Privacy notice

Who is responsible

ServeITSM Ltd (company number 17490108), trading as Field Serve CRM, is responsible for personal information collected through this website and for account, onboarding, billing and service-security administration. Its business address is 105 Swan Road, Feltham, TW13 6PE. The privacy and data-protection contact is Zain Ali Abbas at Zain.Abbas@serveitsm.com or w3buk.dev@gmail.com. Octopye Digital Designs develops and hosts the software. For customer workspace records, the customer organisation generally decides what information it enters and why; ServeITSM Ltd processes that information to provide the contracted service.

Customer workspace information

The customer organisation decides what client, lead, staff, booking, job, email, quote and other operational information it puts into its Field Serve workspace and why. The customer generally acts as controller for this workspace information; the contracted service provider generally acts as processor and handles it on the customer’s documented instructions. Field Serve may separately act as controller for its own business contacts, billing administration, security logs and support communications. The actual allocation must be recorded in the signed customer agreement and data-processing agreement (DPA).

Information and purposes

Depending on the interaction, information may include contact details and enquiry messages; requested trial or onboarding details; account and subscription administration; support communications; technical request and security logs; and customer workspace data. For hosted billing, Field Serve stores subscription and trial status, package, paid seat count and Stripe customer/subscription identifiers. Stripe processes payment-method details; Field Serve does not store full card numbers. We use relevant information to respond to enquiries, arrange onboarding, provide and support the service, administer subscriptions, protect the platform, meet legal obligations and manage the customer relationship.

Please do not send passwords, mailbox credentials, payment card details, special-category data or confidential customer records through a public website enquiry. Use only approved workspace features and follow your organisation’s instructions.

Website forms, email and external resources

The public trial request form prepares an email in your device’s email application; it does not submit the form directly to a Field Serve website server. If you send that message, Field Serve receives the details you chose to include. The public website loads typefaces from Google Fonts, which makes a request to Google and may disclose technical connection details such as your IP address and browser information. Check the current Google terms and privacy information if you want details about that provider.

Lawful bases

The appropriate lawful basis depends on the processing. It may include taking steps you request before entering a contract, performing a contract, complying with a legal obligation, pursuing legitimate interests such as responding to business enquiries and protecting the service, or consent where required. The final processing records and customer-facing service information must identify the bases used for the actual deployed service.

Hosting, subprocessors and data locations

The Field Serve hosted service is deployed on a Hostinger VPS in the UK West location specified for this service. Hostinger provides the underlying server infrastructure. Access to and processing of customer workspace data is limited to what is needed to operate, secure, support and back up the service.

Depending on features enabled by a customer or user, information may also be processed by these providers:

• Stripe: payment checkout and subscription administration. Stripe receives payment information directly; Field Serve does not store full card numbers.
• Customer-selected email providers: email delivery or synchronisation through SMTP/IMAP settings connected by the customer. The provider and its location depend on the mailbox selected by that customer.
• Microsoft: Microsoft Entra sign-in and optional Microsoft Graph integrations when configured. Microsoft processes the account and integration data required for those features.
• OpenStreetMap: map tiles and map embeds used for job locations and engineer tracking. When a map is loaded, the browser connects to OpenStreetMap and may send the coordinates displayed on that map and technical connection data.
• Google: Google Fonts on the public marketing website. A page load may disclose technical connection data such as IP address and browser information to Google.

These providers act as independent controllers for some of their own services and as processors or subprocessors for particular service functions, depending on the arrangement. Other optional integrations, including Slack and monday.com, may process the information needed for the specific connection and actions a customer enables. The customer’s configured email provider and any additional integrations must be recorded in the applicable customer-specific processing information. Field Serve AI is configured to use the Ollama service endpoint selected by the operator; any endpoint outside the Field Serve hosting environment must be assessed and disclosed before customer data is sent to it.

Core hosting is in the UK West location stated above. Optional providers may process information in other countries under their own service arrangements. Where a restricted international transfer applies, the relevant provider terms and required UK transfer safeguard must be in place. We do not sell personal information.

Retention, security and deletion

Customer workspace data is retained while the customer’s tenancy is active unless the customer asks us to purge it sooner. When a tenancy ends, Field Serve creates a workspace archive at departure. The archive is available to the customer’s Admin for download for 90 days and is permanently deleted at the end of that period if no earlier purge is requested. A purge requested by an Admin is permanent. Limited billing, security or dispute records may be retained where necessary to meet legal obligations or establish, exercise or defend legal claims. Stored passwords, active sessions, mailbox credentials, OAuth tokens and customer tracking-link secrets are excluded from the archive; the archive may contain customer records and synced email contents. Stripe retains payment details under its own terms. Deletion from live systems may not immediately remove protected disaster-recovery copies, which are removed through the applicable backup rotation.

Your rights and complaints

Depending on the circumstances, you may have rights to access, correct, erase or restrict information, object to certain processing, request portability, or complain to the UK Information Commissioner’s Office (ICO). For information held in your employer’s or customer organisation’s workspace, contact that organisation first; it decides how the data is used and coordinates requests with its processor. You may also contact our contact form.

Changes and related documents

We will update this notice when processing changes and publish the current version here. This website notice is not the customer DPA or a complete product privacy schedule. The applicable customer contract and DPA should identify the processing instructions, configured subprocessors and any customer-specific processing locations. See the Cookie and storage policy and Website terms.