Legal
Data Processing Addendum
This DPA supplements the Terms. It applies when WAH processes personal data on behalf of a customer who is a controller (or processor) under GDPR or similar law.
In short
You control the workspace data; WAH processes it only to provide the service, under your instructions, with contracted subprocessors and deletion on exit. Full DPA text below — ask privacy@wahtodo.com for the countersigned version.
1 · Roles
Customer is controller of workspace personal data. WAH is processor. Each party complies with applicable data-protection law. Today’s preview stores workspace locally — cloud processing begins when signed-in workspaces ship.
2 · Instructions
WAH processes personal data only to provide the service, on documented instructions from the customer, including the Terms and product configuration. No other use.
3 · Security
Technical and organizational measures are described on Security: TLS in transit, encryption at rest, access control, and workspace isolation — as launch requirements until the stack is live (see Security page caveat).
4 · Subprocessors
Infrastructure, email, and billing — under contract, responsible for their processing. Current list on request at privacy@wahtodo.com. We notify before adding a new subprocessor that touches workspace personal data.
5 · International transfers
Where personal data leaves the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses (SCCs). Primary hosting region will be documented at launch.
6 · Assistance & deletion
- Assist with data-subject requests within the service’s capabilities.
- Delete or return workspace data after the end of the service, except where law requires retention.
- Audit or questionnaire requests: privacy@wahtodo.com · Business contact: legal@wahtodo.com.
7 · Precedence
If this DPA conflicts with the Terms on data protection, this DPA controls for that conflict. Need a signed copy? Email privacy@wahtodo.com — we countersign within two business days.