Data processing agreement (dpa) — Framer

Cited by

Facts read from this source

• DPA version Report an error

  “Version 2.0 — Effective June 16, 2026”

• Contracting entity Report an error

  “Framer B.V., a company incorporated and existing under the laws of the Netherlands and having its registered office at Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands”

• DPA GDPR basis Report an error

  “This DPA has been designed to ensure the Parties’ compliance with Article 28(3) of Regulation 2016/679”

• Subprocessor notice days Report an error

  “Framer shall inform the Customer in writing of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance.”

• Subprocessor termination right Report an error

  “If the Parties are unable to reach a mutually agreeable resolution, Customer, as its sole and exclusive remedy, may terminate the affected Service by providing 30 days’ written notice.”

• International transfer mechanisms Report an error

  “the transfer will be made pursuant to a valid transfer mechanism under Chapter V GDPR, namely (a) an adequacy decision under Article 45 GDPR, including the EU-US Data Privacy Framework where the recipient is certified under it; or (b) where no adequacy decision applies, the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 (the “SCCs”) or another appropriate safeguard under Article 46 GDPR.”

• Breach notification hours Report an error

  “Framer’s notification to the Customer shall take place within 72 hours after Framer has become aware of the personal data breach”

• Erasure on request Report an error

  “Upon written request, Framer shall be obliged to delete all personal data processed on behalf of the Customer in the performance of the Agreement”

• Retention duration Report an error

  “Framer will process personal data for the duration of the Agreement, after which the procedure as detailed in the relevant section of this DPA shall apply”

• DPA costs Report an error

  “The Customer shall be invoiced for any form of support or any other additional service Framer will be required to provide under this DPA or at the request of the Customer”

• DPA governing law Report an error

  “This DPA will be governed by and interpreted in accordance with Dutch law”

• Processing purposes Report an error

  “Provision of the Service. Framer may process Customer personal data to facilitate the Service, including providing Framer’s Platform, Framer Community and Framer ´matched´, and Spam and Abuse Protection Features (where enabled by Customer).”

• Categories processed Report an error

  “The processing of personal data will consist of all information necessary for the provision of the Service to the Customer.”

• Supervisory authority Report an error

  “The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is the competent supervisory authority.”

• Certifications Report an error

  “Framer is ISO 27001:2022 and SOC 2 Type 2 attested.”

• Encryption Report an error

  “Data in transit is protected using TLS (version 1.2 or higher) for all communications between clients, services, and third-party integrations: Data at rest is protected using AES with 256-bit keys, applied at the storage layer across databases, file and object storage, and backups.”

• Provider Report an error

  “Framer uses Amazon Web Services (“AWS”) for hosting its Service.”

• Availability Report an error

  “All Framer customer data is stored redundantly at multiple AWS data centers (availability zones) to ensure availability.”

• Aws segmentation Report an error

  “Framer achieves network segmentation boundaries at various layers of their cloud infrastructure by using a multi-account strategy within AWS to isolate production, development, and test environments”

• Scc modules Report an error

  “(a) Module Two (controller to processor) where Framer acts as importer of the Customer's personal data; (b) Module Three (processor to processor) where the Customer acts as a processor on behalf of its own controller(s); and (c) Module Four (processor to controller)”

• UK idta Report an error

  “the International Data Transfer Addendum issued by the UK Information Commissioner's Office (version B1.0) applies to that transfer with England and Wales as the governing law and forum”

• Employees confidentiality Report an error

  “Framer shall only grant access to the personal data being processed on behalf of the Customer to persons under Framer’s authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and only on a need-to-know basis.”

4 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Data Protection Officer European sovereignty
• The Freelance Web Designer Imprint, privacy & cookie compliance
• The Freelance Web Designer European sovereignty
• The Marketing Lead Imprint, privacy & cookie compliance
• The Marketing Lead European sovereignty
• The Practice Owner Imprint, privacy & cookie compliance
• The Practice Owner European sovereignty
• The Skeptic Imprint, privacy & cookie compliance
• The Skeptic European sovereignty
• The Small-Business Owner Imprint, privacy & cookie compliance
• The Small-Business Owner European sovereignty