Deleting your account and your data
Digital Field Book — how erasure works here, and who asks whom
This page explains what deleting an account means in Digital Field Book, how to ask for it, how long it takes and what is kept afterwards. It states nothing the privacy notice does not; it sets the same facts out as a procedure, because "how do I delete my account" is a question a notice answers in a paragraph and a person needs answered in steps.
In short
- If you administer the company account, you can erase the whole company — every user, every parcel, every operation and every uploaded document — from the Company Settings page, and you choose whether the records are anonymised or destroyed outright. The one exception is described below: if the confirmation email cannot be sent, our staff may complete the request and make that choice themselves.
- If you are a member of a company somebody else administers, ask that administrator to erase your account; they can do it from the user list. They created it, and what is recorded about your work is their decision, not ours.
- If nobody answers you, write to gdpr@fuzzy-works.com. We acknowledge you, take it to the company, and hold it to the one-month deadline the Regulation sets.
None of this costs anything, and asking for erasure is never a reason to be treated differently afterwards.
Why there are two routes and not one
Digital Field Book is used by companies. A company decides which of its people get an account, what is recorded about the work they do and how long that record is needed. In the language of the Regulation the company is the controller and we are its processor, and that is why the delete button a consumer application would put on your profile is not there: your account is the company's record of its own workforce, and a service provider that deleted it on request would be destroying its customer's records without being asked to.
The same reasoning runs the other way. The person who administers the company account can have everything deleted, their own account included, without needing our agreement — because it is theirs to delete. We carry the deletion out; we do not decide it.
Deleting the whole company account
A company administrator starts this from the Company Settings page inside the application. Nothing is deleted at the moment of asking: a single-use link is emailed to the company's first administrator — the oldest active administrator account, which is whoever set the company up and is not necessarily the person who asked — and nothing happens until somebody opens it, unless the email cannot be sent at all (the end of this section says what happens then). The link is valid for 3 days and works once.
Following it asks which of two things should happen. They are genuinely different, and the choice is the customer's — except in the one case described at the end of this section, when the confirmation could not be sent and our staff make it:
- Anonymisation
- Every name, email address and telephone number recorded about a person is removed, and so is every uploaded document; the agronomic record — parcels, crops, operations, yields — is kept with no account or employee attached to it. What the company typed itself is kept as it was written: its notes, and the names it gave its own fields, sheds, animals and flocks. If a person is named in one of those, the name stays — correct it before asking, or choose complete deletion. Choose this when the farming history still has to be produced for an inspection or a subsidy file, but the people in it no longer need to be named.
- Complete deletion
- Everything goes: users, employees, parcels, operations, vehicles, documents and the files behind them. Nothing is recoverable afterwards, by us or by anybody else.
Opening the link and choosing records the choice; it does not carry it out. We release the erasure afterwards, as a separate step, and the gap is deliberate: an operation this final should not be one click away from whoever happens to hold a link. If it is not released before the confirmation lapses, nothing is deleted and the whole request has to be made again.
Once released, both run as one operation and both are irreversible. Uploaded files are removed from storage as well as from the database, and if any file could not be removed the count is recorded rather than assumed to be zero, so that it can be chased.
Deleting one person's account
Ask the administrator of the company that created your account. They can deactivate your user at any time, and they can erase it from the user list. Erasing it removes your name, email address and telephone number, your sign-in history, your sessions and connected devices, your two-factor authentication and what you wrote to support, and your email address becomes free to use again, at this company or any other. It cannot be undone. What you recorded for the company stays in its registers under an account number with no name attached, because the register of operations is the company's record of its own work.
Two things an account erasure does not reach, and it is better to say so than to let you find out. A note somebody typed into a register is kept as it was written, so if one names you, ask for it to be corrected as well. And if you also stand on the work log as an employee who carried out an operation, that is a separate record the company keeps about its workforce: say so too — an account that no longer signs in and a record that no longer names you are not the same thing, and only the second one is erasure. The accounts of the company's administrators cannot be erased this way, their own included: an administrator's account is erased with the company. An administrator who is leaving a company that carries on can write to gdpr@fuzzy-works.com, and we will take it up with the company.
If you would rather not go through them, or they do not reply, write to gdpr@fuzzy-works.com. Tell us the email address the account uses and, if you know it, the name of the company. We confirm that we have your request, pass it to the company, and support them in answering you in time. Where the law requires us to act ourselves rather than on their instructions, we do.
Before you delete anything, consider taking a copy of it. Your account page will email you an export of everything held about you, in a form you can read and a form another system can import, and it is worth doing first: after an erasure there is nothing left to export.
If you have no account in the application
Some of the people whose data ends up in Digital Field Book have no account and never see the application. That is the case for employees recorded by a company for its work log, and for the owners, tenants and beneficiaries named on a parcel record. The Regulation applies to them exactly as fully as it does to a user with a password.
- The company that entered your data is the one answerable for it: it decided to collect it, it knows why, and it can correct or delete it from within the application.
- That company is obliged to inform you about the processing (Art. 14) -- including the fact that the data is held in an application hosted by us.
- We act on the company's instructions. If you write to us directly we will acknowledge you, pass the request to the company, and support it in answering you in time.
If you do not know which company to approach, write to gdpr@fuzzy-works.com with what you do know and we will tell you.
How long it takes
- A company erasure runs within seconds of being released. Releasing it is a second checkpoint after the confirmation link, and it exists because the operation cannot be undone.
- The confirmation link is valid for 3 days. Nothing is lost by letting one lapse — ask again and a fresh link is sent.
- A request that arrives by email is answered within one month of us receiving it (Art. 12(3)). If it is complex we may extend that by up to two further months, and we tell you so, and why, inside the first month rather than at the end of it.
What is kept afterwards, and why
An erasure that left no trace of itself could not afterwards be shown to have happened — which cuts both ways, since it could not be disproved either. We therefore keep a register of erasures: the date, which of the two modes was used, how many accounts and documents were affected, who released it, and whether the company confirmed it or our staff completed it without the confirmation. It holds no names, no addresses and not even the company name. A register of deletions that identified the people deleted would be a deletion that did not happen.
Two other things survive, and both are limited on purpose. Accounting records of a paid subscription are kept for as long as tax law requires them and for no other reason. And a backup taken before the erasure still contains the data until that backup ages out of its own cycle; backups are not searched, and are restored only after a disaster.
Everything else has a stated period enforced by a scheduled job rather than by good intentions. This is the same table the privacy notice prints, generated from the code that does the deleting:
| What is kept | For how long | Deleted by |
|---|---|---|
| Access and change log — IP address, browser, account, what was done | 30 days | cli/purge_log.php |
| Record change history — which record somebody created, changed or deactivated, and what an edited register entry said before | 1095 days | cli/purge_log.php |
| Sign-in history and security events — IP address, browser, account, what was done | 365 days | cli/purge_log.php |
| Failed sign-in attempts — email address and IP address | 7 days | cli/purge_login_attempt.php |
| Expired or revoked mobile device tokens — device name, last used | 30 days | cli/purge_api_token.php |
| Active web sessions — IP address, browser, last activity | Until sign-out, or 120 minutes of inactivity | cli/purge_session.php |
| Account and employee data, land owner names | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Planned and recorded field operations, vehicle operations and boundary history | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Who created and who last changed each company record — the account and the date | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Uploaded documents and their metadata | Removed on request, or with the company account | Not deleted automatically |
| Scouting notes (text, kind, photo reference, optional position and author): for the lifetime of the company account. The position and the author are removed by the anonymising erasure; the whole note by the deleting one. | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The position your handset recorded when you saved a field or vehicle entry, with how accurate it was and who saved it: for as long as that entry exists. It is what lets an inspection years later see that the entry was made in the field. The anonymising erasure clears the coordinates and the operator; the deleting one removes the row | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Registered machines and handsets — the device name, the identifier it reports, and which user a handset belongs to. Customers frequently make the name a person’s name, which is why it is listed here | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Support requests raised from inside the product — who raised it, which page from, the free text of the report and of our answer | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The livestock register — animals, groups, events, grazing and breeding, including the attending veterinarian, whom an animal was bought from or sold to, and the reference of a hired sire. These are third-party names a customer typed, and the anonymising erasure clears them | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Harvest lots and where they went — including the buyer a customer named | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The vehicle register — machines, implements, their operations and their reminders, including the registration plate | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Raw readings sent in by machines and sensors the customer has connected - a position, a work session, a fuel or soil value, with the time the device recorded it. Kept briefly: a reading exists to be turned into a proposed field operation for somebody to confirm, and once that has happened the record it produced lives elsewhere. | 90 days | cli/purge_device_reading.php |
| A short-lived note that a write from a mobile phone has already been carried out, so that a phone which lost its connection and sent the same work again does not record it twice. It holds no names, no positions and no document contents - only which kind of write a signed-in user made, at what minute, and what answer they got. Kept for about a week, which is how long a phone may plausibly be out of coverage with unsent work still on it. | 7 days | cli/purge_api_idempotency.php |
| Records of access and portability requests — which account asked, from which address, when, and how often the link was used | 365 days | cli/purge_data_export_request.php |
| Finished erasure requests — which account asked and when, whether it was confirmed, the mode, when and by which of our staff it was carried out, and any reason our staff recorded for completing it without the confirmation. A request still in progress is never deleted | 365 days | cli/purge_company_erasure_request.php |
| Records of data takeouts — which account took a copy, from which address, when, and how much data | 365 days | cli/purge_company_takeout.php |
| Acceptance of the data processing agreement — the name typed as a signature, the address and the browser it was typed from, and which text was accepted | For as long as the contract could be disputed. The name, the address and the browser are removed by an erasure; the record that the contract was accepted, and of which text, remains | Not deleted automatically |
| Finished requests to exercise a right that reached us by email — which right, the address it came from, what was asked, the deadline and what was decided. A request still open is never deleted, at any age | 1095 days | cli/purge_data_subject_request.php |
| Payment notifications received from Paddle - the billing contact's name and address as the payment provider sent them. The record that a notification arrived is kept beyond this period, but carries no personal data once the body has been emptied. | 365 days | cli/purge_paddle_event.php |
| Signups started on the public website - the company name, and the name and email address of the person who started one. Kept only as long as a recent purchase may still need reconstructing; most of these rows belong to people who never became customers. | 180 days | cli/purge_company_signup.php |
| Database backups — a complete copy of the database, taken before every deployment as the only rollback a migration has. It contains whatever the database contained at that moment | 30 days, then the copy is deleted. Backups are not searched and are restored only after a disaster, so data erased in the live system can survive in a backup until that backup is deleted | Not deleted automatically |
| The working directory a download is built in — while an access copy or a data takeout is being assembled, the file being built sits on the server. It is deleted as soon as the download finishes | Deleted the moment the download completes; anything a failed or interrupted download leaves behind is removed within 6 hours | cli/purge_staging.php |
Contact and complaints
- Controller
- Fuzzy Works S.R.L., 38442280, Bumbacului nr. 19 bloc PB21 ap. 2, Oradea 410591, Bihor
- Email for data protection matters
- gdpr@fuzzy-works.com
If our answer does not satisfy you, you may approach the supervisory authority:
- Supervisory authority
- Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucureşti, România
- anspdcp@dataprotection.ro — https://www.dataprotection.ro