When Windsurf processes your data on behalf of your employer, Windsurf's own privacy policy does not protect you — your employer's privacy policy governs instead, and Windsurf takes no responsibility for how your employer handles your data.
If your employer uses Windsurf as a business tool, Windsurf's privacy protections described in this policy do not apply to your data — your employer's privacy practices govern, which may offer fewer protections.
Cross-platform context
See how other platforms handle Dual Controller/Processor Role Disclaimer and similar clauses.
Compare across platforms →Enterprise users may have significantly fewer protections than individual users because Windsurf disclaims responsibility for how employer-customers handle personal data processed through the platform.
(1) REGULATORY FRAMEWORK: This provision directly implicates GDPR Article 28 (processor obligations and mandatory DPA requirements), Article 26 (joint controller arrangements), and Article 82 (liability allocation between controller and processor). The UK GDPR imposes equivalent obligations. For US enterprise deployments, CCPA/CPRA §1798.140(ag) defines 'service provider' and 'contractor' roles with specific contractual requirements. The FTC Act Section 5 applies if the disclaimer is used to evade accountability for deceptive practices. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.