Privacy at WorkMonitorEffective August 3, 2026
Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Platform Terms of Service between WorkMonitor and the customer ("Customer") and applies where WorkMonitor processes personal data on behalf of the Customer in connection with the Services.
Definitions
Terms such as "controller", "processor", "data subject", "personal data", and "processing" have the meanings given in applicable data protection law, including the GDPR.
Roles of the Parties
The Customer is the controller and WorkMonitor is the processor with respect to personal data processed under the Services. WorkMonitor processes personal data only on the Customer's documented instructions, including the configuration choices the Customer makes within the platform.
Details of Processing
Subject matter: provision of the workforce-analytics and monitoring Services. Duration: the term of the agreement. Nature and purpose: collection, storage, and analysis of activity data as configured by the Customer. Categories of data subjects: the Customer's employees and contractors. Categories of data: identification, activity, and device data and, where enabled, screenshot and recording data.
Sub-processing
The Customer authorizes WorkMonitor to engage the sub-processors listed on our Sub-processors page. WorkMonitor will impose data-protection obligations on each sub-processor no less protective than those in this DPA, and remains responsible for each sub-processor's performance of those obligations as if performed by WorkMonitor itself.
Security and Data Subject Requests
WorkMonitor maintains the technical and organizational measures described in our security documentation and assists the Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting its obligations for security, breach notification, and impact assessments. Where WorkMonitor becomes aware of a personal data breach affecting Customer data, it will notify the Customer without undue delay and in any event within 48 hours of confirming the breach.
International Transfers
Where processing involves a transfer of personal data subject to the GDPR to a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA by reference.
Return and Deletion
On termination of the Services, WorkMonitor will, at the Customer's choice, return or delete the personal data processed on the Customer's behalf, unless retention is required by law.