Privacy

Privacy Policy

Last updated: 24 October 2026

FieldTaskora provides software that captures field-operations evidence and turns it into job records, safety documentation and reports. Handling that information carefully is core to what we sell, so we have tried to be specific in this policy rather than vague.

1. Who this policy applies to

This policy applies to FieldTaskora Limited (registered in Ireland, CRO 820085) (“we”, “us”, “our”), a private company limited by shares whose registered office is 11 Cluain Rynagh, Banagher, Co. Offaly, R42 VY11, Ireland. It explains how we handle personal information when:

• you visit or interact with our website at fieldtaskora.com;
• your organisation uses the FieldTaskora product, or you use it as a worker, supervisor or administrator;
• we deal with you as a prospective customer, supplier or contractor; and
• we carry out the ordinary activities of running our business.

Some parts of our product or our recruitment process may have their own, more specific privacy notice. Where that happens, the specific notice applies to that activity.

2. Controller and processor — an important distinction

Our role, and therefore our obligations, depend on whose data it is:

• We are the controller for personal information we handle for our own purposes — website visitors, enquiries, marketing contacts, suppliers and our own staff. This policy governs that information.
• We are the processor for personal information inside a customer's workspace — their workers' details, the evidence their crews capture, and details of their own customers. The customer organisation is the controller of that data. We act on their documented instructions under our agreement with them, and their privacy policy governs it.

If you are a field worker whose employer uses FieldTaskora and you want to access or correct your data, the fastest route is usually your employer. You can still contact us and we will help direct the request.

3. The laws we work to

Because we are based in Ireland, our baseline is the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. We apply that standard to everyone's data, wherever they are, rather than running a weaker standard in some countries.

Where other regimes apply to a customer or an individual, we work to those as well — including the UK GDPR and Data Protection Act 2018, and, for our Australian customers, the Australian Privacy Principles in the Privacy Act 1988 (Cth). We also comply with the electronic-marketing rules that apply where we are sending — the EU ePrivacy rules, and equivalents such as Australia's Spam Act 2003 (Cth).

Our information security is governed by an Information Security Management System aligned to ISO/IEC 27001, with independent certification in progress.

4. What we collect, and why

Website visitors and enquiries

If you submit a form on our website we collect your name, work email, organisation, an indication of team size and anything you write in the message, so that we can respond to you and — if you asked for early access — contact you when access opens. Our web host also processes standard technical information such as IP address and request logs for security and reliability.

Prospective customers

We collect business contact details of people at organisations that may need our product, from sources such as company websites, public professional profiles and business-data providers. We use these for business-to-business outreach only, and you can opt out at any time.

Customer users — workers, supervisors and administrators

On our customers' instructions we handle names, work contact details, phone numbers, role, licence and competency details, sign-in and device information, and the field evidence generated in the course of work — including photographs, voice notes, form responses, safety checks, timestamps and location data associated with a job.

Location and time data is central to the product's purpose: it is what makes a job record verifiable. Customers configure what is captured on their jobs.

End-customers of our customers

Job records may include the name, signature, contact details or property details of the person a job was done for, where the customer captures a sign-off.

Suppliers, contractors and applicants

We collect contact and account details of the people we work with, and the information necessary to assess and manage job applications and engagements.

5. Cookies and analytics

This marketing website sets no cookies at all. It runs no advertising or analytics tracking, loads nothing from third-party servers, and does not profile you across other websites. Because it stores nothing on your device, there is nothing for you to accept or decline.

The product itself uses a small number of strictly-necessary cookies — signing you in, keeping your session, and remembering your language and light/dark choice. It can also record product-usage analytics to help us see which features are used, but that is off unless you turn it on. You can change your choice at any time from the privacy page inside the app, and declining changes nothing about the service you get.

6. How we use artificial intelligence

The product uses AI to read and structure what crews capture: describing and tagging photographs, drafting job summaries, checking a job against the required evidence, and assembling reports. This processing uses leading enterprise AI models within our cloud provider, under terms that prohibit your data being used to train the underlying models. Voice quoting, if your organisation turns it on, uses a separate AI speech provider.

AI outputs are drafts and aids, not decisions. They are intended to be reviewed by a person before being relied on, and we do not use AI to make decisions that produce legal or similarly significant effects about an individual.

7. Our legal bases for processing

Under the GDPR we rely on the following legal bases:

• Contract — to provide the product and support to the organisation that engaged us.
• Legitimate interests — to operate, secure and improve our service, to run business-to-business marketing, and to protect our legal position; balanced against your rights.
• Consent — for optional analytics and certain communications, which you can withdraw at any time.
• Legal obligation — where we must retain or disclose information to meet a legal or regulatory requirement.

8. Who we share information with

We do not sell personal information, and we do not disclose it for unrelated purposes without your authorisation. We use a deliberately short list of service providers to run the service. Each one is bound by contract to protect the information and to act only on our instructions. They fall into these categories:

• Cloud hosting and infrastructure — a leading enterprise cloud provider, for hosting, storage, backups, monitoring and sign-in.
• AI services — leading enterprise AI models, for the AI features described in section 6, including voice-note transcription and our in-product assistant.
• Voice quoting — a separate AI speech provider, used only if your organisation turns voice quoting on.
• Communications — transactional email, including messages sent from this website's forms.
• Security and abuse prevention — a bot check on public sign-up and public forms.
• Support tools — our own engineering and team-messaging tools, when a support request needs an engineer.
• Business tools — our own CRM and marketing systems. These handle our business contacts only, and are never used for customer workspace data.

Our sub-processor list names every provider, what it sees, and where it processes data. Customers, and organisations evaluating us, can request it — see section 15. We tell customers about changes to the list as their agreement requires.

We may also disclose information to professional advisers, or to law enforcement, regulators or other authorities where we are required to by law or where there is a legal or professional duty to do so.

9. Where your data is stored and processed

FieldTaskora is hosted with a leading enterprise cloud provider. Every customer's data is held in the same place, whichever country the customer is in, and backups are kept in a second location with the same provider so the service survives a regional outage.

A few things work differently, and we would rather tell you than have you find out:

• AI features run within our cloud provider. For some features a request may be processed in another of the provider's locations; nothing is stored there, and your data is never used to train the provider's models.
• Voice quoting is optional. If your organisation turns it on, the live conversation is sent to a separate AI speech provider outside our cloud environment. We keep the transcript, not the audio. Your organisation can turn voice quoting off.
• The bot check on public sign-up and forms runs on a global network, so it may be handled near you.
• Our staff can only reach customer data through our own admin console, and every staff sign-in is logged.
• Our test environment holds no customer data.

We do not offer a choice of hosting location today. If your organisation needs its data held in a particular country, tell us and we will review it.

International transfers

FieldTaskora Limited is based in Ireland, and customer data is held in the United States, so personal data from the EU, the EEA and the UK is transferred out of Europe, and personal data from Australia is disclosed overseas. We protect those transfers with our providers' data protection terms, including the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) and, where a provider is certified, the EU-US Data Privacy Framework. For Australian customers we take reasonable steps, including contracts with each provider, so that they handle the information consistently with the Australian Privacy Principles.

You can ask us for more detail about any transfer, or for our sub-processor list — see section 15.

10. How we protect information

We run a formal Information Security Management System aligned to ISO 27001, with independent certification in progress. Our controls include:

• encryption in transit (TLS) and at rest, with field-level encryption for sensitive values;
• tenant isolation so one customer's workspace is separated from another's;
• role-based access control, multi-factor authentication and the ability for administrators to revoke sessions immediately;
• least-privilege access for our own staff, granted only where needed to support the service;
• logging, monitoring and backup; and
• staff training on privacy and security obligations.

No system can be guaranteed completely secure. If a breach occurs that is likely to put people at risk, we will notify the Irish Data Protection Commission within 72 hours as the GDPR requires (Articles 33 and 34), and tell the people affected where the law requires it. Where another regime applies to a customer — such as Australia's Notifiable Data Breaches scheme — we will meet those obligations too. You can read more on our security page.

11. How long we keep it

• Customer job and evidence data is kept for the life of the customer's account, plus the retention window the organisation sets for each kind of record, because it is their compliance record. It is deleted or returned on their instruction in line with their agreement.
• Enquiry and prospect data is kept until it is no longer needed or you opt out.
• Operational logs are kept only as long as useful for security and reliability.
• Staff and financial records are kept for the periods required by law.

12. Your rights

Depending on where you are, you may have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• request erasure of your information;
• restrict or object to how we process it;
• receive a portable copy, or ask us to transfer it; and
• withdraw consent where our processing relies on it.

To exercise a right, contact us using the details in section 15. We will verify your identity before acting. Where the information sits inside a customer's workspace, we will pass your request to that customer as the controller, or act on their instruction.

13. Marketing and opting out

We may send you information about our product where you have asked for it or where it is permitted for business-to-business contact. Every marketing email includes an unsubscribe link, and you can also ask us to stop at any time using the details below. We will not use your information to market third parties' products.

14. Children

Our website and product are intended for business use and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe we have, please contact us and we will delete it.

15. Contact us, and how to complain

The data controller is FieldTaskora Limited, a private company limited by shares registered in Ireland, company registration number 820085, registered office 11 Cluain Rynagh, Banagher, Co. Offaly, R42 VY11, Ireland.

For any privacy question, request or complaint, contact our privacy contact at privacy@fieldtaskora.com. For security-specific matters, including requesting our sub-processor list or a security review, contact security@fieldtaskora.com.

We take complaints seriously. We will acknowledge your complaint promptly, investigate it, and let you know the outcome.

If you are not satisfied with our response, you can complain to a data protection authority. Because we are established in Ireland, our lead supervisory authority is the Irish Data Protection Commission. You may also complain to the authority where you live or work — for example the UK Information Commissioner's Office in the United Kingdom, or the Office of the Australian Information Commissioner in Australia.

16. Changes to this policy

We will update this policy as our practices change, and the “Last updated” date above shows when the current version was published. Where a change is material we will take reasonable steps to tell affected customers. We encourage you to review this page periodically.