Workable

Six changes affect international transfers, security commitments, data uses, group disclosures, and the policy's effective date and registered office.

• International transfer arrangements changed: the Privacy Shield section was replaced by a Data Privacy Framework self-certification covering the EU-U.S., Swiss-U.S. and UK Extension frameworks, with the SCCs and UK DTIA remaining as the alternative mechanism. The policy now states, "We will not otherwise transfer your Personal Data outside of the United Kingdom or EEA", and adds onward-transfer liability for third parties receiving data under the Data Privacy Framework. (Transfers of Personal Data; Where we store your Personal Data)
• Security commitments were added: the policy now states that appropriate measures are taken to keep Personal Data secure for the duration of service use, that access is limited to those with a genuine business need, and that those processing the information do so only in an authorised manner under a duty of confidentiality. (How we store your Personal Data — Security)
• The Google account authentication clause now also lets Workable access and read Google Contacts to suggest email recipients when composing email messages or events through Workable, alongside the existing Gmail and Google Calendar access. (Google Account Authentication)
• A new section permits Workable to use anonymised and aggregate data collected through use of the Services and Website for statistical purposes, improvement of the Services, research, or any other lawful purpose. (Aggregate Data)
• The disclosure section now states Workable may disclose personal information to any member of its group — subsidiaries, the ultimate holding company and its subsidiaries — with transfers to group members outside the UK or EU made under a contract. (Disclosure of your information)
• The policy's last-updated date moved from 4 August 2023 to 16 January 2025, and Workable's registered office address changed from 5 Golden Square, 5th Floor, London W1F 9BS to 1st Floor, Sackville House, 143-149 Fenchurch Street, London EC3M 6BL. (Contact; last updated line)

Seven further changes add an opening clarification of controller versus processor roles, a statement that name, email address, employer and work URL are required at registration, an extension of the listed data-subject rights to all users regardless of location, an expanded service-provider category list, a Do Not Track statement, a Nevada opt-out right, and a clause permitting future policy amendments with acceptance by continued use.