Data Processing Agreement

11. Parties and roles#

This DPA is between the Customer and [To be confirmed: legal name and form of the operator], [To be confirmed: country of establishment and registration number], [To be confirmed: registered address] (WorkNivo).

1. Customer as Controller. For Customer Personal Data the Customer is the Controller and WorkNivo is its Processor.
2. Customer acting for another Controller. If the Customer processes Customer Personal Data as a Processor for someone else, the Customer confirms that its Controller has authorised it to appoint WorkNivo on the terms of this DPA, including the Subprocessors and the transfers. WorkNivo then acts as the Customer's Subprocessor, and the Customer remains WorkNivo's only point of contact.
3. WorkNivo's own processing. WorkNivo is a Controller, not a Processor, for Account Data, for the website and its assistant, for early-access and pilot requests, for support, feedback and data-rights requests, and for security and abuse prevention. It is also a Controller for the limited own uses of Usage Data and of the Workspace's activity history that section 4 lists in full. That processing is described in the Privacy Policy; the list in section 4 is the only permission this Agreement gives for it.

How this DPA is accepted. Once a final version is published, a Workspace Owner accepts this DPA for the Customer when creating the Workspace (or when asked in the app), by confirming they are authorised to do so. WorkNivo records who accepted, for which Workspace, the version and a fingerprint of its text, and when. While this DPA is a draft, the same step is recorded only as confirmation that the draft was read: a draft is not in effect and does not bind either party. [To be confirmed: which terms govern pilot processing until a final DPA is in effect] [To be confirmed: whether the evidence kept is sufficient, and whether members should be asked anything] The DPA applies to Pilots as well as to Paid Plans.

22. Definitions#

Capitalised terms have the meanings below. The shared definitions are identical in the Terms of Service, the Privacy Policy and this DPA.

WorkNivo, we, us

[To be confirmed: legal name and form of the operator], the operator of the Services and of worknivo.app.

Customer, you

The business (company, partnership or sole trader acting for its trade) that creates a Workspace or is given access to the Services under these terms. The Customer is the contracting party.

Authorized User

A person the Customer allows to use its Workspace, by creating it or by accepting an invitation, in the role the Workspace assigns (owner, manager or member).

Workspace

The separate area of the Services that holds one Customer's settings, Authorized Users, records and documents. One Workspace's data is not visible to another.

Workspace Owner

An Authorized User with the owner role. Owners manage members, roles and plan selection for the Workspace. Every Workspace has at least one owner.

Services

The WorkNivo website, the WorkNivo web application (currently WorkNivo Intake) and the related support we provide. Features marked "In development" or "Planned" are not part of the Services until we release them.

Customer Content

Everything the Customer or its Authorized Users put into the Services (Customer Input) or have the Services produce for them (Outputs).

Uploaded Document

A file (currently PDF only) uploaded to a Workspace for processing, such as a purchase order.

Output

Information the Services produce from Customer Input: AI Drafts, matches against the Customer's records, flagged issues, calculated totals, draft confirmation emails (which WorkNivo never sends), reports and exported files.

Account Data

Information about a person's WorkNivo account: name, email address, sign-in method, password hash (held by our authentication provider), Workspace memberships and roles, and account settings.

Usage Data

Technical and operational information created when the Services are used: processing jobs and their status, AI model name and token counts, order-allowance counts, security and request logs, and similar records.

Personal Data

Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the General Data Protection Regulation (EU) 2016/679 (GDPR).

Controller

The party that decides why and how Personal Data is processed (GDPR Article 4(7)).

Processor

A party that processes Personal Data on behalf of a Controller (GDPR Article 4(8)).

Subprocessor

A third party WorkNivo engages to process Personal Data contained in Customer Content on the Customer's behalf. The current list is on the Subprocessors page.

AI Provider

The third-party company whose AI models read Uploaded Documents and answer website-assistant questions. Today this is Anthropic (see the Subprocessors page).

Pilot

Complimentary access to a plan for a Workspace, today the free beta that a verified Workspace Owner can start without payment or manual approval (or, where we offer it, a time-limited access that WorkNivo approves by hand). A Pilot is not a paid subscription and nothing is charged for it.

Paid Plan

A Starter, Growth or Scale subscription paid for monthly or annually. Paid Plans are not yet available; no payments can be made today.

Security Incident

An event that compromises, or is reasonably suspected to compromise, the confidentiality, integrity or availability of the Services or of data in them.

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data (GDPR Article 4(12)).

The following terms are used only in this DPA:

Customer Personal Data

Personal Data contained in Customer Content that WorkNivo processes on behalf of the Customer under this DPA.

Applicable Data Protection Law

The GDPR and the national laws of EU and EEA Member States that implement or supplement it and apply to the processing, such as Cyprus Law 125(I)/2018 where it applies. [To be confirmed: whether UK or Swiss data protection law must be added for the target countries]

Data Subject

The identified or identifiable natural person to whom Customer Personal Data relates.

SCCs

The standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914, in the module stated, in their official, unmodified wording.

Restricted Transfer

A transfer of Customer Personal Data to a country outside the EEA that is not covered by an adequacy decision of the European Commission.

Other terms such as “processing” and “supervisory authority” have the meaning given in the GDPR.

33. Subject matter, nature, purpose and duration#

WorkNivo processes Customer Personal Data to provide the Services to the Customer: storing Uploaded Documents and records, reading documents with the AI Provider, matching and checking the results against the Customer's own records, showing them for review, recording approvals and exports, and keeping the Workspace activity history. Annex 1 gives the details.

This DPA applies for as long as WorkNivo processes Customer Personal Data, including after the Terms end until the data has been returned or deleted under section 13.

44. Processing only on documented instructions#

WorkNivo processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to third countries. The Customer's instructions are:

1. this DPA and the Terms of Service;
2. the Customer's use and configuration of the Services by its Authorized Users, such as uploading documents, importing records, editing, approving, rejecting and exporting, inviting and removing members, and changing settings; and
3. any other written instruction that the Customer gives and WorkNivo agrees in writing is consistent with the Services.

By using document processing, the Customer instructs WorkNivo to send each Uploaded Document in full to the AI Provider, as described in section 9 and the Privacy Policy.

Processing required by law. WorkNivo may process Customer Personal Data other than on instructions only where Union or Member State law to which it is subject requires it. WorkNivo will tell the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

Instructions that may infringe the law. WorkNivo will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. WorkNivo is not obliged to carry out an instruction it reasonably believes is unlawful.

No training and no sale. WorkNivo does not use Customer Personal Data to train AI models and does not sell it.

WorkNivo's own uses (complete list). WorkNivo uses Usage Data as a Controller only to operate and support the Services, to measure and limit their use under plans and Pilots, to keep them secure and prevent abuse, and, in a form that does not identify the Customer or any person, to improve them. WorkNivo uses the Workspace's activity history as a Controller only to keep the Services secure, to investigate misuse and incidents, and to administer the platform (WorkNivo's administrators can see a Workspace's activity feed, which can include the file names of Uploaded Documents). It makes no other use of Customer Content for its own purposes. The Terms of Service repeat this list word for word. [To be confirmed: confirmation of the limited purposes for which WorkNivo uses Usage Data as a Controller]

55. The Customer's responsibilities#

The Customer, as Controller, is responsible for:

• having a lawful basis for the Customer Personal Data it puts into the Services and for its instructions;
• giving the people whose data appears in its documents and records (such as its own customers' and suppliers' contact persons) the information required by Articles 13 and 14 GDPR, including that documents are read by an AI Provider outside the EU;
• not uploading special categories of personal data (Article 9 GDPR) or data about criminal convictions and offences (Article 10 GDPR), except as permitted under the AI Use & Responsibility Policy. [To be confirmed: whether special-category and criminal-offence data are excluded]
• deciding who in its organisation becomes an Authorized User and in which role, and removing access when it is no longer needed; and
• deciding whether the processing needs a data protection impact assessment on its side.

66. Confidentiality of personnel#

WorkNivo ensures that every person it authorises to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and processes the data only as needed to provide the Services under this DPA.

Today the only people with technical access are WorkNivo's platform administrators. Administrator tools cannot read Uploaded Documents or orders through the Workspace access rules, and administrator actions are logged and shown in the Customer's activity history as “WorkNivo”. The founder's direct infrastructure access to the database bypasses those rules and may be used only to provide support at the Customer's request, to handle a Security Incident, or where the law requires. [To be confirmed: written staff-access policy for Customer Personal Data]

77. Security of processing#

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, and the risks to Data Subjects, WorkNivo implements the technical and organisational measures in Annex 2. They are explained in plain language on the Security & Data Protection page.

WorkNivo may update these measures as the Services develop, provided the overall level of protection is not materially reduced. The Customer is responsible for the security of its own devices and accounts, for choosing strong passwords, and for keeping invitation links private.

88. Subprocessors#

General authorisation. The Customer gives WorkNivo general written authorisation to engage the Subprocessors listed on the Subprocessors page on the date of acceptance, and further Subprocessors under this section.

Flow-down. WorkNivo engages each Subprocessor under a written contract that imposes data protection obligations providing sufficient guarantees of appropriate technical and organisational measures, as required by Article 28(4) GDPR. WorkNivo uses each provider's standard data processing terms. [To be confirmed: confirmation that each vendor's data processing terms are in force for WorkNivo's account] [To be confirmed: whether the vendor contracts are held by the operator or by the founder personally]

Notice of changes. WorkNivo will inform the Customer of any intended addition or replacement of a Subprocessor at least [To be confirmed: advance notice period for a new or replaced Subprocessor] before the new Subprocessor processes Customer Personal Data, by [Planned: in-app notice to Workspace Owners, and email once a customer email channel exists], and by updating the Subprocessors page with the change and its date.

Right to object. The Customer may object to the change on reasonable data protection grounds within [To be confirmed: period in which the Customer may object] of the notice, by writing to the contact in section 17. The parties will discuss the objection in good faith. If it is not resolved, the Customer may stop using the affected part of the Services or end the Terms, [To be confirmed: remedy on unresolved objection, including any refund of prepaid fees once Paid Plans exist].

Urgent replacement. If a Subprocessor must be replaced urgently to keep the Services secure or available, WorkNivo will notify the Customer as soon as possible, and the right to object applies from that notice.

Responsibility. WorkNivo remains liable to the Customer for the performance of each Subprocessor's data protection obligations, as required by Article 28(4) GDPR, subject to section 15.

99. International transfers#

Customer Personal Data stored in the database, authentication service and file storage is held by Supabase in the EU (Ireland). Some processing takes place outside the EEA:

• Every Uploaded Document is sent in full to the AI Provider, Anthropic. Anthropic's processing can run in any geography and its data at rest is in the United States; it offers no EU-only option.
• WorkNivo's web application server runs on Netlify in the United States (us-east-2, Ohio), so Workspace data shown in the app passes through it. The document-processing function run by Supabase is likely to run outside the EU. [To be confirmed: processing regions for Netlify functions and the document-processing Edge Function]
• Providers' support staff may access data from other countries, as described in their own terms.

WorkNivo makes a Restricted Transfer only where a transfer mechanism under Chapter V GDPR applies, such as an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or the SCCs. The mechanism relied on for each Subprocessor is listed in Annex 4. Where the SCCs apply, they apply in their official wording; nothing in this DPA modifies them, and if this DPA conflicts with the SCCs, the SCCs prevail.

Customer to WorkNivo. [To be confirmed: whether a transfer mechanism is needed between the Customer and WorkNivo, which depends on where the operator is established]

Requests from public authorities. If WorkNivo receives a legally binding request from a public authority for Customer Personal Data, it will notify the Customer unless the law prohibits it, and will disclose only what it is legally required to disclose.

1010. Help with data-subject requests#

Taking into account the nature of the processing, WorkNivo assists the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights under Chapter III GDPR.

• If WorkNivo receives a request about Customer Personal Data directly, it will pass it to the Customer without undue delay and will not answer it itself, except to tell the person that it has been passed on, unless the Customer instructs otherwise.
• Within the Services, Authorized Users can view, correct and export order records (CSV and XLSX), and Workspace Owners can remove members.
• Other requests, such as a full copy or deletion of a Data Subject's data, are carried out by WorkNivo by hand when a Workspace Owner asks, by email or from Settings → Privacy & data (Workspace export and Workspace deletion requests). A person handles each request.

Requests from people about WorkNivo's own processing (for example their account) are handled under the Privacy Policy.

1111. Personal Data Breaches#

WorkNivo will notify the Customer without undue delay, and in any event within [To be confirmed: maximum time for notifying the Customer of a Personal Data Breach], after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice goes to the Workspace Owners by the contact details held for the Workspace.

The notice will include, as far as the information is then available, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where not everything is known at once, WorkNivo will provide information in phases without further undue delay.

WorkNivo will take reasonable steps to contain the breach and reduce its effects, keep a record of it, and help the Customer with its own notifications to the supervisory authority and to Data Subjects (Articles 33 and 34 GDPR). The Customer decides whether those notifications are needed. Notifying a breach is not an admission of fault. The process is described under incident response.

1212. Security, impact assessments and prior consultation#

Taking into account the nature of the processing and the information available to it, WorkNivo assists the Customer in meeting its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority. In the first place WorkNivo does this by providing:

• this DPA and its Annexes;
• the AI Use & Responsibility Policy, including the limitations of the AI and human review;
• the Security & Data Protection page and the Subprocessors page; and
• answers to reasonable written questions about the processing.

Further assistance is provided on reasonable terms. [To be confirmed: audit notice period, frequency and cost allocation, and when assistance is charged]

1313. Return and deletion#

At the choice of the Customer, WorkNivo deletes or returns all Customer Personal Data after the provision of the Services ends, and deletes existing copies, unless Union or Member State law requires WorkNivo to keep them.

1. Return. Before the end, Authorized Users can export approved orders as CSV or XLSX. A fuller export can be requested from WorkNivo, which provides it by hand. Export and switching are described in the Terms of Service. [To be confirmed: retrieval period after termination and scope of the full export]
2. Deletion. WorkNivo deletes Customer Personal Data, including Uploaded Documents in storage and the Workspace's records and activity history, within [To be confirmed: deletion timeframe after a verified request or after the retrieval period]. Deletion is carried out by WorkNivo, not by a self-service control. [Planned: procedure that deletes a Workspace's stored files and records (gap report item O2)]
3. What can remain. Copies in backups are deleted when the backups expire [To be confirmed: Supabase backup retention and when backed-up data expires]. Copies held by the AI Provider are deleted under its own retention terms, described on the Subprocessors page. Records of acceptance of the Terms and this DPA are kept as evidence of the contract, also after the Workspace is deleted (they keep the Workspace's name and identifier), as set out in the Privacy Policy.
4. On written request, WorkNivo will confirm in writing that deletion has been carried out.

During the Services, the Customer can ask for a Workspace or individual records to be deleted; WorkNivo handles these requests in the same way.

1414. Information and audits#

WorkNivo makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or by an auditor the Customer mandates.

• WorkNivo first provides the documents listed in section 12 and answers reasonable written questionnaires.
• If that does not reasonably show compliance, the Customer may carry out an audit on reasonable prior written notice, during business hours, without unreasonably disrupting the Services, and subject to confidentiality. [To be confirmed: audit notice period, frequency and cost allocation, and when assistance is charged]
• Audits may not give access to other customers' data or to WorkNivo's security secrets.
• Nothing in this section limits an audit or inspection by a competent supervisory authority.

WorkNivo does not hold any security certification and has not commissioned an independent security audit. See what we do not claim.

1515. Liability and order of precedence#

Each party's liability under this DPA is governed only by the liability cap in the Terms of Service, which says whether breaches of this DPA have their own cap and how it relates to the general cap. This DPA sets no cap of its own. Nothing in this DPA limits a party's liability to Data Subjects under Article 82 GDPR, or any liability that cannot be limited by law.

This DPA prevails over the Terms of Service for the processing of Customer Personal Data, in particular over the Terms' sections "How WorkNivo may use Customer Content", "Data protection", "Third-party services" and "Data export, switching and deletion" to the extent they concern Customer Personal Data. WorkNivo's own uses of data are limited to the list in section 4, whichever document is read. If this DPA conflicts with the SCCs, the SCCs prevail. This DPA is governed by the same law as the Terms of Service (governing law), except that the SCCs are governed by the law they specify. [To be confirmed: governing law and courts]

1616. Term, termination and changes#

This DPA starts when it is accepted and continues for as long as WorkNivo processes Customer Personal Data. It ends automatically when the Terms of Service end and all Customer Personal Data has been returned or deleted under section 13. Obligations that by their nature continue survive.

WorkNivo may change this DPA only as described in the Terms of Service. A material change takes effect only after advance notice to the Workspace Owners and re-acceptance by a Workspace Owner. [To be confirmed: notice period for material changes] A change required by law or a supervisory authority may take effect sooner.

1717. Contact#

Notices and questions under this DPA, including objections to Subprocessors, go to the contact below. [To be confirmed: dedicated privacy contact mailbox] Full contact details are in the Legal Notice.

Privacy and data-protection requests

[To be confirmed: dedicated privacy contact address] General contact meanwhile: support@worknivo.app

Support and general questions

support@worknivo.app

18Annex 1. Details of the processing#

19Annex 2. Technical and organisational measures#

These are the measures in place on the date of this version. A plain-language explanation is on the Security & Data Protection page.

20Annex 3. Approved Subprocessors#

The approved Subprocessors are those listed under Current subprocessors on the Subprocessors page, in the version in effect on the date the Customer accepts this DPA, as later changed under section 8. Each entry gives the provider, purpose, data, location, role and transfer mechanism. Past changes are listed in the page's change history.

Providers that are not Subprocessors, such as Google for Google sign-in, are listed separately under Other recipients.

21Annex 4. Transfer mechanisms#

The table lists the mechanism each provider's own terms state for transfers outside the EEA. The legal instruments are Commission Implementing Decision (EU) 2021/914 (SCCs; Module 2 is controller to processor, Module 3 is processor to processor) and Commission Implementing Decision (EU) 2023/1795 (EU-U.S. Data Privacy Framework). Which module, if any, applies to WorkNivo itself depends on where WorkNivo is established and which company of each provider it contracts with: the 2021/914 SCCs cover transfers to importers outside the EEA, so where WorkNivo contracts with a provider's EEA company (for example Anthropic Ireland, Limited), the transfer outside the EEA is that provider's onward transfer under its own DPA. [To be confirmed: the transfer chain and module for each provider, once the operator (LD-01, LD-02) and contracting entities (LD-19) are confirmed]

The status of each provider's terms for WorkNivo's account: [To be confirmed: confirmation that each vendor's data processing terms are in force for WorkNivo's account]. Transfer impact assessments: [To be confirmed: transfer impact assessments under SCC Clause 14 for each transfer in this table].

Where the Data Privacy Framework is relied on and ceases to be valid or the recipient's certification lapses, WorkNivo will rely on the SCCs in that provider's terms, or on another valid mechanism, or will stop the transfer.