Vendor-statedIntercom and GDPR
Intercom states it holds a data processing agreement. CertReports captured this on 17 Sep 2026 from its trust centre (Vanta); it is a vendor statement, not an independent confirmation.
Evidence
- Kind
- listing
- Issued or listed
- 13 Oct 2016
- Expires or valid through
- 14 Nov 2026
- Scope
- Intercom processes HR data (candidate and employee data) as well as the data of individuals who contact or interact with Intercom. The data processed includes personal data and, in some cases, sensitive data. The data is collected from the data subject and, in some cases, from third parties. Candidate data is mainly processed to assess suitability during the recruitment process, while employee data is processed to fulfill the employment contract and for other purposes, such as complying with Intercom’s legal obligations. The data of individuals who interact with Intercom is primarily processed to provide and improve the Intercom services, communicate with them, manage security, send marketing communications, and comply with legal requirements. Data may be collected directly or from third parties. It is shared with Intercom Group companies, service providers, and our professional advisors. Data is retained only for as long as necessary to fulfill the purpose for which it was collected, after which it is securely deleted.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Intercom, Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 8a163bd0c0 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Intercom GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 17 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Customer support category) whose GDPR row is verified or vendor-stated, ranked by similarity.
No Customer support vendor has GDPR evidence in the index yet.