Loading...
Last updated: January 2025
This Data Processing Addendum ("DPA") supplements our Terms of Service and Privacy Policy for customers who process personal data subject to applicable data protection laws.
"Controller" means you, the customer, who determines the purposes and means of processing personal data.
"Processor" means Toolfy, who processes personal data on behalf of the Controller.
"Personal Data" has the meaning given in applicable data protection laws.
Provision of field service management software and related services.
Processing continues for the duration of your subscription and applicable retention periods.
You warrant that:
We commit to:
We may engage sub-processors to assist in providing services. Current sub-processors include:
We will provide 30 days' notice of new sub-processors. You may object to new sub-processors on reasonable data protection grounds.
Personal data may be transferred internationally. We ensure appropriate safeguards:
We implement technical and organizational measures including:
We will assist you in responding to data subject requests within 30 days, including:
We will assist with Data Protection Impact Assessments when legally required, providing relevant information about our processing activities.
We will notify you of any personal data breach without undue delay and, where required by applicable data protection laws (including GDPR Article 33, UK Data Protection Act 2018, and similar regulations), within 72 hours of becoming aware of the breach.
If notification cannot be provided within 72 hours due to the complexity of the investigation, we will provide an initial notification within 72 hours with available information and follow up with additional details as soon as practicable.
Our breach notification will include, to the extent known at the time:
We will cooperate with you and provide reasonable assistance in investigating the breach, notifying supervisory authorities (if required), and communicating with affected data subjects (if required). We will keep you informed of all material developments in our investigation and remediation efforts.
You remain responsible for determining whether the breach requires notification to supervisory authorities or data subjects under applicable laws. We will provide you with sufficient information to meet your notification obligations.
Upon reasonable notice, you may audit our compliance with this DPA. We may charge reasonable fees for extensive audits. We will provide relevant certifications and audit reports as available.
Each party shall be liable for damages caused by its breach of applicable data protection laws. We will indemnify you against claims arising from our non-compliance with this DPA, subject to the limitations in our Terms of Service.
This DPA remains in effect while we process personal data on your behalf. Upon termination, we will delete or return personal data as instructed, unless legally required to retain it.
For DPA-related matters, contact: