Data Protection and GDPR at awork

Data Protection at awork

Protecting personal data is a core part of how we develop and operate awork.

awork processes personal data in compliance with the General Data Protection Regulation (GDPR) and uses technical and organizational measures to protect your customer data appropriately.

Roles and Responsibilities

When processing data within the awork platform, the following applies in principle:

• You and your customers are responsible for the personal data you process in your workspace.

• awork processes this data as a processor in accordance with Article 28 GDPR.

• Service providers we use who process your customer data in this context are contractually engaged as sub-processors.

The details can be found in our current Data Processing Agreement (DPA).

Hosting and Data Processing

awork's central data storage is hosted on Microsoft Azure in Germany.

awork operates the platform in its own dedicated Microsoft Azure tenant, which is controlled by awork.

For certain features, we may use additional sub-processors. This particularly applies to optional features such as certain AI models and support and communication services.

Depending on the service, data processing takes place:

• exclusively in Germany,

• within the European Union or the EEA, or

• in limited cases also in third countries based on the safeguards required by GDPR.

A current overview of the sub-processors we use, processing purposes, and processing locations is included in our DPA.

Sub-processors

awork only uses sub-processors where necessary for operating the platform or for specific support, service, or optional AI features.

This means:

• Sub-processors only receive data necessary for their specific purpose.

• Access and processing are restricted to clearly defined use cases.

• Service providers are vetted from a data protection and security perspective before being engaged, bound by contract, and regularly reviewed.

• You can find a transparent overview with purpose, processing location, and protective measures under "Sub-processors & Data Flows"; the legally binding list is included in our DPA.

AI Processing is Controllable

You can use the awork platform without AI data processing.

AI features in the standard product can be disabled by administrators. The advanced awork AI Add-on requires a separate subscription.

Different AI models and technical providers may be used for the awork AI Add-on. Workspace administrators can disable the AI models available for regular use. Individual technical or basic AI features may rely on fixed models that are not part of the regular model selection.

You can find more information under awork and AI and Sub-processors & Data Flows.

International Data Transfers

Where personal data is processed outside the EEA, we ensure that the necessary data protection requirements are met.

Depending on the provider, these may include in particular:

• Adequacy decisions from the European Commission,

• EU Standard Contractual Clauses,

• complementary technical and organizational protective measures.

Data Protection Organization

Data protection is embedded in our processes. This includes in particular:

• established data protection policies and review processes,

• regular training and awareness-raising for our employees,

• defined processes for data protection requests and data subject rights,

• as well as privacy and security checks when introducing new relevant systems and service providers.

awork has established data protection processes and integrates data protection and information security into the selection of new systems and service providers.

Our external Data Protection Officer is:

PROLIANCE GmbH, Munich

You can direct data protection requests at any time to privacy@awork.com.

Additional Documents

You can find further details in:

• our current Data Processing Agreement (DPA),

• the privacy policy for the awork App,

• our overview of Sub-processors and Data Flows,

• our technical and organizational measures (TOMs).