Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal data may be transferred to and processed in countries including the United States, and that continued use of the platform constitutes consent to such international transfers.
This analysis describes what ClickUp's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision asserts that consent to international data transfers is obtained through platform use, which may require evaluation under GDPR Chapter V, which establishes specific lawful transfer mechanisms. The policy defers more detailed transfer safeguards to a separate Data Protection Addendum for contractual customers.
Interpretive note: Whether consent obtained through platform use satisfies GDPR Chapter V transfer mechanism requirements depends on regulatory interpretation and jurisdiction-specific enforcement context.
The updated policy now explicitly recognizes eight distinct data subject rights, including rights to access, correct, delete, restrict processing, receive data in portable format, object to processing, withdraw consent, and lodge complaints with regulators. Previously, ClickUp described privacy controls through general opt-out options and data access procedures without formal legal framing. The revised language aligns with GDPR and similar data protection frameworks, providing clearer legal reference points for how users may exercise control over their personal data. You can exercise these rights by contacting ClickUp's support team.
View change record →Under this provision, personal data may be stored and processed in countries with different data protection standards, including the United States. The agreement treats continued platform use as consent to these transfers, though applicable law may impose additional requirements beyond consent for such transfers.
Cross-platform context
See how other platforms handle International Data Transfer by Platform Use Consent and similar clauses.
Compare across platforms →Monitoring
ClickUp has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Your data, including personal data that we collect from you, may be transferred to, stored at and processed by us and other third parties outside the country in which you reside, including, but not limited to the United States, where data protection and privacy regulations may not offer the same level of protection as in other parts of the world. By using our platform, you agree to this transfer, storing or processing subject to the terms of our Data Protection Addendum. To the fullest extent allowed by applicable law, by using the ClickUp Service and submitting such information on it, you voluntarily consent to the trans-border transfer and hosting of such information.Excerpt from ClickUp's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Chapter V (transfers to third countries), UK GDPR transfer provisions, and the adequacy framework established by the European Commission. Blanket consent obtained through platform use may not satisfy GDPR's transfer mechanism requirements, which generally require adequacy decisions, Standard Contractual Clauses, or other specified safeguards. The policy's reference to the Data Protection Addendum as the governing instrument for transfers suggests that contractual customers may have additional protections not available to individual users under this policy alone. GOVERNANCE EXPOSURE: High for EEA and UK enterprise customers. The adequacy of consent-based transfer mechanisms under GDPR has been subject to regulatory scrutiny, and reliance on this provision alone without supplementary transfer safeguards may create exposure for organizations subject to GDPR or UK GDPR. JURISDICTION FLAGS: EEA and UK users face the most significant exposure, as GDPR and UK GDPR impose specific requirements for lawful international transfers that may not be satisfied by consent obtained through continued platform use. The policy's assertion that California law governs all users regardless of jurisdiction may not be enforceable in EU member states. CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should obtain the Data Protection Addendum and verify that it includes Standard Contractual Clauses or equivalent transfer mechanisms. The policy body alone does not identify specific transfer safeguards beyond consent and the DPA reference, which may be insufficient for regulated-industry customers in the EEA or UK. COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the Data Protection Addendum contains adequate transfer mechanisms under current GDPR guidance, including post-Schrems II requirements for transfer impact assessments where relevant. UK customers should verify UK GDPR transfer compliance separately, as UK adequacy determinations may differ from EU positions.
This provision asserts that consent to international data transfers is obtained through platform use, which may require evaluation under GDPR Chapter V, which establishes specific lawful transfer mechanisms. The policy defers more detailed transfer safeguards to a separate Data Protection Addendum for contractual customers.
Under this provision, personal data may be stored and processed in countries with different data protection standards, including the United States. The agreement treats continued platform use as consent to these transfers, though applicable law may impose additional requirements beyond consent for such transfers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ClickUp.