Data Processing Addendum

• "Personal Data" means any information relating to an identified or identifiable individual processed by Fieldza on behalf of Customer through the Service.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Subprocessor" means a third party engaged by Fieldza to process Personal Data on behalf of Customer.
• "Data Protection Laws" means applicable privacy and data protection laws, including the CCPA/CPRA, GDPR, and other applicable regulations.

Customer is the Controller (or Business, under the CCPA) of Personal Data relating to Customer's clients, employees, and other individuals that Customer uploads or processes through the Service. Fieldza is the Processor (or Service Provider, under the CCPA) with respect to such Personal Data. Customer is responsible for ensuring it has a lawful basis to collect and provide Personal Data to Fieldza and for providing appropriate notices to data subjects.

Fieldza will process Personal Data only on documented instructions from Customer, including as necessary to provide the Service through the Website, Apps, and related features, unless required by applicable law. Customer instructs Fieldza to process Personal Data as described in the Terms of Service, Privacy Policy, and this DPA.

Customer authorizes Fieldza to engage Subprocessors to assist in providing the Service. Current Subprocessors include Stripe, Inc. (payments), Twilio Inc. (SMS), and Resend, Inc. (email). A current list is maintained at our Subprocessors page. Fieldza will notify Customer of material changes to Subprocessors. Fieldza imposes data protection obligations on Subprocessors consistent with this DPA.

Fieldza implements appropriate technical and organizational measures to protect Personal Data, as described in our Security page. Measures include encryption in transit and at rest, access controls, and security monitoring across the Website and Mobile Apps.

Fieldza will assist Customer in responding to data subject requests (including access, deletion, and correction requests) to the extent required by Data Protection Laws and technically feasible. If Fieldza receives a request directly from a data subject whose data Customer controls, Fieldza will redirect the request to Customer unless prohibited by law.

Fieldza will notify Customer without undue delay upon becoming aware of a Personal Data breach affecting Customer's data processed through the Service, and will provide information reasonably available to assist Customer in meeting its breach notification obligations.

Personal Data may be processed in the United States and other countries where Fieldza or its Subprocessors operate. Fieldza will ensure appropriate safeguards for international transfers as required by applicable Data Protection Laws.

Upon termination of the Service or upon Customer request, Fieldza will delete or return Customer's Personal Data within a reasonable period, subject to legal retention requirements and backup cycles described in our Privacy Policy.

To the extent the CCPA applies, Fieldza certifies that it understands the restrictions on Service Providers and will not (a) sell or share Personal Data received from Customer, (b) retain, use, or disclose Personal Data for any purpose other than providing the Service specified in the agreement or as permitted by the CCPA, or (c) combine Personal Data received from Customer with Personal Data from other sources except as permitted by the CCPA.

To request a countersigned copy of this DPA for your records, email support@fieldza.com with the subject line Data Processing Addendum Request. Include your company name and Fieldza account email.

See all policies on our Legal page.