How does Webflow handle site visitors and form submissions in regards to GDPR compliance?

Webflow helps users maintain GDPR compliance, but it's your responsibility to implement and manage GDPR-compliant practices on your site. Here's how Webflow handles key factors like site visitors and form submissions under GDPR.

1. Form Submission Handling

• Form data is processed by Webflow when users submit forms on your site.
• Submission data is stored on Webflow’s servers, located in the United States, unless you use an external integration (like a third-party CRM).
• Webflow retains submission data in your Project Settings > Forms tab.
• You can export, delete, or manage form data to comply with data subject access and deletion requests.
• To be GDPR-compliant, you must:
• Add consent checkboxes to all forms that collect personal data.
• Clearly state how the data will be used and stored.
• Avoid collecting unnecessary personal data.

2. Cookies and Site Visitor Tracking

• Webflow sites include cookies when using features like Google Analytics or embeds that track users.
• Webflow itself does not install tracking cookies by default unless you're using integrated features like Webflow Analytics or third-party scripts.
• For GDPR compliance:
• Implement a cookie consent banner on your site, preferably with opt-in functionality.
• Only load non-essential cookies (like tracking) after consent.
• Use cookie management tools like Finsweet Cookie Consent or integrate with services like Cookiebot.

3. Data Processing Agreement (DPA)

• Webflow offers a Data Processing Addendum (DPA), which includes standard contractual clauses and outlines Webflow’s data handling responsibilities.
• To access and accept the DPA:
• Go to your Account Settings > Privacy tab.
• Download, review, and electronically sign the DPA.

4. Third-Party Services and GDPR

• If you integrate with services like Mailchimp, Google Fonts, or Facebook Pixel, ensure those third parties are GDPR-compliant.
• Always disclose third-party data sharing in your privacy policy.
• Control the loading of third-party scripts based on user consent.

5. User Rights and Request Handling

• You are responsible for responding to requests like Right to Access, Right to Erasure, or Data Portability.
• Webflow allows you to view and delete form submission data easily to comply with such requests.
• If you use CMS Users (e.g., for membership sites), manage personal data through the CMS Collections and Users tab.

Summary

Webflow offers tools and infrastructure that support GDPR compliance, such as form data control and a Data Processing Agreement. However, to be GDPR-compliant, you must implement proper consent mechanisms, data handling policies, and disclosure practices within your site.