Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that contact and profile information for Prospects is collected not only directly but also from named third-party data enrichment and professional data providers including LinkedIn, ZoomInfo, Clearbit, Cognism, and Lusha.
This analysis describes what Monday.com's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that monday.com sources personal data about prospective customers from commercial data brokers and professional networking platforms, meaning individuals may have profile data held by monday.com without having directly interacted with the company.
Under this clause, monday.com may hold contact and professional profile information sourced from third-party data enrichment providers about individuals who have not directly provided their data to monday.com. The agreement grants rights to request access to and erasure of such data by contacting support@monday.com.
Cross-platform context
See how other platforms handle Third-Party Data Enrichment for Prospect Profiles and similar clauses.
Compare across platforms →Monitoring
Monday.com has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We collect this information directly from you, or from other sources and third parties such as our Customer (your employer), Users and colleagues related to your organizational monday.com account, organizers of events or promotions that both you and us were involved in, and through the use of tools and channels commonly used for connecting between companies and individual professionals in order to explore potential business and employment opportunities, such as LinkedIn, ZoomInfo, Clearbit, Cognism and Lusha.Excerpt from Monday.com's Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates GDPR Articles on transparency and the right to be informed, which require that data subjects receive notice when personal data is obtained from sources other than themselves, including the identity of those sources. The CCPA similarly requires disclosure of categories of sources from which personal information is collected. Data broker regulations in states including California (CPRA and the Delete Act) and Vermont may also apply to the named providers. 2. GOVERNANCE EXPOSURE: Medium. The explicit naming of commercial data enrichment sources (ZoomInfo, Clearbit, Cognism, Lusha) in the policy satisfies a disclosure obligation, but the adequacy of downstream notice to individuals whose data is sourced from these providers, particularly under GDPR Article 14, may require further evaluation. GDPR Article 14 requires that data controllers provide notice to data subjects within a reasonable period when data is obtained from third-party sources. 3. JURISDICTION FLAGS: EU and UK residents whose data is sourced from commercial data brokers without direct notice from monday.com may have claims under GDPR Article 14. California residents may have rights under CPRA to opt out of the use of data obtained from data brokers for targeted advertising. The legality of the underlying data held by named providers varies by jurisdiction. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should assess whether the named data enrichment providers operate in compliance with applicable data protection laws in relevant jurisdictions and whether monday.com's agreements with those providers include appropriate data processing terms. 5. COMPLIANCE CONSIDERATIONS: Organizations whose employees or contacts may appear in monday.com's Prospect Data sourced from named enrichment providers should be aware of the data subject access and erasure rights available under Section 8 of this policy. Legal teams evaluating monday.com's GDPR compliance posture should assess whether Article 14 notice obligations for third-party-sourced Prospect Data are satisfied.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that monday.com sources personal data about prospective customers from commercial data brokers and professional networking platforms, meaning individuals may have profile data held by monday.com without having directly interacted with the company.
Under this clause, monday.com may hold contact and professional profile information sourced from third-party data enrichment providers about individuals who have not directly provided their data to monday.com. The agreement grants rights to request access to and erasure of such data by contacting support@monday.com.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Monday.com.