DRAFT: This document is pending legal review and is not yet a binding agreement. It is published for transparency while our counsel finalizes the text.
This Data Processing Agreement ("DPA") forms part of the agreement between Workbench CRM LLC ("Workbench", the "Processor") and the customer identified in the applicable order or account registration (the "Customer", the "Controller") governing the Customer's use of the Workbench platform (the "Service").
Last updated: August 19, 2026
1. Roles of the parties
For personal data that the Customer and its end clients submit to the Service, the Customer acts as the data controller and Workbench acts as a data processor, processing personal data only on the Customer's documented instructions as set out in this DPA and the Terms of Service.
2. Subject matter and duration
This DPA applies for as long as Workbench processes personal data on behalf of the Customer under the agreement. Processing ends when the Customer's account is deleted and the deletion and retention periods in Section 9 have elapsed.
3. Nature and purpose of processing
Workbench processes personal data to provide the Service, which includes: customer relationship management, invoicing and payments, quoting, job scheduling, client communications (email, SMS, and voice), online booking, document signing, marketing tools, and AI-assisted features, together with related support, security, and billing operations.
4. Categories of data and data subjects
Data subjects include the Customer's staff and the Customer's own clients and leads. Categories of personal data include: contact details (names, email addresses, phone numbers, postal addresses), business and billing information, communications content (messages, call recordings and transcripts), scheduling and job details, documents and signatures, uploaded files and photos, and technical usage data.
The Service is not intended for special categories of personal data (such as health or biometric data), and the Customer agrees not to submit such data.
5. Processor obligations
Workbench will:
- process personal data only on the Customer's documented instructions, unless required by law;
- ensure persons authorized to process personal data are bound by confidentiality obligations;
- implement the technical and organizational measures described in Section 6;
- assist the Customer, taking into account the nature of the processing, in responding to data subject requests (access, correction, deletion, export);
- notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data;
- make available information reasonably necessary to demonstrate compliance with this DPA.
6. Security measures
Workbench maintains technical and organizational security measures including: encryption of data in transit (TLS) and at rest, row-level access controls isolating each business tenant's data, role-based access within a tenant, authentication with optional multi-factor authentication, network and application security controls, logging and monitoring, and least-privilege access for Workbench personnel.
7. Subprocessors
The Customer provides general authorization for Workbench to engage the subprocessors listed at tryworkbench.app/subprocessors. Workbench will update that page before adding or replacing a subprocessor and will impose data protection obligations on each subprocessor that are no less protective than those in this DPA. The Customer may object to a new subprocessor on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the affected portion of the Service.
8. International transfers
Where personal data originating from the European Economic Area, the United Kingdom, or Switzerland is transferred to a country without an adequacy decision, the parties will rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses.
[PLACEHOLDER: SCC module selection, UK Addendum, and transfer annexes to be completed by counsel.]
9. Deletion and return of data
Upon termination or deletion of the Customer's account, Workbench will delete the personal data processed on the Customer's behalf within the retention window described in the Terms of Service (currently 30 days after cancellation), except where retention is required by law. Before deletion, the Customer may export its data using the Service's export tools or by contacting support.
10. Contact
Questions about this DPA can be sent to legal@tryworkbench.app.