How Trefna handles customer workspace data.

Supplier identity and contact

For this addendum, Trefna means Trefna Ltd (company number 904246), registered in Scotland. Our business-correspondence address is 3F1 Third Floor, 3 Hill Street, Edinburgh, EH2 3JP, United Kingdom. Data-protection questions can be sent to hello@trefna.com.

Roles

For customer workspace information, the customer normally acts as the controller and Trefna acts as the processor. The customer decides what information to enter, who can access it and why it is used. Trefna processes that information only to provide, secure and support the service, or where law requires otherwise.

For Trefna’s own account, billing, security and support-administration information, Trefna may act as an independent controller as explained in the Privacy Notice.

What may be processed

The information depends on how a customer uses Trefna. It may include user names and emails, project contacts, site details, project records, customer and supplier details, programme and forecasting records, Trade Management work records, expenses, receipts and tax-record information.

Purpose and duration

Trefna processes customer workspace information to host the workspace, authenticate users, apply access permissions, store and display records, process requested support, maintain security and meet legal obligations. Processing continues for the duration of the customer’s access and any limited retention period needed for the purposes described in the Privacy Notice.

Confidentiality and security

Trefna restricts processing to people and providers who need it to provide the service and who are subject to appropriate confidentiality obligations. We use technical and organisational measures designed to protect customer information, while recognising that no online service can be completely risk-free.

Sub-processors

Trefna uses specialist providers for functions such as hosting, database services, authentication, file storage, email delivery and payment processing. These providers may process customer information only as needed for their service. Trefna remains responsible for selecting them with appropriate safeguards.

Customer requests and incidents

Trefna will reasonably assist a customer with requests from individuals about their information where the customer cannot deal with the request through the product. If Trefna becomes aware of a personal-data breach affecting customer workspace information, we will notify the affected customer without undue delay and provide relevant information available to us.

Deletion and return

Customers should export or retain the records they need before access ends. On request and where technically practical, Trefna will explain available options for deleting or returning customer workspace information, subject to legal, security and accounting retention requirements.