other than performing the services specified in the Agreement, or as otherwise permitted by the applicable law, and will not do so outside the direct business relationship between the parties;
will not combine Customer Data with personal information received from or on behalf of any other person, except as the applicable law permits a service provider to do;
will not re-identify any pseudonymised or de-identified data derived from Customer Data without Customer's written permission; and
certifies that it understands and will comply with the restrictions in this section.

6.3 Customer's rights. Customer may take reasonable and appropriate steps to ensure FieldSignal uses Customer Data consistently with Customer's obligations under the applicable law, and, on notice, to stop and remediate any unauthorised use.

7. Audits

FieldSignal will satisfy audit requests first through written responses and available documentation and third-party reports of its infrastructure sub-processors (e.g., AWS/Supabase certifications). If those are insufficient to demonstrate compliance, Customer may conduct an audit no more than once per year, on 30 days' notice, during business hours, without disrupting the service, at Customer's cost, under confidentiality.

8. Customer's responsibilities as controller

The service captures precise location, can share a user's live location with their colleagues, and records photographs that may include identifiable people. Customer determines whether and how those features are used within its organisation. Accordingly, Customer is responsible for:

establishing a lawful basis for its processing, including for any monitoring of workers' location, and for carrying out any assessment, consultation or works-council process that the law of its jurisdiction requires before such monitoring begins;
informing its own personnel about what the service records, how location sharing works, and how long records are kept;
informing or obtaining consent from third parties whose personal data its users capture in the field, including individuals photographed and the owners of property recorded;
not submitting special-category or sensitive personal data to the service, which is not designed to receive it; and
configuring team permissions so that access to Customer Data within its organisation is appropriate.

FieldSignal provides the settings and disclosures described in its Privacy Policy but is not in a position to perform these obligations on Customer's behalf.

9. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations of liability in the Agreement. If this DPA conflicts with the Agreement on data-protection matters, this DPA controls; the EU SCCs, the UK Addendum and the Swiss modifications control over both where they apply. This DPA is drafted in English; the English version controls.

Annex A — Processing details

Subject matter and duration: provision of the FieldSignal field-data-collection service for the term of the Agreement.
Nature and purpose: hosting, storage, synchronization, display, team sharing, report generation (including AI-generated reports via Anthropic's Claude API), and export of Customer Data, as directed through the service's features.
Categories of data subjects: Customer's users (team members) and individuals appearing in field data (e.g., persons incidentally captured in photos or notes).
Categories of personal data: names, email addresses, roles/permissions; GPS coordinates and location history (including live location where enabled by the user); field notes, voice-to-text transcriptions, photographs, checklist responses; imported GIS files; device and diagnostic data.
Sensitive data: not intended to be collected; Customer is responsible for not submitting special-category data (see section 8).
Frequency: continuous, while the subscription is active.
Location of processing: primarily the United States. The sub-processors engaged and the processing location of each are listed at fieldsignal.com/subprocessors, which forms part of this Annex and is the authoritative statement of where Customer Data is processed.
Retention: for the subscription term, then deletion per Section 3(7).
Competent supervisory authority (SCC Annex I.C): determined by the data exporter's establishment or, where the exporter is not established in the EEA, by the Member State in which its representative is established. FieldSignal's EU representative is located in Spain.

Annex B — Technical and organizational measures

Access control and isolation

Row-level security enforcing per-account and per-team data isolation in the database.
Role-based access controls within Customer teams (owner/admin/member roles).
Authentication via managed identity provider (Supabase Auth); passwords hashed, never stored in plaintext.
Principle of least privilege for administrative access to production infrastructure; access limited to authorized personnel.

Encryption and hosting

Encryption of data in transit (TLS) and at rest.
Hosting on SOC 2 / ISO 27001-certified infrastructure (AWS via Supabase).

Monitoring and incident response

Logging and monitoring of errors and anomalies; documented incident-response process with customer notification per Section 3(6).

Backup and restoration — stated precisely, because the detail matters

The database is backed up once every 24 hours, and each backup is retained for 7 days. There is no point-in-time recovery.
Stored files — photographs, voice recordings and imported files — are not included in database backups. Customer should not rely on FieldSignal backups as its archive of record for these, and should export field records it needs to retain independently.
Data deleted from the live service is not restored. If the service is rebuilt from a backup, deletions taken before that backup are re-applied.
Because backups are retained for 7 days, data deleted from the live service ceases to exist in any backup within 7 days of the deletion.

Vendor management

Vendor due diligence and a written data processing agreement with every sub-processor.