This Webflow Data Processing Addendum (this "DPA") forms part of, and is subject to the provisions of, the Agreement. This DPA will apply to the extent Customer is subject to relevant Data Protection Laws.
HI THERE
If you would like to execute a DocuSigned version of this Data Processing Addendum, please review and sign our pre-signed DPA here.
Capitalized terms that are used but not defined in this DPA have the meanings given to them in the Agreement.
1.1. “Affiliate” means an entity that directly or indirectly controls (e.g., subsidiary), is controlled by (e.g., parent), or is under common control with (e.g., sibling) such party; and the term “control” (including the terms “controlled by” and “under common control with”) means either: (a) ownership or control of more than 50% of the voting interests of the subject entity; or (b) the power to direct or cause the direction of the management and policies of an entity, whether through ownership, by contract, or otherwise.
1.2. “Agreement” means any subscription agreement governing Customer’s access to and use of the Platform, which may mean, as applicable, Webflow’s online Terms of Service (available at webflow.com/legal/terms), a Master Subscription Agreement, or other related Platform subscription agreement between Webflow and Customer.
1.3. “Authorized Affiliate” means Customer's Affiliate(s) which (a) are subject to Data Protection Laws; (b) are permitted to use the Platform pursuant to the Agreement between Customer and Webflow; and (c) have not signed their own Agreement with Webflow and are not "Customers" as defined under this DPA.
1.4. “Controller” means the entity that determines the purposes and means of the Processing of Personal Information.
1.5. “Customer” means the entity and the entity’s Authorized Affiliates that agree to be bound by the Agreement and this DPA.
1.6. “Customer Personal Information” means all Personal Information, excluding Customer Relationship Data, made available to Webflow by or on behalf of Customer.
1.7. “Customer Relationship Data” means Personal Information that relates to Customer’s relationship with Webflow, including the names or contact information of the business point(s) of contact between Customer and Webflow, individuals, Customer billing information, and customer relationship management information.
1.8. “Customer Workforce” means any Data Subjects who are employees, contractors, representatives, or other individuals engaged by Customer who have access to the Platform via a user account.
1.9. “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Information transmitted, stored, or otherwise Processed.
1.10. “Data Protection Laws” means all applicable laws and regulations applicable to Webflow’s processing of Personal Information under the Agreement.
1.11. “Data Subject” means an individual whose Personal Information is subject to Data Protection Laws.
1.12. “EEA” means the European Economic Area.
1.13. “End User” means any Data Subject accessing or otherwise using Website Content.
1.1. “EU Standard Contractual Clauses” or “EU SCCs” means the annex found in the European Commission decision of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (available as of August 1, 2021 at data.europa.eu/eli/dec_impl/2021/914/oj) and any amendments, replacements, or updated standard contractual clauses as recognized and approved by the European Commission from time to time.
1.2. “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
1.3. “Personal Information” means any information relating to a Data Subject.
1.4. “Platform” means the access to Webflow’s software-as-a-service platform and the related web design technology products and services as subscribed to by Customer.
1.5. “Processing” means any operation or set of operations which is performed upon Personal Information, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
1.6. “Processor” means the entity which Processes Personal Information on behalf of the Controller.
1.7. “Regulator” means any supervisory authority with authority under Data Protection Laws over all or any part of the provision or receipt of the Platform or the Processing of Personal Information.
1.8. “Subprocessor” means any Processor engaged by Webflow to Process Customer Personal Information on behalf of Webflow.
1.9. “UK International Data Transfer Agreement” means the addendum Version B1.0, issued by the UK Information Commissioner’s Office (“ICO”), under section 119A ( 1 ) of the Data Protection Act 2018, in force from 21 March 2022.
1.10. “Website Content” means any content that Customer submits, posts, displays, or otherwise makes available on or via the Platform.
2.1. Webflow as a Processor. The Parties hereby agree that with regard to the processing of Customer Personal Information, Customer may act either as a Controller or Processor and Webflow is a Processor for all Customer Personal Information except for Customer Relationship Data as set forth in Section 2.2 (Webflow as a Controller of Customer Relationship Data). Webflow will process Customer Personal Information in accordance with Customer’s instructions as set forth in Section 3.1 (Instructions).
2.2. Webflow as a Controller of Customer Relationship Data. The parties hereby agree that, with regard to the processing of Customer Relationship Data, Webflow is an independent Controller, not a joint Controller with Customer. Webflow will process Customer Relationship Data as a Controller: (a) to manage the relationship with Customer; (b) to carry out Webflow’s core business operations, such as accounting and filing taxes; (c) to detect, prevent, or investigate Data Breaches, fraud, and other abuse or misuse of the Platform; (d) to comply with applicable law; and (e) as otherwise permitted under Data Protection Law and in accordance with this DPA, the Agreement, and Webflow’s Privacy Policy.
3.1. Instructions. Customer instructs Webflow, when acting as a Processor, to Process Customer Personal Information to provide the Platform. Customer warrants that the instructions it provides to Webflow pursuant to this DPA will comply with Data Protection Laws.
3.2. Data Subject and Regulator Requests. Customer shall be responsible for communications and leading any efforts to comply with all requests made by Data Subjects under Data Protection Laws and all communications from Regulators that relate to Customer Personal Information, in accordance with Data Protection Laws. To the extent such requests or communications require Webflow’s assistance, Customer shall immediately notify Webflow in writing of the Data Subject’s or Regulator’s request.
3.3. Notice, Consent, and Other Authorizations. Customer agrees that the Personal Information it collects shall be in accordance with Data Protection Laws, including all legally required consents, bases of processing, approvals, and authorizations. Upon Webflow’s request, Customer shall provide all information necessary to demonstrate compliance with these requirements.
4.1. Scope of Processing and Customer Instructions. Webflow will Process the Personal Information on documented instructions from Customer in such a manner as is necessary for the provision of the Platform under the Agreement, except as may be required to comply with any legal obligation to which Webflow is subject.
4.2. Lawfulness of Instructions. Webflow shall immediately inform Customer if, in its opinion, the execution of an instruction could infringe on any Data Protection Laws. In the event Webflow must Process or cease Processing Personal Information for the purpose of complying with a legal obligation, Webflow will inform the Customer of that legal requirement before Processing or ceasing to Process, unless prohibited by applicable law.
4.3. Webflow Personnel Confidentiality Obligations. Webflow will grant access to Customer Personal Information to its personnel only to the extent strictly necessary for implementing, managing and monitoring the Platform. Webflow shall ensure that personnel authorized to Process Customer Personal Information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
4.4. Fulfillment of Data Subject Requests. Webflow shall promptly notify Customer of any request it has received from a Data Subject. Webflow shall not respond to the request itself, unless authorized to do so by Customer. Webflow shall provide reasonable assistance to Customer in fulfilling its obligations to respond to Data Subject requests to exercise their rights under Data Protection Laws.
4.5. Security of Processing. Webflow shall implement appropriate technical and organizational measures to ensure the security of Personal Information including protection against a Data Breach. In complying with its obligations under this paragraph, Webflow shall implement the technical and organizational measures specified in Schedule 2.
4.6. Data Breach Notification. Webflow shall notify Customer without undue delay in the event of a confirmed Data Breach.
4.7. GDPR Articles 32-36. Taking into account the nature of the Processing and the information available to Webflow, Webflow will provide reasonable assistance to Customer in complying with its obligations under GDPR Articles 32-36, which address obligations with regard to security, breach notifications, data protection impact assessments, and prior consultation.
4.8. Deletion or Return of Personal Information. Following termination of the Agreement, Webflow shall, at the choice of Customer, delete or return all Customer Personal Information Processed on its behalf unless such continued processing is otherwise required by applicable law.
4.9. Compliance Documentation. Webflow shall make available to Customer all information necessary to demonstrate compliance with GDPR. At Customer’s request, Webflow shall also permit and contribute to audits in the manner prescribed in Section 6 of this DPA (Audit).
4.10. Disclosure to Third Parties. Except as expressly provided in this DPA, Webflow will not disclose Customer Personal Information to any third party without Customer’s consent. If requested or required by a competent governmental authority to disclose Customer Personal Information, to the extent legally permissible and practicable, Webflow will provide Customer with sufficient prior written notice in order to permit Customer the opportunity to oppose any such disclosure.
5.1. New Subprocessors. Customer hereby agrees and gives its general authorization for Webflow, when acting as a Processor, to engage new Subprocessors in connection with the processing of Customer Personal Information. A list of Webflow’s current Subprocessors is located at webflow.com/legal/subprocessors. Customer must sign up at the aforementioned URL to receive email notifications concerning the addition of new Subprocessors. Customer may reasonably object to the addition of any new Subprocessor within fifteen (15) calendar days of receiving such email notification, in which case Webflow will use reasonable efforts to make a change in the Platform or recommend a commercially reasonable change to avoid Processing by such Subprocessor. If Webflow is unable to provide an alternative, Customer may terminate subscription to the Platform and shall pay Webflow any fees or expenses not yet paid for all services provided pursuant to any Agreement. If Customer fails to sign up for these email notifications, Customer shall be deemed to have waived its right to object to the newly added Subprocessor(s).
5.2. Responsibility for Subprocessors. Webflow shall impose the same material data protection obligations as set out in this DPA on its Subprocessors. Where a Subprocessor fails to fulfill its data protection obligations, Webflow shall be liable for the Subprocessor’s failure to fulfill its data protection obligations.
6.1. Scope. Webflow will maintain records of its Processing activities carried out on behalf of Customer and will make available to Customer the information reasonably necessary to demonstrate its compliance with the obligations set out in this DPA. Webflow may limit the scope of information made available to Customer if Customer is a Webflow competitor, provided that such limitation does not violate Data Protection Laws. Customer’s inspection rights under this DPA do not extend to Webflow’s employee payroll, personnel records or any portions of its sites, books, documents, records, or other information that do not relate to the Platform or to the extent they pertain to third parties.
6.2. Process. Subject to thirty (30) days’ prior written notice from Customer and at Customer's additional expense (including all reasonable costs and fees for any and all time Webflow expends on such audit, in addition to the rates for services performed by Webflow), Webflow and Customer shall mutually agree to appoint a third-party auditor to verify that Webflow is in compliance with the obligations under this DPA. In no event shall the Parties agree to a third-party auditor that is a competitor to Webflow. Audits and inspections will be carried out at mutually agreed times during regular business hours. Customer shall be entitled to exercise this audit right no more than once every twelve (12) months. Customer shall not be entitled to an on-site audit of Webflow’s premises unless legally required by a Regulator.
6.3. Confidentiality. All information obtained during any such request for information or audit will be considered Webflow’s Confidential Information under the Agreement and this DPA. The results of the inspection and all information reviewed during such inspection will be deemed Webflow’s Confidential Information. The third-party auditor may only disclose to Customer specific violations of this DPA, if any, and the basis for such findings, and shall not disclose any of the records or information reviewed during the inspection.
To the extent Customer’s use of the Platform requires an onward transfer mechanism to lawfully transfer Personal Information from the European Economic Area, the United Kingdom, or Switzerland to a country or territory which has not been formally recognized by the European Commission or applicable government(s) or Regulator(s) as affording the Personal Information an adequate level of protection, Customer hereby acknowledges, agrees, and instructs Webflow to transfer Customer Personal Information as set forth in Schedule 3 (Cross Border Transfers) of this DPA.
If Schedule 3 applies to Customer’s use of the Platform, then, if applicable, under the order of precedence, by entering into this DPA, the Parties are deemed to be signing such EU Standard Contractual Clauses, including each of its applicable Annexes, or the UK International Data Transfer Agreement, as applicable.
To the extent Webflow processes Customer Personal Information originating from and protected by Data Protection Laws in one of the jurisdictions listed in Schedule 5 (Jurisdiction Specific Terms), the terms specified in Schedule 5, with respect to the applicable jurisdiction(s), will also apply.
Termination or expiration of this DPA shall not discharge the Parties from their obligations that by their nature may reasonably be deemed to survive the termination or expiration of this DPA.
This DPA shall be subject to the limitations of liability agreed between Customer and Webflow in the Agreement and such limitation shall apply in aggregate for all claims under the Agreement and DPA.
Any provision of this DPA that is prohibited or unenforceable in any jurisdiction shall, as to such jurisdiction, be ineffective to the extent of such prohibition or unenforceability without invaliding the remaining provisions hereof, and any such prohibition or unenforceability in any jurisdiction shall not invalidate or render unenforceable such provision in any other jurisdiction. The Parties will attempt in good faith to agree upon a valid and enforceable provision that is a reasonable substitute and shall incorporate such substitute provision into this DPA.
Webflow reserves the right to modify, update, or change this DPA from time to time in the usual course of business, so we encourage you to review this page periodically. Notwithstanding, when we change this DPA in a material manner, we will update the effective date at the top of this page and provide you with reasonable advance notice before the updates to this DPA become effective. Webflow may provide such notifications to you via email notice, written or hard copy notice, and/or through posting of such notice on the Platform. We reserve the right to determine the form and means of providing notifications to you. You may be required to click-to-accept or otherwise agree to the updated DPA, but in any event your continued use or access of the Platform after the effective date of the updated DPA shall constitute your agreement to the updated DPA. The DPA will be effective as of the date specified in the effective date at the top of this page, and will apply to your use of the Platform from that point forward. If we update this DPA in a non-material manner after the effective date, we will update the last modified date at the top of this page. Webflow is not responsible for any automatic filtering you or your network provider may apply to email notifications we send to the email address you provide us.
SCHEDULE 1
Data exporter:
Name: Customer, user of the Platform.
Contact Details: Specified in the signature block above.
Activities relevant to the data transfer: Use of the Platform.
Role: Controller and/or Processor depending on the type of processing as set forth below.
Data importer:
Name: Webflow, Inc., provider of the Platform.
Contact Details: 398 11th St., Floor 2, San Francisco, CA 94103.
Activities relevant to the data transfer: Provisioning of the Platform.
Role: Controller and/or Processor depending on the type of processing as set forth below.
Categories of data subjects whose personal data is transferred:
Module One (Controller to Controller):
Module Two (Controller to Processor) and Module Three (Processor to Processor):
Categories of personal data transferred:
Module One (Controller to Controller):
Module Two (Controller to Processor) and Module Three (Processor to Processor):
Sensitive data transferred (if applicable):
Module One (Controller to Controller):
Module Two (Controller to Processor) and Module Three (Processor to Processor):
Frequency of the transfer:
Module One (Controller to Controller), Module Two (Controller to Processor), and Module Three (Processor to Processor):
Purposes of the data transfer and further processing:
Module One (Controller to Controller), Module Two (Controller to Processor), and Module Three (Processor to Processor):
The period for which the personal data will be retained:
Module One (Controller to Controller):
Module Two (Controller to Processor), and Module Three (Processor to Processor):
Subject matter, nature, and duration of the processing by sub-processors:
Module One (Controller to Controller), Module Two (Controller to Processor), and Module Three (Processor to Processor):
Module One (Controller to Controller), Module Two (Controller to Processor), and Module Three (Processor to Processor):
SCHEDULE 2
Webflow has a SOC 2 Type II certification and is dedicated to the continued validation of its security program. Specifically, Webflow implements the following security measures with respect to Personal Information:
SCHEDULE 3
1.1 Order of Precedence. In the event the Platform is covered by more than one Transfer Mechanism, the transfer of Personal Information will be subject to a single Transfer Mechanism in accordance with the following order of precedence: (a) the EU-U.S. and Swiss-U.S. Data Privacy Framework as well as the UK Extension to the EU-U.S. Data Privacy Framework and any valid successors thereto, provided Webflow is certified under the relevant framework; (b) the EU Standard Contractual Clauses as set forth in Section 1.2 (EU Standard Contractual Clauses) of this Schedule 3; (c) the UK International Data Transfer Agreement as set forth in Section 1.3 (UK International Data Transfer Agreement) of this Schedule 3; (d) Swiss Transfers as set forth in Section 1.4 (Swiss Transfers) of this Schedule 3; and, if neither (a) nor (b) nor (c) nor (d) is applicable, then (e) other applicable data Transfer Mechanisms permitted under Data Protection Law.
1.2 EU Standard Contractual Clauses. The parties agree that the EU Standard Contractual Clauses will apply to Personal Information that is transferred via the Platform from the EEA or Switzerland, either directly or via onward transfer, to any country or recipient outside the EEA or Switzerland that is: (a) not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for Personal Information. For data transfers from the EEA that are subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows:
(a) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where Webflow is processing Customer Relationship Data;
(b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Controller of Customer Personal Information and Webflow is processing Customer Personal Information;
(c) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer is a Processor of Customer Personal Information and Webflow is processing Customer Personal Information;
(d) For each Module, where applicable:
(e) Schedule 1 of this DPA serves as Annex I of the EU Standard Contractual Clauses;
(f) Schedule 2 (Technical and Organizational Security Measures) of this DPA serves as Annex II of the EU Standard Contractual Clauses.
1.3 UK International Data Transfer Agreement. The parties agree that the UK International Data Transfer Agreement will apply to Personal Information that is transferred via the Platform from the United Kingdom, either directly or via onward transfer, to any country or recipient outside of the United Kingdom that is: (a) not recognized by the competent United Kingdom Regulator or governmental body for the United Kingdom as providing an adequate level of protection for Personal Information. For data transfers from the United Kingdom that are subject to the UK International Data Transfer Agreement, the UK International Data Transfer Agreement will be deemed entered into (and incorporated into this DPA by this reference) and completed as set forth in Schedule 4.
1.4 Swiss Transfers. Where Personal Information that is transferred via the Platform from Switzerland, either directly or via onward transfer, to any country or recipient outside Switzerland that is not recognized by the Swiss Federal Act on Data Protection (“FADP”) as providing an adequate level of protection for Personal Information, the following applies:
The EU Standard Contractual Clauses apply as set forth in Section 1.2 (EU Standard Contractual Clauses) of this Schedule 3 with the following modifications:
SCHEDULE 4
If applicable, this UK International Data Transfer Agreement has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.