Monday AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ If you would like to make any requests or queries regarding personal data we process as a data processor on our Customer’s behalf, including accessing, correcting or deleting your data, please contact the Customer’s Account Admin directly.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ monday.com Inc., our US subsidiary, complies with the EU-US Data Privacy Framework (EU-US DPF), the UK Extension to the EU-US DPF, and the Swiss-US Data Privacy Framework as set forth by the US Department of Commerce, and where appropriate – primarily relies on such certification for accepting transfers of data from the EEA, UK and Switzerland to the US (as applicable).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ For data transfers from the EEA, the UK and Switzerland to countries which are not considered to be offering an adequate level of data protection, we and the relevant data exporters and importers have entered into Standard Contractual Clauses as approved by the European Commission, the UK Information Commissioner’s Office (ICO), and the Swiss FDPIC, as applicable. You can obtain a copy by contacting us as indicated in Section 10 below.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ monday.com & the GDPR and UK GDPR ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ monday.com & the Australian Privacy Act ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ EU Representative : VeraSafe has been designated as monday.com’s representative in the European Union for data protection matters pursuant to Article 27 of the GDPR. VeraSafe may be contacted only on matters related to the processing of personal data of EU residents. To make such an inquiry, please contact VeraSafe through this contact form .” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ monday.com Ltd. is headquartered in Israel, a jurisdiction which is considered by the European Commission, the UK Secretary of State, and the Swiss Federal Data Protection and Information Commissioner (FDPIC), to be offering an adequate level of protection for personal data of individuals residing in EU Member States, the UK and Switzerland, respectively. We transfer data from the European Economic Area (EEA), the UK and Switzerland to Israel on this basis.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ monday.com & Japan’s APPI ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ monday.com & Canada’s PIPEDA ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ monday.com Inc., has certified to the U.S. Department of Commerce that monday.com Inc., adheres to the EU-US Data Privacy Framework Principles (EU-US DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-US DPF, and from the UK (and Gibraltar) in reliance on the UK Extension to the EU-US DPF. monday.com Inc., furthermore certifies that it adheres to the Swiss-US Data Privacy Framework Principles (Swiss-US DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-US DPF. monday.com Inc., will remain liable for onward transfers of your personal data to third parties (including our Service Providers) in accordance with applicable data transfer mechanisms. If there is any conflict between the terms in this privacy policy and the EU-US DPF Principles and/or the Swiss-US DPF, the Principles shall govern with respect to personal data transferred under the DPF. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/ .” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ While privacy laws vary between jurisdictions, monday.com, its affiliates and Service Providers are each committed to protect personal data in accordance with this Privacy Policy, customary and reasonable industry standards, and such appropriate lawful mechanisms and contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “Data Location : We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States (US), Europe, Israel, Australia, Guatemala, the Philippines, Brazil, Japan, Singapore, the United Kingdom (UK), and other locations as reasonably necessary for the proper performance and delivery of our Services, or as may be required by applicable law.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ UK Representative : monday.com UK 2020 Ltd. has been designated as monday.com’s representative in the United Kingdom for data protection matters pursuant to Article 27 of the UK GDPR. monday.com UK 2020 Ltd. may be contacted on matters related to the processing of personal data of residents of the UK, at [email protected] .” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Complaints about transfers of data from the EU, UK or Switzerland to the US & dispute resolution : In compliance with the DPF Principles, we commit to resolve complaints about our collection or use of your personal data. EEA, UK and Swiss individuals with inquiries or complaints regarding our DPF compliance should submit enquiries to [email protected] .” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ We process such Customer Data on behalf and under the instruction of the respective Customer in our capacity as a “ data processor ”, in accordance with our Data Processing Addendum with them. For more information, please refer to Section 9 below.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “monday.com is the “data processor” of personal data contained in Customer Data, as submitted or otherwise collected by our Customers and their Users to their Account’s boards, items, docs, forms, canvases, Chrome extension for CRM Users, and other features availabile to them via the Services. We process such data on behalf of our Customer (who is the “data controller” of such data) and in accordance with its reasonable instructions, subject to our Terms, our Data Processing Addendum (to the extent applicable) and other commercial agreements with such Customer.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ monday.com & Brazil’s LGPD ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | Enterprise | low | “Please note that where monday.com processes personal data on behalf of a Customer, such personal data (included in their Customer Data) may only be processed in accordance with, and in the locations as agreed in our Data Processing Addendum and other commercial agreements with such Customer (as further described in Section 9 below).” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Data Retention : We may retain your personal data for as long as it is reasonably needed to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (e.g. as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with our data retention policy and at our reasonable discretion. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of such data, the potential risk of harm from unauthorized use or disclosure of such data, the purposes for which we process it, and the applicable legal requirements. If you have any questions about our data retention policy, please contact us by email at [email protected] .” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 3. Data Location & Retention ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 4. Data Disclosure ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Transfer of the Restricted personal data to third parties: (1) in accordance with this Privacy Policy, solely to the extent necessary to provide or improve the Integrated Google Services; (2) to comply with applicable laws and regulations; and (3) in connection with any change in control, including by means of merger, acquisition or purchase of substantially all of monday.com’s assets ( Performance of Contract; Legitimate Interests; Legal Obligation) ; or” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences, including through partnerships with local distributors, resellers, business partners and providers of professional services related to our Services (“ Partners ”, as further described in Section 4 below) (Legitimate Interests) ;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Partnerships : We engage selected business and channel partners, resellers, distributors and providers of professional services related to our Services, which allow us to explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences for our prospective and existing Customers and Users. In such instances, we may disclose relevant contact, business and usage details to the respective Partner, to allow them to engage with those Customers and Users for such purposes. If you directly engage with any of our Partners, please note that any aspect of that engagement which is not directly related to the Services and directed by monday.com is beyond the scope of monday.com’s Terms and Privacy Policy, and may therefore be governed by the Partner’s terms and privacy policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Application Providers and Event Sponsors : We may disclose relevant connectivity, technical and usage data to the provider(s) of any third-party applications, or if so instructed or permitted by you or your Account Admin, your personal data (such as your User Profile and contact details, as well as relevant technical data) to provider(s) of any third-party integrations or applications added to your Account. We may also share connectivity, technical, and usage data with the provider(s) of third-party applications whose marketplace pages you have visited.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Services integrations : You or your Account Admin may choose to integrate your Account on the Services with third-party Services (provided that such integration is supported by our Services). The provider of such integrated third-party Services may receive certain relevant data about or from your Account on the Services, or disclose certain relevant data from the account on the third-party provider’s Services with our Services, depending on the nature and purpose of such integration. Note that we do not receive or store your passwords for any of these third-party Services (but do typically require your API key in order to integrate with them). If you do not wish your data to be disclosed to such third-party Services(s), please contact your Account Admin.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Legal Compliance : In exceptional circumstances, we may disclose or allow government and law enforcement officials access to your personal data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect the security or integrity of our products and Services.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For the purposes of the CCPA, in the past twelve (12) months, we may have disclosed Identifiers; Professional or Employment-Related Information; Internet or other Electronic Network Activity Information; Customer Records Information; Geolocation Information ; Inferences; and Audio, electronic, visual or similar Information to the third parties listed above.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ monday.com Subsidiaries : We disclose personal data internally within our group of companies, for the purposes described in this Privacy Policy. In addition, should monday.com or any of its subsidiaries undergo any change in control, including by means of merger, acquisition or purchase of substantially all of its assets, your personal data may be disclosed with the parties involved in such an event. If we believe that such change in control might materially affect your personal data then stored with us, we will notify you of this event and the choices you may have via email or prominent notice on our Services.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service Providers : We engage selected third-party companies and individuals as “Service Providers”, to perform services on our behalf or complementary to our own. These include providers of Third Party Services (as defined in the Terms ), such as: hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, fraud detection, investigation and prevention services, web and mobile analytics, email and communication distribution and monitoring services, session or activity recording services, call recording, analytics and transcription services, event production and hosting services, remote access services, performance measurement, data optimization and marketing services, social and advertising networks, content, lead generating and data enrichment providers, email, voicemails, video conferencing solutions, support and customer relation management systems, third-party customer support providers, and our legal, compliance and financial advisors and auditors.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Service Providers : We engage selected third-party companies and individuals as “Service Providers”, to perform services on our behalf or complementary to our own. These include providers of Third Party Services (as defined in the Terms ), such as: hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, fraud detection, investigation and prevention services, web and mobile analytics, email and communication distribution and monitoring services, session or activity recording services, call recording, analytics and transcription services, event production and hosting services, remote access services, performance measurement, data optimization and marketing services, social and advertising networks, content, lead generating and data enrichment providers, email, voicemails, video conferencing solutions, support and customer relation management systems, third-party customer support providers, and our legal, compliance and financial advisors and auditors. Our Service Providers may have access to personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services or other activities, and may only use the data as determined in our agreements with them.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Our Service Providers may have access to personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services or other activities, and may only use the data as determined in our agreements with them.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For the avoidance of doubt, monday.com may disclose your personal data in additional manners, pursuant to your explicit approval, if we are legally obligated to do so, or if we have successfully rendered such data non-personal and anonymous.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Protecting Rights and Safety : We may disclose your personal data to others if we believe in good faith that this will help protect the rights, property or safety of monday.com, any of our Users or Customers, or any members of the general public.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third Party Websites and Services : Our Services includes links to third party websites and services, and integrations with Third Party Services (as defined in the Terms ). Such websites, services and Third Party Services, and any information you process, submit, transmit or otherwise use with or to such websites, services and Third Party Services, are governed by such third party’s terms and privacy practices and policies, and not by this Privacy Policy. We encourage you to carefully read the terms and privacy policies of such websites, services and Third Party Services.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.