Fieldlink Privacy Policy

Fieldlink ("Fieldlink", "we", "us", or "our") provides cloud-based software and related services for civil construction businesses, contractors, workers, suppliers and other organisations.

We take privacy and information security seriously.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you use Fieldlink's websites, applications, mobile applications, portals, integrations, support services and related services (together, the "Services").

We handle personal information in accordance with the New Zealand Privacy Act 2020 and other applicable laws.

This Privacy Policy should be read together with the Fieldlink Terms of Service and any other agreement that applies to your use of Fieldlink.

This Policy may apply to information relating to:

• Fieldlink account holders;
• employees and workers of Fieldlink customers;
• contractors and subcontractors;
• customers and suppliers;
• drivers and plant operators;
• site visitors;
• contacts entered into Fieldlink;
• users of customer or contractor portals;
• people appearing in documents, photographs, forms or records uploaded to Fieldlink;
• people whose information is otherwise entered, collected or processed through the Services.

Where an organisation uses Fieldlink to collect or manage information about its workers, contractors, customers, suppliers or other individuals, that organisation may also have its own privacy obligations.

Depending on the Fieldlink features used, information processed through Fieldlink may include:

• name;
• email address;
• phone number;
• account and profile information;
• employer or organisation;
• job title and role;
• employment and workforce information;
• timesheets and working hours;
• leave information;
• payroll-related information;
• competency, qualification and training records;
• job and project information;
• site records;
• health and safety records;
• toolbox talk and sign-on records;
• pre-start and inspection records;
• forms and checklists;
• photographs and uploaded documents;
• signatures or sign-on confirmations;
• vehicle and plant information;
• driver and truck information;
• GPS or location information where relevant Fieldlink functionality is enabled;
• supply-yard visits and material movements;
• weighbridge and docket information;
• customer and supplier information;
• quotes, invoices and financial records;
• communications and correspondence;
• support requests;
• device, browser and technical information;
• IP address;
• authentication and security information;
• application activity and audit records;
• integration information;
• other information entered, uploaded or generated through the Services.

The information collected depends on the Fieldlink modules and functionality being used.

Businesses using Fieldlink may upload, enter, generate, import or otherwise provide information to the Services ("Customer Data").

The customer remains responsible for determining what Customer Data its authorised users enter into Fieldlink and for ensuring that it has an appropriate lawful basis for collecting and using that information.

Fieldlink processes Customer Data for the purpose of providing, securing, maintaining, supporting and improving the Services and as otherwise permitted by our agreement with the customer and applicable law.

Fieldlink does not acquire ownership of Customer Data merely because that information is stored or processed using Fieldlink.

We may collect and use information where reasonably necessary to:

• provide the Services;
• create and administer accounts;
• authenticate users;
• operate jobs and project-management functionality;
• process timesheets and workforce records;
• operate safety and compliance functionality;
• manage plant, vehicles and assets;
• provide supply-yard, docket and material-management functionality;
• provide quoting, invoicing and financial functionality;
• generate documents and reports;
• provide integrations requested or enabled by customers;
• provide customer support;
• communicate service-related information;
• detect, investigate and prevent misuse, fraud and security threats;
• maintain audit and security records;
• diagnose technical issues;
• monitor and improve the performance and reliability of Fieldlink;
• comply with legal obligations;
• enforce our agreements and protect our legal rights;
• perform other purposes authorised by the individual concerned or permitted by law.

We will not collect personal information where it is not reasonably necessary for a lawful purpose connected with our activities.

Much of the information held within Fieldlink is entered by businesses and their authorised users.

If your information has been entered into Fieldlink by your employer, contractor, principal or another organisation, that organisation may be responsible for deciding why the information was collected and how it is used.

Requests concerning that information may therefore need to be handled by that organisation.

Fieldlink will provide reasonable assistance where appropriate and required by law.

Access to Customer Data within Fieldlink is controlled through user accounts, roles and permissions.

Customers are responsible for:

• deciding who should have access to their Fieldlink account;
• assigning appropriate permissions;
• maintaining accurate user access;
• removing access when it is no longer required;
• protecting account credentials;
• ensuring users do not share passwords or authentication credentials;
• promptly notifying Fieldlink of suspected unauthorised access.

Users must not attempt to access information they are not authorised to access.

Fieldlink uses technical and organisational measures designed to protect information against loss, unauthorised access, disclosure, alteration, misuse and destruction.

Security measures may include, where appropriate:

• authentication and access controls;
• role-based permissions;
• encryption;
• secure communications;
• logging and monitoring;
• audit records;
• backups;
• infrastructure security;
• vulnerability and dependency management;
• administrative controls;
• incident response procedures;
• access restrictions for Fieldlink personnel.

However, no internet-connected service, computer system, database, network, cloud platform, transmission method or electronic storage system can be guaranteed to be completely secure.

Accordingly, while Fieldlink takes reasonable measures to protect information, Fieldlink does not represent or warrant that the Services will be immune from all cyberattacks, unauthorised access, malicious activity, software vulnerabilities, credential compromise, infrastructure failure or other security incidents.

Nothing in this section limits any obligation Fieldlink has under applicable law.

Security is a shared responsibility.

Customers and users are responsible for taking reasonable steps to protect their accounts and information, including:

• using strong passwords;
• protecting login credentials;
• using available authentication security features;
• not sharing user accounts;
• maintaining appropriate user permissions;
• promptly disabling former employees or users;
• maintaining secure devices and networks;
• ensuring information entered into Fieldlink is appropriate and lawful;
• reviewing connected integrations;
• promptly reporting suspected security incidents.

Fieldlink is not responsible for unauthorised access resulting solely from a customer's or user's acts or omissions where Fieldlink has complied with its own legal and contractual obligations.

A "privacy breach" has the meaning given to that term under applicable privacy law.

If Fieldlink becomes aware of a suspected privacy or security incident affecting personal information, we may:

• investigate the incident;
• take reasonable steps to contain and remediate it;
• assess the nature and extent of affected information;
• assess the risk of harm;
• work with relevant service providers, customers and authorities;
• preserve relevant security and audit information; and
• make notifications where required by applicable law.

Where a privacy breach is a notifiable privacy breach under the Privacy Act 2020, Fieldlink will comply with applicable notification requirements.

Fieldlink may contact affected customers or users where reasonably necessary to investigate or respond to an incident.

Customers must reasonably cooperate with Fieldlink where an incident involves their account, users, systems or integrations.

The parties acknowledge that modern cloud services necessarily involve security risks.

Despite reasonable safeguards, information may potentially be affected by events including:

• sophisticated cyberattacks;
• zero-day vulnerabilities;
• compromised user credentials;
• phishing;
• malware;
• malicious insiders;
• third-party service provider incidents;
• internet or telecommunications failures;
• software defects;
• infrastructure failures;
• events outside Fieldlink's reasonable control.

This acknowledgement does not exclude or limit any rights or obligations that cannot lawfully be excluded or limited.

Any contractual allocation or limitation of liability relating to the Services is governed by the Fieldlink Terms of Service or applicable customer agreement.

Fieldlink may use trusted third-party service providers to help operate the Services.

These may include providers of:

• cloud infrastructure;
• databases and storage;
• authentication;
• email and communications;
• payment processing;
• analytics and monitoring;
• mapping and location services;
• artificial intelligence functionality;
• accounting and business integrations;
• customer support;
• security and infrastructure services.

Service providers may process information only as necessary for the services they provide to Fieldlink, subject to applicable contractual and legal requirements.

Some Fieldlink service providers or infrastructure may be located outside New Zealand, or may process or store information outside New Zealand.

Where personal information is disclosed outside New Zealand, Fieldlink will take steps required by applicable privacy law concerning overseas disclosure and protection of personal information.

Where an overseas provider processes information on Fieldlink's behalf as an agent or service provider, Fieldlink will manage that relationship in accordance with applicable legal requirements.

The countries in which information is processed may change as Fieldlink's infrastructure and service providers evolve.

Where appropriate, further information about material service providers may be made available through Fieldlink's security or subprocessors information.

Customers may connect Fieldlink to third-party services.

Examples may include accounting, communications, mapping, storage or other business platforms.

When a customer enables an integration, information may be exchanged between Fieldlink and that provider as necessary to provide the integration.

The third-party provider's own terms and privacy practices may apply to information processed independently by that provider.

Customers are responsible for deciding which integrations they enable and ensuring they are authorised to provide relevant information to those services.

Where Fieldlink provides artificial intelligence or automated assistance features, information submitted to those features may be processed by Fieldlink and relevant technology providers for the purpose of providing the requested functionality.

Fieldlink will configure and operate such functionality in accordance with applicable privacy obligations and relevant contractual arrangements.

AI-generated content may contain errors and should not be treated as a substitute for professional judgement, site verification, engineering advice, legal advice or safety-critical decision-making.

Fieldlink may disclose personal information where reasonably necessary:

• to provide the Services;
• to service providers acting on our behalf;
• to integrations authorised by a customer;
• to a customer's authorised users;
• where authorised by the individual concerned;
• where required or permitted by law;
• to protect the security, rights or property of Fieldlink, our customers, users or others;
• in connection with a merger, acquisition, financing, restructuring or sale of all or part of Fieldlink's business, subject to appropriate protections;
• for another purpose permitted under applicable privacy law.

We do not sell personal information as a data-brokerage business.

Fieldlink retains personal information for as long as reasonably necessary for the purposes for which it was collected, to provide the Services, to meet contractual obligations, maintain legitimate business and audit records, resolve disputes, enforce agreements, or comply with legal obligations.

Retention periods may differ depending on the type of information and the Fieldlink module involved.

Customers may also have legal obligations requiring certain construction, employment, health and safety, financial or other records to be retained for particular periods.

Deletion of information from the active application may not result in immediate deletion from encrypted backups or other systems where information is retained temporarily for security, disaster recovery, legal or technical reasons.

Individuals may have rights under the Privacy Act 2020 to request access to personal information held about them and to request correction of that information.

Requests can be made using the contact details below.

Before responding, we may need to verify the requester's identity.

Where information is controlled by a Fieldlink customer, we may refer or coordinate the request with that customer where appropriate.

There may be lawful grounds on which access or correction can be refused or limited.

Fieldlink may use cookies, local storage and similar technologies where reasonably necessary to:

• authenticate users;
• maintain sessions;
• remember settings;
• protect account security;
• understand application performance;
• diagnose errors; and
• improve the Services.

Where required, additional information may be provided through a cookie notice or consent mechanism.

Fieldlink is a business and workforce platform and is not intended as a general service for children.

Customers must ensure that any personal information relating to young persons entered into Fieldlink is collected and used lawfully and appropriately.

Fieldlink may update this Privacy Policy from time to time to reflect changes to:

• the Services;
• technology;
• security practices;
• service providers; or
• legal requirements.

The current version will be published on the Fieldlink website with its effective date.

Where a change materially affects how we handle personal information, we will take reasonable steps to provide appropriate notice where required.

Fieldlink has a privacy contact responsible for privacy matters.

Privacy enquiries, access requests, correction requests and privacy concerns can be sent to:

Privacy Officer
Fieldlink
Email: Privacy@fieldlink.co.nz
Website: www.fieldlink.co.nz

Individuals may also have the right to make a complaint to the Office of the Privacy Commissioner in New Zealand.

This Privacy Policy is intended to operate consistently with the laws of New Zealand.

Nothing in this Privacy Policy excludes, restricts or modifies any right, remedy, obligation or liability where doing so would be unlawful.

For privacy or security enquiries:

Fieldlink
New Zealand

Privacy: Privacy@fieldlink.co.nz
Website: www.fieldlink.co.nz