Data Processing Agreement

1. Roles#

You are the Controller and we are the Processor for all personal data in your Service content. That includes the personal data of your own staff, and, the larger category here, the personal data of people in the field who submit tickets through your capture links.

We process it only to provide the Service and on your documented instructions, which the agreement, your use of the Service, and your configuration choices together constitute. Approving a ticket is an instruction to write that data into your Procore account.

As Controller you are responsible for having a lawful basis to collect what your capture codes collect, and for giving the people who submit tickets whatever notice or information the law requires. Those people have no account with us and no channel to us; you are the only party who can reach them.

2. Scope of processing#

• Subject matter: providing the Fieldstub Service.
• Duration: the term of your agreement, plus any legally required retention.
• Nature and purpose: receiving ticket submissions from your capture links; storing them; presenting them to your reviewers; and, on approval, creating a Change Event with its line items and attachments in your Procore account.
• Types of personal data: for your staff: email address and sign-in timestamps. For field submissions: the name and role of the signer, an image of the signature, the name of the person who directed the work, photographs, and per-photo capture time and, where the device provides it, coordinates.
• Data subjects: your authorized users; the subcontractors, crew members and other field workers who submit or sign tickets; and any individual appearing in a photograph attached to a ticket.
• Special categories: none are requested by the Service. A photograph of a jobsite may incidentally show a person, which is why the sensitivity of what your crews photograph is worth a word in your own notice to them.

3. Our obligations#

• Process personal data only on your documented instructions.
• Ensure anyone authorized to process it is bound by confidentiality.
• Implement appropriate technical and organizational measures, including encryption in transit and at rest, least-privilege access, and tenant isolation enforced in the service layer. These are described concretely on the Trust and security page, which forms part of this DPA.
• Assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification and impact-assessment obligations.
• Notify you without undue delay after becoming aware of a personal-data breach affecting your data.
• On termination, delete or return personal data, except where the law requires us to keep it.

4. Sub-processors#

You authorize us to engage the sub-processors below. The current list, with what each one handles, is on the Trust and security page. We will update it and aim to notify you before a new sub-processor handling personal data takes effect, so you can object on reasonable grounds. We remain responsible for their performance.

Procore is not a sub-processor. It is your system, held under your agreement with Procore, and our writing to it is the performance of your instruction rather than a disclosure to a vendor of ours.

5. International transfers#

We and our sub-processors process data in the United States. Where personal data is transferred from the EEA, UK or Switzerland, the parties rely on a lawful transfer mechanism such as the EU Standard Contractual Clauses, incorporated by reference where applicable.

6. Audits#

On reasonable written request and subject to confidentiality, we will provide the information necessary to demonstrate compliance with this DPA, including answering a security questionnaire.

We hold no third-party audit report or certification today, and we will not imply one. If we obtain a SOC 2 report in future, providing it will satisfy this section.

7. Data-subject requests#

If a data subject contacts us directly about data we process for you, we will not respond substantively other than to direct them to you, and we will tell you promptly. Where a request concerns a field submission we will help you locate and act on the record.

8. Liability and precedence#

This DPA is subject to the limitation of liability in our Terms of Service. Where this DPA and the Terms conflict on the processing of personal data, this DPA controls.

9. Contact#

PurelySearch LLC · privacy@fieldstub.com