SiteFeed TeamsData processing terms
These terms are part of the SiteFeed Teams terms. They apply between Steve O’Neill, a sole trader trading as SiteFeed, of Flat 2 Walker House, 1 Barker Butts Lane, Coundon, Coventry, CV6 1BF, United Kingdom ("we", "us"), and each business that keeps records in SiteFeed Teams ("your business"). They meet the requirements of Article 28 of the UK GDPR. If these terms and the main terms disagree about personal data, these terms win.
1. Roles
- For the records your business keeps in SiteFeed Teams (jobs, customers, diary and hours, team, photos, files and financial records), your business is the controller and we are its processor.
- For the information we need to run the service ourselves (sign-in accounts, sessions, server request logs and messages sent to us), we are the controller. The privacy notice covers that.
- Your business is responsible for having a lawful basis for the records it keeps, and for telling the people concerned (for example its customers and team) about them.
2. Details of the processing
| Subject matter | Providing SiteFeed Teams to your business: storing its records and syncing them between its team's devices. |
|---|---|
| Duration | While your business uses SiteFeed Teams, and then until the records are returned or erased under section 9. |
| Nature and purpose | Storage, retrieval, sync, numbering issued invoices, generating documents and sending emails your business asks us to send. Nothing else. |
| Types of personal data | Names, contact details and addresses of customers and team members; job and site details; diary entries and hours worked; photos and documents; quotes, invoices and payments (including any CIS deduction shown on them); anything else your business chooses to enter. |
| People concerned | Your business's team members, customers and their contacts, and anyone else your business records. |
| Special category data | SiteFeed Teams is not designed for it. Your business should not enter health or other special category data unless it has checked it may. |
3. Our commitments
We will:
- process the records only on your business's documented instructions, which are these terms and its use of SiteFeed Teams, including about transfers outside the UK, unless the law requires otherwise (in which case we will tell your business first unless the law forbids it);
- tell your business if we think an instruction breaks data protection law;
- make sure anyone we allow to process the records is bound by confidentiality;
- take the security measures in section 5;
- only use sub-processors under section 6;
- help your business, taking into account what we can reasonably do, to respond to requests from people exercising their data protection rights;
- help your business meet its obligations on security, breach notification, data protection impact assessments and consulting the ICO, taking into account the nature of the processing and the information we have;
- return or erase the records at the end, under section 9;
- give your business the information it reasonably needs to show these obligations are met, and allow and contribute to audits under section 8.
4. Your business's commitments
Your business will give lawful instructions, have a lawful basis for the records it keeps, and keep its own copies of any records it is required by law to keep.
5. Security
The measures we take are those described on the Security page: sign-in by one-time email code (no passwords), server-side checks of company membership and role on every request, separation between companies including for files, encryption in transit (HTTPS), private file storage with no public links, and keeping our own access to the minimum needed to run and support the service. SiteFeed Teams has not been certified to a security standard or independently reviewed.
6. Sub-processors
Your business gives general authorisation for these sub-processors:
| Sub-processor | What it does |
|---|---|
| Cloudflare, Inc. | Hosts the service (Workers), the database (D1) and file storage (R2) |
| Resend | Sends emails, such as invitations |
We will give at least 30 days' notice on this page and by email to each business's Admins before adding or replacing a sub-processor. Your business can object on reasonable data protection grounds; if we can't resolve the objection, your business can stop using SiteFeed Teams. We will put data protection terms in place with each sub-processor that give at least the protection in these terms, and we remain responsible to your business for them.
7. Transfers outside the UK
Our sub-processors may process the records outside the UK, including in the United States. We will only allow that where UK data protection law permits the transfer, for example under UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for a certified recipient) or with appropriate safeguards such as the UK International Data Transfer Agreement or Addendum. Which applies to each sub-processor is set out in the privacy notice.
8. Personal data breaches and audits
We will tell your business without undue delay after becoming aware of a personal data breach affecting its records, with the information we have, and keep it updated. Your business decides whether to notify the ICO or the people affected.
We will answer your business's reasonable written questions about how we meet these terms. If your business, or the ICO, reasonably needs more, we will co-operate with an audit on reasonable notice, at a reasonable time and without access to other businesses' records.
9. At the end
When your business stops using SiteFeed Teams, or sends an authorised request to support@sitefeed.co.uk, we will, as your business chooses, arrange a manual return of its records to a verified Admin or erase them within 90 days. This includes stored copies of records previously deleted in the app and associated photos and files. V1 does not provide automated self-service export or permanent erasure of individual business records; we will handle those requests through support. Requests under an individual's data protection rights will be handled within the applicable statutory deadline, which may be shorter than 90 days. We will then erase any remaining copies, unless the law requires us to keep them. Any copies in our hosting provider's backups expire on that provider's schedule, described in the privacy notice.
10. Liability
The limits in section 8 of the terms apply to these terms between us and your business. They do not limit anyone's rights under data protection law to claim against us directly.