Imprint, privacy & cookie compliance — found from sitemap — Framer

Cited by

Facts read from this source

• Entity Report an error

  “Framer B.V., a company incorporated and existing under the laws of the Netherlands and having its registered office at Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands”

• DPA version Report an error

  “Version 2.0 — Effective Jun 16, 2026”

• DPA GDPR article28 Report an error

  “This DPA has been designed to ensure the Parties’ compliance with Article 28(3) of Regulation 2016/679”

• Governing law Report an error

  “This DPA will be governed by and interpreted in accordance with Dutch law without regard to international law regulations or principles of law leading to the application of other laws. The competent courts of Amsterdam, the Netherlands, will have exclusive jurisdiction”

• Certifications Report an error

  “Framer is ISO 27001:2022 and SOC 2 Type 2 attested.”

• Notification period Report an error

  “Framer shall inform the Customer in writing of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance.”

• List location Report an error

  “Framer will maintain an up-to-date list of its sub-processors, as specified within its Trust Center.”

• Objection remedy Report an error

  “If the Parties are unable to reach a mutually agreeable resolution, Customer, as its sole and exclusive remedy, may terminate the affected Service by providing 30 days’ written notice.”

• Transfer mechanisms Report an error

  “namely (a) an adequacy decision under Article 45 GDPR, including the EU-US Data Privacy Framework where the recipient is certified under it; or (b) where no adequacy decision applies, the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 (the “SCCs”)”

• UK idta Report an error

  “the International Data Transfer Addendum issued by the UK Information Commissioner's Office (version B1.0) applies to that transfer with England and Wales as the governing law and forum”

• Breach notification Report an error

  “Framer’s notification to the Customer shall take place within 72 hours after Framer has become aware of the personal data breach”

• Erasure Report an error

  “Upon written request, Framer shall be obliged to delete all personal data processed on behalf of the Customer in the performance of the Agreement, unless (i) EU or Member State law requires storage of the personal data, (ii) the data is retained in back-ups in which the data is not separately accessible, or (iii) the Customer has modified its choice under article 28(3)(g) of the GDPR.”

• Retention Report an error

  “Framer will process personal data for the duration of the Agreement, after which the procedure as detailed in the relevant section of this DPA shall apply, unless otherwise agreed upon in writing by Parties.”

• Audit report Report an error

  “Upon Customer’s written request during the term of the Agreement, Framer shall supply a summary copy of its audit report(s) (“Report”) to Customer, subject to the non-disclosure section of the Agreement”

• Information questionnaires Report an error

  “including responses to information security and audit questionnaires that are necessary to confirm Framer’s compliance with this DPA, provided that Customer shall not exercise this right more than once per year.”

• CCPA Report an error

  “This section 17 applies only to the extent Framer processes personal information that is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020”

• Security measures annex Report an error

  “Annex II contains the minimum security measures to be implemented by Framer.”

• Provider Report an error

  “Framer uses Amazon Web Services (“AWS”) for hosting its Service.”

• Encryption transit Report an error

  “Data in transit is protected using TLS (version 1.2 or higher) for all communications between clients, services, and third-party integrations”

• Encryption rest Report an error

  “Data at rest is protected using AES with 256-bit keys, applied at the storage layer across databases, file and object storage, and backups.”

• Availability Report an error

  “All Framer customer data is stored redundantly at multiple AWS data centers (availability zones) to ensure availability.”

• Backups Report an error

  “Backups of Framer’s databases are continuous (point-in-time) and stored off-site; The restoration of backups are tested and verified every 30 days;”

• Access control Report an error

  “Individual, identifiable and role-based user account assignment; Two factor authentication; Access to Framer customer data is provided on an explicit need-to-know basis and follows the principle of least privilege;”

• Siem Report an error

  “Logs are collected centrally and ingested into our SIEM for monitoring, alerting, and investigation in the event of misuse or a security incident;”

• SSO Report an error

  “Remote access to internal systems is managed through SSO via Google Workspace, with multi-factor authentication enforced for all users;”

• DPA cost Report an error

  “The Customer shall be invoiced for any form of support or any other additional service Framer will be required to provide under this DPA or at the request of the Customer, including requests for assistance in line with section 5.3 and section 8 of this DPA.”

• Types Report an error

  “Full name Job title Initials Business department Date of birth Company name Gender Framer/Project ID City/country of residence Device ID Address IP address (Business) email address Location data (Business) telephone number Personal data of End Users”

• Service scope Report an error

  “Framer’s processing of personal data on behalf of Customer shall mainly pertain to the Service described below: Provision of the Service. Framer may process Customer personal data to facilitate the Service, including providing Framer’s Platform, Framer Community and Framer ´matched´, and Spam and Abuse Protection Features (where enabled by Customer).”

• Scc modules Report an error

  “(a) Module Two (controller to processor) where Framer acts as importer of the Customer's personal data; (b) Module Three (processor to processor) where the Customer acts as a processor on behalf of its own controller(s); and (c) Module Four (processor to controller) where Framer exports personal data to the Customer as a controller located outside the EEA.”

• Scc governing law Report an error

  “under Clauses 17 and 18 the SCCs are governed by the laws of the Netherlands and subject to the jurisdiction of the courts of the Netherlands.”

• Authorisation Report an error

  “Framer has the Customer’s general authorisation for the engagement of sub-processors.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Data Protection Officer Hosting, domains & portability
• The Data Protection Officer Imprint, privacy & cookie compliance
• The Data Protection Officer European sovereignty
• The Freelance Web Designer Imprint, privacy & cookie compliance
• The Freelance Web Designer European sovereignty
• The Marketing Lead Imprint, privacy & cookie compliance
• The Marketing Lead European sovereignty
• The Practice Owner Hosting, domains & portability
• The Practice Owner European sovereignty
• The Skeptic Hosting, domains & portability
• The Skeptic Imprint, privacy & cookie compliance
• The Skeptic European sovereignty
• The Small-Business Owner Hosting, domains & portability
• The Small-Business Owner Imprint, privacy & cookie compliance
• The Small-Business Owner European sovereignty