Data Processing Agreement

This Data Processing Agreement ("DPA") is incorporated into and forms part of the WorkWing Terms of Service (the "Terms") for the provision of the WorkWing field service management platform (the "Service") between:

• Littlebourne Labs Ltd, a company registered in England and Wales with company number 17119449, whose registered office is at 128 City Road, London, EC1V 2NX, trading as WorkWing ("WorkWing", the "Processor"); and
• The customer organisation that has accepted the Terms (the "Customer", the "Controller").

This DPA applies where and to the extent WorkWing processes Personal Data on behalf of the Customer in the course of providing the Service.

1. Definitions

1.1 "Data Protection Law" means the UK GDPR (as defined in the Data Protection Act 2018), the Data Protection Act 2018, and, where applicable, Regulation (EU) 2016/679 (the "EU GDPR"), each as amended or replaced.

1.2 "Personal Data", "processing", "data subject", "personal data breach", "controller", "processor" and "supervisory authority" have the meanings given in Data Protection Law. The supervisory authority for WorkWing is the UK Information Commissioner's Office ("ICO").

1.3 "Customer Personal Data" means Personal Data processed by WorkWing on behalf of the Customer, as described in Annex 1.

1.4 "Sub-processor" means any third party engaged by WorkWing to process Customer Personal Data.

2. Roles and Scope

2.1 The parties acknowledge that, for Customer Personal Data, the Customer is the controller and WorkWing is the processor.

2.2 For data WorkWing processes for its own purposes, WorkWing acts as an independent controller and that processing is governed by WorkWing's privacy policy, not this DPA. That category is defined by purpose and not by the role of the individual: it comprises Customer account administration and billing, and, for every Authorised User who signs in to the Service, their sign-in identity, session and device records, diagnostic logs generated by platform monitoring, and product usage records (which pages and features are used in each workspace, and when, without the content of any record). WorkWing determines the purposes and means of that processing itself and does not act on the Customer's instructions in respect of it.

2.3 Everything else the Service holds about an Authorised User - including their worker profile, skills and certifications, availability, assignment and job history, location data, and the notes, forms, photographs and attachments associated with their work - is Customer Personal Data and is governed by this DPA.

2.4 The subject matter, duration, nature, and purpose of processing, the types of Personal Data, and the categories of data subjects are set out in Annex 1.

3. Processor Obligations (UK GDPR Article 28(3))

WorkWing shall:

(a) process Customer Personal Data only on the Customer's documented instructions (including with regard to international transfers), unless required to do otherwise by law to which WorkWing is subject, in which case WorkWing shall inform the Customer of that legal requirement before processing unless that law prohibits it. The Terms, this DPA, and the Customer's configuration of the Service (including feature toggles such as GPS tracking, the customer portal, and retention policies) constitute documented instructions;

(b) ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) implement and maintain the technical and organisational measures set out in Annex 2;

(d) respect the conditions in clauses 6 and 7 for engaging Sub-processors;

(e) taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests for exercising data subject rights (see clause 8);

(f) assist the Customer in ensuring compliance with the obligations in UK GDPR Articles 32 to 36 (security, breach notification, DPIAs, prior consultation), taking into account the nature of processing and the information available to WorkWing;

(g) at the Customer's choice, delete or return all Customer Personal Data after the end of the provision of the Service, and delete existing copies unless storage is required by law (see clause 9);

(h) make available to the Customer all information necessary to demonstrate compliance with the obligations in UK GDPR Article 28 and allow for and contribute to audits as set out in clause 10;

(i) immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law.

4. Customer Obligations

4.1 The Customer warrants that it has a lawful basis for the processing it instructs, including, where it enables worker GPS tracking, a documented legitimate interests assessment (or other valid basis) and appropriate transparency to its workers, and, where it stores special category data in custom fields or forms, a valid Article 9 condition.

4.2 The Customer is responsible for the accuracy, quality, and legality of Customer Personal Data and for responding to data subjects exercising their rights against the Customer.

4.3 The Customer shall not instruct processing that infringes Data Protection Law.

5. Security

5.1 WorkWing shall implement the technical and organisational measures in Annex 2 and shall not materially decrease the overall security of the Service during a subscription term.

5.2 WorkWing shall ensure that access to Customer Personal Data is limited to personnel who require it to perform the Service.

6. Sub-processors

6.1 The Customer grants WorkWing a general written authorisation to engage Sub-processors for the processing of Customer Personal Data.

6.2 The current Sub-processor list is maintained at Annex 3 (the sub-processor list published at https://workwing.io/legal/subprocessors, as updated by WorkWing from time to time).

6.3 WorkWing shall give the Customer at least 30 days' prior written notice (which may be by email to the Customer's admin contact or by in-product notice) of the addition or replacement of any Sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection in good faith, the Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees.

6.4 WorkWing shall impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains fully liable to the Customer for the performance of each Sub-processor's obligations.

7. International Transfers

7.1 WorkWing's primary database and compute infrastructure is hosted in the UK/EEA, and error monitoring is ingested in the EU. Certain Sub-processors process Customer Personal Data outside the UK/EEA; each Sub-processor's processing location and the applicable transfer mechanism are stated in Annex 3.

7.2 Where the provision of the Service involves a transfer of Customer Personal Data outside the UK (or, for EU GDPR-scoped data, outside the EEA) to a country without an adequacy decision, the parties shall ensure an appropriate safeguard is in place: for UK transfers, the ICO's International Data Transfer Agreement ("IDTA") or the UK Addendum to the EU Standard Contractual Clauses; for EEA transfers, the EU Standard Contractual Clauses ("SCCs"). Such transfers and their mechanisms are recorded per vendor in Annex 3.

7.3 WorkWing shall carry out and document transfer risk assessments where required.

8. Data Subject Rights Assistance

8.1 WorkWing provides self-service tooling enabling the Customer to fulfil data subject requests directly: structured machine-readable export of a data subject's records (right of access and portability) and irreversible anonymisation of a data subject's records (right to erasure), both available in the Service's privacy settings, alongside in-app rectification and deactivation (restriction).

8.2 If WorkWing receives a request from a data subject relating to Customer Personal Data, it shall not respond substantively (beyond directing the data subject to the Customer) and shall forward the request to the Customer without undue delay.

8.3 Where a request cannot be fulfilled via the self-service tooling, WorkWing shall provide reasonable assistance at the Customer's request; WorkWing may charge a reasonable fee for assistance that is manifestly excessive or repetitive.

9. Deletion and Return on Termination

9.1 During the subscription term, and throughout the grace period in clause 9.2, the Customer can export Customer Personal Data at any time using the Service's export tooling.

9.2 Following termination or expiry of the subscription, Customer Personal Data is retained for a grace period of 90 days (allowing reactivation), after which it is automatically and irreversibly anonymised and purged by WorkWing's automated churn process. The Customer may request earlier deletion in writing. This clause applies equally to free trials and free tiers: data in a trial or free-tier account is handled on termination or expiry exactly as data in a paid subscription is, and the Terms do not provide otherwise.

9.3 Clause 3(g) gives the Customer the choice between deletion and return. To exercise the return option, the Customer may, at any time before the end of the grace period, request a final export of Customer Personal Data in a structured, commonly used, machine-readable format; WorkWing shall provide it without undue delay and in any event before the grace period ends. Where the Customer makes no such request, deletion under clause 9.2 is the default.

9.4 WorkWing may retain Personal Data to the extent required by law, and residual copies in encrypted backups until those backups expire in the ordinary course (point-in-time recovery history at the database provider), provided such copies remain protected by Annex 2 measures and are not otherwise processed.

10. Audits

10.1 WorkWing shall, on reasonable written notice (not more than once per 12-month period unless required by a supervisory authority or following a personal data breach), make available the information reasonably necessary to demonstrate compliance with this DPA, which may include: this DPA's annexes, the current DPIA, penetration test or audit summaries, and sub-processor due-diligence records.

10.2 Where the information in 10.1 is insufficient, the Customer (or an independent auditor bound by confidentiality, not a competitor of WorkWing) may conduct an audit limited in scope, duration, and access so as not to compromise the security or confidentiality of other customers' data. Costs are borne by the Customer unless the audit reveals material non-compliance.

11. Personal Data Breach

11.1 WorkWing shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

11.2 The notification shall, to the extent then known, describe the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information may be provided in phases as it becomes available.

11.3 WorkWing shall document breaches and remediation in accordance with its internal incident response procedures and provide reasonable cooperation with the Customer's own UK GDPR Articles 33/34 obligations. Notification is not an admission of fault.

12. Liability, Term, Order of Precedence

12.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Law does not permit such limitation.

12.2 This DPA takes effect on the subscription start date and continues for as long as WorkWing processes Customer Personal Data.

12.3 In case of conflict between this DPA and the Terms regarding the processing of Personal Data, this DPA prevails.

13. Changes to this DPA

13.1 Each version of this DPA is dated and versioned; superseded versions remain available on request.

13.2 WorkWing may update this DPA: (a) to reflect changes to the published Sub-processor list, via the clause 6.3 notice process; (b) where required by Data Protection Law or a supervisory authority; and (c) otherwise only with at least 30 days' notice, with material changes subject to the same notice-and-termination mechanism as material changes to the Terms. No change will materially reduce the protections for Customer Personal Data during a paid subscription term.

14. Governing Law

This DPA is governed by the law governing the Terms; provisions required by Data Protection Law are governed by the law of England and Wales.

Annex 1 - Description of Processing (UK GDPR Art. 28(3) / Art. 30(2))

Annex 2 - Technical and Organisational Measures (UK GDPR Art. 32)

WorkWing implements and maintains, as a minimum, the following technical and organisational measures. More detailed control documentation is available under clause 10.

1. Tenant isolation: logical isolation between customers enforced at the database layer on every application table, verified by automated tests that gate every release.
2. Access control: role- and capability-based access within each tenant; least-privilege service accounts; API keys with granular scopes.
3. Authentication: industry-standard adaptive password hashing; optional two-factor authentication; session expiry and invalidation; rate limiting and lockout of repeated failed sign-ins.
4. Encryption in transit: TLS on all external endpoints and on database connections.
5. Encryption at rest: encryption at rest at the database and object-storage layers; stored integration secrets and tokens additionally envelope-encrypted using a hardware-backed key management service hosted in the EU.
6. Anonymisation: built-in irreversible anonymisation of a data subject's records across related data, including within audit history.
7. Data minimisation: location tracking active only during assigned jobs; the customer portal exposes a minimal field set behind verification; contact logging records attempts only, not content.
8. Retention: per-category, Customer-configurable retention policies with automated enforcement, and automated post-termination purge (clause 9).
9. Auditability: tenant-scoped access and change logs recording who did what and when.
10. Monitoring and incident response: application error monitoring wired into every service and configured to ingest in the EU region; documented incident response and breach notification procedures (clause 11); point-in-time database recovery.
11. Secure development: automated testing, type-safety, and dependency vulnerability checks as blocking gates before release, on a protected release process.
12. Organisational measures: documented operational procedures, managed secrets with rotation, tested backup and recovery, and confidentiality commitments from all persons authorised to process Customer Personal Data (clause 3(b)).

Annex 3 - Authorised Sub-processors

The authorised Sub-processor list, including each vendor's purpose, the personal data it processes, its processing location, and the applicable transfer mechanism, is published at https://workwing.io/legal/subprocessors. The notice-and-objection process in clause 6 applies to changes to that list.

That list names only Sub-processors as defined in clause 1.4 - third parties engaged to process Customer Personal Data. Vendors WorkWing engages as an independent controller for the processing described in clause 2.2 (for example its payment provider), and vendors that receive no personal data at all (for example its key management service, which processes only wrapped encryption keys), are not Sub-processors and are not listed there; the former are identified in WorkWing's privacy policy, as the law requires of a controller.

Execution

This DPA is incorporated into and forms part of the WorkWing Terms of Service, so it binds every Customer automatically from acceptance of the Terms and no separate signature is required. It is signed for and on behalf of WorkWing below on publication of this version. A Customer that requires a countersigned copy for its records may request one from support@workwing.io, sign and retain it, and optionally return a copy; countersigning does not change this DPA's effect or create a separate agreement.

WorkWing is a trading name of Littlebourne Labs Ltd, a company registered in England and Wales (company no. 17119449). Registered office: 128 City Road, London, EC1V 2NX. ICO data protection registration ZC111876.

Questions about this document? Email support@workwing.io.