Data Processing Addendum
Last updated: 15 May 2026.
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Data Controller") and Works of Web Ltd ("Data Processor") and governs the processing of personal data in connection with the Service.
1. Definitions
- GDPR: the General Data Protection Regulation (EU) 2016/679 and the UK GDPR.
- Personal Data: any information relating to an identified or identifiable natural person.
- Processing: any operation performed on Personal Data.
- Sub-processor: any third party engaged to process Personal Data on behalf of the Customer.
2. Scope of Processing
Subject matter: provision of AI-powered lead management and communication services for the Upwork platform.
Duration: for the term of the agreement, plus 30 days for data deletion.
Types of Personal Data: names, email addresses, Upwork usernames, message content, job posting details, calendar events, IP addresses.
Categories of Data Subjects:the Customer's clients and prospective clients on Upwork, team members, and third-party contacts in calendar events.
3. Obligations of the Data Processor
- Process Personal Data only on documented instructions from the Customer
- Ensure authorized persons have committed to confidentiality
- Implement appropriate technical and organizational security measures
- Not engage a Sub-processor without prior written authorization
- Assist the Customer in responding to Data Subject requests
- Assist with security, breach notification, and impact assessments
- Delete or return all Personal Data upon termination
- Make available information necessary to demonstrate compliance and allow audits
4. Obligations of the Data Controller
- Ensure lawful basis for processing
- Provide appropriate notice to Data Subjects regarding AI-assisted communication
- Ensure instructions comply with data protection law
- Be responsible for accuracy of content provided to the Service
5. Sub-processors
The Company uses the following Sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| GitHub Container Registry (Microsoft) | Container image hosting | United States |
| Google LLC | AI processing, Calendar API | United States |
| Anthropic, PBC | AI processing | United States |
| OpenAI, Inc. | AI processing | United States |
| Open Router, Inc. | AI model routing | United States |
| Stripe, Inc. | Payment processing | United States |
| Telegram Messenger LLP | Notification delivery | UK / Dubai |
We will notify you of changes to Sub-processors, giving you the opportunity to object.
6. International Transfers
Transfers outside the EEA/UK are protected by Standard Contractual Clauses, the UK International Data Transfer Agreement, and data processing agreements.
7. Data Breach Notification
We will notify you without undue delay (and in any event within 48 hours) upon becoming aware of a breach. We will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33.
8. Audit Rights
You may conduct audits no more than once per year, with reasonable notice, during business hours, subject to confidentiality.
9. Term
This DPA remains in effect for the duration of the agreement. Upon termination, data is deleted within 30 days.
10. Contact
Works of Web Ltd[email protected]