Privacy FAQs

Terms and Agreements

• Terms of Service
• Product Terms
• Beta Terms
• Data Processing Addendum
• Creator Agreement

Privacy Resources

• Global Privacy Policy
• EU & Swiss Privacy Policy
• Cookie Policy
• Subprocessors
• Privacy FAQs

Policies

• Acceptable Use Policy
• Intellectual Property Policy
• Trademark Usage Policy

Webflow Privacy FAQs

Last modified date: October 7, 2024

Webflow is committed to providing you with the information you need to meet your data privacy obligations. Below you'll find resources related to our privacy practices and answers to frequently asked questions.

Disclaimer

These Privacy FAQs and resources are provided for informational purposes only. Its contents may be subject to change over time. The information contained herein does not modify existing contractual arrangements and should not be construed as legal advice.

Some background before we dive in

GDPR

On May 25, 2018, the European Union’s General Data Protection Regulation (GDPR) came into effect. The GDPR is a law designed to protect the privacy and security of personal data for individuals located in Europe.

The GDPR places certain obligations on companies (as well as other types of organizations) to protect the personal data of individuals located in Europe. These obligations notably include: security requirements, record keeping, and ensuring the protection of personal data that is transferred out of Europe. The GDPR also grants individuals in Europe certain rights concerning their personal data. Please see the “GDPR Rights” section below for more information on these rights.

Definitions

GDPR

Part of what makes the GDPR complicated is its use of legalese. To that end, we wanted to provide you with a list of the definitions and what they mean so you can better understand the GDPR as it relates to your use of Webflow’s services.

Controller means the entity that determines how and for what purposes personal data is processed.

• *Basically... A controller is the company (or organization) that gets to determine how and why your personal data is processed. Usually, but not always, a controller is the company or organization that you directly interact with and submit your data to. *

• *Example: You log in to Facebook and post a status. Facebook is your controller and can choose what they do with your personal data. Facebook explains what they do with your personal data in their privacy policy and terms of service. Europe, for the purposes of these FAQs, means countries where the GDPR is in effect. These countries include all countries that are part of the European Union (EU), Iceland, Liechtenstein, Norway, and the United Kingdom.

• Basically... The GDPR applies if personal data relates to an individual located in Europe. The GDPR applies based on where a person is located — not their nationality.

• *Example: The GDPR applies to a Canadian citizen located in Germany. The GDPR does not apply to a German citizen located in Canada. Personal data means any information relating to an identified or identifiable person.

• *Basically... If the piece of data can be traced back to a person, it counts as personal data. *

• Example: You submit your name along with your eye color to a website. Your name is personal data as well as your eye color when the two pieces are associated. If your name becomes permanently dissociated with your eye color, all a controller knows is that an anonymous user has, for instance, brown eyes. The eye color data is no longer personal data at that point.