Privacy Policy

This Privacy Policy explains how Workbase Platforms sp. z o.o. (“Workbase”, “we”, “us”) collects, uses, shares, and protects personal data when you visit our websites, use our products, communicate with us, or connect third-party services.

Controller: Workbase Platforms sp. z o.o., Franz-Joseph-Str. 11, 80801 Munich, Germany. Email: legal@workbase.com Privacy contact: privacy@workbase.com Managing director: Nils Kroeger VAT identification number: PL8992989402

Scope

This policy applies to our websites, software, APIs, integrations, customer support, billing, analytics, security operations, and related services. Additional terms may apply to specific products, enterprise agreements, or data processing arrangements.

Personal Data We Process

We may process the following categories of personal data:

• Account data, including name, business email address, company, role, login credentials, and workspace membership.
• Contact and communication data, including messages, support requests, meeting notes, feedback, and preferences.
• Billing and contract data, including plan information, invoices, payment status, tax details, and business address.
• Product usage data, including logins, feature usage, API calls, settings, audit events, and workflow activity.
• Technical data, including IP address, device information, browser type, operating system, identifiers, error logs, and security logs.
• Customer content, including data that customers upload, connect, import, generate, or otherwise process through Workbase.
• Integration data from services that customers connect to Workbase, depending on the permissions granted by the customer.

Sources Of Data

We receive personal data directly from you, from your organization, from connected integrations, from service providers, from public business sources, and from automatically generated technical logs. Where customers upload or connect data about other people, the customer is responsible for having a lawful basis to do so.

Purposes Of Processing

We process personal data to:

• Provide, operate, secure, and improve Workbase.
• Create and manage accounts, workspaces, permissions, and subscriptions.
• Deliver customer support and respond to requests.
• Process billing, payments, taxes, renewals, and account administration.
• Monitor service performance, troubleshoot issues, and prevent misuse.
• Maintain security, audit logs, fraud prevention, and compliance controls.
• Send product, service, and administrative communications.
• Analyze product usage and improve our website, onboarding, and product experience.
• Comply with legal obligations and enforce our agreements.

Legal Bases

Where the GDPR or similar laws apply, we rely on the following legal bases:

• Performance of a contract for account management, service delivery, support, and billing.
• Legitimate interests for security, fraud prevention, service improvement, analytics, and business communications.
• Consent for optional cookies, certain marketing communications, and other optional processing where required.
• Legal obligations for tax, accounting, compliance, and regulatory requests.

Customer Data And Processor Role

For personal data that customers submit to Workbase for processing through the services, Workbase generally acts as a processor or service provider and the customer acts as controller. The customer determines the purposes and means of processing. Processing of that data is governed by the applicable agreement and, where relevant, our Data Processing Addendum.

Sharing Personal Data

We may share personal data with:

• Hosting, infrastructure, analytics, payment, communication, security, and support providers.
• Professional advisers, auditors, banks, insurers, and legal representatives.
• Third-party integrations enabled by the customer.
• Authorities, courts, or regulators where required by law.
• Affiliates or successors in connection with a merger, acquisition, financing, restructuring, or asset transfer.

We do not sell private customer workspace data. We require service providers to process data only under appropriate contractual, confidentiality, and security obligations.

International Transfers

We may process data in the European Economic Area and other countries where we or our providers operate. Where required, we use appropriate safeguards such as adequacy decisions, standard contractual clauses, data processing agreements, and technical and organizational security measures.

Retention

We keep personal data only as long as necessary for the purposes described in this policy, including service delivery, account administration, legal compliance, dispute resolution, security, backups, and audit requirements. Retention periods vary by data category, product configuration, customer instructions, and legal obligations.

Security

We use technical and organizational measures designed to protect personal data, including access controls, encryption, logging, monitoring, least-privilege permissions, secure development practices, and provider due diligence. No system is completely secure, but we work to reduce risk and respond to incidents promptly.

Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data. You may also withdraw consent where processing is based on consent. To exercise rights, contact privacy@workbase.com. We may need to verify your identity and may direct requests about customer-controlled data to the relevant customer.

Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage optional cookies through the consent controls where available and through your browser settings.

Marketing Communications

You can unsubscribe from marketing emails by using the unsubscribe link in the email or contacting us. We may still send transactional, security, billing, or service-related messages.

Children

Workbase is intended for business users and is not directed to children. We do not knowingly collect personal data from children.

Changes

We may update this Privacy Policy from time to time. The latest version will be published on this page. Material changes may be communicated through the product, by email, or by another appropriate method.