Privacy policy

Workmap is a working tool for excavation and groundworks companies. Companies use it to plan jobs, keep track of machines and vehicles, and let their people communicate. This page describes which personal data is processed when you use Workmap, why, who has access to it and for how long it is kept.

Who is responsible for the data

Workmap is provided by Scriptdrift, which develops and operates the service.

When you use Workmap as an employee or contractor of a company that holds a Workmap account, your company is the data controller of the data about you. The company decides what is recorded and why. Scriptdrift acts as data processor and handles the data on the company's instructions under a data processing agreement. If you have questions about how your employer uses Workmap, your employer is the first place to turn.

For visitors to workmap.se, for anyone who submits the contact form, and for the contact persons at our customer companies, Scriptdrift is the data controller.

What data is processed

Account data

Name, e-mail address and phone number (used to sign in), password in hashed form, work role, employment type and an optional profile picture.

Work data

Jobs and projects you are assigned to, working hours, site diary and work book, function checks, deviations, documents and photos uploaded to the service.

Chat

Messages you send and receive, attachments, who takes part in a conversation and how far you have read.

Vehicles and location

Machines and vehicles may carry GPS trackers that report position, speed and vehicle data to Workmap. When a vehicle or machine is linked to you as its driver, that history is also data about you, for instance in the driver's log. The position comes from the tracker in the vehicle, not from your phone. The app and the browser only use your phone's position if you tap "My position" on the map yourself, and that position stays on your device.

Notifications

If you enable push notifications, an anonymous device identifier (push token) that Apple issues to the app is stored, together with your preferences for which notifications you want.

Technical data

IP address, time and requested page in server logs, needed for operations and security.

Why the data is processed

The data is needed for the service to work: so that you can sign in, see today's work, report from site, chat with colleagues, and so that the company can plan and document its operations. Driver's logs and job documentation are often also processed to meet legal requirements, such as tax rules for company cars and workplace safety regulations.

Scriptdrift does not use the data for its own purposes. We do not sell it, we show no advertising, and we use no analytics or tracking tools, neither on the website nor in the app.

Cookies

Workmap uses a single cookie, token, which keeps you signed in. It is necessary for the service and requires no consent. Forms are additionally protected with a technical token against forged requests. No cookies are used for statistics or marketing.

Who has access to the data

Staff and administrators at your company see the data their role gives access to. Scriptdrift has access in order to operate, troubleshoot and support the service.

To deliver the service we use the following sub-processors:

• Hetzner Online GmbH (Germany and Finland) - servers, database, file storage and backups. All data is stored within the EU.
• Cloudflare - DNS and protection of traffic to workmap.se.
• Apple - push notifications to iPhone. Apple sees the device identifier and the content of the notification, such as the text of a chat message.
• Resend - e-mail sent by the service.
• Fortnox - only if your company itself chooses to connect Workmap to its Fortnox account.
• OpenFreeMap and Esri - map imagery. Your browser fetches map tiles directly from them, so they see your IP address. Address lookups are made from our server via OpenStreetMap and do not expose your IP address.
• Google Fonts - typefaces on workmap.se. Google sees your IP address when the fonts are fetched. Inside the service no external fonts are used.

Data is not transferred outside the EU/EEA beyond what follows from the providers above, and then with the safeguards the GDPR requires.

How long the data is kept

The data is kept for as long as your company holds a Workmap account and needs it. An employee who leaves is archived by the company. When a customer agreement ends, the company's data is deleted in accordance with the agreement. Backups rotate continuously and are deleted after 90 days at the latest.

Your rights

You have the right to know which data is processed about you, to have inaccurate data corrected, in some cases to have it erased or restricted, and to object to the processing. For data in your company's account, contact the company, which is the data controller. We help the company fulfil your request. If you are not satisfied you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or the supervisory authority in your country.

Contact

Questions about this policy or about how Workmap processes personal data go to johan@scriptdrift.se.

We update this page when the service changes in a way that affects how personal data is processed. The date at the top shows when that last happened.