Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the WRKZY Terms of Service when a client uses WRKZY to process personal data for which the client determines the purposes and means. If the parties execute a separate DPA, that signed DPA controls to the extent of a conflict.

The client is the controller, business, data fiduciary, or equivalent responsible party. AIRBRILS PRIVATE LIMITED is the processor, service provider, data processor, or equivalent. Each party remains responsible for its own legal obligations.

“Client Personal Data” means personal data that WRKZY processes on the client's behalf through the service. “Data Protection Law” means privacy, data-protection, and breach-notification law applicable to that processing. “Subprocessor” means a third party engaged by WRKZY to process Client Personal Data on the client's behalf. Terms such as personal data, processing, controller, processor, business, service provider, contractor, data fiduciary, and data processor have the meanings given by applicable Data Protection Law.

WRKZY processes client personal data only on documented instructions, including the Terms, this DPA, the client's configured use of the service, and additional lawful written instructions. WRKZY will notify the client if an instruction appears to violate applicable data-protection law, unless prohibited from doing so.

Persons authorized to process client personal data are bound by confidentiality obligations and receive access only as needed for their responsibilities. The client is responsible for lawful collection, notices, permissions, accuracy, and instructions, and must not submit prohibited or unnecessary sensitive data.

United States service-provider restrictions

To the extent a comprehensive United States state privacy law treats WRKZY as a service provider, contractor, or processor, WRKZY will process Client Personal Data only for the business purposes described in the agreement and the client's lawful instructions. WRKZY will not sell Client Personal Data, share it for cross-context behavioral advertising, use it for targeted advertising, or retain, use, or disclose it outside the direct business relationship except as permitted by that law. WRKZY will not combine it with personal data received from another person or collected from WRKZY's own interaction with an individual except as legally permitted to provide the service.

WRKZY will notify the client if it determines it can no longer meet these restrictions. The client may take reasonable and appropriate steps to monitor compliance and to stop and remediate unauthorized processing, subject to the confidentiality, security, and audit provisions of this DPA.

WRKZY maintains technical and organizational measures appropriate to the service and risk, including workspace authorization boundaries, role controls, encrypted handling of provider credentials, verified integration events, session controls, operational logging, and incident response. Current controls and assurance limits are described on the Security page.

After becoming aware of a confirmed personal-data breach affecting client personal data, WRKZY will notify the client without undue delay, provide available information reasonably needed for the client's obligations, and take appropriate containment and remediation steps. Notification is not an admission of fault or liability.

The client gives general authorization for WRKZY to use the subprocessors listed on the Subprocessors page. WRKZY requires subprocessors to protect personal data through written terms appropriate to the services they provide and remains responsible for their processing to the extent required by applicable law and this DPA.

WRKZY will publish material subprocessor changes before the new provider begins processing client personal data where reasonably practicable. A client with a reasonable, documented data-protection objection should contact WRKZY promptly so the parties can seek a practical resolution. If no reasonable resolution is available, the client may discontinue the affected feature before the new subprocessor begins processing; any broader termination right is governed by the applicable service agreement.

Taking into account the nature of processing and information available to WRKZY, WRKZY will provide reasonable assistance with verified data-subject requests, security and breach obligations, data-protection impact assessments, and required regulator consultations. The client remains responsible for responding to requests for data it controls.

WRKZY will disclose client personal data to an authority only where required by law. Unless legally prohibited, WRKZY will notify the client before disclosure and will challenge requests it reasonably believes are unlawful or excessive.

WRKZY is operated from India and may use subprocessors in other countries. Each party will use a valid transfer mechanism where its law requires one. For eligible EEA transfers, the parties will execute the applicable modules of the European Commission's Standard Contractual Clauses and complete the required annexes and transfer assessment. Swiss transfers may use those clauses with the adaptations required by Swiss law. For eligible UK transfers, the parties will use the UK Addendum or IDTA and complete the applicable data-protection test. For Brazilian transfers, the parties will use an ANPD-authorized mechanism. For transfers governed by other laws, the parties will use the locally required contractual, adequacy, consent, certification, or other valid mechanism.

These transfer instruments require transaction-specific details and are not represented as executed merely because this page is public. Contact privacy@wrkzy.com before transferring regulated data that requires an executed instrument or transfer assessment.

WRKZY will provide information reasonably available to it about relevant subprocessors, processing locations, and safeguards to support a required transfer assessment. A client remains responsible for determining whether its own transfer and instructions are lawful.

During the subscription, the client may use available export tools or request reasonable export assistance. After termination, WRKZY will delete or return eligible client personal data in accordance with documented instructions and the Data Deletion process, except for data that law requires WRKZY to retain. Protected backup copies are removed through the normal backup cycle.

WRKZY will make available information reasonably necessary to demonstrate compliance with this DPA. If that information is insufficient, the parties may arrange a proportionate audit by an independent professional under confidentiality terms, no more than once annually unless a confirmed incident or regulator requires otherwise. The client bears reasonable audit costs unless material non-compliance is found.

Subject and duration

Customer operations and communication processing for the term of the client's use, plus the limited retention and deletion period described in the Privacy Policy and Data Deletion process.

Nature and purpose

Hosting, organizing, retrieving, displaying, transmitting, securing, supporting, and deleting data to provide inboxes, CRM context, campaigns, pipelines, quotes, automations, reporting, and optional AI-assisted features.

Data subjects and categories

Client users, prospects, customers, suppliers, and other business contacts; account identifiers, contact details, message content and metadata, attachments, CRM and commercial records, permissions, consent and suppression records, activity logs, and the other categories the client submits. The service is not designed for special-category, highly sensitive, children's, payment-card, health, biometric, or criminal-offence data unless WRKZY has expressly approved the use in writing and appropriate safeguards are in place.