Data Processing Agreement

Last updated: October 14, 2026

This Data Processing Agreement (“DPA”) applies when a business or organization (“Customer”) uses Worklynq and, in doing so, has Cohesync Inc. (“Cohesync”) process personal data on its behalf. It forms part of the Terms of Use (or any other agreement between Customer and Cohesync for Worklynq, together the “Agreement”). If this DPA and the Agreement conflict on data protection, this DPA wins.

1. Definitions

• Data Protection Laws means the data protection and privacy laws that apply to the processing of Customer Personal Data, such as the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended.
• Customer Personal Data means personal data in Customer’s Worklynq workspace that Cohesync processes on Customer’s behalf to provide Worklynq.
• Subprocessor means a third party that Cohesync engages to process Customer Personal Data.
• “Controller”, “processor”, “personal data”, “processing”, “data subject” and “supervisory authority” have the meanings given in the GDPR. Under the CCPA, Customer is the “business” and Cohesync the “service provider”.

2. Roles and scope

Customer is the controller and Cohesync is the processor of Customer Personal Data. Cohesync is a controller only of the limited data it uses to run its own business, such as account administration, billing and security logs, as described in the Privacy Policy. The Annex describes the processing.

3. Customer instructions

Cohesync processes Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA, and Customer’s use and configuration of Worklynq (including which tools it connects and which AI features it turns on) are those instructions. Cohesync will tell Customer if it believes an instruction breaks Data Protection Laws. Cohesync will not sell or share Customer Personal Data, keep or use it for any purpose other than providing Worklynq, combine it with data from other sources except as allowed by Data Protection Laws, or use it to train AI models.

Customer is responsible for having a lawful basis for the processing and for the instructions it gives.

4. Confidentiality

Cohesync makes sure that everyone it authorizes to process Customer Personal Data is bound by confidentiality, and gives access only to those who need it to provide or support Worklynq.

5. Security

Cohesync maintains appropriate technical and organizational measures to protect Customer Personal Data, including:

• encryption in transit (HTTPS) and at rest (by our cloud providers);
• logical separation of each customer’s workspace data, with a separate database per dedicated instance;
• private storage for uploaded files, and encrypted storage of credentials for connected tools;
• passwords stored only as hashes, and role-based access controls inside each workspace;
• restricted, logged administrative access to production systems; and
• automated backups of production databases.

Cohesync may update these measures as long as the overall level of protection does not decrease.

6. Subprocessors

Customer authorizes Cohesync to use the Subprocessors listed below. Cohesync imposes data protection terms on each Subprocessor that are at least as protective as this DPA, and remains responsible for their performance.

Services that Customer chooses to connect, such as GitHub, Jira, Confluence, Gmail, Anthropic (Claude) or Anysphere (Cursor), are used under Customer’s own account with those providers and are not Cohesync’s Subprocessors.

Cohesync will give at least 30 days’ notice, by email to Customer’s workspace administrators or by updating this page, before adding or replacing a Subprocessor. Customer may object on reasonable data protection grounds within that period. The parties will then work in good faith to find a solution; if none is found, Customer may terminate the affected part of the service and receive a refund of any prepaid fees for the remaining term.

7. Data subject requests

Taking into account the nature of the processing, Cohesync will help Customer respond to requests from data subjects to exercise their rights, mainly through features in Worklynq that let Customer access, correct, export and delete data. If Cohesync receives such a request directly, it will refer the person to Customer and will not respond itself unless Customer asks it to or the law requires it.

8. Personal data breaches

Cohesync will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, what happened, the data and people affected, the likely consequences, and the steps taken or proposed. Cohesync will take reasonable steps to contain and fix the breach and will keep Customer updated. Notifying Customer is not an admission of fault.

9. Assessments and consultations

Cohesync will give Customer reasonable information and help, taking into account the nature of the processing, for data protection impact assessments and prior consultations with supervisory authorities that relate to Customer’s use of Worklynq.

10. International transfers

Customer Personal Data is processed in the United States. Where Data Protection Laws require a transfer mechanism for personal data sent from the European Economic Area, the United Kingdom or Switzerland, the parties agree that the European Commission’s Standard Contractual Clauses (Module Two, controller to processor), with the UK Addendum or Swiss amendments where relevant, are incorporated into this DPA, with Customer as data exporter and Cohesync as data importer. The Annex provides the information those clauses require. Under the clauses, the governing law is that of Ireland and disputes go to the courts of Ireland (for the UK, England and Wales).

11. Return and deletion

When the Agreement ends, Customer may export its content within 30 days. After that, Cohesync will delete Customer Personal Data from active systems within 30 days and from backups within a further 90 days, unless the law requires Cohesync to keep it. Data kept for legal reasons stays protected by this DPA.

12. Audits

On written request, no more than once a year (or after a personal data breach, or when a supervisory authority requires it), Cohesync will answer reasonable written questions and provide information needed to show compliance with this DPA. If that is not enough to meet Data Protection Laws, Customer may carry out an audit at its own cost, with at least 30 days’ notice, during normal business hours, under confidentiality, and without accessing other customers’ data.

13. General

• This DPA lasts as long as Cohesync processes Customer Personal Data.
• Each party’s liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow it.
• Apart from section 10, this DPA is governed by the laws of the State of Delaware, USA, and disputes go to the state or federal courts in Santa Clara County, California, as in the Terms of Use.
• Cohesync may update this DPA to reflect changes in law or in Worklynq, giving notice of material changes. Changes will not reduce the protection given to Customer Personal Data.
• Customers that need a countersigned copy can request one at info@cohesync.com.

Annex: processing details