Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Contentful
GDPR evidence
Contentful is a German-American headless content management system (CMS), founded in 2013 in Berlin, Germany, by Sascha Konietzke and Paolo
Vendor-statedContentful and GDPR
Contentful states it holds a data processing agreement. CertReports captured this on 21 Sep 2026 from its trust centre (Vanta); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 21 Sep 2026 · confidence 90%VerifiedActive: EU-US Certification, SW-US Certification, UK Extension Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 6 Sep 2024
- Expires or valid through
- 30 Jul 2027
- Scope
- Contentful collects personal data directly from individuals provide to Contentful when they use the Contentful services. This could be information they provide when they set up an account on the Contentful services, or correspond with us via customer support tools, by e-mail or otherwise. 1. In relation to personal data that Contentful collects directly from individuals, the following personal data is processed: (a) Contact and registration information. First name, last name, professional details (company, job title and function), email address, username, and password. (b) Payment information. Credit or debit card details and information on the transaction, such as the services purchased and date and time of the transaction. (c) Correspondence, interactions and event recordings. Emails and customer support messages with individuals, responses from individuals to customer surveys, registrations for Contentful events and trainings or visits to Contentful premises, and photos, videos, and audio recordings at Contentful events. (d) Your preferences. Preferences set for notifications, marketing communications, how the Contentful services and website are configured or displayed. Contentful also collects personal data that individuals provide via our website, for example, when they fill in a form, subscribe to our mailing lists, newsletters or other forms of marketing communications, or use some other feature of our website. In addition, Contentful may collect personal data from individuals when they register for or attend events and interact with us in person. 2. In relation to personal data that Contentful collects automatically from individuals using the Contentful services or website, the following personal data is processed: (a) Information about the way individuals access and use the Contentful services and websites. Information about when and how frequently individuals access the Contentful services, how long individuals use it for, approximate location from which individuals access it, whether individuals access the Contentful services from multiple devices, and other actions individuals take in connection with and about how they use the Contentful services. Information about how individuals use the Contentful website, such as the site from which individuals came, the pages individuals visit on the website, the links individuals click, whether individuals open emails or click the links contained in emails, whether individuals access the website from multiple devices, and other actions individuals take. (b) Identifiers and other information about individuals’ device and its software. In relation to the Contentful website, for example, we collect information such as IP address, hostname of device, browser type, Internet service provider, device type / model / manufacturer, operating system, date and time of server request, and other such information. In relation to the Contentful services, for example, we also log certain user activity, including log-in time-stamps and actions taken in the Contentful services. We process this personal data for the following purposes: - To set up and authenticate the individual's account and operate, maintain and provide the features and functionality of the Contentful services; - To communicate directly with the individual to respond to their queries (for example, support requests) and to send service-related emails (for example, account verification, change or updates to features of the Contentful services, or technical and security notices). - To send you news, alerts, operational information and marketing communications in accordance with the individual's preferences; - To facilitate payment in order to operate, maintain and provide to you the features and functionality of the Contentful services; - To answer the individual's questions and concerns, obtain their insights and feedback, provide them with requested information and resolve their customer service issues. We also use their information to administer events and use audio visual recordings that you may appear in for promotional purposes; - To send the individual marketing and sales content in accordance with their marketing preferences. Contentful also collects personal data automatically, namely information about the way in which an individual uses the Contentful services and our website, and identifiers and other information about an individual's device and its software. We process this personal data to provide the features and functionality of the Contentful services and websites, to monitor and improve them and to develop new products and services. Contentful also processes personal data received from third parties in certain situations, for example, from trusted partners that we work with that improve an individual's experience of the Contentful services and website, marketing information that we receive from third parties we work with in the context of running events or promotions, or that we collect from publicly available sources online. We use personal data we receive from an individual's social media, or other third party accounts, to set up and authenticate their Contentful account and to operate, maintain and provide to you the features and functionality of the Contentful services (where that individual chooses to use a third party account to register or login to Contentful). We use marketing and sales generation information for marketing purposes, to assess whether an individual may be interested in the Contentful services, to contact them with marketing and promotional information and to conduct surveys and market research. We may disclose the above personal data with the following categories of third parties: - Service providers that perform services for us or on our behalf; - Third party applications including social media services, for example where an individual chooses to login or register using a third party application such as a social media provider; - Other companies within the Contentful group; - Third parties in the context of a corporate transaction; and - Law enforcement, regulators and other parties for legal reasons.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Contentful Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 30f4a850fa |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Contentful GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 19 Sep 2026First indexed by CertReports6 evidence rows across 6 frameworks entered the index.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Developer tools category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read