No public evidenceNimbleWork and GDPR
CertReports found no public GDPR evidence for NimbleWork as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
- Kind
- listing
- Issued or listed
- 21 May 2024
- Expires or valid through
- 7 Apr 2027
- Scope
- NimbleWork, Inc. processes personal data received from the European Union/European Economic Area, the United Kingdom (and Gibraltar), and Switzerland in reliance on the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) for the following purposes: Types of Personal Data Processed: Customer/Client Data: Name, business email address, IP address, usage data, and account information collected from users of NimbleWork's SaaS products (Nimble, SwiftKanban, kAIron, Nimble Retro, Collaborative OKRs). Visitor Data: IP address, browser/device information, cookie identifiers, geolocation data, and behavioral/analytics data collected from visitors to NimbleWork's websites. HR Data: Not currently collected in reliance on the DPF. Purposes of Processing: Provisioning, maintaining, and improving NimbleWork's SaaS platform and associated services. Account registration, authentication, and customer support. Billing, subscription management, and transaction processing (via third-party payment processors). Sending service-related communications, product updates, and (with consent) marketing communications. Analytics and performance monitoring to improve user experience and website functionality. Compliance with legal obligations and enforcement of Terms of Service. Fraud prevention and security. Third Parties to Whom Personal Data Is Disclosed: NimbleWork discloses personal data only to subprocessors and service providers acting on its behalf, including cloud infrastructure providers, analytics vendors (e.g., Google Analytics, Mixpanel, Middleware), customer communication platforms, billing processors, and customer support tools. A complete list is maintained at: https://www.nimblework.com/about/enterprise-security/subsidiaries-and-sub-processors/. NimbleWork does not sell personal data to third parties. NimbleWork remains liable for onward transfers to subprocessors in accordance with the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF Principles.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | NimbleWork, Inc.: Active: EU-US Certification, UK Extension Certification, SW-US Certification | Live pagesha256 38fc86ddb5 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is NimbleWork GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Analytics category) whose GDPR row is verified or vendor-stated, ranked by similarity.
No Analytics vendor has GDPR evidence in the index yet.