Privacy notice
Digital Field Book mobile application (Android)
Version 19, in force from 2026-10-03
This notice covers the phone application. The mobile application works with the same account and the same data as the web application, but collects it differently: it uses no cookies, and instead keeps an authentication token on the phone. Those differences are why there is a separate notice.
In short
- The mobile application uses no cookies and shows no advertising. It records your location only if your company and you have both switched position recording on, and never in the background. One button uses your location without recording it: when you press "Which parcel am I in?" on the register form, the application asks Android for your position -- Android first asks your permission if you have not given it -- even when position recording is off, uses it on the phone to find the parcel, and then discards it; the position is never sent or stored. The application does not hold the camera permission (a scouting photograph is taken by the phone's own camera application, which hands back that one picture) and cannot browse your files.
- No behavioural analytics tool and no advertising service is embedded in it.
- After you sign in, the phone receives a token valid for 90 days. Every request to the server is made with it; it is the thing to protect if you lose the phone.
- You can see all your connected devices and revoke any of them from the account page in the web application.
- The data remains your company's; the mobile application is simply another window onto it.
Who is answerable for your data
The roles are the same as in the web application. The company whose account you use is the controller for the data it enters; we, Fuzzy Works S.R.L., are the processor and handle it only on its instructions. For the security data of the sign-in itself -- IP address, device, time -- we are the controller, in our legitimate interest.
What the application sends to the server
- At sign-in
- Your email address, your password and, if you have two-factor authentication turned on, the generated code. It also sends the device's name and platform, so that you can recognise it in the list of connected devices.
- On every request
- The authentication token. The server records the IP address and the time it was used.
- When you record an operation
- The parcel, vehicle, accessory, employee, substances and quantities you selected, and the account that recorded them.
- When you upload a document
- The JPEG or PDF file and the record you are attaching it to. Images are re-encoded on the server, which also strips the photograph's EXIF data, including GPS coordinates if the camera wrote any.
- When you record a scouting note
- The parcel, what you saw, the growth stage, an optional photograph (re-encoded like every upload) and -- only if your company and you have both switched position recording on -- where you were when you made the note, with the accuracy the phone reported. If your company has also switched on photo guidance and the platform has a provider configured, the photograph and your text are sent to that provider, named in the recipient table below, for a short second opinion that is stored beside the note; your position, the parcel name and your name are not sent.
- When position recording is on
- Only if your company and you have both switched it on. Where you were at the moment you saved a field operation or a vehicle entry, with the accuracy the phone reported; an entry saved without signal keeps its position on the phone and sends it right after the entry. While a work session you started is running, its track -- your position at the interval your company set, with the time of each -- sent as one reading when you stop the session, from which the server proposes a field operation for somebody to confirm. To enrol the phone for this, the application sends a random identifier it generated once and the phone's model name; the server keeps only a fingerprint of the identifier.
- When you send a support ticket
- The text you wrote and the account it came from.
- When you search the national cadastre
- Only if you have allowed it on the phone, which it asks the first time and which you can switch off in Settings. The cadastral number you searched for and the UAT you searched in. Our server passes the number and the UAT's code to the national cadastre (ANCPI) and returns the parcel's boundary to show on the map; the boundary is not stored.
The application receives your company's data from the server: parcels and their boundaries, vehicles, accessories, employees, documents and catalogs. The personal data within them is as described in the web application's notice.
What stays on the phone
Everything the application holds on the device, and when each of them goes. The token is valid for 90 days from sign-in; signing out invalidates it on the server as well, so a token copied off a signed-out phone is of no use to anybody.
| What is stored | Why it is there | Until when |
|---|---|---|
| The authentication token | Proves who you are on every request. Held in the application's own encrypted storage, which the operating system keeps from other applications. | Sign-out, or uninstall |
| Your email address | So the settings screen can say whose account this is. Cleared when you sign out, so a shared handset does not show the last person's address to the next. Your password is not stored. | Sign-out, or uninstall |
| The catalogs | Crops, products and operation types, so the recording screens work where there is no signal. Platform-wide reference data with nothing personal in it. | Sign-out, or uninstall |
| The parcel, machine, employee and legal entity lists | The parcels, machines, accessories and employees of your company, and the legal entities it keeps records for (the company and its sub-companies, by name), saved on the phone so a record can be started where there is no signal. Cleared when you sign out. | Sign-out, or uninstall |
| Documents you opened | A downloaded document is written to the application's cache so a viewer can open it. | Sign-out, or uninstall |
| Your answer about the map background | Whether you allowed the map background to be fetched, so you are not asked on every map. Changeable at any time from Settings. | Sign-out, or uninstall |
| Your answer about the national cadastre search | Whether you allowed the map to search the national cadastre (ANCPI) for a cadastral number you do not hold, so you are not asked on every search. Changeable at any time from Settings. | Sign-out, or uninstall |
| Map background tiles | The imagery already fetched, kept so that panning the same area does not fetch it again. Only ever present if you allowed the background. | Sign-out, uninstall, or the moment you withdraw the consent |
| Which version of this notice you have seen | One number, so the application can show you this notice again when it changes and stay quiet when it has not. | Uninstall |
| The chosen server and the device name | The address the application talks to, and the name this device appears under in your list of connected devices. | Uninstall |
| Which notifications you have already been shown | A short list of markers, so that the same reminder is not announced to you every hour. It stays on the phone and is never sent anywhere — the server keeps no record of what you have read, which is why signing out and back in can announce what is still outstanding once more. | Sign-out, or uninstall |
| Whether you want notifications | Your answer to the notification question, so you are not asked again. Kept past sign-out on purpose: it is a choice about this phone rather than about the account, and clearing it would mean switching them off again after every sign-out. | Uninstall |
| Work recorded with no signal | Work you recorded while the phone had no signal, waiting to be sent. This is the only thing the application keeps that exists nowhere else - a spraying you recorded in a valley is on this phone and on no server anywhere - so it is deliberately NOT cleared when you sign out or when a session expires. It is deleted item by item as each one reaches the server. | The moment it reaches the server - not sign-out, and not session expiry |
| Files waiting to upload | A copy of any photograph or document you attached while offline, kept in the application's own private storage until the upload succeeds. The copy is needed because the file you picked stops being readable once the application closes, and a queue holding only a reference would quietly upload nothing. It is deleted as soon as the upload is confirmed. | The moment it reaches the server - not sign-out, and not session expiry |
| Positions saved with an entry, not yet sent | Where you were when you saved an entry that has not reached the server yet. The position waits here with the entry it belongs to and is sent right after it; if either position switch is turned off, it is deleted rather than sent. A work session's track is not kept here: the application holds it in memory while the session runs, deletes it unsent if you sign out or a switch goes off, and when you stop the session the track joins the work waiting to be sent, above - which the server refuses if position recording has been switched off in the meantime. | The moment it reaches the server - not sign-out, and not session expiry |
| This phone's sending credential | The credential this phone uses to send position readings, one for each person who turns position recording on here. It can only send - it cannot read your parcels, your colleagues or your documents - and it is replaced each time that person's enrolment is renewed. | Uninstall |
| A random identifier for this installation | A random value generated once on this phone, so that re-enrolling finds the same registration instead of leaving a dead one behind every time. It is random rather than derived from anything about you or the handset. It is sent to the server when this phone is enrolled for position recording, and the server keeps only its fingerprint, never the value itself. | Uninstall |
| Which screens your sign-in may use | The list of server functions your role and your company's enabled features allow, so the menu can leave out screens the server would refuse. It names no person and holds no farm data. | Sign-out, or uninstall |
| Which picture guides were already shown | Markers saying which of the wordless picture guides this phone has already shown, per signed-in account, so each appears once and can still be replayed from the settings screen. Kept past sign-out so a shared phone teaches the next person without re-teaching you. | Uninstall |
Work you record with no signal waits on the phone until there is one, and it is the only thing in this list that exists nowhere else. None of it is included in the phone's backup, which is deliberate: the alternative is your farm records, and the positions attached to them, sitting in a backup service that is neither your company's nor ours. One consequence follows, and we would rather you read it here than discover it -- updating the application keeps work that is still waiting, moving to a new phone does not. Let the queue empty, which it does as soon as the phone has a network, before you hand the old phone on.
Your password is not on this list, and that is not an omission: the application does not keep it. It is sent once when you sign in and is not written to the device at all.
The permissions the application asks for
The table below is generated from the application's own declaration, so it is exactly what the installed build asks for. Two kinds of entry are in it: permissions Android asks you about in a dialog you can refuse (notifications, and your location), and permissions granted silently at installation because they give access to nothing of yours (the network, restarting after a reboot, running a work session in the foreground).
| Permission | What it is for | Does it ask you? |
|---|---|---|
| Internet access | To reach the server. Without it the application has nothing to do. | No — it gives access to nothing of yours |
| Network state | To tell whether there is a connection, so that a failure in the field can be reported as "no signal" rather than as an error. | No — it gives access to nothing of yours |
| Notifications | To show a notice on your phone when a service interval falls due, or when a support request you opened is answered. The application asks our server on a schedule, over the same connection as everything else it does, and tells you what it found — no notification service sends anything to your phone. You may refuse, and everything else works exactly as before. | Yes — you are asked, and may refuse |
| Start after the phone is switched on | So that the scheduled check survives the phone being switched off and on again. It gives access to nothing of yours: it means only that the check is registered again after a restart, rather than staying silent until you next open the application. | No — it gives access to nothing of yours |
| Precise location | To record where you were when you save a field operation, to draw the track of a work session you start yourself, and to find the parcel you are in when you press "Which parcel am I in?". It is used only while you have a work session running, at the moment you save an entry, or when you press that button - the application does NOT hold the background location permission, so it cannot read your position at any other time, and Android shows a notification for the whole time a session is running. A position is recorded and sent only when your company has switched position on and you have switched it on for this phone. The button is the one exception to those switches, because it records nothing: Android asks you for this permission when you press it, even with position recording off, and the position stays on the phone, is used to find the parcel and is then discarded - it is never sent or stored. | Yes — you are asked, and may refuse |
| Approximate location | The approximate version of the permission above. If you grant only this one, everything still works: the position saved with an entry is less precise, and how precise it was is stored and shown beside the point so nobody mistakes an approximate fix for an exact one. | Yes — you are asked, and may refuse |
| Running while the screen is off | So a work session keeps running while the screen is off and the phone is in your pocket. Without it Android would stop the session as soon as you put the phone away, which for a day in a field means losing the record. | No — it gives access to nothing of yours |
| Running while the screen is off, using location | The specific kind of the permission above: it tells Android that the running session uses your location, which is why a notification stays on your screen for as long as it runs. That notification is deliberate - it is how you can always see that a session is recording, and it is the reason the application does not need the background location permission at all. | No — it gives access to nothing of yours |
Three things follow. The application records your location only after your company AND you have switched position recording on, never asks for background location, and can therefore take a position only while a work session you started is running, at the moment you save an entry, or when you press "Which parcel am I in?" on the register form. That button is the one reading the two switches do not govern, because it records nothing: Android asks you for the permission when you press it, even with position recording off, and the position stays on the phone, is used to find the parcel and is then discarded -- it is never sent or stored. Before Android's own dialog, the application shows a screen of its own saying what the position will be used for, and if you choose "Not now" nothing is asked. It does not hold the camera permission: a scouting photograph is taken by the phone's own camera application, which hands back that one picture and nothing else. And it cannot browse the files on your phone: when you attach a document you pick it through the system file chooser, which hands the application that one file -- which is why no storage permission is needed, and why the application never sees anything you did not choose.
Why we process this data
The purposes and legal bases are those in the web application's notice: providing the service and performing the contract, the agricultural traceability the law requires, account security in our legitimate interest, and operational communications. The mobile application adds no new purpose.
The map in the mobile application takes its imagery from the same place the web application does: our own server, which draws it from OpenStreetMap data. Where the application asks your permission to load the map background, the basis is your consent and you can withdraw it from the application's settings.
How long we keep it
Data on the server is kept under the same rules as data entered from a browser:
| What is kept | For how long | Deleted by |
|---|---|---|
| Access and change log — IP address, browser, account, what was done | 30 days | cli/purge_log.php |
| Record change history — which record somebody created, changed or deactivated, and what an edited register entry said before | 1095 days | cli/purge_log.php |
| Sign-in history and security events — IP address, browser, account, what was done | 365 days | cli/purge_log.php |
| Failed sign-in attempts — email address and IP address | 7 days | cli/purge_login_attempt.php |
| Expired or revoked mobile device tokens — device name, last used | 30 days | cli/purge_api_token.php |
| Active web sessions — IP address, browser, last activity | Until sign-out, or 120 minutes of inactivity | cli/purge_session.php |
| Account and employee data, land owner names | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Planned and recorded field operations, vehicle operations and boundary history | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Who created and who last changed each company record — the account and the date | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Uploaded documents and their metadata | Removed on request, or with the company account | Not deleted automatically |
| Scouting notes (text, kind, photo reference, optional position and author): for the lifetime of the company account. The position and the author are removed by the anonymising erasure; the whole note by the deleting one. | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The position your handset recorded when you saved a field or vehicle entry, with how accurate it was and who saved it: for as long as that entry exists. It is what lets an inspection years later see that the entry was made in the field. The anonymising erasure clears the coordinates and the operator; the deleting one removes the row | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Registered machines and handsets — the device name, the identifier it reports, and which user a handset belongs to. Customers frequently make the name a person’s name, which is why it is listed here | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Support requests raised from inside the product — who raised it, which page from, the free text of the report and of our answer | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The livestock register — animals, groups, events, grazing and breeding, including the attending veterinarian, whom an animal was bought from or sold to, and the reference of a hired sire. These are third-party names a customer typed, and the anonymising erasure clears them | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Harvest lots and where they went — including the buyer a customer named | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The vehicle register — machines, implements, their operations and their reminders, including the registration plate | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Raw readings sent in by machines and sensors the customer has connected - a position, a work session, a fuel or soil value, with the time the device recorded it. Kept briefly: a reading exists to be turned into a proposed field operation for somebody to confirm, and once that has happened the record it produced lives elsewhere. | 90 days | cli/purge_device_reading.php |
| A short-lived note that a write from a mobile phone has already been carried out, so that a phone which lost its connection and sent the same work again does not record it twice. It holds no names, no positions and no document contents - only which kind of write a signed-in user made, at what minute, and what answer they got. Kept for about a week, which is how long a phone may plausibly be out of coverage with unsent work still on it. | 7 days | cli/purge_api_idempotency.php |
| Records of access and portability requests — which account asked, from which address, when, and how often the link was used | 365 days | cli/purge_data_export_request.php |
| Finished erasure requests — which account asked and when, whether it was confirmed, the mode, when and by which of our staff it was carried out, and any reason our staff recorded for completing it without the confirmation. A request still in progress is never deleted | 365 days | cli/purge_company_erasure_request.php |
| Records of data takeouts — which account took a copy, from which address, when, and how much data | 365 days | cli/purge_company_takeout.php |
| Acceptance of the data processing agreement — the name typed as a signature, the address and the browser it was typed from, and which text was accepted | For as long as the contract could be disputed. The name, the address and the browser are removed by an erasure; the record that the contract was accepted, and of which text, remains | Not deleted automatically |
| Finished requests to exercise a right that reached us by email — which right, the address it came from, what was asked, the deadline and what was decided. A request still open is never deleted, at any age | 1095 days | cli/purge_data_subject_request.php |
| Payment notifications received from Paddle - the billing contact's name and address as the payment provider sent them. The record that a notification arrived is kept beyond this period, but carries no personal data once the body has been emptied. | 365 days | cli/purge_paddle_event.php |
| Signups started on the public website - the company name, and the name and email address of the person who started one. Kept only as long as a recent purchase may still need reconstructing; most of these rows belong to people who never became customers. | 180 days | cli/purge_company_signup.php |
| Database backups — a complete copy of the database, taken before every deployment as the only rollback a migration has. It contains whatever the database contained at that moment | 30 days, then the copy is deleted. Backups are not searched and are restored only after a disaster, so data erased in the live system can survive in a backup until that backup is deleted | Not deleted automatically |
| The working directory a download is built in — while an access copy or a data takeout is being assembled, the file being built sits on the server. It is deleted as soon as the download finishes | Deleted the moment the download completes; anything a failed or interrupted download leaves behind is removed within 6 hours | cli/purge_staging.php |
Data held on the phone is covered by the table in "What stays on the phone" above, which says of each item whether it goes at sign-out or at uninstall. Nothing on the phone outlives the uninstall.
Who we disclose it to
The same recipients as in the web application, and no others. The mobile application sends no data to the app store, to a statistics service or to an advertising service.
| Recipient | Why it receives data | Where it processes | Can it be declined? | What it is to us |
|---|---|---|---|---|
| Host Europe GmbH | Runs the server and the database the application lives on, and holds the uploaded files. | Germany | No — the service cannot be provided without it | Sub-processor — engaged by us, under contract, acting on our instructions |
| Cloudflare, Inc. (cloudflare.com) | Sits in front of our server. Your browser's encrypted connection ends here, so this company reads every request whole on its way through — the address and password you type into the sign-in form, every document you upload, everything the mobile application sends — before passing it on to us. It filters abusive traffic and keeps a copy of the map tiles it has already served. The site cannot be reached without it. | Handled at a European Union edge; the company is established in the United States — EU–US Data Privacy Framework certification, with standard contractual clauses | No — the service cannot be provided without it | Sub-processor — engaged by us, under contract, acting on our instructions |
| Host Europe GmbH | Delivers the messages the application sends: password resets, erasure confirmations, maintenance reminders. | Germany | No — the service cannot be provided without it | Sub-processor — engaged by us, under contract, acting on our instructions |
| Host Europe GmbH | Serves the map imagery shown underneath the parcel outlines. The pictures are drawn by our own server from OpenStreetMap data, so the request for them reaches the same company that hosts everything else here, through the edge network above like every other request, and no map company. It carries your IP address and the area you are looking at. | Germany | Yes — only with your consent | Sub-processor — engaged by us, under contract, acting on our instructions |
| Paddle.com Market Ltd (paddle.com) | Sells and bills the subscription as Merchant of Record - it is the seller, not a supplier acting on our instructions, and is the controller of your payment details under its own privacy notice. It receives the billing contact's name and email address and the company reference; it returns only the state of the subscription. No card details, billing address or invoice line is stored by this application. | United Kingdom (adequacy decision), with group companies outside the EEA | No — the service cannot be provided without it | Not our sub-processor — a controller in its own right — it sells the subscription in its own name and is the controller of your payment details under its own privacy notice |
| ANCPI (geoportal.ancpi.ro) | The national cadastre. Queried from our server when a parcel is looked up by its cadastral number; it receives the number, not who asked. | Romania | Yes — only with your consent | Not our sub-processor — receives data under its own published terms — the authority's own published terms for the geoportal govern the disclosure |
| ANAF (webservicesp.anaf.ro) | Looks up what a fiscal code is registered to, so a company's own details can be filled in instead of typed. Only the fiscal code is sent, from our server; no account, address or device information goes with it. Used only when somebody presses the button. | Romania | Yes — only with your consent | Not our sub-processor — receives data under its own published terms — the authority's own published terms for its public web service govern the disclosure |
| Copernicus Data Space Ecosystem — Sentinel Hub API (dataspace.copernicus.eu, ESA / Sinergise) | Computes vegetation-index statistics for a parcel from satellite imagery. It receives the parcel boundary and a date range from our server — no name, no account detail, and not who asked. | European Union | On by default: while a company's Satellite (NDVI) feature is on, the boundary of each of its parcels is sent once a week. The company's administrator can switch the feature off under Company Settings → Features, and nothing is sent after that | Sub-processor — engaged by us, under contract, acting on our instructions |
Distributing the application through an app store means the store operator learns that you installed it. That processing belongs to the store operator and is governed by its own privacy policy, not by this notice.
Transfers outside the European Economic Area
The farm data -- parcels, operations, employees, vehicles, documents -- is held on servers in the European Union. The table of recipients above shows where each one processes. Two things reach further, and both are named below.
The subscription payment goes to Paddle, which sells the subscription and is established in the United Kingdom, a country the European Commission has recognised as providing an adequate level of protection; its group includes companies outside the EEA, and those transfers are covered by standard contractual clauses. What is sent is the name and email address of the person administering the account, and the company reference. This concerns only companies on a paid plan, and only the person who set the subscription up -- no employee, landowner or field record is involved in it.
The map background does not leave the European Economic Area and has not since 6 September 2026. The imagery is drawn by our own server from OpenStreetMap data and reaches you from the same company that hosts everything else here, through the edge described in the next paragraph like every other request. The request still carries your IP address and the area you are looking at, which is why the map background stays optional and is not loaded unless you accept it; the parcels themselves are drawn from our own data and are visible without it.
What does reach a company outside the European Economic Area is every request you make to this site, including this page. Our server sits behind Cloudflare, Inc., which filters abusive traffic and caches what it can. Your browser's encrypted connection ends at Cloudflare, so it reads each request on its way through before passing it on to us. The traffic is handled at a Cloudflare location inside the European Union and the company itself is established in the United States, which makes it a transfer: it is covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Cloudflare is certified, and by standard contractual clauses that stand on their own if that decision ever falls. This one cannot be switched off, because the request that would carry your refusal has already passed through it.
The cadastral lookup to ANCPI stays inside the European Union, and is made from our server rather than from your browser: it sends the cadastral number being searched for, not the identity or the address of whoever is searching. It is nevertheless optional -- it is not performed unless you accept it, and a parcel can be registered without it by typing its cadastral number and drawing the boundary on the map.
If a provider comes to process data outside the EEA in future, the transfer will be made only under a European Commission adequacy decision or standard contractual clauses, and this notice will be updated beforehand.
How we protect it
- Communication between the application and the server is encrypted.
- The token is stored on the server only as a hash, so not even we can reconstruct it from the database.
- The token expires after 90 days and can be revoked at any time, individually, from the account page in the web application.
- Two-factor authentication applies to the mobile application too: if it is turned on for the account, the application asks for the code.
- Changing or resetting your password invalidates tokens issued earlier.
Your rights
Regulation (EU) 2016/679 gives you the following rights over your data. You can exercise them at any time, free of charge, and we answer within one month of receiving the request (Art. 12(3)); if the request is complex we may tell you that we are extending that by two further months, and why.
- Right of access (Art. 15)
- To find out whether we process data about you and to receive a copy of it, together with the purposes, categories, recipients and retention periods.
- Right to rectification (Art. 16)
- To have inaccurate data corrected and incomplete data completed. You correct your own name and telephone number on your account page, and change your email address there too, confirmed through a link sent to the new address; the administrator of the company that created your account can also correct your name. What the company recorded about you in its own registers is corrected by the company.
- Right to erasure (Art. 17)
- To have data erased where it is no longer necessary for the purpose it was collected for, where you withdraw consent and there is no other basis, or where the processing is unlawful. An administrator of the company that created your account can erase it from the user list: your name, email address, telephone number, sign-in history and connected devices are removed, your email address becomes free to use again, and what you recorded for the company stays in its registers under an account number with no name. Erasure of an entire company account is done from within the application and is described below.
- Right to restriction (Art. 18)
- To require that data is only stored and not otherwise used, while we verify a challenge you have made to its accuracy or to the basis for processing it.
- Right to portability (Art. 20)
- To receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where that is technically feasible.
- Right to object (Art. 21)
- To object to processing based on our legitimate interest, on grounds relating to your particular situation. We stop, unless we can demonstrate compelling legitimate grounds that override yours.
- Withdrawing consent
- Where we have relied on your consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out beforehand.
- Right to lodge a complaint (Art. 77)
- To complain to the supervisory authority. Its contact details are below. You do not have to come to us first, though it would help us to know.
Requests go to gdpr@fuzzy-works.com. So that we do not hand data to someone who has no right to it, we may ask you to prove your identity -- and if we cannot establish who you are, we are obliged to refuse (Art. 12(6)).
If you have no account in the application
Some of the people whose data ends up in Digital Field Book have no account and never see the application. That is the case for employees recorded by a company for its work log, and for the owners, tenants and beneficiaries named on a parcel record. The Regulation applies to them exactly as fully as it does to a user with a password.
- The company that entered your data is the one answerable for it: it decided to collect it, it knows why, and it can correct or delete it from within the application.
- That company is obliged to inform you about the processing (Art. 14) -- including the fact that the data is held in an application hosted by us.
- We act on the company's instructions. If you write to us directly we will acknowledge you, pass the request to the company, and support it in answering you in time.
If you do not know which company to approach, write to gdpr@fuzzy-works.com with what you do know and we will tell you.
Automated decisions and profiling
We do not take automated decisions producing legal effects concerning you or similarly significantly affecting you, within the meaning of Art. 22. We do not profile, we do not compute behavioural scores, and we do not assess anyone's performance from the data in the application.
The application calculates areas, fuel consumption and maintenance due dates. Those are arithmetic on entered data, not decisions about people.
Changes to this notice
This notice is version 19, in force from 2026-10-03. When we change something of substance -- a new purpose, a new recipient, a changed retention period -- we publish the new version, change its number, and bring it to your attention at your next sign-in. Wording fixes and translation corrections do not change the version number, because they do not change anything you need to know.
Contact and complaints
- Controller
- Fuzzy Works S.R.L., 38442280, Bumbacului nr. 19 bloc PB21 ap. 2, Oradea 410591, Bihor
- Email for data protection matters
- gdpr@fuzzy-works.com
If our answer does not satisfy you, you may approach the supervisory authority:
- Supervisory authority
- Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucureşti, România
- anspdcp@dataprotection.ro — https://www.dataprotection.ro