Asana

Asana sets session authentication cookies, CSRF protection tokens, feature flag cookies for product testing, and analytics cookies. Third party services integrated into Asana's platform, such as Amplitude and Segment, may also set analytics cookies. When Asana Forms are embedded on external sites, cookies from app.asana.com and related analytics domains may be deposited on visitor browsers. Asana also uses local storage for caching application state and user preferences.

For internal team use within an organisation, consent is generally not required as contract performance or legitimate interest applies. However, when Asana Forms are embedded on public facing websites, consent is recommended before collecting personal data from external users, especially if cookies are set. Cookie consent under the ePrivacy Directive is required for non essential analytics cookies on any page embedding Asana widgets.

Internal project management use relies on contract performance (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)). Security logging and fraud prevention are covered by legitimate interest. Public facing Asana Forms collecting external user data should rely on consent (Art. 6(1)(a)). Third party integration data flows should be assessed individually. Each processing activity should be documented in your Records of Processing Activities.

Yes. Asana Inc. is a US based company and data is primarily hosted on AWS infrastructure in the United States. International transfers are covered by Asana's DPA incorporating SCCs and Asana's certification under the EU US Data Privacy Framework. Enterprise customers can enable EU data residency, keeping data at rest in AWS Frankfurt data centers. Some processing operations and support activities may still involve US systems.

A DPIA is recommended when Asana is used to manage workflows containing personal data, such as HR processes, recruitment pipelines, customer relationship management, or any project involving sensitive personal data. The assessment should cover data categories stored in tasks and comments, international transfers to US infrastructure, connected third party integrations, and access control configurations across workspaces.

Execute Asana's DPA from the Trust page. Enable EU data residency if available. Configure workspace permissions and access controls. Establish data retention policies and regularly clean completed projects. Audit third party integrations for GDPR compliance. Deploy cookie consent for embedded Asana Forms. Train team members on data minimisation in task descriptions. Include Asana in your DPIA if it processes sensitive data.

Alternatives include OpenProject (open source, self hosted project management), Taiga (open source agile platform), Nextcloud Deck (self hosted Kanban boards), Vikunja (open source task management), and Cryptpad with Kanban (encrypted collaboration). For EU hosted SaaS alternatives, consider Hive or Teamwork. Each alternative should be evaluated for GDPR compliance, data processing agreements, and feature parity with your requirements.

If you embed Asana Forms on your website, document the cookies set by app.asana.com and any analytics domains. Specify whether each cookie is essential or requires consent. Describe the personal data collected through embedded forms. Reference Asana's role as data processor, the DPA with SCCs, and the EU US Data Privacy Framework certification. Provide instructions for managing consent and inform users about their data subject rights regarding form submissions.