Wrike

The Candidate Privacy Policy states that third-party AI tools are used for recruitment (transcription, summarization, screening) and contractually requires providers to 'not use your data for their own purposes (including model training), unless such use is expressly authorized by us.' However, this language is specific to recruitment data and job applicants, not general product users. The documents provided do not address AI training on general Wrike product user data (tasks, projects, team communications). The absence of explicit protection for product user data warrants a moderate concern score.

“[Privacy] 'not use your data for their own purposes (including model training), unless such use is expressly authorized by us, limited to clearly defined purposes, and carried out under appropriate legal and technical safeguards'”

The provided documents (Trust Center, Candidate Privacy Policy) do not contain explicit terms governing the license scope for user-generated content in the Wrike product itself. The Candidate Privacy Policy addresses recruitment data only. Without access to the main Terms of Service or a Data Processing Agreement that explicitly defines content license rights for product users, the absence of clear protections regarding sublicensing, derivative works, or post-termination license survival creates moderate concern.

“Not found in documents — scored conservatively”

The Candidate Privacy Policy states data may be shared with 'Third-Party Providers: Vendors that support our recruitment' and 'Affiliated Entities' for cross-functional purposes, with contractual requirements for confidentiality and security. However, the documents do not specify whether these sub-processors are listed, whether DPAs are required for all sub-processors, or how broadly 'Affiliated Entities' is defined. The DPA is referenced as available but not provided in full. For general product data sharing, no explicit restrictions on advertising networks or analytics partners are stated.

“[Privacy] 'We may share your personal data with third-party service providers to help organize and facilitate recruitment activities' and 'Affiliated Entities: For cross-functional or global role considerations within Wrike's network of entities.'”

The Candidate Privacy Policy provides specific retention periods for recruitment data (12 months post-recruitment for EEA/UK; 24 months for rest of world; extended 12 months with consent). Recording records are retained for maximum 12 months. However, these terms apply only to recruitment/candidate data, not general product user data. The documents do not address retention or deletion policies for company data stored in the Wrike product itself (tasks, projects, files). Absence of product data retention terms creates moderate concern.

“[Privacy] 'Personal data is retained for up to 12 months following the conclusion of the recruitment process' (EEA/UK) and 'up to 24 months after the conclusion of the recruitment process' (Rest of World)”

The provided documents do not explicitly address IP ownership of content created by users within the Wrike product (tasks, projects, deliverables, outputs). The Candidate Privacy Policy addresses recruitment data only and does not grant Wrike ownership of applicant-generated content. The absence of explicit IP ownership terms in the provided documents—particularly regarding whether Wrike claims rights to user-generated project content—warrants a moderate concern score pending review of the full Terms of Service.

“Not found in documents — scored conservatively”

The Trust Center document explicitly references multiple compliance frameworks: EU Standard Contractual Clauses (2021/914/EU Modules Two and Three), UK International Data Transfer Addendum (vB1.0), GDPR compliance, and a Data Processing Addendum that applies globally. The Candidate Privacy Policy confirms compliance with GDPR and CCPA. The Trust Center provides downloadable DPA and SCC documents and references a security overview page. These demonstrate formal compliance certifications and documented data protection mechanisms.

“[Security] 'Wrike EU Standard Contractual Clauses (SCC) and the UK International Data Transfer Addendum (Version B1.0)' and 'DPA applies to all personal information as defined in the DPA or under applicable data protection laws on a global basis'”