Monday.com Privacy Policy

This document is monday.com's Privacy Policy, governing the collection, use, storage, and sharing of personal data for visitors to its website and users of its work management platform, with the stated legal basis varying by jurisdiction (consent, legitimate interests, and contractual necessity under GDPR for EEA users; statutory compliance obligations for California residents under CCPA/CPRA). The policy states that monday.com collects a broad range of personal data including account registration information, payment details, usage and log data, device identifiers, location data, and content users upload to the platform, and the terms authorize sharing this data with third-party sub-processors, affiliated companies, advertising partners, and in the context of business transfers. A notable structural distinction is monday.com's dual role as both a data controller (for visitor and marketing data) and a data processor (for customer-uploaded content within the platform), with the policy explicitly stating that customer data processed within the service is governed by the applicable customer agreement rather than this policy, limiting consumer-facing rights disclosures for that data category. The policy engages GDPR, CCPA/CPRA, and potentially other regional frameworks, and explicitly addresses the transfer of personal data from the EEA, UK, and Switzerland to the United States, relying on Standard Contractual Clauses and adequacy decisions as transfer mechanisms. Compliance teams should note the policy's acknowledgment of cookie-based advertising and analytics tracking, AI feature disclosures, and the need to evaluate sub-processor agreements, data processing addenda, and regional consent mechanisms.