GDPR & Privacy at Teamwins

Data roles. For customer workspaces, Teamwins acts as the data processor and our customers act as the data controller. For limited cases such as website analytics, billing, and account administration, Teamwins acts as the controller.

Lawful basis. We process personal data as necessary to: perform our contract (to provide the Service), support legitimate interests (such as product improvement and security), and obtain consent where legally required.

Data residency. Customer data is hosted in EU or US regions, depending on project configuration. EU projects can be provisioned in EU regions to support residency requirements.

Sub‑processors. Teamwins relies on trusted infrastructure providers under written agreements, including: Vercel (hosting and edge delivery), Supabase (database and authentication), Stripe (payment processing). These providers operate on SOC 2 and ISO 27001 certified infrastructure, and we maintain agreements reflecting GDPR requirements.

Security. Teamwins implements appropriate technical and organizational measures, including encryption in transit and at rest, role‑based access controls, Row‑Level Security for database isolation, and managed backups. Audit logging is available on Enterprise plans.

Data subject rights. Individuals have rights under GDPR, including access, correction, export, and deletion of personal data. Workspace administrators can manage exports and deletions within the product. Requests will be supported through in‑product options.

Retention. Customer data is retained for the duration of the service and deleted upon account closure or request, unless retention is required by law.

DPA. A Data Processing Addendum (DPA) is incorporated into the Terms of Service and available to all customers. It outlines Teamwins’ subprocessors and security measures.

Requests. Privacy and GDPR requests can be initiated directly through the product’s support and account settings features.