Privacy Policy

At TwoWorks Ventures (“TwoWorks”, “we”, “our”, or “us”), we are committed to safeguarding the privacy and security of your corporate data and personal information. This Privacy Policy details our practices concerning the collection, storage, processing, transfer, and disclosure of data when you interact with our website, cloud ERP software, APIs, and custom enterprise deployments.

1. Information We Collect

We collect information in three primary categories:

• Directly Provided Information: Corporate contact details (name, work email address, telephone number, job title, company name) submitted via contact forms, onboarding questionnaires, calendar booking widgets, or customer support channels.
• Operational & ERP Tenant Data: Data ingested, processed, or generated by our ERP platform on behalf of our enterprise clients—including inventory logs, invoice metadata, customer records, and employee access records. Such data is governed under our Master Service Agreement (MSA) and Data Processing Addendum (DPA).
• Automated Telemetry & System Logs: IP addresses, browser types, operating systems, referring URLs, access timestamps, system performance metrics, and anonymized user interaction analytics captured to maintain system security and optimize response times.

2. Legal Bases & Purpose of Data Processing

We process information under recognized legal bases (including Contractual Necessity, Legitimate Interests, and Legal Obligations) for the following purposes:

• Provisioning, configuring, and maintaining bespoke ERP infrastructure and cloud instances.
• Responding to engineering inquiries, scheduling technical consultations, and providing 24/7 client support.
• Authenticating user identities and enforcing multi-factor, role-based tenant access controls (RBAC).
• Detecting, mitigating, and preventing security breaches, fraudulent transactions, and unauthorized system access.
• Complying with applicable statutory tax, financial auditing, and regulatory reporting mandates.

3. Enterprise Data Isolation & Security Architecture

TwoWorks implements defense-in-depth architectural safeguards designed to meet ISO 27001, SOC 2 Type II, and GDPR standards:

• Encryption: All data is encrypted in transit using TLS 1.3 cryptographic protocols and at rest utilizing AES-256 encryption.
• Tenant Isolation: Logical and database-level tenancy separation ensures that no client data is commingled or accessible by unauthorized entities.
• Zero-Trust Architecture: Internal administrative access is gated via least-privilege principles, ephemeral session tokens, and strict audit trails.

4. Data Sharing & Third-Party Sub-processors

We do not sell, rent, or trade your corporate information. Data is disclosed strictly on a need-to-know basis to verified enterprise sub-processors under compliant Data Processing Agreements:

• Cloud Infrastructure Providers: AWS, Google Cloud Platform, and Microsoft Azure (governed in regional data centers).
• Communications & Scheduling: Cal.com, WhatsApp Business API (Twilio/Meta), and transactional email delivery networks.
• CRM & Workflow Engines: Proprietary TwoWorks CRM instances operated under strict access controls.

5. Data Retention & Deletion

We retain client data only for the duration necessary to satisfy contractual obligations and statutory compliance requirements. Upon termination of an enterprise agreement or receipt of a verified deletion request, client datasets are securely purged from primary and replica stores within 30 days in compliance with NIST SP 800-88 sanitization standards.

6. Your Data Rights

Depending on your jurisdiction (e.g., GDPR, CCPA, Digital Personal Data Protection Act), you maintain the right to:

• Request access to, rectification of, or erasure of your personal data.
• Restrict or object to specific processing operations.
• Request portability of your data in a structured, machine-readable format (JSON/CSV).
• Withdraw consent at any time without affecting the lawfulness of prior processing.

7. Contact Our Data Protection Officer (DPO)

For privacy inquiries, audit requests, or to exercise your statutory data rights, please contact our privacy and legal office: