Roles of the parties
The operator (the owner of the workspace) is the controller of the personal data it stores in its workspace about its customers, visitors and staff. Workan.Space is the processor and handles that data only to provide the service. Where Workan.Space handles data about the operator’s own account and subscription, it acts as a controller, as described in the Privacy Policy at /privacy.
Scope and purpose of processing
Workan.Space processes personal data to run the operator’s workspace: storing customers, workspaces and bookings; recording payments, refunds and voids in the finance ledger; sending notifications and messages the operator triggers; generating Wi-Fi hotspot credentials for bookings; handling support tickets; keeping audit logs; and backing the data up. Processing lasts for as long as the workspace is active, and until deletion is complete as described below.
Types of data and people
People: the operator’s customers and visitors, and the operator’s owner and staff. Data: names, email addresses and phone numbers; bookings and their status; payment, refund and void records (amounts and methods, not card numbers); Wi-Fi hotspot usernames and passwords (the password is stored hashed; a readable copy is kept only until the router is set up and delivery to the customer is confirmed, or for at most 25 hours if that never happens); messages sent through the platform, including the message that delivers Wi-Fi credentials, which is stored with the password masked (the real text is held encrypted only until the message is sent or fails, and Wi-Fi delivery messages created on or before 22 October 2026 may still contain the password in their stored text), and their delivery status; support ticket content; and audit-log entries about who did what.
Instructions
Workan.Space processes personal data only on the operator’s documented instructions, which are these terms and the operator’s use of the product’s features. If Workan.Space believes an instruction breaks data-protection law, it will tell the operator. Everyone at Workan.Space who can access the data is bound by confidentiality.
Security measures
• Tenant isolation: every workspace’s data is scoped to that workspace, and the platform admin area is a separate trust boundary with its own accounts and sign-in. • Access control: role-based permissions inside each workspace; two-factor authentication available to every account and mandatory for platform staff. • Sessions: sign-in tokens expire after 7 days, and the platform’s separate staff and operator sessions cannot be used against each other. • Encryption in transit: connections are served over HTTPS. Integration credentials saved by operators are stored encrypted and are never returned by the API. • Audit: workspace actions are written to a per-workspace audit log, and platform-staff actions to a separate append-only platform audit log. • Staff access: platform staff reach workspace data only through audited, time-boxed impersonation sessions (30 minutes by default). • Abuse protection: rate limiting on sign-in and the API, and checks that block integrations from reaching internal network addresses. • Backups: the database is backed up nightly, the most recent 10 backups are kept, and restores are tested on a schedule.
Sub-processors
The operator authorises Workan.Space to use these sub-processors: • Microsoft Azure — hosting of the application, database and backups. • Azure Communication Services — sending transactional email (invitations, password resets, notifications) from noreply@workan.space. • Namecheap — domain registration and forwarding of mail sent to our support, privacy and legal addresses. • Twilio — delivery of SMS and WhatsApp messages, only when an operator connects its own Twilio account in Integrations. • Sentry — error monitoring, only if enabled; it is configured not to send personal data by default. • Azure Blob Storage — off-site copies of backups, once enabled. Workan.Space does not use a card processor: subscriptions are paid offline. Wi-Fi hotspot provisioning talks to the operator’s own MikroTik router, not to a third party. We will update this list before adding or replacing a sub-processor and will tell workspace owners, who may object on reasonable data-protection grounds.
Where data is processed
Workspace data is hosted on Microsoft Azure infrastructure operated for Workan.Space. Contact us for the hosting location. Where personal data is transferred across borders, Workan.Space will put in place a lawful transfer mechanism.
Helping with requests from individuals
On request to support, Workan.Space will give the operator a copy of its workspace data and will erase the workspace. For access, correction or other requests from the operator’s own customers, Workan.Space will help the operator respond; if we receive such a request directly, we will refer the person to the operator.
Personal data breaches
If Workan.Space becomes aware of a breach of security affecting an operator’s personal data, it will notify the workspace owner without undue delay and within 72 hours where feasible. The notice will describe what happened, the data and people affected, what we are doing about it, and a contact for more information.
Deletion and return at the end of the service
Before leaving, the operator can ask support for an export of its workspace data. On request to support the workspace is erased after a notice period (30 days by default) during which the operator can cancel; after it, the workspace is permanently deleted, including its ledger (payments, refunds and voids). Generated report exports are removed within 8 days. Copies in routine backups age out as older backups are replaced. We keep our own platform records of actions on the workspace (subscription and payment records, suspensions, support access) and a record that the erasure took place.
Audits and information
Workan.Space will give the operator the information needed to show compliance with this agreement. The operator can also ask for the platform audit-log entries about staff access to its own workspace, including every impersonation session; we provide them on request. Any further audit is agreed in writing in advance and conducted so as not to affect other customers.
Contact
Questions about this agreement, or want a signed copy? Email privacy@workan.space.