Privacy policy — Passwork

Cited by

Facts read from this source

• Controller Report an error

  “Data Controller: Passwork Europe SL (Barcelona, Spain)”

• ISO 27001 Report an error

  “Passwork maintains ISO 27001 certification, demonstrating our commitment to information security management best practices.”

• Encryption Report an error

  “Using TLS 1.3 encryption for any transmission of personal data electronically”

• MFA Report an error

  “Maintaining adequate access control mechanisms (e.g., two-factor authentication, password protection, and limited access)”

• Pentest Report an error

  “Our security infrastructure is regularly tested by independent experts, including penetration testing by HackerOne.”

• Ddos Report an error

  “DDoS mitigation via Cloudflare”

• DPA Report an error

  “To ensure that we process personal data on behalf of our clients in compliance with the GDPR, we offer our Data Processing Agreement (DPA), a copy of which is available by contacting us at info@passwork.pro.”

• DPA scc Report an error

  “we offer our DPA based on the latest Standard Contractual Clauses adopted by the European Commission to meet adequacy and security requirements for our clients who operate in the EU or submit EU residents' personal data through Passwork.”

• Applicable law Report an error

  “This Privacy Policy is governed by and construed in accordance with the laws of Spain, without regard to its conflict of law provisions.”

• Payment processors Report an error

  “Please note that we do not process payments directly; this is handled by our third-party payment processors, Paddle and PayPal.”

• Payment retention Report an error

  “We keep your personal data for 7 years, as required by tax law.”

• Log retention Report an error

  “We keep your IP address data for 90 days.”

• Account retention Report an error

  “Account data Duration of account + 30 days after deletion”

• Demo retention Report an error

  “We keep your personal data for up to 3 years after your last interaction with us, unless you request us to delete it earlier.”

• Deletion on request Report an error

  “We store your personal data in our systems only for as long as such personal data is required for the purposes described in this Privacy Policy or until you request us to delete your personal data, whichever comes first.”

• Rights response days Report an error

  “We will respond to your request within a reasonable time frame, but no later than 30 days.”

• Rights Report an error

  “Right of access You can request a copy of your personal data that we store Right to rectification You can correct any inaccurate personal data we hold about you Right to erasure You can ask us to delete your personal data Right to restriction You can ask us to restrict how we use your data Right to data portability You can request a copy of your data in a structured, commonly used format Right to object You can object to certain types of processing, including profiling Rights related to automated decisions You have rights regarding automated decisions with legal effects”

• Portability tools Report an error

  “Offering data portability and data management tools, including data import, export, amendment, and deletion tools whereby our clients may access, import, export, update, and delete their data through their interface”

• Service description Report an error

  “The Service allows you to store all of your company passwords in protected vaults, collaborate with teammates, manage user rights, track all changes, monitor security and use one-click login.”

• Data processed Report an error

  “We act as a data processor with regard to the data submitted or generated by you through the Service for our processing like passwords ("Your Data")”

• On premises Report an error

  “including, without limitation, the on-premises version of Passwork”

• Change notice days Report an error

  “Post a prominent notice on our website 30 days before the changes take effect”

• Policy version Report an error

  “2.1 December 1, 2025 Added quick summary and navigation, enhanced security section with ISO 27001 and HackerOne references”

• Effective date Report an error

  “Effective date: December 1, 2025”

• No sale Report an error

  “We do not sell your personal data to third parties.”

• Breach notification Report an error

  “In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you promptly about the nature of the breach, the likely consequences of that breach, and the steps you can take to mitigate the potential consequences of that breach.”

• Secret management Report an error

  “Secret management”

• Browsers Report an error

  “Google Chrome Mozilla Firefox Microsoft Edge Apple Safari”

• Mobile apps Report an error

  “App Store Google Play”

• Self hosted edition Report an error

  “On-premise solution”

Scores citing this record

• The CISO European sovereignty
• The CISO Hosting choice, offline access & export
• The CISO European sovereignty
• The Compliance Auditor Audit logs, policies & reporting
• The Compliance Auditor Hosting choice, offline access & export
• The Compliance Auditor European sovereignty
• The Compliance Auditor Audit logs, policies & reporting
• The DevOps Engineer Audit logs, policies & reporting
• The DevOps Engineer Hosting choice, offline access & export
• The DevOps Engineer European sovereignty
• The DevOps Engineer Hosting choice, offline access & export
• The Identity Engineer Hosting choice, offline access & export
• The Identity Engineer European sovereignty
• The Identity Engineer Audit logs, policies & reporting
• The Identity Engineer Hosting choice, offline access & export
• The Skeptic Hosting choice, offline access & export
• The SME Owner Sharing, roles & recovery
• The SME Owner Hosting choice, offline access & export