Concept site: Loomwork, Inc. is fictional, and the company details are placeholders (addresses and emails use the reserved .example domain). On a real site, every page is filled with the real business details and reviewed by a lawyer in the business's country.

Data Processing Addendum

Last updated: 17 October 2026

This addendum applies when Loomwork processes personal data on behalf of a Customer under GDPR Art. 28, the UK GDPR, the CCPA/CPRA and similar laws. It's part of the Terms and prevails over them on data protection. A signable copy is available on request at privacy@loomwork.example.

1. Roles and instructions

Customer is the controller; Loomwork is the processor. Loomwork processes Customer personal data only on Customer's documented instructions (these terms, the product settings, and support requests), including for transfers. Loomwork will immediately tell Customer if, in its opinion, an instruction infringes data protection law.

2. What is processed

• Data subjects: Customer's staff, vendors, customers and their contacts.
• Data: names, business contact details, invoice and payment data, approval history.
• Purpose and duration: running the workflows Customer configures, for the term of the agreement plus the deletion period.

3. Our commitments

• Confidentiality obligations for everyone with access.
• Security measures appropriate to the risk (section 4).
• Help with data subject requests, security, DPIAs and prior consultations.
• Breach notification without undue delay, and at the latest within 48 hours of becoming aware.
• At the end of the service, deletion or return of all Customer personal data, at Customer's choice, and deletion of existing copies unless EU or Member State law requires storage.
• Making the information needed to demonstrate compliance available, and allowing audits (or providing independent audit reports).

4. Security measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Single sign-on, role-based access and audit logs.
• Separate customer workspaces, regular backups, tested restores.
• Staff background checks and security training.

5. Sub-processors

Customer gives general authorisation for the sub-processors below. Each is bound by written data protection obligations no less protective than this addendum, and Loomwork remains fully liable to Customer for their performance. We give 30 days' notice of new or replaced sub-processors (subscribe by emailing privacy@loomwork.example); Customer may object on reasonable grounds, and if we can't resolve it, terminate the affected service with a pro rata refund.

6. Transfers

Where Customer personal data is transferred from the EU/EEA to Loomwork in the US, the Standard Contractual Clauses Module 2 (controller to processor) apply, and Module 3 (processor to processor) for onward transfers to sub-processors, with the UK addendum for UK data and the Swiss amendments for Swiss data. Enterprise customers can choose EU-only data residency.

7. California (CCPA/CPRA) service provider terms

Loomwork is a service provider. It will not sell or share Customer personal information; will not retain, use or disclose it for any purpose other than providing the service, or outside the direct business relationship with Customer; will not combine it with personal information from other sources except as the law permits; will comply with the CCPA and give the same level of protection; will notify Customer if it can no longer meet these obligations; and allows Customer to take reasonable steps to stop unauthorised use. Loomwork certifies that it understands and will comply with these restrictions.