Incident #ABE102 · 22 APR 2026notable
Sana adds Workday as joint controller and shares marketing data with it
Sana now says it acts as a joint controller with Workday for integrated services and joint marketing. Business contact details and marketing preferences may be exchanged with Workday. Privacy requests and contact with the Data Protection Officer now go through Workday's online form instead of Sana's own email address.
Taken from you
- Sana's earlier statement that it does not share personal data with affiliates or partners was removed
- Business contact information and marketing preferences may now be shared with and received from Workday
- Privacy requests and DPO contact must go through Workday's online form rather than Sana's privacy email
- Responsibility for handling your data rights and breach reporting is shared with Workday for joint activities
Won back
- Right under GDPR to exercise rights against either Sana or Workday is stated explicitly
- Added explanation of controller and processor roles
- Sana's postal address is now listed
Evidence · 4 of 4 quotes matched in source
We may share your personal data, including your business contact information and marketing preferences, with Workday where we conduct joint marketing campaigns or offer integrated services.+ inserted · ✓ matched in source
Workday manages privacy operations and data subject requests on behalf of Sana.+ inserted · ✓ matched in source
If you have any questions about this Privacy Notice, wish to exercise your rights, or contact our Data Protection Officer, please submit your request through Workday’s online form.+ inserted · ✓ matched in source
Archived version ↗ · 1,183 words changed