Netlify Data Processing Agreement
Last Updated: June 9, 2026
This Data Processing Agreement (' DPA ') forms part of the Enterprise Master Subscription Agreement and the Self-Serve Subscription Agreement, as applicable, unless Customer has entered into a superseding written agreement with Netlify, in which case, it forms part of such written agreement (in either case, the ' Agreement ') to reflect the parties' agreement with regard to the Processing of Personal Data.
Customer enters into this DPA on behalf of itself and, to the extent required under Applicable Data Protection Laws (defined below), in the name and on behalf of its Affiliates (defined below). For the purposes of this DPA only, and except where indicated otherwise, the term ' Customer ', shall include Customer and its Affiliates. All capitalized terms not defined herein shall have the meaning set forth in the Agreement.
In the course of providing the Services under the Agreement, Netlify may Process certain Customer Data (such terms defined below) on behalf of Customer and where Netlify Processes such Customer Data on behalf of Customer the Parties agree to comply with the terms and conditions in this DPA in connection with the processing of such Customer Data, each acting reasonably and in good faith.
1 Definitions
- 1.1 ' Applicable Data Protection Laws ' means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states, Switzerland, the United Kingdom and the United States and its states, applicable to the Processing of Customer Data under the Agreement as amended from time to time.
- 1.2 ' Affiliate ' means any of Customer's Affiliate(s) which (a) is subject to the data protection laws and regulations of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom, and (b) is permitted to use the Services pursuant to the Agreement between Customer and Netlify.
- 1.3 'CCPA ' means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations, as amended by the California Privacy Rights Act of 2020, and any other legislative and/or regulatory amendments or successors thereto.
- 1.4 'Controller ' means the entity which determines the purposes and means of the Processing of Personal Data.
- 1.5 'Customer' means the entity that executed the Agreement together with its Affiliates (for so long as they remain Affiliates).
- 1.6 ' Customer Data ' means Personal Data that is described in Exhibit 1 and any other Personal Data that is Processed by Netlify pursuant to the Agreement and this DPA;
- 1.7 'Data Subjec t' means the identified or identifiable natural person to whom Personal Data relates.
- 1.8 'GDPR' means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), including as implemented or adopted under the laws of the UK.
- 1.9 ' Netlify Group ' means Netlify and any companies under the direct or indirect control of Netlify, Inc who are engaged in the Processing of Customer Data.
- 1.10 ' Personal Data ' means any information relating to: (i) an identified or identifiable natural person, and(ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under Applicable Data Protection Laws).