From first conversation to production in three weeks. See how Select Home Care did it Read the story →
Book a demo
PlatformPlatform overviewFlows, Data Lists and Intelligence as one layerDark matter calculatorNewEstimate the work hiding between your systems
ProductsOpsPulseFor Manufacturing. Inspections, audits, risk, incidentsDealPulseFor Finance. Deal lifecycle from pipeline to closeCarePulseFor Healthcare. Staff management and compliance
CompanyAbout usThe team and the purpose behind Workhall
Contact us
Book a demo
Legal

Data Protection Addendum

Workhall's Data Protection Addendum (DPA) for customers.

Last Updated: June 2025

This Data Protection Addendum (“Addendum”) between Workhall Pvt Ltd (“Workhall”) and the Customer (as defined in the Agreement) forms part of the Workhall Terms of Use set forth at www.workhall.com/terms or such other written or electronic agreement incorporating this Addendum, in each case governing Customer’s access to and use of the Services (the “Agreement”).

Customer enters into this Addendum on behalf of itself and any Affiliates authorized to use the Services under the Agreement and who have not entered into a separate contractual arrangement with Workhall. For the purposes of this Addendum only, and except where otherwise indicated, references to “Customer” shall include Customer and such Affiliates.

The Parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Agreement.

1. Definitions

In this Addendum, the following terms shall have the meanings set out below, and cognate terms shall be construed accordingly:

  • Affiliate: An entity that owns or controls, is owned or controlled by, or is under common control or ownership with either Customer or Workhall, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract, or otherwise.
  • Customer Personal Data: Any Personal Data provided by or made available by Customer to Workhall or collected by Workhall on behalf of Customer, which is processed by Workhall to perform the Services.
  • Controller to Processor SCCs: The standard contractual clauses for cross-border transfers published by the European Commission on June 4, 2021, governing the transfer of EU Area Personal Data to Third Countries, as adopted by the European Commission, the Swiss Federal Data Protection and Information Commissioner (“Swiss FDPIC”) (“EU SCCs”); the international data transfer addendum (“UK Transfer Addendum”) adopted by the UK Information Commissioner’s Office (“UK ICO”); or any similar clauses adopted by a data protection regulator relating to Personal Data transfers to Third Countries.
  • Data Protection Laws: Any local, state, or national law regarding the processing of Personal Data applicable to Workhall in the jurisdictions in which the Services are provided, including, without limitation, GDPR, UK GDPR, Swiss DPA and India’s Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).
  • EU Area: The European Union, European Economic Area, United Kingdom, and Switzerland.
  • EU Area Law:
    • Regulation (EU) 2016/679 (“EU GDPR”) and applicable implementing legislation.
    • The Data Protection Act 2018 of the United Kingdom and the EU GDPR as saved into UK law by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK GDPR”).
    • The Swiss Federal Data Protection Act of 19 June 1992 and its Ordinance (“Swiss DPA”).
    • Any other applicable law relating to data protection, security, or privacy in the EU Area.
  • Security Incident: Any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data being processed by Workhall.
  • Services: The team productivity, collaboration, and organizational tools provided by Workhall to Customer or Customer’s Affiliates pursuant to the Agreement.
  • Third Country: Countries that, where required by applicable Data Protection Laws, have not received an adequacy decision from an applicable authority (e.g., European Commission, UK ICO, or Swiss FDPIC).
  • The terms Business, Business Purpose, Controller, Data Subject, Personal Data, Personal Data Breach, Process, Processor, Sell, Service Provider, Share, Subprocessor, Supervisory Authority, and Third Party have the same meanings as described in applicable Data Protection Laws.
  • Capitalized terms not defined in this Addendum shall have the meanings ascribed in the Agreement.

2. Scope of Addendum

This Addendum applies to Workhall’s Processing of Customer Personal Data under the Agreement to the extent such Processing is subject to Data Protection Laws. This Addendum is governed by the governing law of the Agreement unless otherwise required by Data Protection Laws.

3. Roles of the Parties

The Parties acknowledge that with regard to the Processing of Customer Personal Data:

  • Customer acts as a Business or Controller.
  • Workhall acts as a Service Provider or Processor (as specified in Annex 1). This Addendum applies solely to Workhall’s Processing of Customer Personal Data as a Processor, Subprocessor, or Third Party.
  • Customer is solely responsible for:
    Ensuring timely communications to its Affiliates or relevant Controller(s) receiving the Services, as required by Data Protection Laws.
  • Complying with Security Incident notification laws and notifying government authorities or affected individuals as needed.

4. Description and Purpose of Personal Data Processing

  • Details of Processing: Set out in Annex 1, which may be amended by mutual written agreement to meet Data Protection Law requirements. Annex 1 does not create obligations or rights for any Party.
  • Purpose: The provision of the Services pursuant to the Agreement and any Order Form(s).

5. Data Processing Terms

5.1 Customer Obligations:

  • Customer shall comply with all applicable Data Protection Laws in connection with this Addendum and the Processing of Customer Personal Data.
  • Customer shall process Customer Personal Data within the Services and provide Workhall with instructions in accordance with Data Protection Laws.
  • Customer is responsible for the lawful collection and transfer of Customer Personal Data to Workhall.
  • Customer agrees not to provide Workhall with any special categories of data as defined in Article 9 of the GDPR (e.g., health, religion, political affiliations).

5.2 Workhall Obligations: Workhall shall comply with all applicable Data Protection Laws and:

  • Process Data per Instructions: Process Customer Personal Data only for the purposes of the Agreement, as set out in Annex 1, and per Customer’s documented instructions (e.g., via the Agreement, this Addendum, or Service features). Workhall shall:
    • Use, retain, disclose, or Process Customer Personal Data only on behalf of Customer for the Business Purpose of providing the Services.
      Not Sell or Share Customer Personal Data, nor use it outside the business relationship or for other purposes, except as required by law.
    • Immediately inform Customer if Workhall cannot meet Data Protection Law obligations or if an instruction infringes such laws.
    • Allow Customer to take reasonable steps to ensure compliance and remediate unauthorized use.
  • Permitted Processing: Process Customer Personal Data only to:
    • Perform Business Purposes and obligations under the Agreement.
    • Operate, manage, test, maintain, and enhance the Services.
    • Disclose aggregate, non-identifiable statistics about the Services.
    • Protect the Services or Customer Personal Data from threats.
    • Comply with court orders or authorized governmental requests (with prior notice to Customer, if legally permissible).
    • As expressly authorized by Customer.
  • No Combining of Data: Not combine Customer Personal Data with data from other sources, except to perform permitted Business Purposes.
  • Confidentiality: Ensure personnel authorized to Process Customer Personal Data are bound by confidentiality obligations.
  • Security Measures: Implement and maintain technical and organizational measures per Article 32 of the GDPR, including:
    • Pseudonymization and encryption (e.g., AES-256, SSL/TLS).
    • Ensuring confidentiality, integrity, availability, and resilience of systems.
    • Restoring access to Customer Personal Data after incidents.
    • Regularly testing and evaluating security measures.
  • Subprocessors:
    • Workhall is authorized to engage Subprocessors listed in Annex 2, subject to:
      • Notifying Customer at least 30 days in advance of changes via email.
      • Including equivalent data protection obligations in Subprocessor contracts.
      • Remaining liable for Subprocessor failures.
    • Customer may object to a Subprocessor on data protection grounds within 30 days. The Parties will work in good faith for 30 days to find a solution. If no solution is found, either Party may terminate the relevant Services without penalty.
  • Legal Requests: Promptly notify Customer of legally binding requests for disclosure of Customer Personal Data (unless prohibited) and maintain records of such requests. Non-binding requests will be rejected, with notice to Customer.
  • Data Subject Requests: Notify Customer of Data Subject communications regarding Customer Personal Data and not respond unless authorized or required by law. Assist Customer with Data Subject rights (e.g., GDPR Chapter III) at Customer’s expense.
  • Security Incidents: Notify Customer without undue delay of any Personal Data Breach, providing information to meet reporting obligations. Take measures to mitigate effects and keep Customer informed. Notification is not an admission of fault.
  • GDPR Assistance: Provide reasonable assistance for Customer’s obligations under GDPR Articles 32–36 (e.g., security, impact assessments), at Customer’s expense for Articles 35–36.
  • Data Deletion: Upon Agreement termination, return or delete Customer Personal Data at Customer’s option, unless required to retain it by law.
  • Compliance Records: Maintain records to demonstrate compliance with this Addendum.
  • Audits: Provide information to demonstrate compliance and allow audits by Customer or a third-party auditor, with reasonable notice, during business hours, and minimizing disruption. Audits are limited to once per year unless required by a Supervisory Authority or due to a Personal Data Breach. Customer shall cover Workhall’s costs for audit assistance.

6. Warranties

Both Parties warrant compliance with Data Protection Laws for the term of the Agreement.

7. Restricted Transfers

When the transfer of Customer Personal Data from Customer (or its Affiliates) to Workhall is a Restricted Transfer under EU Area Law, the appropriate Controller to Processor SCCs apply as follows:

7.1 EU GDPR:

  • Module Two (controller to processor) applies.
  • Clause 7: Optional docking clause applies.
  • Clause 9: Option 2 applies; prior notice for Subprocessor changes per Section 5.2.
  • Clause 11: Optional language does not apply.
  • Clause 17: Governed by Irish law.
  • Clause 18(b): Disputes resolved before Republic of Ireland courts.
  • Annex I and II: Completed per Annex 1 of this Addendum.

7.2 Swiss DPA:

  • EU SCCs apply as per Section 7.1, with modifications:
    • References to “Regulation (EU) 2016/679” mean Swiss DPA.
    • “EU” or “Member State” means Switzerland and Swiss law.
    • Supervisory authority and courts refer to Swiss equivalents.
    • Governed by Swiss law; disputes resolved before Swiss courts.

7.3 UK GDPR:

  • EU SCCs apply as per Section 7.1, modified by the UK Transfer Addendum’s Mandatory Clauses. Conflicts are resolved per Sections 10–11 of the UK Addendum. Tables 1–3 are completed per Annex 1; Table 4 selects both “Importer” and “Exporter”.

7.4 AI Processing:

  • Workhall processes Personal Data using AI and machine learning within the EU (e.g., Frankfurt Region, Germany) for Service functionalities (e.g., workflow automation, analytics), in compliance with Data Protection Laws. AI processing is limited to Service purposes.

7.5 Other Restricted Transfers:

  • Workhall shall not participate in other Restricted Transfers unless compliant with Data Protection Laws and relevant SCCs.

7.6 Customer Responsibilities:

  • Customer shall review international data transfers regularly and implement safeguards (e.g., encryption) to mitigate risks.

7.7 Transfer Mechanism:

  • For transfers outside the EEA or adequate countries, the Parties use:
    • EU SCCs (June 4, 2021).
    • UK International Data Transfer Agreement/Addendum (March 21, 2022).
  • If the Transfer Mechanism is insufficient, Workhall will implement supplementary measures to ensure compliance.

7.8 Disclosures:

  • If Workhall receives a public authority request for Customer Personal Data, it will (if legally allowed):
    • Challenge the request.
    • Notify Customer promptly.
    • Disclose only the minimum required data and maintain records.

8. Precedence

In case of inconsistencies, the order of priority is:

  • Controller to Processor SCCs or other Cross-Border Transfer Mechanisms.
  • This Addendum.
  • The Agreement.

If any provision conflicts with the SCCs, the SCCs prevail.

9. Indemnity

To the extent permitted by law, Customer shall:

  • Defend Workhall and its Affiliates (“Indemnified Parties”) against third-party claims arising from Customer’s breach of this Addendum or Data Protection Laws.
  • Indemnify and hold harmless Indemnified Parties for losses, damages, fines, penalties, and expenses (including legal fees) arising from such breaches. Workhall may participate in defense/settlement at its own expense.

10. Severability

If any section of this Addendum is deemed unlawful or unenforceable, it shall not affect the validity of other sections.

11. Miscellaneous

This Addendum incorporates:

  • Privacy by Design and Default: Ensuring data protection in Service design.
  • Security: Measures per Annex 1, Section 4.
  • Breach Notification: To Supervisory Authorities and Customer as required.
  • Privacy Impact Assessments: Conducted where required.
  • Assistance: Provided for Supervisory Authority consultations, at Customer’s expense.
  • Compliance: With ISO 27001:2022, ISO 27701:2019, GDPR, and SPDI Rules.

Data Subjects may exercise rights (e.g., access, correction, erasure) by contacting Workhall’s Data Protection Officer:
Name: Dhanush Nehru
Email: dpo@workhall.com
No temporary files are generated during Processing.

Annex 1: Description of Processing Activities for Customer Personal Data

List of Parties

Data Exporter:

  • Name: Customer (as defined in the Agreement).
  • Address: As set forth in the relevant Order Form.
  • Contact: As set forth in the relevant Order Form.
  • Activities: Recipient of Services provided by Workhall per the Agreement.
  • Role: Controller.

Data Importer:

  • Name: Workhall Pvt Ltd.
  • Address: Level 2, #185, 3rd Main Road, Natesa Nagar, Virugambakkam, Chennai – 600 092, Tamil Nadu, India.
  • Contact: Workhall Private Limited, ask@workhall.com.
  • Activities: Provision of Services to Customer per the Agreement.
  • Role: Processor.

Competent Supervisory Authority:

  • As determined by Clause 13 of the EU SCCs.

Processing Information:

  • Categories of Data Subjects: Customer’s authorized users of the Services (e.g., employees, agents).
  • Categories of Personal Data:
    • Automatically processed: Names, email addresses, Workspace Content (e.g., messages, tasks, files).
    • Where provided by Customer/users: Address, phone number, optional profile data (e.g., photo).
  • Sensitive Personal Data: None.
  • Frequency of Transfer: Continuous.
  • Nature of Processing: Provision of team productivity and collaboration tools, including data storage, processing, and analytics to enable workflows, task management, and integrations.
  • Purpose: To facilitate Service delivery as described in the Agreement and Order Forms.
  • Business Purpose(s) for Processing Personal Data:
    • Helping to ensure security and integrity.
    • Debugging to identify and repair errors.
    • Short-term, transient use (e.g., non-personalized ads).
    • Performing services (e.g., account management, customer service, analytics).
    • Providing advertising/marketing (except cross-context behavioral advertising).
    • Internal research for technological development.
    • Maintaining quality/safety of Services.
    • Preventing/detecting security incidents or fraud.
  • Retention Period: As described in the Agreement, Addendum, and Order Forms.
  • Subprocessor Transfers: As described in the Agreement, Addendum, and Annex 2.

Technical and Organizational Security Measures:

  • Security Management System:
    • Organization: Designated security personnel oversee the Information Security Program.
    • Policies: Annual review of security policies to ensure confidentiality, integrity, and availability.
    • Assessments: Annual third-party risk assessments of systems handling Customer Personal Data.
    • Risk Treatment: Penetration testing, vulnerability management, and patch management.
    • Vendor Management: Oversight of third-party vendors.
    • Incident Management: Regular review of security incidents with root cause analysis and corrective action.
    • Standards: Compliance with ISO 27001:2022 and ISO 27701:2019.
  • Personnel Security:
    • Background checks (where legally permissible) for employees handling Customer Personal Data.
    • Confidentiality agreements and mandatory training on privacy/security policies.
  • Access Controls:
    • Formal access management process based on “least privilege” and “need to know.”
    • Multi-factor authentication or single sign-on for administrators and users.
    • Periodic access reviews and logging for accountability.
    • Strong password policies and restrictions on reuse.
  • Data Center and Network Security:
    • Infrastructure: Hosted on AWS with multi-availability zones for resiliency.
    • Server Security: Hardened servers with code review processes.
    • Disaster Recovery: Regular backup restoration testing and data replication.
    • Security Logs: Enabled for auditing and detecting intrusions.
    • Vulnerability Management: Regular scans and risk-based remediation.
  • Networks and Transmission:
    • Data Transmission: HTTPS encryption (SSL/TLS) for data in transit.
    • External Attack Surface: AWS Security Groups as virtual firewalls.
    • Incident Response: Policies for monitoring and responding to security incidents.
    • Encryption: AES-256 for data at rest.
    • Data Storage/Isolation: Multi-tenant AWS environment with logical isolation and secure disposal processes.

Workhall Sub-processors

Please refer to http://workhall.com/sub-processors for Workhall’s list of sub-processors.

Ready to start?

Get your first workflow live today!

Book a demo