When we touch your customers’ data, this isthe contract.

01Roles and scope

You determine the purposes and means of processing (controller). Workwox processes personal data only to deliver the agreed engagement (processor), on your documented instructions, and only for as long as the engagement requires.

02Our obligations

• Process only on your written instructions; tell you if an instruction breaches the law
• Ensure staff are bound by confidentiality and trained on data handling
• Apply the technical and organisational measures on the Security page
• Assist with data-subject requests, impact assessments and supervisory-authority enquiries
• Make available the information needed to demonstrate compliance and allow audits on 30 days’ notice, once a year unless a breach occurs

03Sub-processors

04International transfers

Where data leaves the EEA or UK, transfers rely on the EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, plus the sub-processor’s own DPA. Data location is chosen per project and recorded in the proposal.

05Breach notification

We notify you without undue delay and within 48 hours of becoming aware of a personal-data breach, with what happened, what data, what we have done and a named contact. We support your notifications to authorities and individuals.

06Return and deletion

On termination we return or delete personal data as you instruct within 30 days and confirm deletion in writing, except where law requires retention. Backups are purged on their normal cycle, no longer than 35 days.

07How it is signed

The DPA is incorporated into every proposal that involves personal data. A countersigned PDF is available on request at contact@workwox.com.