Data Processing Addendum
Published in full, with no gate and no form, so your privacy team can read it before they talk to us.
Last updated 24 September 2026
Draft. This page is being finalised with counsel and is not yet binding. Questions: [email protected].
Publishing the DPA ungated is deliberate. Your reviewers should not have to ask us for it, and the inform-and-object mechanism below cannot work without the subprocessor list being public too.
Roles
For Customer Data processed through the service, the customer is the controller and TheWorkCompany LLC is the processor. For our own website visitors and account holders, we are the controller — see the Privacy Policy.
What we commit to
- Process personal data only on the customer's documented instructions.
- Ensure our personnel are bound by confidentiality.
- Implement appropriate technical and organisational measures, as described on the security page.
- Engage subprocessors only under equivalent terms, and maintain the public subprocessor list.
- Give advance notice of any new subprocessor and a window to object.
- Assist with data-subject requests, with DPIAs and with breach notification.
- Delete or return personal data at the end of the engagement.
- Make available the information needed to demonstrate compliance and submit to audits on reasonable notice.
International transfers
The transfer mechanism will be stated here in the final version of this addendum.