Data processing agreement

This agreement between the customer and NEWWORK [legal form to confirm] (the “processor”) forms part of the terms of service and applies whenever we process personal data on the customer’s behalf. If you need a signed copy, write to privacy@newworkprojects.com.

1. Subject, duration, nature and purpose

We host and process the customer’s workspaces to provide NEWWORK Projects: storing and showing content, sending notifications, connecting integrations and agents, and running AI features when members use them. The agreement lasts as long as we process data for the customer.

2. Data and people concerned

• Types of data: names, email addresses and profile pictures of members and guests; the content of tickets, comments, files and documents; time entries; activity and access records, including support access and what support opened.
• Usage records: daily counts per workspace of the screens, features and MCP tools used, and for each AI request the feature, model, token counts and cost, without its content. We use them to apply the plan’s limits, bill and run the service, and keep them for at most 25 months (AI requests 13 months).
• Audit log: every change in a workspace with who made it and what it was before, sign-ins (time, method and IP address), billing events and support access. The workspace’s admins on Business and Enterprise read and export it. Entries are kept for a year on Business and Enterprise and 90 days on other plans, then deleted.
• People: the customer’s members and guests, and anyone the content mentions.
• The service is not designed for special categories of personal data (Art. 9 GDPR). The customer decides whether to store them.

3. Instructions

We process the data only on the customer’s documented instructions, which are these terms, the customer’s settings and its use of the service, unless the law requires otherwise. We tell the customer if we believe an instruction breaks data protection law.

4. Confidentiality

Everyone at NEWWORK [legal form to confirm] with access to customer data is bound to confidentiality.

Our staff do not read workspace content unless one of the workspace’s admins grants support access, for 1, 3 or 7 days, under Workspace settings → Data & privacy. While a grant is open, staff with the support role may read the workspace’s projects and tickets, read-only and without files, to answer the customer’s request. Each page they open is listed for the workspace’s admins, who can end access at any time. Granting access is an instruction under section 3.

5. Security (Art. 32 GDPR)

• Data is stored in the EU (Frankfurt) and encrypted in transit and at rest.
• Every table is separated by workspace with row-level security, and an automated suite checks on every change that one workspace cannot read or change another’s data.
• Agent tokens are stored as hashes, belong to one workspace, expire after 90 days and can be revoked at any time.
• Access to production is limited to the people who run the service. Staff work in a separate console that needs two-factor sign-in, and what they do there is logged.
• Databases are backed up daily.

6. Subprocessors

The customer authorises the subprocessors below. We bind each to data protection obligations equivalent to this agreement. We tell workspace owners by email at least 30 days before adding or replacing a subprocessor that processes customer data. The customer may object for good reason; if we cannot address the objection, the customer may cancel the affected plan.

List as of 15 October 2026. Transfers outside the EU rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

7. Assistance

We help the customer answer requests from data subjects, mostly through the service itself (export, edit and delete), and support it with security, breach notifications, impact assessments and prior consultations (Art. 32 to 36 GDPR).

8. Personal data breaches

We tell the customer without undue delay after becoming aware of a breach that affects its data, with the information we have and what we are doing about it.

9. Deletion and return

Owners can export a workspace at any time. When a workspace is deleted, or the agreement ends and the customer has deleted it, we delete its content and its audit log unless the law requires us to keep them. Copies in backups are removed as the backups roll over.

10. Audits

We give the customer the information needed to show compliance with Art. 28 GDPR. The customer may audit us, or have an auditor bound to confidentiality do so, after reasonable notice, during business hours and without disrupting the service, normally once a year.

11. Liability and precedence

Liability follows the terms of service and Art. 82 GDPR. Where this agreement and the terms differ on data protection, this agreement prevails.