Data processing

When a business uses FortyFive to manage its field work, it is the controller of its operational data and FortyFive is its processor. Our data processing agreement (DPA) forms part of every customer agreement and meets Article 28 of the UK GDPR and EU GDPR.

Roles

• Customer as controller: jobs, sites, instructions, evidence, approvals and the personal data in them.
• FortyFive as processor: we process that data only on the customer’s documented instructions, to provide the platform.
• FortyFive as controller: platform-level data such as user accounts, engineer profiles, ratings and security logs, as described in our privacy policy.

What the DPA commits us to

• process customer data only to provide and support the service, and use it to improve the platform only in aggregated or de-identified form;
• ensure our staff and contractors are bound by confidentiality;
• apply appropriate technical and organisational security measures, including access control, encryption in transit and at rest, logical separation of each customer’s data, backups and logging;
• use only approved sub-processors, give at least 30 days’ notice of changes and allow customers to object;
• notify customers without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting their data;
• help customers respond to data-subject requests and carry out impact assessments;
• transfer data internationally only with appropriate safeguards (UK IDTA or EU Standard Contractual Clauses);
• return or delete customer data at the end of the contract, except where we must keep it by law;
• make information available to demonstrate compliance and allow reasonable audits.

Request a copy

Customers and prospective customers can request the DPA from [email protected].