Data processingArticle 28, in full
You instruct. We process.
Where wayworks holds personal data for your organisation, your organisation is the controller and we are the processor. This page summarises the terms that bind us under Article 28 of the GDPR. It is a summary — the signed addendum is the document that governs, and we will send it before you sign.
Last reviewed 13 September 2026 · full text: link to the executable DPA
The commitments
What Article 28 requires of us.
- Only on your instructions
We process personal data only on your documented instructions, including on transfers, unless a law requires otherwise — and then we tell you, unless telling you is itself prohibited.
- Confidentiality
Everyone we authorise to process it is bound to confidentiality.
- Security
Appropriate technical and organisational measures under Article 32. What those are is on the security page, stated without badges we do not hold.
- Subprocessors
Engaged only under written terms no weaker than these, published on the subprocessor page, with notice and a right to object before a new one starts.
- Helping with rights requests
We assist you in answering data subject requests, and pass any that reach us directly straight to you rather than answering for you.
- Helping with assessments
We assist with impact assessments and prior consultation, and with breach notification.
- Breach notice
We notify you without undue delay after becoming aware, with what we know and what we are doing.
- Deletion or return
At the end, we delete or return the data at your choice, and delete existing copies unless a law requires us to keep them.
- Audit
We make available what is needed to demonstrate compliance and allow audits, on terms set out in the addendum.
The details you will be asked for
The annexes.
- Subject matter and duration
Provision of the wayworks service, for the term of the agreement plus deletion window.
- Nature and purpose
Hosting, storage, retrieval, workflow execution, document handling, search and assistant-mediated access, as configured by you.
- Categories of data subject
Your personnel, contractors, candidates, and the individuals in records you hold — customers, suppliers and counterparties among them.
- Categories of personal data
Depends on the modules you enable. Payroll and HR necessarily involve data requiring particular care, and where special category data is in scope it is named explicitly, per module.
- Transfers
Standard Contractual Clauses, with the UK Addendum where relevant, plus a transfer risk assessment. See the privacy notice.
- Technical measures
As described on the security page and annexed to the addendum.