Slack

The policy has been updated to clarify Slack's role as a data processor acting on Customer instructions, add new transfer safeguards, and remove certain internal links. Specific changes include:

• Removed links to "Workspace creation" and "third-party application management" details from the "Information We Collect and Receive" section (the previous versions included clickable references that have been deleted).
• Added a new introductory paragraph in the "How We Share and Disclose Information" section stating: "Customers determine their own policies and practices for the sharing and disclosure of Information to third parties. Slack does not control how a Customer or any third party chooses to share or disclose Information."
• Added a new subsection "The Customer’s Instructions." that explains Slack shares Information in accordance with Customer instructions, and notes that "Some sharing at a Customer’s request may incur additional fees."
• Added a new safeguard in the "International Data Transfers" section: "Asia-Pacific Economic Cooperation Cross-Border Privacy Rules System And Privacy Recognition For Processors." (APEC CBPR/PRP) along with a reference to a third-party dispute resolution provider.
• Added a sentence under the existing SCC safeguard: "A copy of our standard data processing addendum, incorporating the Standard Contractual Clauses, is available here, and a copy of the executed version of the Standard Contractual Clauses may be obtained by contacting us as described in the 'Contacting Slack' section below."

The policy now removes the hyperlink to the Data Processing Addendum form, replacing it with plain text that no longer provides a direct URL to access the document.

The policy appears to have removed two sections: the detailed explanation of sharing in accordance with Customer instructions under 'How We Share and Disclose Information' and the reference to the APEC Cross-Border Privacy Rules system and Privacy Recognition for Processors under 'International Data Transfers'.

• Removed 'The Customer’s Instructions' sharing bullet: The previous version stated that Slack may share and disclose Information in accordance with a Customer’s instructions, with appropriate consent, and that some sharing may incur fees, and included examples of administrator controls. This entire paragraph has been deleted, removing the explicit framing that sharing is guided by Customer instructions and associated controls.
• Removed APEC CBPR/PRP certification: The previous version included a second safeguard under International Data Transfers describing Slack's compliance with the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules system and Privacy Recognition for Processors, and offered a third-party dispute resolution provider. That section is no longer present.
• Added hyperlinks: In the 'Information We Collect And Receive' section, under 'Workspace and account information', the policy now includes a link with text "(for more detail on Workspace creation, click here." Similarly, under 'Third-Party Services information', a link was added: "(for more details on third-party application management, settings and permissions, click here." These add references to additional resources but do not alter the described data practices.
• Minor rewording: The introductory sentence to 'How We Share and Disclose Information' changed from "as described in the section entitled 'Information We Collect and Receive' above" to "as described in the earlier section of this Privacy Policy."

The policy removes the dedicated subsection describing sharing under 'The Customer’s Instructions' and the introductory language emphasizing that customers control their own sharing. It also removes the reference to the APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) certifications under 'International Data Transfers', and the offer to provide a copy of the executed Standard Contractual Clauses. The new version appears to streamline the sharing section by starting directly with 'Displaying the Services' and shortens the international transfers section to only the European Commission's Standard Contractual Clauses bullet.

The policy now appears to add a new subsection 'The Customer’s Instructions' under 'How We Share and Disclose Information', emphasizing that Customers determine their own sharing policies and Slack follows their instructions. It also appears to add a second safeguard for international data transfers referencing the APEC Cross-Border Privacy Rules system and Privacy Recognition for Processors, and expands the bullet on Standard Contractual Clauses to mention a data processing addendum and a way to obtain an executed copy. For example, the new text states: 'Customers determine their own policies and practices for the sharing and disclosure of Information to third parties. Slack does not control how a Customer or any third party chooses to share or disclose Information.' and under international transfers: 'A copy of our standard data processing addendum, incorporating the Standard Contractual Clauses, is available here...'