Data processing addendum
How we process data for clients.
The data processing terms that apply when Outwerk processes personal data on behalf of a client.
DATA PROCESSING ADDENDUM
This data processing addendum (the "DPA") forms part of the master services agreement dated [date of the agreement] (the "agreement") between Vivek Yogesh Doshi, trading as Outwerk, Mumbai, Maharashtra, India ("Outwerk" or the "processor") and [CLIENT LEGAL NAME], [CLIENT ADDRESS] (the "client" or the "controller").
1. Definitions
1.1 Terms defined in the agreement have the same meaning here. In addition:
"Applicable data protection law" means all laws and regulations that apply to the processing of personal data under this DPA, including, as applicable: Regulation (EU) 2016/679 (the "GDPR"); the GDPR as it forms part of the law of the United Kingdom under the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018 (together the "UK GDPR"); the Swiss Federal Act on Data Protection; the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 and its regulations (the "CCPA"); other US state consumer privacy laws; the Personal Information Protection and Electronic Documents Act (Canada) and substantially similar provincial laws including Quebec's Act respecting the protection of personal information in the private sector ("PIPEDA"); and the Digital Personal Data Protection Act 2023 (India) and the rules under it (the "DPDP Act").
"Controller", "processor", "data subject", "personal data", "personal data breach", "processing", "special categories of personal data" and "supervisory authority" have the meanings given in the GDPR. Under the CCPA, "controller" includes "business", "processor" includes "service provider", "personal data" includes "personal information" and "data subject" includes "consumer". Under PIPEDA, "personal data" includes "personal information". Under the DPDP Act, "controller" includes "data fiduciary", "processor" includes "data processor" and "data subject" includes "data principal".
"Client personal data" means personal data contained in client data that Outwerk processes on the client's behalf under the agreement.
"EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force 21 March 2022.
"Restricted transfer" means a transfer of client personal data that is subject to the GDPR, UK GDPR or Swiss law to a country that does not have an adequacy decision from the European Commission, the UK government or the Swiss Federal Council, as applicable.
"Sub-processor" means any third party engaged by Outwerk to process client personal data.
2. Roles and scope
2.1 The client is the controller and Outwerk is the processor of client personal data. Where the client is itself a processor for a third party, the client warrants that it has the authority to appoint Outwerk as a sub-processor on these terms and that its instructions comply with its own controller's instructions.
2.2 This DPA applies to all processing of client personal data by Outwerk under the agreement and every SOW. The details of processing are in Annex 1.
2.3 Outwerk acts as an independent controller, not a processor, for the business contact details of the client's staff that Outwerk uses for account management, invoicing and communication, and for Outwerk's own records. That processing is covered by Outwerk's privacy policy at outwerk.ai/privacy/.
3. Processor obligations
3.1 Documented instructions. Outwerk will process client personal data only on the client's documented instructions, including with regard to transfers to a third country, unless required to do otherwise by law to which Outwerk is subject, in which case Outwerk will inform the client of that requirement before processing unless the law prohibits it. The client's documented instructions are the agreement, each SOW, this DPA, and written instructions from the client's decision maker. Outwerk will inform the client without delay if, in its opinion, an instruction infringes applicable data protection law, and may suspend the instruction until it is confirmed or changed.
3.2 Confidentiality. Outwerk will ensure that each person it authorizes to process client personal data has committed to confidentiality in writing or is under an appropriate statutory obligation of confidentiality, and processes the data only as needed to perform the services.
3.3 Security. Outwerk will implement and maintain the technical and organizational measures in Annex 2, and such other measures as are appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, to ensure a level of security appropriate to the risk, including protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to client personal data. Outwerk may update Annex 2 provided the updates do not reduce the overall level of protection.
3.4 Records. Outwerk will maintain a record of processing activities carried out on the client's behalf containing the information required by Article 30(2) GDPR and will make it available to the client on request.
3.5 Excluded data. Outwerk does not accept protected health information under HIPAA, special categories of personal data under Article 9 GDPR, criminal offense data, payment card data, government identification numbers or financial account credentials, and the client will not include them in client personal data or instruct Outwerk to process them, unless a separate business associate agreement or written addendum covering that data is signed. Clause 14 of the agreement applies.
3.6 Assistance. Taking into account the nature of the processing and the information available to it, Outwerk will assist the client in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation) and the equivalent provisions of other applicable data protection law. Reasonable assistance is included in the run fee; substantial assistance beyond that may be charged at Outwerk's then-current rates after notice.
3.7 Compliance information. Outwerk will make available to the client all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, subject to clause 10.
4. Client obligations
4.1 The client is responsible for the lawfulness of the collection and processing of client personal data, including having a valid lawful basis, giving the notices required by applicable data protection law, obtaining any necessary consents, and responding to data subjects.
4.2 The client will ensure that its instructions comply with applicable data protection law, that client personal data is accurate and up to date to the extent the client controls it, and that it will not instruct Outwerk to process data in breach of clause 3.5.
4.3 The client will complete any data protection impact assessment, legitimate interests assessment, transfer impact assessment or privacy impact assessment that its own law requires before instructing Outwerk to process the relevant data, with Outwerk's assistance under clause 3.6.
5. Sub-processors
5.1 General authorization. The client gives Outwerk general written authorization to engage sub-processors to process client personal data. The sub-processors engaged at the date of this DPA are listed in Annex 3, and the client approves them.
5.2 Notice of changes. Outwerk will give the client at least 30 days' written notice before engaging a new sub-processor or replacing an existing one, by email to the client's notice address and by updating the list at outwerk.ai/dpa/. The notice will state the sub-processor's name, location, the processing it will perform and the transfer mechanism where relevant.
5.3 Right to object. The client may object to a new sub-processor on reasonable grounds relating to data protection within the 30-day notice period, by written notice stating the grounds. The parties will discuss the objection in good faith. If Outwerk cannot reasonably accommodate the objection (for example by offering an alternative configuration), either party may terminate the affected SOW on 30 days' written notice without liability for early termination, and Outwerk will refund any run fee prepaid for the period after termination. If the client does not object within the notice period, the sub-processor is deemed approved.
5.4 Flow-down. Outwerk will enter a written contract with each sub-processor imposing data protection obligations that are at least as protective as those in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organizational measures, and will remain fully liable to the client for the performance of each sub-processor's obligations.
5.5 Client's own stack. Where the client instructs Outwerk to use the client's own software and service providers (for example the client's CRM, accounting system, email or AI provider account), those providers are the client's processors or sub-processors, not Outwerk's, and the client is responsible for the contracts with them. Outwerk's access to them is processing on the client's instructions.
6. Data subject requests
6.1 Taking into account the nature of the processing, Outwerk will assist the client by appropriate technical and organizational measures, insofar as possible, to fulfil the client's obligation to respond to requests from data subjects exercising their rights under applicable data protection law, including rights of access, rectification, erasure, restriction, portability, objection, opt-out of sale or sharing, and limitation of use of sensitive personal information.
6.2 If Outwerk receives a request directly from a data subject relating to client personal data, it will not respond on the merits but will redirect the data subject to the client and inform the client within five business days, unless the law prohibits it.
6.3 Outwerk will provide the client, on request, with the tools, exports or information needed to respond to a request within 10 business days, so that the client can meet its statutory deadline.
7. Data protection impact assessments
7.1 Where the client is required to carry out a data protection impact assessment or consult a supervisory authority in relation to processing performed by Outwerk, Outwerk will provide reasonable assistance, including a description of the processing operations, the technical and organizational measures, and the sub-processors involved.
7.2 Outwerk will tell the client if it becomes aware that a system it is building or running is likely to involve systematic monitoring of individuals, large-scale processing, scoring or profiling of individuals, or any other feature that commonly triggers an impact assessment, so that the client can assess it before go-live.
8. Personal data breach
8.1 Outwerk will notify the client without undue delay and in any event within 48 hours after confirming a personal data breach affecting client personal data. Confirmation means that Outwerk has established, on reasonable grounds, that a breach has occurred; a suspected incident under investigation will be notified as such without waiting for confirmation where it is likely to be material.
8.2 The notification will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point. Information may be provided in phases as it becomes available.
8.3 Outwerk will cooperate with the client, take reasonable steps to contain and remediate the breach, and keep a record of the breach and its handling. Outwerk will not notify any supervisory authority, regulator or data subject of a breach of client personal data unless the client instructs it to, or Outwerk is required to do so by law, in which case it will inform the client first where lawful.
8.4 Outwerk is also subject to Indian incident reporting rules (including the CERT-In directions of April 2022, where applicable) and will comply with them in a manner that does not disclose client personal data beyond what is legally required.
9. Return and deletion
9.1 On termination or expiry of the agreement or the relevant SOW, Outwerk will, at the client's choice, return client personal data to the client in a structured, commonly used, machine-readable format or delete it, within 30 days, and will delete existing copies, unless retention is required by law to which Outwerk is subject, in which case Outwerk will protect the retained data under this DPA and process it only for the required purpose.
9.2 If the client does not state a choice within 15 days of termination, Outwerk will export the data as described in clause 24.2 of the agreement, make it available for 15 days, then delete it.
9.3 Client personal data held in accounts in the client's name is not subject to this clause; Outwerk will remove its own access to those accounts within seven days of termination.
9.4 Data in encrypted backups is deleted on the backup provider's rotation cycle, not exceeding 90 days, and is not restored or accessed in the meantime except as required by law. Outwerk will confirm deletion in writing on request.
10. Audits
10.1 Outwerk will make available to the client, on request and no more than once in any 12-month period, the information reasonably necessary to demonstrate compliance with this DPA, in the first instance by: (a) completing the client's reasonable written security and privacy questionnaire; (b) providing its current security policies, Annex 2 and any penetration test summary; and (c) where available, providing third-party audit reports or certifications (such as SOC 2 or ISO 27001) covering Outwerk or its hosting providers.
10.2 If the information in clause 10.1 is reasonably insufficient, or a supervisory authority requires it, or a personal data breach affecting the client has occurred, the client or an independent auditor appointed by it and bound by confidentiality may conduct an audit of Outwerk's processing of client personal data, on at least 30 days' written notice, during business hours, no more than once in any 12-month period (except after a breach), and in a way that does not unreasonably disrupt Outwerk's business or compromise the confidentiality of other clients' data. Remote audits are preferred.
10.3 The client bears the costs of any audit unless it reveals a material breach of this DPA by Outwerk. Outwerk will remedy any non-compliance identified within a reasonable time.
11. International transfers
11.1 Processing location. Outwerk processes client personal data from India and uses sub-processors located in the United States and the European Union, as set out in Annex 3. The client acknowledges and instructs this.
11.2 Transfers from the EEA, UK and Switzerland to Outwerk. India has no adequacy decision. To the extent the client's provision of client personal data to Outwerk is a restricted transfer, the parties enter into the EU SCCs, Module Two (controller to processor), which are incorporated into this DPA by reference and completed as set out in clause 11.3. Where the client is itself a processor, Module Three (processor to processor) applies instead with the same selections. For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference and completed as set out in clause 11.4. For transfers subject to Swiss law, the EU SCCs apply with the amendments required by the Swiss Federal Data Protection and Information Commissioner.
11.3 EU SCCs selections. The parties agree that: (a) Clause 7 (docking clause) is included, so that an affiliate of the client may accede to the SCCs by signing Annex I; (b) in Clause 9, Option 2 (general written authorization) applies with a notice period of 30 days; (c) in Clause 11, the optional language on independent dispute resolution bodies does not apply; (d) in Clause 13, the competent supervisory authority is that of the EU member state where the client is established, or, where the client is not established in the EU, the Irish Data Protection Commission, unless the client's Article 27 representative is located elsewhere; (e) in Clause 17, Option 1 applies and the governing law is the law of the EU member state where the client is established, or Ireland where the client is not established in the EU; (f) in Clause 18, the courts of the same member state have jurisdiction; (g) Annex I.A (parties) is completed with the parties' details in this DPA, with the client as data exporter and Outwerk as data importer; (h) Annex I.B (description of transfer) is completed by Annex 1 to this DPA; (i) Annex I.C (competent supervisory authority) is completed by sub-clause (d); (j) Annex II (technical and organizational measures) is completed by Annex 2 to this DPA; and (k) Annex III (sub-processors) is completed by Annex 3 to this DPA.
11.4 UK Addendum selections. The UK Addendum is completed as follows: Table 1 (parties) with the parties' details in this DPA; Table 2 with the EU SCCs Module Two (or Three) as completed in clause 11.3; Table 3 with Annexes 1, 2 and 3 to this DPA; and Table 4 with "neither party" able to end the Addendum under its section 19, so that changes to the approved Addendum apply automatically. Where the client prefers the UK International Data Transfer Agreement in place of the UK Addendum, the parties will sign it separately with the same substance.
11.5 Transfer impact assessment. Outwerk has prepared a transfer impact assessment covering transfers of client personal data to India, which describes the laws and practices in India relevant to government access to data, the nature of the client personal data (business operational records rather than data of interest to intelligence agencies), the supplementary measures in Annex 2, and Outwerk's policy of challenging any request for data that is not legally binding and notifying the client where lawful. Outwerk will provide the assessment to the client on request and will update it if the law or practice in India changes materially. Each party warrants that it has no reason to believe that the laws and practices in India prevent Outwerk from fulfilling its obligations under the EU SCCs.
11.6 Onward transfers to sub-processors. Outwerk will ensure that each onward transfer of client personal data to a sub-processor in a third country is covered by an appropriate transfer mechanism, which for US sub-processors is the EU SCCs Module Three or, where the sub-processor is certified and the certification covers the data, the EU-US Data Privacy Framework and its UK Extension. Annex 3 records the mechanism relied on for each sub-processor.
11.7 Government requests. If Outwerk receives a legally binding request from a public authority for access to client personal data, it will notify the client promptly unless prohibited by law, review the legality of the request, challenge it where there are reasonable grounds, and disclose only the minimum data required.
11.8 Conflict. If there is a conflict between this DPA and the EU SCCs or UK Addendum, the EU SCCs or UK Addendum prevail for the restricted transfer concerned.
11.9 India outbound. Where client personal data of data principals in India is processed, the client acknowledges that Outwerk may process it in India and in the sub-processor locations in Annex 3, subject to any restriction notified by the Indian government under section 16 of the DPDP Act.
12. California and other US state law
12.1 This clause applies to the extent client personal data includes personal information subject to the CCPA or another US state consumer privacy law under which Outwerk acts as a service provider, contractor or processor.
12.2 The client discloses personal information to Outwerk only for the limited and specified business purposes set out in the agreement and Annex 1. Outwerk certifies that it understands and will comply with the restrictions in this clause.
12.3 Outwerk will not: (a) sell or share the personal information; (b) retain, use or disclose the personal information for any purpose, including a commercial purpose, other than the business purposes specified in the agreement, or as otherwise permitted by the CCPA; (c) retain, use or disclose the personal information outside the direct business relationship between Outwerk and the client; or (d) combine the personal information with personal information that Outwerk receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA regulations.
12.4 Outwerk will comply with the CCPA and provide the same level of privacy protection as the CCPA requires of the client. The client has the right to take reasonable and appropriate steps to ensure that Outwerk uses the personal information in a manner consistent with the client's obligations under the CCPA, including the audit and information rights in clause 10, and to stop and remediate unauthorized use.
12.5 Outwerk will notify the client within five business days if it determines that it can no longer meet its obligations under the CCPA.
12.6 Outwerk will cooperate with the client in responding to verifiable consumer requests, including requests to know, delete, correct, opt out of sale or sharing and limit the use of sensitive personal information, in accordance with clause 6, and will not respond directly except to redirect the consumer to the client.
12.7 Outwerk will engage sub-processors only under a written contract that imposes the obligations in this clause, and will notify the client of them under clause 5.
12.8 For other US state laws (including Colorado, Virginia, Connecticut, Texas and Oregon), Outwerk will act as a processor in accordance with the duties those laws impose on processors, and the client may request a state-specific rider where its counsel requires one.
13. Canada
13.1 Where client personal data is subject to PIPEDA or substantially similar provincial law, the client remains accountable for the personal information it transfers to Outwerk, and Outwerk will provide a comparable level of protection through this DPA and Annex 2.
13.2 Outwerk will assist the client with the client's breach reporting to the Office of the Privacy Commissioner of Canada and affected individuals, and with the client's record of breaches of security safeguards, by providing the information in clause 8.2.
13.3 Where the client is established in Quebec or processes personal information of Quebec residents, Outwerk will provide the information the client needs to complete its privacy impact assessment for communication of personal information outside Quebec under section 17 of the Quebec private sector act, including the location of processing, the safeguards in Annex 2 and the sub-processors in Annex 3, before the relevant processing begins.
14. India
14.1 Where client personal data includes digital personal data of data principals in India and the client is a data fiduciary under the DPDP Act, Outwerk acts as a data processor under a valid contract within section 8(2) of the DPDP Act, will implement the security safeguards required by the DPDP Rules, will assist the client with breach intimation to the Data Protection Board and affected data principals, and will erase the data when the client's purpose is served or the client instructs erasure, in accordance with clause 9. The parties acknowledge that the substantive obligations of the DPDP Act and Rules are being phased in and will apply this clause as they come into force.
15. Liability
15.1 Each party's liability arising out of or in connection with this DPA, including the EU SCCs and UK Addendum as between the parties, is subject to the exclusions and limitations in clause 22 of the agreement, except that nothing in this clause limits either party's liability to data subjects or supervisory authorities under the EU SCCs or applicable data protection law, or any liability that cannot be limited by law.
15.2 For the purpose of clause 22.3 of the agreement, a breach of this DPA that results from Outwerk's gross negligence or willful misconduct is within the carve-outs; an ordinary breach of this DPA is within the cap.
16. Term and order of precedence
16.1 This DPA takes effect on the effective date of the agreement and continues for as long as Outwerk processes client personal data, including the return and deletion period under clause 9.
16.2 In the event of conflict: (a) the EU SCCs and UK Addendum prevail over this DPA for restricted transfers; (b) this DPA prevails over the agreement and any SOW for the processing of personal data; (c) the agreement prevails for all other matters.
16.3 This DPA may be updated by Outwerk on 30 days' written notice where the update is required by a change in applicable data protection law or regulatory guidance, provided it does not reduce the protection for client personal data; any other amendment requires both parties' signatures.
Signed for and on behalf of Vivek Yogesh Doshi, trading as Outwerk (as processor and data importer)
Name: Title: Date: Signature:
Signed for and on behalf of [CLIENT LEGAL NAME] (as controller and data exporter)
Name: Title: Date: Signature:
Annex 1: Details of processing
This Annex also serves as Annex I.B to the EU SCCs and Table 3 to the UK Addendum.
| Item | Description |
|---|---|
| Subject matter | The design, build and operation of software and AI systems that perform operational work for the client, as described in the agreement and each SOW. |
| Duration | The term of the agreement and each SOW, plus the return and deletion period under clause 9. |
| Nature of processing | Collection from the client's systems and users, structuring, storage, retrieval, consultation, use, transmission to the client's systems and third-party AI providers, generation of outputs, logging, backup, and erasure. Processing is performed by automated means with human oversight by Outwerk personnel for configuration, support and incident handling. |
| Purpose of processing | To perform the operational workflows in the SOW, such as intake, record keeping, follow-up communications, scheduling, quoting, invoicing, inventory, delivery coordination and reporting; to measure the named outcome; to provide support; and to secure the systems. |
| Categories of data subjects | The client's customers, clients and prospects; the client's patients, members or guests (business contact and scheduling data only, no PHI or clinical data); the client's suppliers and business partners and their staff; the client's employees and contractors who use the systems. |
| Categories of personal data | Identification and contact data (name, email, phone, postal address, company, role); account identifiers in the client's systems; transaction and commercial data (quotes, orders, invoices, payment status, excluding card numbers and bank credentials); scheduling and attendance data (appointments, bookings, reminders); communication content (emails, messages, call notes, documents exchanged in the workflow); operational records (jobs, cases, tickets, deliveries, inventory movements, with the related individual's details); user activity logs within the systems; AI inputs and outputs containing the above. |
| Special categories, PHI and other excluded data | None. Excluded under clause 3.5 of this DPA and clause 14 of the agreement. For clinical, med spa and wellness clients the system holds appointment, membership, invoicing and inventory data only, with clinical notes, diagnoses, treatments, prescriptions and insurance identifiers excluded unless a business associate agreement or addendum is signed. |
| Frequency of transfer | Continuous, for the duration of the run stage. |
| Retention | For the duration of the SOW; AI logs 90 days unless the SOW provides longer; backups rotated within 90 days; deletion under clause 9. |
| Sub-processor transfers | Nature and subject matter as above, to the sub-processors and for the purposes in Annex 3. |
| Competent supervisory authority (EU SCCs Annex I.C) | As determined under clause 11.3(d). |
Annex 2: Technical and organizational measures
This Annex also serves as Annex II to the EU SCCs. The measures are appropriate for a small company operating on cloud services and are reviewed at least annually.
1. Access control and identity - Named individual accounts for every person; no shared logins. - Multi-factor authentication enforced on every account that can access client personal data, including email, hosting, code repositories, AI provider consoles and the client's systems where supported. - Least-privilege roles: each person has only the permissions needed for their current work; administrator rights limited to two named people. - Quarterly access review; access removed within one business day when a person leaves or changes role; offboarding checklist covering every system in the client account register. - Credentials stored in a business password manager with per-client vaults; no credentials in code, chat or email. - Where third-party accounts are in the client's name, Outwerk accesses them as a delegated user so the client can revoke access at any time.
2. Encryption - All data in transit encrypted with TLS 1.2 or higher; no plaintext protocols. - Data at rest encrypted using the provider's encryption (AES-256 or equivalent) at Netlify, Google Workspace and the database and storage providers used for each system. - Device encryption (FileVault or BitLocker) and screen lock enforced on all Outwerk laptops; no client personal data stored on personal devices. - API keys and secrets stored in environment variables or a secrets manager, rotated on personnel change or suspected compromise.
3. Data minimization and segregation - Systems built to collect only the fields the workflow needs; free-text fields minimized where they could attract excluded data. - Logical separation of each client's data by project, workspace or database; no cross-client data joins. - Test and development use the client's real data only during acceptance testing on the client's instruction, in environments with the same controls as production. - AI provider accounts configured so that inputs and outputs are not used for provider training, where the provider offers the option (API usage by default at OpenAI and Anthropic); zero data retention or shortest available retention selected where available.
4. Logging and monitoring - Access and change logs enabled on hosting, databases and AI provider consoles; retained for at least 180 days (meeting Indian CERT-In requirements) in the provider's logging service. - AI input and output logs per system retained for 90 days or as the SOW provides. - Alerts for failed login bursts, new administrator grants and unusual export volumes where the provider supports them.
5. Backups and resilience - Automated daily backups of each system's database with 30-day retention and encrypted storage; restore tested at least twice a year. - Backup rotation not exceeding 90 days. - Dependence on single individuals reduced through documented runbooks for every system.
6. Vendor due diligence - Before adding a sub-processor: review of its security documentation, DPA, data location, breach notification terms, and transfer mechanism; record kept in the vendor register. - Signed DPA or equivalent terms with every sub-processor; annual review of the sub-processor list and of each vendor's certification status.
7. Personnel - Written confidentiality and data protection obligations in every employment and contractor agreement. - Data protection and security onboarding for every person before access is granted; annual refresher; AI literacy briefing covering the risks of AI outputs. - Background verification of staff and contractors proportionate to the role, where lawful.
8. Incident response - Written incident response plan with roles, contact tree, severity classification, containment steps, evidence preservation and communication templates. - Client notification within 48 hours of confirming a personal data breach under clause 8; CERT-In reporting within the statutory window where applicable; post-incident review within 10 business days. - Plan tested by tabletop exercise at least annually.
9. Secure development and change management - Code in version control with review before deployment to production; secrets excluded from repositories. - Dependencies monitored for vulnerabilities and updated on a monthly cycle, or immediately for critical issues. - Changes to production systems logged and reversible; staged rollout for workflow changes that touch personal data.
10. Physical and environmental - Outwerk holds no servers. Physical security of data centers is provided by the hosting sub-processors under their certifications. - Office and remote work policy: screen lock, clean desk, no printing of client personal data, visitor access controlled.
11. Data subject rights support - Every system built with the ability to search, export and delete records for an identified individual on the client's instruction, within 10 business days.
12. Governance - Named person responsible for data protection and security (currently the founder) and a deputy. - Record of processing activities, vendor register, client account register, consent and breach logs maintained and reviewed quarterly. - This Annex reviewed annually and after any material change or incident.
Annex 3: Sub-processors
This Annex also serves as Annex III to the EU SCCs. Current list also published at outwerk.ai/dpa/. Changes are notified under clause 5.
| Sub-processor | Entity and location | Processing performed | Data location | Transfer mechanism for EU/UK data | Status to verify at signing |
|---|---|---|---|---|---|
| Netlify | Netlify, Inc., San Francisco, United States | Hosting of web applications and forms built for the client where applicable; serverless functions; logs | United States, with global CDN | EU SCCs Module Three; Data Privacy Framework if certified | Confirm DPF listing and signed Netlify DPA |
| Google Workspace | Google LLC, Mountain View, United States (Google Ireland Limited for EU contracting) | Email, calendar, documents and file storage used to communicate with the client and hold engagement documents | United States and Google data center regions | Google Cloud Data Processing Addendum including EU SCCs; Data Privacy Framework if certified | Confirm DPF listing and Workspace data region settings |
| Cal.com | Cal.com, Inc., United States | Scheduling of calls and meetings with the client's staff and, where a system uses it, with the client's customers | United States | EU SCCs Module Three; Data Privacy Framework if certified | Confirm DPF listing; EU hosting only available by enterprise arrangement |
| Plausible Analytics | Plausible Insights OÜ, Estonia | Cookieless, anonymous analytics on outwerk.ai and, where a system includes a web portal, on that portal | European Union (Germany) | Not a restricted transfer (EU processing); Outwerk access from India under EU SCCs Module Two between client and Outwerk | Confirm Plausible Cloud EU plan |
| Crisp | Crisp IM SAS, Nantes, France | Chat widget on outwerk.ai; where a system includes customer chat, chat processing for the client | European Union (France); confirm Crisp's own sub-processors | Not a restricted transfer for EU processing; Crisp DPA for its sub-processors | Confirm Crisp DPA and sub-processor list |
| OpenAI | OpenAI, L.L.C., San Francisco, United States (OpenAI Ireland Ltd for EU contracting) | Large language model inference for AI workflows and AI employees; no training on client data via API by default | United States (EU data residency available on some tiers) | OpenAI Data Processing Addendum including EU SCCs; Data Privacy Framework if certified | Confirm DPF listing; confirm zero data retention or 30-day retention setting; prefer the client's own OpenAI account under clause 5.5 |
| Anthropic | Anthropic, PBC, San Francisco, United States (Anthropic Ireland, Limited for EU contracting) | Large language model inference for AI workflows and AI employees; no training on client data via API by default | United States | Anthropic Data Processing Addendum including EU SCCs; Data Privacy Framework if certified | Confirm DPF listing; confirm retention setting; prefer the client's own Anthropic account under clause 5.5 |
| Client's own stack | As instructed by the client in the SOW | Processing inside the client's CRM, accounting, messaging, hosting and AI accounts | As the client's providers determine | The client's own contracts; not Outwerk sub-processors (clause 5.5) | Record in the SOW |
Outwerk personnel and contractors access client personal data from India. Any contractor outside India who will access client personal data is listed here before access is granted, with their country and the transfer mechanism.