This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between WORKWAE LLC ("workwae") and the Customer. It applies whenever workwae processes Customer Personal Data on the Customer's behalf, and needs no separate signature. A countersigned copy is available on request from privacy@workwae.com.
1. Scope and roles
For Customer Personal Data, the Customer is the controller (or a processor acting for its own customers) and workwae is the processor (or subprocessor). workwae is an independent controller only for the account, billing, security and usage data it needs to run its business, as described in the Privacy Policy.
2. Definitions
- Customer Personal Data: personal data in Customer Data (as defined in the Agreement) that workwae processes for the Customer, including the data of connected email, calendar, contacts and meeting accounts.
- Data Protection Laws: laws on the protection of personal data that apply to the processing, including the GDPR, the UK GDPR, the Swiss FADP and US state privacy laws such as the CCPA.
- Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Subprocessor: a third party workwae engages to process Customer Personal Data.
3. Processing on instructions
workwae processes Customer Personal Data only to provide the Service and on the Customer's documented instructions. The Agreement, this DPA and the Customer's use and configuration of the Service (its API calls, console settings and connected accounts) are those instructions. workwae tells the Customer if it believes an instruction breaks Data Protection Laws, and processes otherwise only where the law requires it, in which case it informs the Customer first unless the law forbids that.
The Customer is responsible for the lawfulness of its instructions and for having the notices and consents its connected users need.
4. Confidentiality
Everyone at workwae authorized to process Customer Personal Data is bound by confidentiality obligations, and staff do not read connected-account content except as described in section 4 of the Privacy Policy.
5. Security
workwae maintains the technical and organizational measures in Annex II, described in more detail on our Security page. workwae may update them as long as the overall level of protection does not decrease.
6. Subprocessors
- The Customer authorizes workwae to engage the subprocessors listed at workwae.com/subprocessors.
- workwae notifies the owners of the Customer's workspace by email at least 30 days before a new subprocessor processes Customer Personal Data.
- The Customer may object within that period on reasonable data-protection grounds. The parties will discuss the objection in good faith; if they cannot resolve it, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.
- workwae imposes data-protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for its subprocessors' performance.
7. Assistance
- Data subject requests. The Service lets the Customer access, export, correct and delete Customer Personal Data itself. workwae forwards requests it receives about Customer Personal Data to the Customer and, where the Customer cannot act through the Service, helps it respond.
- Impact assessments and consultations. workwae provides the information reasonably needed for the Customer's data protection impact assessments and prior consultations with supervisory authorities.
8. Personal data breaches
workwae notifies the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. workwae provides further information as it becomes available, takes reasonable steps to contain the breach, and cooperates with the Customer's notifications. A notice is not an admission of fault.
9. Deletion and return
The Customer can export its data through the Service at any time, and for 30 days after the Agreement ends. workwae then deletes Customer Personal Data on the schedule in the Privacy Policy's retention section: deleted accounts within 30 days, and copies in encrypted backups within 35 days. Data the law requires workwae to keep stays protected under this DPA until it is deleted.
10. Audits
On request, workwae answers reasonable security questionnaires and provides the information needed to show compliance with this DPA. If that is not enough, or a supervisory authority requires it, the Customer may audit workwae's compliance once a year, at its own cost, with at least 30 days' notice, during business hours, without access to other customers' data, and under confidentiality obligations.
11. International transfers
workwae processes Customer Personal Data in the United States. Where Data Protection Laws require a transfer mechanism for data leaving the EEA, the UK or Switzerland:
- The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor), as applicable, are incorporated into this DPA by reference, with clause 7 (docking) included, option 2 (general authorization, with the notice period in section 6) in clause 9, the optional language in clause 11 omitted, Irish law and the courts of Ireland under clauses 17 and 18, and Annexes I to III of this DPA as their annexes.
- For the UK, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those clauses, with either party able to end it as allowed by its section 19.
- For Switzerland, the clauses apply with the Swiss FADP in place of the GDPR and the Federal Data Protection and Information Commissioner as the competent supervisory authority.
12. US state privacy laws
Where US state privacy laws apply, workwae is the Customer's service provider or processor. workwae does not sell or share Customer Personal Data, does not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, does not combine it with personal data from other sources except as those laws permit, and tells the Customer if it can no longer meet these obligations.
13. General
- Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow it.
- If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data; the Standard Contractual Clauses control over both.
- This DPA is governed by the law that governs the Agreement, except where the Standard Contractual Clauses require otherwise.
- workwae may update this DPA as Data Protection Laws or the Service change, without reducing the protection it gives, and notifies Customers of material changes at least 30 days ahead.
Annex I: Processing details
| Data exporter | The Customer, as identified in its workspace. |
|---|---|
| Data importer | WORKWAE LLC, Texas, United States; privacy@workwae.com. |
| Data subjects | People whose email, calendar, contacts or meeting accounts are connected to the Customer's workspace; the people who correspond with them or appear in their calendars and address books; recipients of messages sent through the Service; the Customer's workspace members. |
| Categories of data | Account identifiers and credentials; email messages and their metadata, bodies and attachments; calendar events and attendees; contacts; meeting details; open, click and unsubscribe events with IP addresses, user agents and approximate location; workspace member details. |
| Special categories | None intended. Mail, calendars and contacts may contain them; they receive the same protections as all Customer Personal Data. |
| Frequency | Continuous, for as long as accounts stay connected. |
| Nature and purpose | Syncing, indexing, storing, searching and serving mail, calendars and contacts; sending mail; creating meetings; delivering webhooks and the change feed; AI features the Customer turns on; support and security. |
| Duration | The term of the Agreement, then until deletion under section 9. |
| Supervisory authority | The authority competent for the Customer under clause 13 of the Standard Contractual Clauses. |
Annex II: Security measures
- Encryption. TLS for all traffic. OAuth tokens, passwords, webhook secrets and stored message content are encrypted with keys held in HashiCorp Vault, each value bound to the record it belongs to; encryption keys are rotated.
- Access control. Production access limited to authorized personnel who need it; workspace members have roles; API keys are stored hashed, scoped and revocable; actions are recorded in an audit log kept for 365 days.
- Isolation. Each workspace's data, stored objects and encryption keys are separate from every other workspace's.
- Least privilege toward providers. Only the permissions a feature needs are requested; grants are revoked when accounts are deleted where the provider allows it.
- Resilience. Continuous database backups, encrypted before they leave the host, with point-in-time restore over at least 21 days; restore drills; monitoring and alerting that never reads message content.
- Application safeguards. Signed webhooks, HTTPS-only endpoints, refusal of requests into private networks, redirect allowlists for connect flows, and rate limits.
- Vulnerability handling. A published security contact and response process (security@workwae.com).
Annex III: Subprocessors
The subprocessors listed at workwae.com/subprocessors, as updated under section 6.