Data Processing Addendum

Version: 1.0

Effective date: The date on which Customer accepts this Addendum or enters into an Order incorporating it.

This Data Processing Addendum (“DPA”) forms part of the agreement between:

Processor: InnOneWeb OÜ, an Estonian private limited company (OÜ), registry code 16826593, registered address Sakala 7-2, 10141 Tallinn, Estonia, doing business as FieldCosts (“FieldCosts”); and

Controller: the customer entity that has entered into the FieldCosts Terms of Service or an applicable Order (“Customer”).

FieldCosts and Customer are each a “Party” and together the “Parties.”

1. Scope and hierarchy

1.1. This DPA applies where FieldCosts processes Personal Data on behalf of Customer in connection with the FieldCosts Service.

1.2. This DPA supplements the FieldCosts Terms of Service and applicable Orders.

1.3. In the event of conflict:

1. this DPA controls for data-protection matters;
2. an applicable transfer mechanism controls for restricted-transfer matters;
3. the Order controls for commercial matters;
4. the Terms of Service control for all remaining matters.

2. Definitions

Terms such as Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing, Subprocessor, and Supervisory Authority have the meanings given in applicable Data Protection Law.

“Applicable Data Protection Law” means all data-protection and privacy laws applicable to the Processing under this DPA, including, where applicable:

• Regulation (EU) 2016/679 (GDPR);
• the UK GDPR and Data Protection Act 2018;
• the Swiss Federal Act on Data Protection;
• applicable United States state privacy laws; and
• implementing or successor legislation.

“Customer Personal Data” means Personal Data contained in Customer Content and processed by FieldCosts on Customer’s behalf.

“Restricted Transfer” means a transfer of Personal Data requiring an approved transfer mechanism under Applicable Data Protection Law.

“Service” means the FieldCosts websites, web application, mobile applications, APIs, integrations, support, and related services covered by the agreement.

3. Roles of the Parties

3.1. Customer is the Controller or Business of Customer Personal Data.

3.2. FieldCosts is the Processor or Service Provider of Customer Personal Data.

3.3. Each Party will comply with the obligations applicable to its role.

3.4. Customer is solely responsible for:

• determining the purposes and essential means of Processing;
• having a lawful basis;
• providing required privacy notices;
• responding to Data Subjects;
• ensuring Customer instructions comply with law; and
• ensuring that Customer Personal Data may lawfully be submitted to the Service.

3.5. FieldCosts may process certain account, security, billing, support, and business-contact data as an independent Controller, as described in the FieldCosts Privacy Policy.

4. Processing instructions

4.1. FieldCosts will process Customer Personal Data only:

• on Customer’s documented instructions;
• as necessary to provide, secure, maintain, and support the Service;
• to comply with applicable law; or
• as otherwise permitted by this DPA.

4.2. The agreement, Customer’s use and configuration of the Service, enabled integrations, support requests, and written instructions constitute documented instructions.

4.3. If FieldCosts reasonably believes an instruction violates Applicable Data Protection Law, FieldCosts will notify Customer and may suspend the affected Processing until the instruction is confirmed, modified, or withdrawn.

4.4. FieldCosts will not:

• sell Customer Personal Data;
• retain, use, or disclose Customer Personal Data outside the direct business relationship except as permitted by law and the agreement;
• combine Customer Personal Data with data received from another person except as necessary to provide the Service or as legally permitted;
• use Customer Personal Data for cross-context behavioral advertising; or
• use Customer Personal Data to train a general-purpose AI model for unrelated third parties unless Customer expressly authorizes that use in writing.

5. Details of Processing

The details required by Article 28 GDPR are set out in Annex 1.

6. Confidentiality

6.1. FieldCosts will ensure that persons authorized to process Customer Personal Data:

• are subject to confidentiality obligations;
• receive access only where necessary for their duties; and
• process Customer Personal Data only on authorized instructions.

6.2. Confidentiality obligations survive termination of employment, engagement, or access.

7. Security

7.1. FieldCosts will maintain technical and organizational measures appropriate to the risk, taking into account:

• the state of the art;
• implementation costs;
• the nature, scope, context, and purposes of Processing; and
• risks to the rights and freedoms of natural persons.

7.2. The current measures are described in the FieldCosts Security and Technical & Organizational Measures document and Annex 2.

7.3. FieldCosts may update security measures provided the overall level of protection is not materially reduced.

7.4. Customer acknowledges that no system can guarantee absolute security and is responsible for:

• secure devices and credentials;
• appropriate role and permission configuration;
• prompt removal of former users;
• lawful and secure integration settings; and
• maintaining independent copies of records where legally or operationally required.

8. Subprocessors

8.1. Customer grants FieldCosts general written authorization to use Subprocessors.

8.2. FieldCosts will maintain a public Subprocessor List at https://fieldcosts.com/subprocessors.

8.3. FieldCosts will provide at least 15 days advance notice of a new Subprocessor that will process Customer Personal Data, except where urgent replacement is necessary for security, continuity, or legal compliance.

8.4. Customer may object within the notice period on reasonable data-protection grounds.

8.5. The Parties will work in good faith to resolve an objection. If no reasonable resolution is available, Customer may terminate the affected Service before the new Subprocessor begins Processing. Customer’s exclusive remedy is termination of the affected Service and a pro-rata refund of prepaid fees for the unused terminated period.

8.6. FieldCosts will impose materially equivalent data-protection obligations on each Subprocessor.

8.7. FieldCosts remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law.

9. Data Subject requests

9.1. Taking into account the nature of Processing, FieldCosts will provide reasonable assistance for Customer to respond to requests to exercise privacy rights.

9.2. If FieldCosts receives a request concerning Customer Personal Data:

• FieldCosts will not respond substantively unless required by law or authorized by Customer;
• FieldCosts will redirect the requester to Customer where appropriate; and
• FieldCosts will notify Customer without undue delay.

9.3. Assistance beyond standard Service functionality may be charged at reasonable professional-services rates where legally permitted and agreed in advance.

10. Security incidents and Personal Data Breaches

10.1. FieldCosts will notify Customer without undue delay after confirming a Personal Data Breach affecting Customer Personal Data.

10.2. Notification will include, to the extent known and available:

• the nature of the breach;
• affected systems and Processing;
• categories and approximate number of affected Data Subjects;
• categories and approximate number of records;
• likely consequences;
• mitigation and remediation measures;
• relevant contact details; and
• available information needed for Customer’s legal assessment.

10.3. FieldCosts may provide information in phases.

10.4. Notification does not constitute an admission of fault or liability.

10.5. Customer is responsible for determining whether notice to a Supervisory Authority, Data Subject, customer, insurer, or other person is legally required, unless FieldCosts acts as Controller for the affected data.

11. Assistance and compliance

Taking into account the nature of Processing and information available, FieldCosts will reasonably assist Customer with:

• security obligations;
• Personal Data Breach assessments;
• data-protection impact assessments;
• prior consultation with Supervisory Authorities;
• Data Subject requests; and
• demonstrating compliance.

12. Audits and information rights

12.1. FieldCosts will make available information reasonably necessary to demonstrate compliance with this DPA.

12.2. Customer should first rely on:

• the Security/TOMs document;
• independent audit reports or certifications, if available;
• penetration-test summaries, if available;
• completed security questionnaires; and
• other standard compliance materials.

12.3. If those materials are insufficient, Customer may request one audit per 12-month period, unless a confirmed Personal Data Breach or Supervisory Authority requires more frequent review.

12.4. Audits must:

• be scheduled with at least 30 days’ notice;
• occur during normal business hours;
• avoid disruption;
• protect other customers and confidential information;
• use an independent auditor bound by confidentiality;
• exclude access to source code, vulnerability details, and other customers’ data unless legally required; and
• be conducted at Customer’s cost.

12.5. FieldCosts may charge reasonable costs for audit support beyond ordinary compliance assistance.

13. Return and deletion

13.1. During the subscription, Customer may use available export and deletion functions.

13.2. On termination, FieldCosts will, at Customer’s choice and subject to the agreement:

• provide a reasonable export opportunity; and
• delete or return Customer Personal Data.

13.3. A workspace closure request starts a 30-day read-only export and cancellation period. After that period, organization-owned rows and files are erased by the scheduled deletion process.

13.4. FieldCosts may retain limited data where required by law, for legal claims, security, or fraud prevention. A documented workspace legal hold pauses scheduled cleanup and final deletion for that workspace until the hold is reviewed and released. Application-managed backups expire after 30 days when enabled; provider snapshots expire under the provider contract.

13.5. Retained data remains protected, access-restricted, and is not used for unrelated purposes.

14. International transfers

14.1. FieldCosts will not make a Restricted Transfer without a valid transfer mechanism.

14.2. Valid mechanisms may include:

• an adequacy decision;
• the European Commission Standard Contractual Clauses;
• the UK International Data Transfer Addendum or Agreement;
• the EU-U.S. Data Privacy Framework where legally available and applicable; or
• another legally recognized safeguard.

14.3. Where the European Commission Standard Contractual Clauses are required:

• Module 2 applies to Controller-to-Processor transfers;
• Module 3 applies to Processor-to-Processor transfers;
• the docking clause applies;
• the optional independent dispute-resolution language does not apply unless agreed;
• the competent Supervisory Authority is determined under the SCCs;
• governing law is the law of Estonia where permitted;
• courts are the courts of Estonia where permitted;
• Annexes 1–3 of this DPA populate the relevant SCC annexes.

14.4. FieldCosts will provide reasonable information needed for transfer-risk assessments, subject to confidentiality and security limitations.

15. United States service-provider terms

Where a U.S. state privacy law applies and FieldCosts processes Personal Data as a service provider, contractor, or processor:

• Customer discloses Personal Data only for the limited and specified business purposes in Annex 1;
• FieldCosts will process it only for those purposes and as permitted by law;
• FieldCosts will provide the same level of privacy protection required by applicable law;
• Customer may take reasonable and appropriate steps to verify compliant Processing;
• FieldCosts will notify Customer if it determines it can no longer meet its obligations; and
• Customer may take reasonable and appropriate steps to stop and remediate unauthorized use.

16. Liability

Liability arising under this DPA is subject to the exclusions and limitations of liability in the Terms of Service, except to the extent prohibited by Applicable Data Protection Law.

17. Term

This DPA remains effective while FieldCosts processes Customer Personal Data.

---

A. Subject matter

Provision of the FieldCosts business operations, job-costing, receipt, expense, approval, reimbursement, invoicing, reporting, file, mobile, and integration Service.

B. Duration

For the subscription term and the post-termination export, backup, legal-hold, and deletion periods described in the agreement and Retention Policy.

C. Nature and purpose

• hosting and storage;
• account and workspace administration;
• authentication and authorization;
• customer, job, schedule, assignment, and team management;
• receipt capture and OCR;
• expense review and approval;
• reimbursement tracking;
• invoice generation and status tracking;
• reports and exports;
• mobile synchronization;
• file storage;
• support and troubleshooting;
• security monitoring;
• backup and recovery;
• customer-enabled integrations.

D. Categories of Data Subjects

• Customer employees;
• Customer contractors and field workers;
• Customer administrators;
• Customer clients and prospective clients;
• Customer suppliers and vendors;
• Customer billing and accounting contacts;
• persons appearing in uploaded receipts, invoices, files, photos, notes, or communications.

E. Categories of Personal Data

• names;
• business and personal contact details;
• job titles, roles, assignments, and permissions;
• account identifiers and authentication metadata;
• client and job addresses;
• schedules, notes, job status, and service details;
• receipt images and extracted receipt information;
• vendor names, purchase dates, amounts, taxes, and payment method descriptors;
• expenses, approvals, rejection reasons, and reimbursements;
• invoice data and payment status;
• uploaded files and photos;
• device, IP, log, and audit information;
• support communications;
• integration data.

F. Special categories

The Service is not intended for special-category data, protected health information, biometric identifiers, full payment-card data, or criminal-offence data. Customer must not submit such data unless expressly authorized in writing.

G. Frequency

Continuous or recurring during use of the Service.

H. Retention

As described in the FieldCosts Data Retention Policy, Customer configuration, and applicable Order.

---

The FieldCosts Security and Technical & Organizational Measures document is incorporated into this Annex.

---

The FieldCosts public Subprocessor List is incorporated into this Annex.