Privacy Policy

CHI Field Companion ("the App", "CHI Field", "we", "us") is operated by CHI Consultants Ltd, a company registered in Malta. CHI Consultants Ltd is the data controller responsible for the personal data processed through the App.

Registered office: 190, “Mystique Court”, Penthouse A, Triq is-Sagħtar, Mellieħa MLH 2264, Malta

Company registration number: C 58400

VAT number: MT 21176928

Privacy contact (Data Protection Officer / contact): info@chi.com.mt

The App processes the following categories of personal data:

• Client names, addresses, telephone numbers and email addresses;
• Site, property, job and service-request information;
• WhatsApp messages and associated contact information;
• Photographs, videos, voice notes and documents supplied through WhatsApp or uploaded during work;
• Message timestamps and sent, delivered and read statuses;
• Technical inspection observations, reports and recommendations;
• Quotations, invoices and payment records;
• User accounts, roles, access records and essential technical logs.

We use the personal data listed above for the following purposes:

• Client communication and job intake;
• Arranging inspections and site attendance;
• Performing investigations, repairs and reinstatement work;
• Preparing technical reports, quotations and invoices;
• Maintaining job records and audit trails;
• Securing and operating the application;
• Complying with legal, accounting and contractual obligations.

We process personal data under the following legal bases, as set out in Article 6 of the EU General Data Protection Regulation (GDPR):

• Contract (Art. 6(1)(b)) — to take steps before entering into a contract and to perform contracts for services, quotations and works.
• Legal obligation (Art. 6(1)(c)) — to comply with accounting, tax and other legal requirements.
• Legitimate interests (Art. 6(1)(f)) — to operate and secure the App, maintain audit trails, and communicate with clients about their jobs.
• Consent (Art. 6(1)(a)) — where you give consent, for example for certain WhatsApp communications or optional processing. You may withdraw consent at any time.

For special categories of data (if any), we rely on the explicit consent or substantial public interest conditions in Article 9 of the GDPR.

We share personal data with the following third-party service providers, who act as processors or independent controllers where applicable:

• Meta / WhatsApp — for messaging, message delivery, and WhatsApp Business coexistence functionality;
• Lovable — for application development and hosting services;
• Supabase — for database, authentication and file storage services;
• Payment providers — where payment processing is enabled in CHI Field (currently Paddle, where active);
• Email providers — where transactional email sending is enabled in CHI Field.

Each provider processes data only on our instructions under written agreements and is bound by confidentiality and security obligations.

We do not sell your personal data. We may share information with the providers listed above, and where required by law, with competent authorities. We may also share information with subcontractors and suppliers involved in delivering site works, to the extent necessary for that purpose.

Some of the service providers listed above process data outside the European Economic Area (EEA), including in the United States. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) adopted by the European Commission, the EU–US Data Privacy Framework, or other lawful transfer mechanisms to ensure your data is protected to a standard equivalent to EU law.

We take appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, authentication, audit logging, and row-level security on stored records. Access to personal data is restricted to authorised personnel on a need-to-know basis. Despite these measures, no system can be guaranteed completely secure.

We retain personal data only for as long as necessary for the purposes described in this policy and to meet legal, accounting and contractual obligations. Specific retention periods are set out below; where a period is not yet confirmed, a placeholder is shown.

• Job records, reports, quotations and invoices: 2 years
• WhatsApp messages and media: 2 years
• User accounts and access logs: 2 years
• Accounting and payment records: 2 years (subject to Maltese tax law)

After the retention period, data is securely deleted or anonymised unless a longer retention is required by law.

You have the following rights regarding your personal data:

• Access — to be informed of, and receive a copy of, the data we hold about you;
• Rectification — to have inaccurate data corrected;
• Erasure — to request deletion of your data ("right to be forgotten");
• Restriction — to request that we limit processing of your data;
• Objection — to object to processing based on legitimate interests or for direct marketing;
• Portability — to receive your data in a structured, commonly used and machine-readable format;
• Withdrawal of consent — where processing is based on consent, at any time, without affecting prior lawful processing.

To exercise any of these rights, contact us at info@chi.com.mt. We will respond within one month, extendable by two further months where necessary for complex requests.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with Malta's Information and Data Protection Commissioner (IDPC):

Office of the Information and Data Protection Commissioner
Level 2, Airways House, High Street, Sliema SLM 1549, Malta
Website: idpc.org.mt

You may also complain to the supervisory authority in the EU member state where you live or work.

CHI Field is a business-to-business tool and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. The latest version will always be available at https://chifield.app/privacy, with the effective date shown at the top of the page. Material changes will be communicated where appropriate.

For any questions about this Privacy Policy or your personal data, contact CHI Consultants Ltd:

Email: info@chi.com.mt
Post: CHI Consultants Ltd, 190, “Mystique Court”, Penthouse A, Triq is-Sagħtar, Mellieħa MLH 2264, Malta
Phone: +356 7983 9810