Privacy Policy

Last Updated: September 11, 2026

Welcome to Workfloow. Workfloow is an intelligent field service management platform operated by Disaster Assist Ltd ("we," "our," or "us"), a company registered in England and Wales under Company Registration Number 13778546.

We are committed to protecting your privacy and managing personal data in strict accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable electronic privacy regulations.

1. Data Controller & Contact Details

Disaster Assist Ltd acts as the Data Controller for personal data collected through our website (https://workfloow.app) and workspace applications.

Legal Entity: Disaster Assist Ltd (Company No. 13778546)
Registered Address: Unit 15, Dalweb Ind est Gravel Lane, Banks, Southport. PR9 8DF , United Kingdom
Privacy & Compliance Email: admin@workfloow.app

2. Infrastructure, Hosting Location & UK GDPR Adequacy

AWS Germany Hosting: All application databases, file repositories, photo logs, and user data are hosted within Amazon Web Services (AWS) data centres in Frankfurt, Germany (eu-central-1).
UK GDPR Adequacy Protection: Under UK privacy law, storing and processing data within the European Economic Area (EEA/Germany) is fully recognized under the UK Government’s EU Adequacy Regulations. This guarantees that your data receives an equivalent level of legal protection as data stored within the UK.
Encryption at Rest & Transit: Databases and uploaded files are encrypted at rest using Advanced Encryption Standard (AES-256) via AWS Key Management Service (KMS). Data in transit between mobile apps, web browsers, and servers is secured using TLS 1.3 protocols.
Zero Data Monetization: We do not view, analyze, sell, rent, or trade your proprietary job records or customer data for advertising or commercial purposes.

3. Information We Collect

We collect personal and operational data necessary to deliver real-time field service management:

Account & Contact Data: Name, business email, phone number, job title, company name, and billing details provided during registration or support inquiries.
Field Operations Data: Site documentation, job notes, digital signatures, RAMS safety records, and photos uploaded to active jobs.
Location & GPS Data: Real-time GPS coordinates captured via our mobile application during active shifts or job check-ins to support dispatching, team safety, and proof-of-work reporting.
Technical & Connectivity Data: IP address, device identifiers, system logs, and essential cookies required to maintain live cloud data synchronization over active internet connections.

4. Lawful Basis for Processing (UK GDPR Article 6)

We process personal data under the following legal grounds:

Performance of a Contract: Processing required to fulfill our software subscription, dispatch jobs, and stream live field updates to your workspace.
Legitimate Interests: Processing necessary to ensure system performance, prevent fraud, maintain application security, and send essential administrative notices.
Legal Compliance: Retaining transactional records, invoices, and audit logs to satisfy UK accounting and statutory requirements.
Consent: Where you explicitly opt-in to non-essential cookies or communications (consent can be withdrawn at any time).

5. Data Retention & Sub-Processors

Retention Period: Customer data is retained for the duration of your active software subscription. Following account termination, active database records are purged within 90 days, except where longer retention is mandated by UK accounting laws (typically 6 years for financial transactions).
Sub-Processors: We engage vetted third-party service providers bound by strict data protection agreements:
- Cloud Infrastructure & Database Hosting: Amazon Web Services (AWS Germany / eu-central-1)
- Transactional Email Delivery: AWS Simple Email Service (SES) / Postmark
- Payment Gateways: PCI-DSS compliant processors (e.g., Stripe)

6. Your Rights Under UK GDPR

Under UK privacy law, you have the following rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete records.
Right to Erasure: Request deletion of your personal data where no overriding legal retention obligation applies.
Right to Restrict or Object: Object to specific processing activities, including location tracking permissions within mobile device settings.
Right to Data Portability: Request transfer of your data in a structured, standard format.

To exercise any of these rights, please contact admin@workfloow.app.

If you believe your data has been handled unlawfully, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk or by phone at 0303 123 1113.

7. Changes to This Policy

We may update this Privacy Policy periodically to reflect operational, technical, or regulatory changes. Updated versions will be published directly on this page with a revised "Last Updated" date.