Webflow, Inc.

United States

Webflow will retain Personal Information we process on your behalf for as long as necessary to provide the Platform to you, subject to our compliance with this Policy, or as required or permitted under applicable law. We may further retain and processPersonal Information as necessary to comply with our legal obligations; maintain accurate accounting, financial, and other operational records; resolve disputes; and enforce our agreements. We have established internal policies for the deletion of Personal Information following the termination of your Account.

Customers may update, delete, or change your Personal Information you have provided Webflow by logging in to the Platform and providing such additional information or deleting such information where applicable. If you are not a Customer and would like to gain access to, or request deletion of, information we have collected, please contact us at contact@webflow.com. We will provide a response in accordance with applicable. For the avoidance of doubt, Webflow has no direct relationship with your End Users Any such End Users seeking access to, or who would like to correct, amend, or delete data which may be stored on the Platform should direct their request to you, the Customer. If Webflow receives a request from your End User we will inform you in a commercially reasonable amount of time.

Where does Webflow store personal data? Webflow stores its Customers' and Customers' End Users' data in the United States, where Webflow is based. Webflow also utilizes a number of processors based in the United States to provide our services ("Subprocessors''). To find a full list of Subprocessors and the countries in which they are located, please visit Webflow's Subprocessors page. ‍ How does Webflow legally process and transfer data out of Europe for its European Customers? Webflow is certified under the EU–U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework. Additionally our DPA contractual clauses as its transfer mechanism to export data from Europe. Webflow's Data Processing Addendum includes the EU Standard Contractual Clauses, the UK's International Data Transfer Agreement and includes the contractual requirements placed on processors under the GDPR. Our Data Processing Agreement is available to all customers regardless of their plan selection and incorporated by reference in our Terms of Service by default. ‍ How does Webflow protect the personal data it sends to subprocessors? Webflow vets our new Subprocessors that access personal data before engagement to check that the necessary security and privacy controls are in place. Webflow also monitors our existing Subprocessors on an ongoing basis. How does Webflow secure the data it stores? Webflow is committed to ensuring our infrastructure is secure, redundant, and reliable. We encrypt data in transit and at rest. Webflow has a SOC 2 certification and is dedicated to the continued validation of its security program. To learn more about our security program please check out our security center. Where does Webflow store personal data? Webflow stores its Customers’ and Customers’ End Users’ data in the United States, where Webflow is based. Webflow also utilizes a number of processors based in the United States to provide our services (“Subprocessors''). To find a full list of Subprocessors and the countries in which they are located, please visit Webflow’s Subprocessors page. ‍ How does Webflow legally process and transfer data out of Europe for its European Customers? Webflow is certified under the EU–U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework. Additionally our DPA contractual clauses as its transfer mechanism to export data from Europe. Webflow’s Data Processing Addendum includes the EU Standard Contractual Clauses, the UK’s International Data Transfer Agreement and includes the contractual requirements placed on processors under the GDPR. Our Data Processing Agreement is available to all customers regardless of their plan selection and incorporated by reference in our Terms of Service by default. ‍ How does Webflow protect the personal data it sends to subprocessors? Webflow vets our new Subprocessors that access personal data before engagement to check that the necessary security and privacy controls are in place. Webflow also monitors our existing Subprocessors on an ongoing basis. Security How does Webflow secure the data it stores? Webflow is committed to ensuring our infrastructure is secure, redundant, and reliable. We encrypt data in transit and at rest. Webflow has a SOC 2 certification and is dedicated to the continued validation of its security program. To learn more about our security program please check out our security center.

yes

no

no

yes

yes

security-bug-reports@webflow.com

yes

no

yes

no

no