Data processing addendum

Last updated September 30, 2026

This Data Processing Addendum (“DPA”) is part of the Terms of Service between you and Grainwork, Inc. (“Grainwork,” “we,” “us,” or “our”). It applies when we process personal information on your behalf as part of the Service, and it applies to every customer, wherever you are located. Country-specific terms near the end adds what particular countries and regions require.

You accept this DPA when you accept the Terms, and you do not need to sign anything. If you need a signed copy for your records, write to compliance@grainwork.io and we will send you one signed by us.

What this DPA covers

When you and your users put information about people into the Service, such as your staff, your customers and their site addresses, and your vendors’ contacts, we process that information on your behalf. In this DPA it is called “Customer Personal Data.” You decide why it is processed, and we process it only to provide the Service to you.

This DPA does not cover personal information we handle for our own purposes, such as your users’ account details, billing, security logs, support calls, and our communications with you. Our Privacy Policy covers that.

“Data Protection Law” means every law that applies to the processing of Customer Personal Data under this DPA. Words such as controller, processor, business, service provider, and personal information have the meanings Data Protection Law gives them. Where a law uses a different word for the same idea, this DPA means that word too.

Roles

For Customer Personal Data, you are the controller and we are your processor, or, under U.S. state privacy laws, your service provider. If you process Customer Personal Data for someone else, you are a processor and we are your subprocessor, and you are responsible for making sure that other party has authorized this DPA and our processing.

Your instructions

We process Customer Personal Data only on your documented instructions. The Terms, this DPA, and the way you and your users set up and use the Service are your complete instructions. We may also process it where the law requires us to. If so, we will tell you first, unless the law forbids that. If we believe an instruction breaks Data Protection Law, we will tell you.

Your instructions include creating aggregated, de-identified data from use of the Service, as the Terms describe under How we use data to improve Grainwork. That data does not identify you or any person. We will not try to re-identify it, and we will not share it in a form that identifies you or any person.

You are responsible for your own compliance with Data Protection Law for Customer Personal Data, including having a lawful basis to put it into the Service, giving the people it is about any notice the law requires, and keeping it accurate. Do not put special categories of personal information into the Service, such as health, biometric, or government identification data, unless your work needs it and the law allows it.

Details of the processing

  • Subject matter and purpose: providing, securing, supporting, maintaining, and improving the Service for you under the Terms, including finding and fixing problems.

  • Nature of the processing: hosting, storage, retrieval, organization, transmission, display, backup, generating drawings, reports, and other outputs, support, and deletion.

  • People the data is about: your owners, staff, and contractors; your customers and prospective customers; your vendors’ and suppliers’ contacts; and anyone else whose information you or your users put into the Service.

  • Kinds of personal information: names, job titles, email addresses, phone numbers, postal and site addresses, notes and messages, and files and images you upload.

  • Special categories: none are intended.

  • Frequency: continuous, for as long as you use the Service.

  • Duration: for as long as the Terms are in effect, and then until deletion as described under When the Service ends.

Our people

Only staff and contractors who need access to provide, secure, or support the Service can reach Customer Personal Data, and each of them is bound by a duty of confidentiality. When Grainwork support opens your workspace, the access is time-limited, recorded, shown in your workspace, and can be ended by your administrators, as the Terms describe under Support access to your workspace.

Security

We keep technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access, appropriate to the risk. The measures in place today are listed under Security measures below. We may change them over time, but not in a way that materially reduces the overall protection of Customer Personal Data.

Subprocessors

You give us general authorization to engage subprocessors to help provide the Service. The current list, with what each one does, is available on request at compliance@grainwork.io.

We bind each subprocessor by written contract to data protection obligations at least as protective as this DPA, as far as they apply to the service it provides, and we remain responsible for its performance.

We will email the owner of your workspace at least 30 days before we add or replace a subprocessor if you are located in the European Economic Area, the United Kingdom, or Switzerland, or if you have asked us at compliance@grainwork.io to tell you. You can object within that period on reasonable data protection grounds. If we cannot resolve your objection, you can cancel your subscription, and we will refund any fees you prepaid for the period after it ends.

Helping you meet your obligations

Requests from individuals. You can do much of this yourself in the Service, such as finding, correcting, exporting, and deleting records. Where you cannot, we will help you answer requests from people exercising their rights under Data Protection Law, taking into account the nature of the processing. If someone asks us directly about Customer Personal Data, we will pass the request to you and will not answer it ourselves unless the law requires us to.

Assessments and consultations. We will give you reasonable information and help for any data protection impact assessment, privacy impact assessment, or consultation with a regulator that the law requires of you about the Service.

Security incidents

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data (a “Security Incident”), we will tell the owner and administrators of your workspace by email without undue delay, and no later than 72 hours after we become aware of it. We will give you the information we have that you reasonably need to meet your own notification duties, add to it as we learn more, and take reasonable steps to contain the Security Incident and limit its effects. Telling you about a Security Incident is not an admission of fault.

Audits

We will make available the information reasonably needed to show that we comply with this DPA, including answers to reasonable security questionnaires. If that information is not enough to meet a requirement of Data Protection Law, or a regulator asks for more, you may audit our compliance. Audits take place no more than once a year, unless a Security Incident or a regulator requires another one, with at least 30 days’ notice, during business hours, and in a way that does not disrupt our operations or break our confidentiality obligations to other customers. You may use an independent auditor who is bound by confidentiality and is not our competitor. You pay the costs of an audit you ask for.

International transfers

We are based in the United States. We and our subprocessors store and process Customer Personal Data in the United States, and some of our subprocessors process it in the European Union and the United Kingdom. Where Data Protection Law requires a safeguard for a transfer, the safeguards under Country-specific terms apply.

Requests from authorities

If a government or other authority asks us for Customer Personal Data, we will refer it to you, unless the law forbids that. If we are legally compelled to disclose Customer Personal Data, we will tell you first so that you can seek a protective order, unless the law forbids it. We will challenge a request we reasonably believe is unlawful, and we will disclose only the minimum the law requires.

When the Service ends

When your subscription ends, you have 30 days to export Customer Personal Data, as the Terms describe. After that we delete it, unless the law requires us to keep it. Copies in our backups are deleted as those backups expire in the ordinary course. Until then they stay protected by this DPA and are not used for anything else. On request, we will confirm the deletion in writing.

Liability, precedence, and governing law

Each party’s liability under this DPA is subject to the limitations of liability in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow that. If this DPA conflicts with the Terms, this DPA controls for the processing of Customer Personal Data. If the Standard Contractual Clauses or the UK Addendum apply and conflict with this DPA, they control. This DPA is governed by the law that governs the Terms, except where Data Protection Law or the Standard Contractual Clauses require another law.

Country-specific terms

If this DPA covers Customer Personal Data about people in a country or region below, the terms for that place also apply. Where they conflict with the rest of this DPA, they control.

European Economic Area and Switzerland

Where the General Data Protection Regulation applies to your processing of Customer Personal Data, and that data is transferred to us or to a subprocessor in a country without an adequacy decision of the European Commission, the Standard Contractual Clauses adopted by the Commission in Implementing Decision (EU) 2021/914 (the “SCCs”) are incorporated into this DPA as follows:

  • Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor. You are the data exporter and we are the data importer.

  • Clause 7 (docking clause) applies.

  • In Clause 9, Option 2 (general written authorization) applies, with the 30-day notice described under Subprocessors.

  • The optional wording in Clause 11 does not apply.

  • Clause 13 applies according to its own terms, based on where you are established or where your representative is.

  • In Clause 17, Option 1 applies, and the governing law is the law of Ireland. In Clause 18, the courts are the courts of Ireland.

  • Annex I is completed by Details of the processing above, with you and us as the parties at the contact details in your account and in the Terms. Annex II is completed by Security measures below. Annex III is our subprocessor list, available on request.

For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with these changes: references to the General Data Protection Regulation are to that Act, the competent supervisory authority is the Federal Data Protection and Information Commissioner, and the term “member state” does not stop people in Switzerland from bringing claims where they habitually live.

United Kingdom

Where the UK GDPR applies and Customer Personal Data is transferred to a country without UK adequacy regulations, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner (the “UK Addendum”) is incorporated into this DPA and applies to the SCCs as set out above. In the UK Addendum, Table 1 is completed with the parties to this DPA, Table 2 with the modules and options chosen above, and Table 3 with the annexes described above. In Table 4, either party may end the UK Addendum as its Section 19 allows.

United States

Where a U.S. state privacy law applies to Customer Personal Data, such as the California Consumer Privacy Act, we act as your service provider or processor, and we:

  • do not sell or share Customer Personal Data, as that law defines those words;

  • do not keep, use, or disclose it for any purpose, commercial or otherwise, other than the business purposes in the Terms and this DPA, or outside our direct business relationship with you;

  • do not combine it with personal information we receive from anyone else or collect ourselves, except as that law allows;

  • meet the obligations that law places on us, and give it the level of privacy protection that law requires of you;

  • will tell you if we can no longer meet our obligations under that law; and

  • allow you to take reasonable and appropriate steps to make sure we use it consistently with your obligations under that law, and to stop and fix any use that is not authorized.

Canada, Australia, New Zealand, and Israel

Where Customer Personal Data is subject to Canada’s Personal Information Protection and Electronic Documents Act or a provincial privacy law, the Australian Privacy Act 1988 (Cth), the New Zealand Privacy Act 2020, or Israel’s Protection of Privacy Law, 5741-1981, we hold and process it only as your service provider or agent under this DPA, protect it to a standard comparable to that law, and keep it only as long as the Service needs it. For Israel, we also take on what the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, ask of a recipient: we keep the data secure, use it only to provide the Service, and do not pass it to anyone other than our subprocessors under this DPA.

Security measures

These are the technical and organizational measures in place today.

  • Encryption. Data is encrypted in transit with TLS. Our hosting and database providers encrypt it at rest.

  • Separation between customers. Each customer’s data is kept apart by row-level security in the database, so a user can reach only the workspaces they belong to.

  • Accounts. Every user signs in with their own account. Passwords are handled by our authentication provider and never stored in plain text. Seats are for one person each.

  • Staff access. Access to production systems is limited to staff who need it. Support access to a customer workspace is time-limited, recorded, shown to the customer, and can be ended by the customer. Staff actions in our administration tools are logged.

  • Development. Changes go through version control, automated type checks and tests, and a staging environment that holds no customer data before they reach production. Where we copy production data to a separate development database to find and fix problems, that copy is limited to our engineering staff and is protected by this DPA.

  • Infrastructure. The Service runs on managed cloud providers that maintain their own security programs. Our database provider keeps regular backups.

  • Monitoring. We monitor the Service for errors, performance, and availability.

  • Payments. Card details are handled by our payment processor. We never store full card numbers.

  • Incidents. We investigate, contain, and report Security Incidents as this DPA requires.

  • People. Staff and contractors are bound by confidentiality, and access is removed when they no longer need it.

Contact

For questions about this DPA, a signed copy, the subprocessor list, or notice of subprocessor changes:

Grainwork, Inc.
203 Wood St
Apt A
Loogootee, IN 47553
Email: compliance@grainwork.io

See also Terms of use and Privacy.