Loading…
Links last opened 28 October 2026. Record confirmed by a person on 16 September 2026. 14 recorded changes, listed below.
Loom contracts through Loom, Inc., registered in United States. Transfers of personal data out of the EEA are covered by EU-US Data Privacy Framework (DPF). Its trust center is published at https://www.atlassian.com/trust. Its customer data processing agreement, also called a data processing addendum, is published by Loom itself; the link is below. Its sub-processor list is published by Loom itself; the link is below. We open those pages every day — last on 28 October 2026 — and a person last went through this record on 16 September 2026.
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
A ready row. Replace the purpose with what your client actually uses Loom for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Loom | Loom, Inc. | US | Workplace tools | DPF | https://www.atlassian.com/legal/data-processing-addendum |
Changes we noticed on Loom's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.
28 October 2026
Close was added as a subprocessor for Provision of Atlassian support across multiple Atlassian products, with data processing occurring in Australia, India, Singapore, and South Korea—countries that lack EU adequacy decisions. Your records should be updated to reflect Close as a new subprocessor and note the processing locations outside adequately-decided jurisdictions.
27 October 2026
Loom has been added as a new subprocessor across multiple Atlassian Cloud products for provision of support and maintenance of service, safety, and security, with data processing occurring in locations including Australia, India, and Singapore that lack EU adequacy decisions. This requires updating your records of processing and subprocessor list to reflect the expanded geographic scope and the new vendor involvement.
26 October 2026
Close has been added as a subprocessor for Loom, processing data in Australia, India, and Singapore, which are countries without EU adequacy decisions. This means personal data may be transferred to these locations, requiring additional safeguards to be documented in processing records and data processing agreements.
26 October 2026
The DPA document was reformatted to add language selection options and restructure content layout, but the substantive legal terms regarding data processing roles, security measures, EU Standard Contractual Clauses, UK Addendum terms, and sub-processor provisions remain unchanged.
Seen on https://www.atlassian.com/legal/data-processing-addendum
25 October 2026
Loom was added to the subprocessor list for cloud hosting and support services, with data processing occurring in multiple countries including Australia, India, and Singapore, which lack EU adequacy decisions. This requires updating records of processing to reflect these new data transfer locations and assessing whether appropriate transfer mechanisms are in place.
25 October 2026
The DPA was reformatted and reorganized with content restructured into different sections, but the substantive legal obligations regarding security measures, EU Standard Contractual Clauses, UK Addendum terms, and sub-processor notification procedures remain substantively the same.
Seen on https://www.atlassian.com/legal/data-processing-addendum
24 October 2026
Loom was added to Loom's subprocessor list for provision of Atlassian support and maintenance of service, safety, and security, with data processing occurring in Australia, India, and Singapore, which are countries without EU adequacy decisions.
24 October 2026
The Loom Data Processing Addendum was updated with formatting changes that added language navigation options and restructured sections on scope, security measures, and European data transfer mechanisms, while removing a FAQ section that previously addressed questions about DPA applicability, sub-processors, and security measures.
Seen on https://www.atlassian.com/legal/data-processing-addendum
23 October 2026
Loom was added as a new subprocessor supporting Atlassian cloud products with data processing locations including Australia, India, and Singapore, which lack EU adequacy decisions. The vendor now processes customer and end-user personal data in these countries for provision of Atlassian support and maintenance of service, safety, and security.
23 October 2026
The Loom DPA was updated with restructured content on EU Standard Contractual Clauses, UK Addendum terms, and security measures, though the substantive legal provisions for data transfers and sub-processor requirements remain substantially the same. This matters for your records because the document organization changed but your data protection obligations and Loom's commitments regarding international transfers and sub-processor notification appear functionally unchanged.
Seen on https://www.atlassian.com/legal/data-processing-addendum
22 October 2026
Loom's data processing agreement was updated to add 27 lines of content covering new sections on scope, sub-processing, assistance obligations, data deletion, audit rights, international provisions, and region-specific terms for Europe, United Kingdom, Switzerland, United States, South Korea, and Brazil. This expansion provides more detailed contractual terms and geographic-specific requirements that organizations relying on Loom as a subprocessor will need to review and potentially incorporate into their records of processing.
Seen on https://www.atlassian.com/legal/data-processing-addendum
21 October 2026
Loom removed 27 lines from their data processing agreement, including key sections on scope, sub-processing, security obligations, audit rights, and region-specific terms for Europe, UK, Switzerland, US, South Korea, and Brazil. This deletion significantly reduces the documented data protection commitments and regional compliance framework that customers and processors rely on for legal certainty.
Seen on https://www.atlassian.com/legal/data-processing-addendum
20 October 2026
Loom's data processing agreement was updated to add 27 lines of content covering key DPA sections including scope, security, sub-processing, assistance obligations, data deletion, audit rights, international provisions, and region-specific terms for Europe, the UK, Switzerland, the US, South Korea, and Brazil. This expansion clarifies Loom's processing obligations and compliance requirements across multiple jurisdictions, which affects how the agreement should be documented in records of processing and subprocessor management.
Seen on https://www.atlassian.com/legal/data-processing-addendum
14 October 2026
We recorded a change to the UK transfer mechanism.
See the 31 sub-processors Loom lists →
Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.
Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.
Six of them. All workplace tools in the registry · others that transfer the same way.