Field2Office dpa

Robert Sparrow trading as Field2Office · 7 Windermere Close, Daventry, NN11 9ED, United Kingdom

Field2Office Data Processing Addendum Parties and scope The subscribing trade business is the controller of its customer and job data. Robert Sparrow trading as Field2Office, 7 Windermere Close, Daventry, NN11 9ED, United Kingdom, is its processor for workspace processing. Contact hello@field2office.co.uk. This addendum forms part of the accepted Terms of Service. It does not make Field2Office the controller of the trade business's customer data or displace Stripe's and other providers' independent-controller obligations. Processing concerns account/workspace hosting, customer/job organisation, bookings, quotes, invoices, receipts, user-requested AI drafting/transcription, approved document sending, calendar connections, security and backups. Data subjects include the controller's customers, contacts and any staff or suppliers entered into the workspace. Data includes names, contact details, addresses, appointments, notes, photos, business prices and financial documents. Special-category data is not required for the service and should not be uploaded. Duration is the service relationship and subsequent return/deletion handling, subject to documented lawful retention. Instructions and confidentiality The processor acts only on documented instructions, including account configuration and approved user actions, unless UK law requires otherwise. It will inform the controller of such a legal requirement unless prohibited and promptly flag instructions it believes infringe data-protection law. The controller warrants that its instructions and collection of personal data are lawful. People authorised by the processor to access data must be bound by confidentiality and limited to necessary duties. Paired devices and shared owner access are controlled by the subscribing business. Security Measures include separate workspace databases, tenant-bound access checks, secure browser sessions, password hashing, enforced administrator authenticator protection, optional owner two-factor authentication, encrypted integration credentials, encrypted and integrity-checked local recovery snapshots, webhook signature validation and account/device revocation tools. The controller must protect devices and account credentials and independently retain statutory records. Measures are reviewed as the service develops; no guarantee of uninterrupted operation or absolute security is made. Subprocessors The controller gives general written authorisation for infrastructure hosting through Hostinger and requested AI/transcription processing through OpenAI, managed transactional email through Resend (Plus Five Five, Inc.), and connected Google Calendar operations. The marketing website uses OpenAI ChatGPT Sites and Cloudflare infrastructure; workspace databases are kept separately on the VPS. Stripe handles subscription billing under its applicable roles and contracts. The Privacy Notice explains data sent to each provider and links to provider processing information. Custom sender or calendar accounts remain subject to the controller's own provider arrangements. The processor must maintain applicable written supplier terms imposing equivalent data-protection obligations for processing carried out on its behalf and remains responsible for its subprocessors' obligations. It will give at least 30 days' notice of a material addition or replacement and allow a reasonable data-protection objection before processing through the new provider. If the parties cannot resolve a valid objection, the controller may terminate affected service without penalty for future periods. This authorisation does not permit advertising uses of workspace data. Assistance and incidents Taking account of the nature of processing and available information, the processor assists with data-subject requests, security, breach assessment/notification, impact assessments and regulator enquiries. It notifies the controller without undue delay after becoming aware of a personal-data breach affecting its data and provides information as it becomes available. The controller remains responsible for its own legally required notifications. The processor makes relevant compliance information available and allows proportionate audits, including independent review where appropriate, subject to confidentiality and security protections. Return, deletion and backups At the controller's choice on termination, return an available export or delete workspace personal data, except where law requires retention. The controller can request this through the account page or contact email. The processor verifies authority, reconciles billing, explains any legal retention exception and records the deletion plan. Inactive or cancelled accounts are not automatically erased on expiry. Live erasure and confirmation of backup/provider handling are separate steps. Local encrypted backups rotate through the seven most recent successful snapshots; separately exported recovery copies require separate handling. Retained backup data must be put beyond ordinary use pending replacement/removal, and any restoration must reapply deletion instructions. Provider retention and controller-owned calendar/mailbox data are handled under their respective arrangements. The processor confirms what has been erased and explains any remaining lawful retention and expiry criteria. International processing The controller authorises the provider processing described in the Privacy Notice, subject to compliance with UK transfer requirements. Providers may process in the UK, EEA, United States or other locations stated in their supplier schedules. The processor must not make a restricted transfer without a lawful adequacy basis or appropriate safeguards, including the UK Addendum where applicable. Copies or relevant details of safeguards are available on request, subject to necessary redactions. Controller instructions that prohibit a provider/location must be raised before using the affected feature. Managed email privacy — updated 12 October 2026 Field2Office uses Resend (Plus Five Five, Inc.) to deliver document emails through the managed sender. Resend receives sender and recipient addresses, the reply-to address, subject, message, attached documents and delivery metadata. Documents may include customer names, addresses, job details and financial information. Review the recipient and attachment before sending. Managed emails pass through the platform operator's Resend account. Authorised people with access to that account can access sending records and potentially message content and attachments. Separate business workspaces do not hide provider records from the platform operator. Provider access should be used only for necessary delivery support, security, abuse prevention or legal obligations. Emails are not end-to-end encrypted. Replies go to the business reply-to mailbox and are not automatically imported into Field2Office. Your mailbox provider handles those replies. A complete custom Resend configuration uses your own provider account instead of the managed sender; Field2Office still processes the message to deliver it. Resend states that customer data is stored in the United States. Selecting a European sending region does not change the storage location. Its published terms specify 30-day email and log retention on Free, Pro and Scale plans, flexible Enterprise retention, seven-day backups and deletion of remaining customer data within 90 days after termination of the Resend account. Deleting a Field2Office workspace does not terminate the shared Resend account or immediately erase provider records. Early removal requests require coordination with Resend. Businesses control their customer data and instruct Field2Office to process it to provide the service. Customer-data requests should normally go to the trade business first. Workspace owners can contact the platform operator through their existing support channel. Resend's Data Processing Addendum describes its processing and international-transfer safeguards, including the UK Addendum. This feature notice supplements the platform privacy notice and does not replace the full terms or Data Processing Addendum. Provider information: https://resend.com/security/gdpr Provider DPA: https://resend.com/legal/dpa Provider subprocessors: https://resend.com/legal/subprocessors

Field2Office · dpa