For all customer data, 20xwork acts as a data processor on your organisation's documented instructions, which are the product configuration and our agreement. Your organisation is the controller: it decides which tools to connect, who has a seat, what retention applies and how recommendations and profiles are used.
20xwork is a controller only for the data it holds about its own customer contacts and website visitors, described in the Privacy notice.