Sub-processors

Field 2 Service — list of sub-processors and third-party recipients

This page is referenced by, and forms part of, the Field 2 Service Data Processing Agreement (the "DPA"). Capitalised terms have the meanings given in the DPA.

---

How to read this page

We operate a general written authorisation for sub-processors under Article 28(2) GDPR. By accepting the DPA you authorise the sub-processors on this page, subject to the change-notice and objection rights in section 6.2 of the DPA and restated below.

The page is split by whose data is involved, because the two populations are separate:

• Section 1 — sub-processors that can reach your customers' data (Customer Personal Data). This is the list that matters for your own Article 28 assessment.
• Section 2 — processors that reach only your account-holder data, where Field 2 Service is the controller. Your customers' records never reach these.
• Section 3 — third parties that receive data but are not our sub-processors: they act as independent controllers, or they receive data because you configured them.
• Section 4 — third-party resources the staff application loads in the browser. No such resource is loaded by the customer portal, the public booking page or our marketing website.
• Section 5 — providers that appear in the product but that receive no personal data at all.

Most entries are conditional. If you leave the relevant feature switched off, no data reaches that sub-processor. The "Engaged when" column says which.

---

1. Sub-processors with access to Customer Personal Data

1.0 Destination countries

Customer Personal Data may be transferred to, and processed in, the following countries and territories, and no others: Ireland; the United States; and [[OWNER: hosting provider and data-centre location]].

This is a closed list of the destinations we choose, not an illustration. If a country is not named here, we do not send Customer Personal Data there, and none may be added except through the thirty-day change process in section 6. It does not cover transfers you direct — a webhook or API endpoint you configure, your own mail or SMS provider, or a payment provider you enable, whose entity and country are determined by it and by you. Those are the section 3 recipients, they are onward transfers made on your instruction under sections 4.6 and 8.5 of the DPA, and naming their destinations is yours to do where your own law requires it. Several laws require the destinations to be named rather than described — Singapore's transfer regulations require a transfer contract to specify the countries and territories; South Africa requires the onward-transfer restriction to be as strong as the original; Australia and Japan both expect the country to be named where that is practicable; and Canada expects customers to be told their data is processed abroad. The same list appears in section 15 of the Data Processing Agreement and the two must be kept in step.

1.1 Notes on section 1

• Only the configured AI provider is engaged. The three AI rows are alternatives, not a stack: the platform (super-admin) console names which of Anthropic PBC, X.AI LLC or OpenAI OpCo, LLC / OpenAI Ireland Ltd. is live, and Customer Personal Data is sent to that one alone. Switching the AI features off per company, or the platform recording a per-tenant opt-out, means no Customer Personal Data is sent to any AI provider. The customer-portal AI is separately gated, is off by default, and is read-only and scoped to the single signed-in customer. Images uploaded to the assistant are stored outside the web root and deleted after sixty minutes. Prompt caching is used only with Anthropic.
• Twilio is engaged only if you configure SMS. Every attempt is recorded in your own SMS log.
• Stripe is engaged only if you enable Stripe. Card numbers are entered by the payer directly on Stripe's hosted page; we never receive or store them.
• Stripe also acts on its own account. For fraud prevention, financial-crime compliance and its own regulatory obligations, Stripe processes payment data as an independent controller under its own privacy policy, in addition to acting as a processor for us. Read its privacy page.
• Your own mail and SMS providers are not in this section. Where you supply the credentials, you are choosing the recipient and it is not our sub-processor. Those entries are in section 3.

---

2. Processors of account-holder data only (Field 2 Service as controller)

Your customers' records never reach anything in this section. These providers see only the data of the people who hold or pay for a Field 2 Service account.

Destination countries for this section: Ireland and the United States, plus the country of the outbound mail relay once it is named. This section concerns account-holder data only, for which Field 2 Service is the controller; your customers' records never reach it.

---

3. Third parties that receive data but are not our sub-processors

Destination countries for this section: Google Maps Platform — Ireland and the United States. For every other row the destination is determined by you or by the recipient, not by us, so we cannot and do not name it: you choose the mail provider, the SMS account and the webhook endpoint, and PayPal's Privacy Statement makes the PayPal entity established in the payer's own jurisdiction the controller of that payer's information. Those destinations fall outside the closed list in section 1.0 because the data does not reach them as a transfer by us under the DPA — if your own law requires you to name them, they are yours to name. ⚠ We have not independently verified PayPal's list of group entities or their countries.

---

4. Third-party resources loaded by the staff application in the browser

These are not sub-processors — no record from your database is sent to them — but the staff user's IP address and browser details reach the provider when the page loads. They are disclosed here so that the picture is complete.

The customer portal, the public booking page and our marketing website load none of these. Verified: no external URL appears in the portal layout, the booking widget or any marketing-site page.

Destination countries for this section: Ireland and the United States. These three resources are the only third parties the staff application contacts from the browser.

---

5. Providers that receive no personal data

The product can store credentials for these payment providers and will make a credential-verification call to confirm the credentials work. Those calls carry the credential only — no customer data — and no live checkout rail exists for any of them.

They are therefore not sub-processors and are not authorised as such. If any of them is ever wired to a live payment rail, it will be added to section 1 under the thirty-day notice in section 6 below.

---

6. Changes to this list, and your right to object

6.1 Notice

Before we add or replace a sub-processor that will have access to Customer Personal Data, we give you at least thirty (30) days' notice, by:

1. updating this page, with a new version number and date and an entry in the change log below; and
2. emailing the account contact we hold for you.

Where a change must be made urgently to protect the security or continuity of the Services, we may make it sooner and will notify you as quickly as possible; your objection right then runs from that notice.

6.2 Objecting

You may object on reasonable data-protection grounds by emailing hello@field2service.com within the thirty-day notice period, saying which sub-processor and why. We will respond within ten business days, and we will do one of the following:

1. not appoint the sub-processor for your data;
2. make a reasonable change to the Services or your configuration so that the sub-processor does not process your data — for example, leaving the dependent feature switched off for your account; or
3. if neither is reasonably possible, tell you so, in which case you may terminate the affected part of the Services — or, if the sub-processor is essential to the Services as a whole, the subscription — without penalty, with a pro-rata refund of the fees you have paid for the unused period.

6.3 Staying informed

Email hello@field2service.com with "Sub-processor notices" in the subject line and we will add your address to the sub-processor notification list, in addition to your account contact. That list is held with the record described in section 6.4.

6.4 Our commitments on every sub-processor

Each sub-processor in section 1 or 2 that we appoint is engaged under a written contract imposing data protection obligations no less protective than those in our DPA, and we remain fully liable to you for its performance. The recipients in section 3 are not covered by that commitment, because you choose them and we do not contract with them.

For each sub-processor we record its legal entity, the service it provides, the categories of data it receives, its country, its own data protection terms, the transfer instrument relied on and the date we last checked it. Sections 1 to 3 of this page are that record, and the verification log in section 7 records when each provider's own document was last read — both are published rather than kept privately, so you can check the same facts we do. Section 8 is the change log for this page. Sections 7 and 8 are part of the published page, not internal notes, and they include entries recording recipients that have been removed; a removed recipient is stated in the past tense and receives nothing.

---

7. Verification log

Every non-AI URL on this page was fetched on 5 September 2026 and resolved successfully. The three AI providers' own published documents were read on 6 September 2026. The transfer-mechanism statements above record what each provider's own published document said on the date in its row.

What we have deliberately not claimed. We do not state that any provider holds a current EU-US Data Privacy Framework certification. Certifications are renewed annually and can lapse, and we have not verified any provider against the official list at https://www.dataprivacyframework.gov/list. Where the Framework is mentioned above, it is because the provider's own document mentions it — we rely on the Standard Contractual Clauses and the UK Addendum, which do not lapse.

---

8. Change log