01Legal
Workzoom sub-processor list.
- Since 2000. Workzoom has run Canadian payroll for 25+ years.
- Canadian data residency, AWS Canada (ca-central-1). Canadian customer data stays in Canada.
- SOC 2-aligned controls. Encrypted at rest, role-based access, immutable audit logs.
- County of Renfrew, Silvera for Seniors, Cable Bahamas. 50 to 5,000 employee organizations.
What this list is
Workzoom relies on a small number of vetted service providers to operate the workzoom.com website and to deliver the Workzoom application. Each provider receives only the data necessary for its function, under written data protection terms at least as strict as those in our Data Processing Agreement.
This list is published in full for transparency to data subjects, prospective customers running vendor reviews, and Quebec residents under Law 25. Active customers are notified at least 30 days before we add or replace any sub-processor that handles application data. To subscribe to change notifications, contact info@workzoom.com.
Website sub-processors (workzoom.com)
The following providers process data about visitors to the workzoom.com marketing website. Categories of data include IP address, browser identifiers, page-view behavior, and any information you voluntarily submit through a form or booking calendar.
| Vendor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Vercel Inc. Privacy policy |
Static hosting, edge delivery, and request logs for workzoom.com. | IP address, request URL, user agent, timing. | United States (primary), global edge PoPs |
| Google LLC Privacy policy |
Google Tag Manager and Google Analytics 4. Page-view + event analytics. | Truncated IP, pages viewed, events, device, approximate location, randomly-generated client ID. | United States, with regional sub-processors |
| HubSpot Inc. Privacy policy |
Visitor tracking (portal 4666617), form submissions (newsletter, lead magnet, contact), and the meetings booking calendar embedded across the site. | Name, business email, phone, company, IP, page history, cookie identifier, calendar booking details. | United States, with European sub-processors for EU traffic |
| Microsoft Corporation Privacy policy |
Microsoft Clarity for session replay, heatmaps, and rage-click detection on the marketing website. Form fields and text content are masked by default. | Anonymized session recordings, click and scroll behavior, IP address, viewport, device. | United States |
| Microsoft Bing, Yandex LLC, IndexNow consortium | Outbound search-engine indexing notifications. No visitor data is shared. | Published URL paths only. | United States, Russia (Yandex), consortium endpoints |
Application sub-processors (Workzoom platform)
The following providers process Personal Information held inside the Workzoom application. They are governed by the Workzoom Data Processing Agreement.
| Vendor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Amazon Web Services Inc. Privacy policy |
Primary cloud hosting for the Workzoom application, database, file storage, and backups. | All Personal Information held in the application, encrypted at rest and in transit. | AWS Canada (Central) for Canadian and non-US clients; AWS US regions for US clients |
Change notifications
Workzoom notifies active customers at least 30 days before adding or replacing any sub-processor that handles application data. Notifications are sent to the primary administrator email on the customer account. Customers who object to a new sub-processor may terminate the affected service in accordance with the Terms of Service.
Quebec Law 25 + PIPEDA disclosure
This list satisfies the third-party transparency obligation under Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and the openness principle under PIPEDA. Workzoom is incorporated in Ontario, Canada. Personal information held in the application is hosted in AWS Canada (Central) for Canadian customers. Marketing-website data (including visitor analytics) is processed in the United States by the vendors listed above under Standard Contractual Clauses or equivalent transfer mechanisms.
To exercise your rights of access, rectification, deletion, portability, or to file a complaint regarding our handling of your personal information, contact info@workzoom.com. Quebec residents may also contact the Commission d'accès à l'information du Québec.
Recent changes
- Initial published sub-processor list extracted from privacy policy.
- Microsoft Clarity added (session replay on marketing website).
Contact
Workzoom's Privacy Officer is Matthew Woolley, reachable at info@workzoom.com. The Privacy Officer is responsible for compliance with this policy and with applicable privacy laws, including Quebec Law 25's designated-person obligation under section 3.1.
Questions about this list, requests for a copy of the Data Processing Agreement, or notification subscription requests can be sent to the same address.