Legal
Data processing agreement
1. Parties, roles and scope
1.1 This agreement is between Fieldcompass.org, an NGO based in Paris, France ("we"), and the organisation that uses Field Compass to process survey data (the "customer"). It forms part of the Field Compass terms of service, and the person who creates an account for the customer accepts it with them. A customer can ask for a copy signed by both parties at privacy@fieldcompass.org.
1.2 The customer is the controller of the survey data it brings into Field Compass from KoboToolbox. We are its processor. Annex I describes the processing.
1.3 If the customer processes the survey data for another controller, such as a funder or a public body, the customer is a processor and we are its sub-processor. The customer passes on that controller's instructions, and this agreement applies in the same way.
1.4 This agreement covers survey data only. For the data of the people who use Field Compass, we are the controller, and our privacy notice applies.
1.5 Personal data, processing, controller, processor, personal data breach and supervisory authority have the meaning given in the GDPR (Regulation (EU) 2016/679).
2. Instructions
2.1 We process survey data only on the customer's documented instructions. These are:
- this agreement and the terms of service;
- the settings the customer chooses in Field Compass: which projects are connected, which checks run, which questions AI reviews, whether recordings are transcribed and answers translated, which AI provider is used, who has access, and what is deleted;
- written instructions sent to privacy@fieldcompass.org that we accept.
2.2 We tell the customer at once if we think an instruction infringes data protection law.
2.3 If EU or French law requires us to process survey data in another way, we tell the customer first, unless that law forbids it.
2.4 We never use survey data for our own purposes: not for marketing, not for product research, and not to train or evaluate AI models.
3. Confidentiality
3.1 Only people who have signed a confidentiality commitment get any access that could reach survey data.
3.2 Our staff open a customer's survey data only when the customer asks for help in writing, to handle a security incident, or when the law requires it.
3.3 Field Compass records each day a staff member opens a survey that is neither theirs nor shared with them. The record is kept 24 months, and the customer can ask for the record of its own surveys.
4. Security
4.1 We apply the technical and organisational measures in Annex II.
4.2 We may change those measures, but never in a way that lowers the protection of survey data. We update Annex II when they change.
4.3 The customer is responsible for its own accounts: who has access to each survey and in which role, keeping passwords safe, and removing people who leave.
5. Sub-processors
5.1 The customer authorises the sub-processors listed in Annex III.
5.2 We give at least 30 days' notice before adding or replacing a sub-processor, by email to the owners of the customer's surveys and on the published list.
5.3 Within those 30 days the customer can object on reasonable data protection grounds. We then look for a solution with the customer, such as keeping its surveys off the service concerned. If there is none, the customer can stop using the feature concerned, or end this agreement without penalty.
5.4 Each sub-processor is bound by contract to data protection obligations at least as protective as this agreement's. We remain responsible to the customer for them.
5.5 Sub-processors that provide AI receive survey data only when a survey uses the AI allowance Field Compass provides. An AI provider the customer connects itself is not our sub-processor: it works under the customer's own contract with that provider.
6. Transfers outside the EEA
6.1 We transfer survey data outside the European Economic Area only to sub-processors in Annex III, and only with a safeguard under Chapter V of the GDPR: an adequacy decision, including the EU–US Data Privacy Framework for a certified recipient, or the European Commission's standard contractual clauses.
6.2 Annex III says where each sub-processor processes data and which safeguard applies.
6.3 Survey data leaves the EEA only when a survey uses the AI allowance with a provider outside it. A customer that wants no transfer can connect its own AI provider or leave the AI features off.
7. Personal data breaches
7.1 We tell the customer of a personal data breach affecting its survey data within 48 hours of becoming aware of it, by email to the owners of the surveys concerned and to the contact in Annex I.
7.2 The notice says what happened, which data and roughly how many people are concerned, the likely consequences, what we have done and will do, and who to contact. What is not yet known follows as soon as it is.
7.3 We help the customer meet its own duties to notify its supervisory authority and the people concerned. We do not notify them on the customer's behalf unless it asks us to.
8. People's rights
8.1 If someone asks us to exercise their rights over survey data, we pass the request to the customer and do not answer it ourselves.
8.2 We help the customer answer such requests. Field Compass reads submissions from KoboToolbox, so corrections and deletions start there. For what Field Compass holds on top (quality findings, transcripts, translations, review decisions and notes), we help the customer find, correct or delete it. The customer can also delete a whole survey and its data itself.
9. Impact assessments
9.1 We give the customer the information it needs for its own data protection impact assessment and any prior consultation with its supervisory authority. We send a ready summary on request.
10. Information and audits
10.1 We make available the information needed to show we meet this agreement: Annex II, the record of staff access to the customer's surveys, and answers to reasonable questionnaires.
10.2 Where that is not enough, the customer can have us audited by an auditor bound to confidentiality. An audit takes place at most once a year, more often after a breach or when a supervisory authority asks, with 30 days' notice. The customer bears its own costs, and the audit must not give access to other customers' data.
11. Deletion and return
11.1 The customer can delete any survey and all its data in Field Compass at any time. Deleting the account that owns a survey deletes the survey too.
11.2 When this agreement ends, we delete all the customer's survey data still in Field Compass within 30 days, unless the law requires us to keep it.
11.3 Copies in backups are gone within 97 days of deletion.
11.4 Survey data comes from the customer's KoboToolbox, which keeps its own copy. What Field Compass wrote back to KoboToolbox at the customer's request (review decisions, transcripts, translations) stays there. Before deletion, the customer can ask for a copy of the rest, in a common machine-readable format such as CSV.
12. Liability
12.1 Each party's liability under this agreement follows the terms of service, except where the GDPR or other law does not allow it to be limited.
13. Duration, changes and precedence
13.1 This agreement applies for as long as we process survey data for the customer. Clauses 3 and 11 continue until all of it is deleted.
13.2 We may update this agreement, with 30 days' notice of any change that affects the customer's rights. Changes the law requires apply when it requires them.
13.3 If this agreement and the terms of service conflict on data protection, this agreement prevails.
14. Law and courts
14.1 French law applies. The courts of Paris decide any dispute, unless mandatory rules say otherwise.
Annex I: The processing
| Customer and contact | The organisation and email given at sign-up, or those in a copy signed by both parties |
|---|---|
| Subject and duration | Checking the quality of the customer's KoboToolbox surveys, for as long as it uses Field Compass |
| Nature | Reading forms, submissions, audit logs and recordings; running quality checks; showing results to the customer's users; when the survey has them on, AI review of chosen questions, transcription and translation; writing review decisions, transcripts and translations back to KoboToolbox on request; storage and deletion |
| Purpose | Helping the customer's team find and fix problems in survey data while collection is under way |
| People concerned | Respondents, often in vulnerable situations; enumerators, by ID and sometimes by name; anyone else the form records |
| Personal data | Whatever the form collects, such as names, phone numbers, GPS points and household details. Also recordings, transcripts, translations, time spent on each question, quality findings, review decisions and notes |
| Special categories | Possible, depending on the form: health, ethnic origin, religion, political opinions and others. Protected by the measures in Annex II, the staff access rule, AI only on the questions the customer picks, and the option of the customer's own AI provider or no AI |
| Frequency | Continuous while a project is connected |
| Retention | Until the customer deletes the survey or its owner's account; backups within 97 days |
Annex II: Security measures
The measures in place, updated under clause 4.2.
| Area | Measure |
|---|---|
| Hosting | Microsoft Azure, North Europe (Ireland), on one virtual machine. Microsoft runs the physical security of its data centres. |
| Encryption in transit | HTTPS only, through Caddy with Let's Encrypt certificates, and HSTS for a year. Backups are uploaded over TLS 1.2 or later. |
| Encryption at rest | The virtual machine's disk and the backup storage are encrypted by Azure with platform-managed keys. |
| Stored credentials and passwords | KoboToolbox tokens and AI provider keys are encrypted again by Field Compass (Fernet), with a key held only in the server's environment. They are never sent to a browser or written to a log. Passwords are stored as bcrypt hashes. |
| Network | Only HTTP, HTTPS and SSH reach the server. The database and Redis are not reachable from outside it. Calls to AI providers refuse private and cloud-metadata addresses. |
| Server access | SSH accepts keys only: password sign-in is off, for root too. The deploy key can run one command and nothing else. |
| Access in the app | Each request is checked against the survey's roles (owner, editor, viewer), and a submission against its own survey. Viewers cannot change data. |
| Sign-in | Sessions are signed tokens that expire after 2 hours. Sign-in and sign-up attempts are limited per IP address. |
| Staff access | The admin role opens every survey. Only the Fieldcompass.org administrator holds it, under a written staff access rule. Each day an admin opens a survey that is neither theirs nor shared with them is recorded, and kept 24 months. |
| Change management | Every change runs tests, linting and type checks. The image that passed is the one deployed, and a failed health check rolls back, schema included. |
| Backups | Nightly, to Azure Blob storage, with an add-only key: the server cannot read, replace or delete them. Daily copies are kept 14 days, weekly ones 90 days, and deleted copies 7 more days. |
| Data minimisation | AI review reads only the questions the owner picks, and skips don't-know answers. Owners can use their own AI provider, or leave AI off. Recordings are processed in a temporary folder deleted after each job. |
| Deletion | Deleting a survey deletes all its data in one transaction. Deleting an account deletes the surveys it owns. Backup copies are gone within 97 days. |
| Logs | Logs name users by ID, not email, and each service keeps at most 5 files of 10 MB. The app uses no analytics or error-tracking services. |
| Breach response | A written procedure: customers are told within 48 hours of Field Compass becoming aware of a breach, and the CNIL within 72 hours when users' own data is at risk. |
Annex III: Sub-processors
The list published in our privacy notice, updated under clause 5. It gives each sub-processor's role, the data it receives, where it processes it and the safeguard for any transfer.