TF Service Privacy Notice

Version 1.0. Effective 22/10/2026.

1. About this notice

This notice explains how T.Freemantle Limited collects, uses, shares and protects personal data in TF Service, our service job scheduling and management system. TF Service is a web application that staff use in a browser or install on their phones and tablets from the browser.

It applies to:

• Customer contacts: people at our customers' businesses whose details we hold to arrange and deliver service work.
• Spares enquirers: people who request parts or help through our public spares request page, for example by scanning the QR code on a machine.
• Staff and contractors: T.Freemantle Limited employees, agency workers and subcontractors who use TF Service.

We give this notice under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Staff should read it alongside our employee privacy notice and IT acceptable use policy.

2. Who we are

T.Freemantle Limited is the controller of the personal data in TF Service. That means we decide why and how it is used.

• Company: T.Freemantle Limited, a private limited company registered in England and Wales
• Company number: 03147425
• Registered office: 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ
• ICO registration number: ZC279550
• Contact us about your data: privacy@tfreemantle.com, or write to Data Protection, T.Freemantle Limited, 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ

We are part of the Lifco group (Lifco AB, Sweden). We have not appointed a statutory Data Protection Officer because the law does not require one for our activities. Please send all privacy questions and requests to the address above.

3. Personal data we collect

Customer contacts:

• Contact details: name, job title, work email, work phone and mobile, and the customer site(s) you are linked to.
• Job records: job descriptions, site addresses and postcodes, machine details, purchase order numbers, notes, quotes, prices, scheduled dates, assigned engineers, job status and history.
• Call records: caller name, phone number and the advice we gave.
• Sign-off records: name, job title and signature of the person accepting the work, with date and time, and any feedback ratings and comments you give at sign-off.
• Email log: who we sent each job email or document to, and when.

Spares enquirers:

• Enquiry details: name, company, email, phone, postcode and the parts or help you need, and your agreement to be contacted about your request.

Staff and contractors:

• Account data: name, work email, role and calendar. Most staff sign in with their T.Freemantle Microsoft account, and we store a Microsoft account identifier. Staff and subcontractors without a Microsoft account sign in with an email and password, and we store only a hashed copy of the password.
• Work records: job assignments, time on site and travel time per day, mileage including odometer readings and vehicle registration.
• Training records: the training lessons you have completed.
• Help and feedback tickets: what you report, including any screenshots you attach.
• Notification preferences.

Everyone:

• Site photos and videos: taken on site to record equipment condition and work completed. Anyone who appears in them is captured incidentally. We remove location data from photos when they are uploaded.
• Job completion location: when an engineer completes a job, the tablet records its GPS position (latitude, longitude, accuracy and time). We store it on the job, print it on the job sheet and show it with a map link. See section 6.
• Activity and audit logs: log-ins, actions taken in the system, timestamps, IP addresses, browser and device type.
• Device data: push notification tokens, device model, operating system version and app version.

We do not intend to collect special category data (for example health, religion or ethnicity) or criminal offence data. Staff must not record this in job notes. If it appears by mistake, we delete it once we notice.

4. Where your data comes from

• From you, when you call, email or speak to our staff, sign off a job, submit a spares request or use the system.
• From your employer or colleagues, when they name you as a contact for a site or job. If this applies to you, this notice is how we tell you, as Article 14 of the UK GDPR requires.
• From our staff, who enter job details, call notes, photos and videos.
• From Microsoft, which confirms staff identity and passes your name, work email and account identifier when you sign in.
• Automatically, from the devices and browsers that connect to TF Service (job completion location, logs and push tokens).

5. Why we use your data and our lawful basis

• Logging, quoting, pricing, scheduling and carrying out service work: contract, where the customer is an individual or sole trader. Legitimate interests, where the customer is a company: we need to contact the right people to deliver work their employer has ordered.
• Answering spares requests: taking steps at your request before entering into a contract. We contact you only about your request.
• Recording advice given on calls: legitimate interests, to keep an accurate record of support we have given.
• Recording completed work with photos, videos, signatures and feedback: legitimate interests, to prove what work we did and that the customer accepted it, to improve our service, and to defend warranty or contractual claims.
• Recording the job completion location: legitimate interests, as proof of attendance at the customer's site.
• Keeping job and pricing records for tax and accounting: legal obligation (HMRC and Companies Act record-keeping).
• Recording safety-related findings on machinery and staff training: legal obligation (health and safety law) and legitimate interests.
• Staff accounts, job assignments, time, travel and mileage records: contract (staff employment or engagement contract) and legal obligation (tax records for mileage).
• Help and feedback tickets, and push notifications: legitimate interests in running and improving the service.
• Keeping the system secure, preventing misuse and investigating incidents: legitimate interests and legal obligation (Article 32 UK GDPR security duty).
• Responding to your data protection requests: legal obligation.
• Dealing with legal claims, insurers or regulators: legitimate interests and legal obligation.

Where we rely on legitimate interests, we have balanced our interests against your rights and expectations. Customer contacts are business contacts acting in a work capacity, the data is limited to what we need for the job, and we do not use it for marketing. You can ask us for details of this assessment.

We do not use TF Service data for marketing, profiling or selling to third parties. We make no decisions based solely on automated processing that have legal or similarly significant effects on you.

6. Staff: location, monitoring and audit logs

TF Service records the tablet's GPS position once, at the moment a job is completed, as proof of attendance. It does not track where engineers or devices are at any other time, and it does not record your movements.

TF Service also records which user did what and when. We use these logs and records to secure the system, fix problems and keep an accurate job history. We may use them in a disciplinary or grievance investigation where there is a specific concern, following our staff handbook. We do not use them for routine performance scoring.

7. Who we share your data with

We build, run and maintain TF Service ourselves. We share personal data only where necessary and only with:

• Service providers (processors) who act on our instructions under written contracts meeting Article 28 UK GDPR:
• Fasthosts Internet Limited (part of the IONOS group), which provides the virtual private server we rent to host TF Service, in a UK data centre in Birmingham. The provider supplies the hardware and data centre. T.Freemantle Limited installs, configures, secures and manages the server and the software on it.
• Microsoft (Microsoft 365, Entra ID, Intune), for staff sign-in and multi-factor authentication, staff device management, and sending emails and documents to customers from service@tfreemantle.com.
• Browser push services (Google, Apple and Mozilla), for delivering notifications to staff devices. Notifications show only the job number, stage and town.
• Other services:
• postcodes.io, to look up addresses and check the distance at sign-off. We send only the site postcode, never names or contact details.
• Lifco group companies, for group reporting and governance, only where necessary and in summary form.
• Professional advisers, such as accountants, auditors, insurers and solicitors.
• Authorities, such as HMRC, the Health and Safety Executive, the police or courts, where the law requires it.
• A buyer or successor, if we sell or restructure all or part of our business, under appropriate confidentiality terms.

8. International transfers

We host TF Service and its data on a server in the United Kingdom, and we keep our backups in the United Kingdom. Some providers, such as Microsoft and the browser push services, may process limited data (for example push tokens or account data) outside the UK. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies) or the ICO's International Data Transfer Agreement or Addendum. You can ask us for a copy of the relevant safeguards.

9. How long we keep your data

• Job records, quotes, prices, call records and job completion location: 7 years after the job closes, which covers the 6 years after the end of the financial year that HMRC requires. We then remove personal details.
• Site photos, videos and sign-off signatures: 2 years after the job closes, unless needed for an open warranty, claim or dispute.
• Customer contact details: while your company has had a job with us in the last 6 years. If you leave your company, 2 years after the last job linked to you.
• Spares requests: 12 months after your request, unless it leads to a job, when it follows the job record periods above.
• Email log: 180 days.
• Staff accounts: disabled when you leave; personal details removed 12 months after leaving. Your name stays on historical job records for the job retention period.
• Staff time, travel, mileage and training records: while you work for us, then in line with our employee privacy notice.
• Activity and audit logs: 24 months.
• Push notification tokens: deleted when you sign out, remove the app, your account is disabled, the device is unused for 90 days, or the push service reports the device is no longer active.
• Backups: daily backups kept for 30 days and monthly backups kept for 12 months.

We keep data longer only where a legal claim, investigation or legal obligation requires it. At the end of the period we delete or anonymise it.

10. How we protect your data

We use technical and organisational measures appropriate to the risk, including:

• a dedicated server that only authorised T.Freemantle Limited staff can administer
• encryption in transit (HTTPS/TLS) for all connections to TF Service
• a firewall and reverse proxy, so only the services TF Service needs are reachable from the internet
• Microsoft sign-in with multi-factor authentication for staff with Microsoft accounts, and a second sign-in step required for every administrator account
• hashed passwords for accounts that use email and password sign-in
• role-based access, so staff see only what their job needs
• managed and encrypted staff devices with remote wipe (Microsoft Intune)
• audit logging, regular patching, scheduled backups we manage ourselves, and restore testing
• staff data protection training and confidentiality obligations

If a personal data breach is likely to result in a risk to your rights, we will report it to the ICO within 72 hours of becoming aware, and tell you without undue delay where the risk is high.

11. Cookies and device storage

TF Service uses cookies and device storage that are strictly necessary to sign you in, keep your session secure and deliver notifications. So that engineers can work without a signal, the app also keeps saved jobs and anything waiting to send in encrypted storage on the tablet until it can upload them. This storage is part of the service you use and is exempt from consent under the Privacy and Electronic Communications Regulations 2003. We use no advertising or analytics cookies in TF Service.

12. Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data
• rectification of inaccurate or incomplete data
• erasure of your data, where we no longer have a valid reason to keep it
• restrict how we use your data
• object to processing we carry out on the basis of legitimate interests
• data portability, where processing is based on contract or consent and carried out by automated means
• withdraw consent at any time, where we rely on consent
• not be subject to decisions based solely on automated processing

Some rights do not apply in every case. For example, we cannot erase job records we must keep for HMRC.

To use any right, email privacy@tfreemantle.com or write to us at the address in section 2. We do not charge a fee. We may ask you to confirm your identity. We will respond within one month, or within three months for complex or multiple requests, and we will tell you if we need the extra time.

13. Complaints

If you are unhappy with how we handle your data, please complain to us first at privacy@tfreemantle.com. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Changes to this notice

We review this notice at least once a year and whenever TF Service changes how it uses personal data. We will publish the updated version in TF Service and tell users about significant changes.

Version 1.0, 22/10/2026, first issue, approved by Richard Kitchen, Managing Director.