CoworkMoves

Data Processing Agreement

Last updated: 11 November 2026 · Version 2026-11-11

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between CoworkMoves (Oxana Ktoridou, Nicosia, Cyprus) as Processor and the organisation that creates a Company on CoworkMoves as Controller. It applies when the Controller’s authorised representative accepts it while creating a Company, and meets the requirements of Article 28 of the GDPR (Regulation (EU) 2016/679).

1. Subject matter and duration

The Processor hosts the Controller’s Company page and processes personal data to run the Controller’s fitness challenge for as long as the Company exists on CoworkMoves, and afterwards only as described in section 9.

2. Nature and purpose

Storing, displaying, aggregating and exporting challenge data: membership of the Company, logged activities, points and rewards, kudos, leaderboards and totals, and sending invitations on the Controller’s request.

3. Categories of data subjects and data

  • Data subjects: the Controller’s employees, contractors and other people the Controller invites.
  • Personal data: name, email address, Company role, display preferences, activity type, optional description and duration, timestamps, points and rewards, kudos.
  • Special categories: none intended. The service does not ask for health data; the Controller should instruct members not to enter it.

Account data (login credentials, account email) is processed by CoworkMoves as an independent controller under its Privacy Policy.

4. Processor obligations

The Processor shall:

  1. process personal data only on the Controller’s documented instructions, which are the Terms, this DPA and the Controller’s use and configuration of the service, unless EU or Member State law requires otherwise (in which case it will inform the Controller first, unless the law prohibits that);
  2. ensure that anyone authorised to process the data is bound by confidentiality;
  3. implement the security measures in section 6 (Art. 32 GDPR);
  4. engage sub-processors only as set out in section 5;
  5. taking into account the nature of the processing, assist the Controller with responding to data subject requests, including through self-service export, deletion and display controls;
  6. assist the Controller with its obligations on security, breach notification, data protection impact assessments and prior consultation (Arts. 32–36 GDPR), taking into account the information available to the Processor;
  7. at the end of the service, delete or return the data as set out in section 9;
  8. make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, by the Controller or an auditor it appoints, on reasonable notice and no more than once a year unless there has been a breach. It will immediately inform the Controller if, in its opinion, an instruction infringes data protection law.

5. Sub-processors

The Controller gives general authorisation for the Processor to use the following sub-processors:

  • Cloudflare, Inc. – hosting, database, file storage, content delivery and security;
  • Resend, Inc. – transactional email (invitations).

The Processor will give at least 30 days’ notice of any new or replacement sub-processor by email to the Company owner, during which the Controller may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Controller may delete the Company. The Processor imposes data protection obligations on each sub-processor that are equivalent to those in this DPA and remains responsible for their performance.

6. Security measures

  • Encryption in transit (HTTPS/TLS) for all traffic, and storage on infrastructure encrypted at rest by the hosting provider;
  • Company data is only visible to authenticated members of that Company; organiser functions are restricted by role;
  • Passwords hashed with PBKDF2; session, invitation and email tokens stored only as hashes and time-limited;
  • Protection against cross-site request forgery and clickjacking; administrative access to production limited to the Processor’s operator.

7. Personal data breaches

The Processor will notify the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data, with the information reasonably available to help the Controller meet its own notification duties.

8. International transfers

Where sub-processors process data outside the EEA, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

9. Deletion at the end of the service

When the Company owner deletes the Company, all Company data (members, invitations, challenges, activities, kudos and logos) is deleted from the live database and storage immediately, and from the hosting provider’s backups within its standard backup retention period. Before deleting, the Controller can download its data using the monthly CSV export.

10. Controller obligations

The Controller is responsible for having a lawful basis for the processing, for informing its members about the challenge, and for the lawfulness of its instructions.

11. Liability and precedence

Liability is governed by the Terms of Service, subject to Article 82 GDPR. If this DPA conflicts with the Terms on data protection, this DPA prevails.