Data Processing Addendum

This DPA applies when WAH processes personal data on behalf of a customer who is a controller (or processor) under GDPR or similar law. It supplements the Terms.

Roles

Customer is controller of workspace personal data. WAH is processor. Each party complies with applicable data-protection law.

Instructions

WAH processes personal data only to provide the service, on documented instructions from the customer, including the Terms and product configuration.

Security

Technical and organizational measures are described on the Security page: encryption in transit and at rest, access control, and workspace isolation.

Subprocessors

We use infrastructure, email, and billing subprocessors. A current list is available on request at privacy@wahtodo.com. We remain responsible for their processing.

International transfers

Where data leaves the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses.

Assistance and deletion

We assist with data-subject requests and deletion after the end of the service, except where law requires retention. Audit requests: privacy@wahtodo.com.