Figma Legal
The information provided here is for Figma customers and users who have questions about our terms, policies, intellectual property, and compliance.
Data Processing Addendum
This Data Processing Addendum, including its Exhibits, (“Addendum”) supplements and is subject to the terms of the agreement between Figma, Inc. (“Figma”) and Customer governing Figma’s provision of the Figma Platform to the Customer (the “Agreement”), including the limitations of liability set forth in the Agreement, which shall apply in aggregate for all claims under the Agreement and this Addendum (including for Authorized Affiliates) and shall not be understood to apply individually and severally to Customer and/or to any Authorized Affiliate that is a contractual party to any such Addendum. Each reference to the Addendum herein means this Addendum including its exhibits. Any capitalized term not defined herein shall have the meaning given to it in the Agreement. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Agreement, this Addendum shall control.
1. Subject Matter, Duration & Customer Parties.
**(a) Subject Matter. **This Addendum reflects the parties’ commitment to abide by applicable Data Protection Laws when Processing Customer Personal Data pursuant to the Agreement. In providing the Figma Platform to the Customer pursuant to the terms of the Agreement, Figma may Process Personal Data on behalf of Customer and the parties agree to comply with the terms of this Addendum with respect to any such Personal Data.
**(b) Duration and Survival. **This Addendum will become legally binding upon the date that the parties sign this Addendum. This Addendum will terminate automatically upon termination of the Agreement, or as earlier terminated pursuant to the terms of the Addendum.
**(c) Customer Parties. **The Customer is entering this Addendum on behalf of itself and to the extent required under applicable Data Protection Laws, in the name of or on behalf of its Authorized Affiliates.
2. Definitions
For the purposes of this Addendum, the following terms and those defined within the body of this Addendum apply.
“Affiliate” means, with respect to any entity, any other entity that, directly or indirectly through one or more intermediaries, controls, is controlled by, or under common control with such entity. As used in this definition, “control” (including, with correlative meanings, “controlled by” or “under common control with”) means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of such entity, whether through ownership of voting securities, by contract or otherwise.
“**Authorized Affiliate” **means any of Customer's Affiliate(s) which: (i) (a) is subject to the Data Protection Laws; and (b) is permitted to use the Figma Platform pursuant to the Agreement between Customer and Figma but has not signed its own Order Form with Figma and is not a "Customer" as defined under the Agreement; and (ii) if and to the extent Figma processes Personal Data for which such Affiliate(s) qualify as the Controller (as defined under applicable Data Protection Laws).
“Customer Personal Data” means Personal Data pertaining to logged-in Customer’s Authorized Users of the Figma Platform Processed by Figma on behalf of Customer (or an Authorized Affiliate) under the Agreement.
“Data Protection Laws” means all data privacy, data protection, and cybersecurity laws, rules and regulations of the United States, the European Union, and the United Kingdom, and similar national laws of Switzerland and Brazil, to which the Customer Personal Data are subject. “Data Protection Laws” shall include, but not be limited to, the California Consumer Privacy Act of 2018 (“CCPA”), the California Privacy Rights Act (“CPRA”), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Virginia Consumer Data Protection Act, and the EU General Data Protection Regulation 2016/679 (“GDPR”) the Swiss Federal Act on Data Protection (“Swiss FADP”), and the Brazilian General Data Protection Law n. 13,709/2018 (“LGPD”) that are applicable to the Processing of Personal Data under the Agreement.