Squarespace Privacy Policy

DATED 2020-08-20 · VERSION 20200901_rev01 · COMPARED WITH 20200801_rev01 · ARCHIVE SNAPSHOT

Full text changes — 20200801_rev01 to 20200901_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

+**Effective Date: July 7, 2020**
+**Effective Date: August 20, 2020**
 Thanks for visiting Squarespace! Squarespace ("Squarespace", "we", "us" or "our") respects your privacy. When it comes to your personal information, we believe in transparency, not surprises. That's why we've set out here what personal information we collect, what we do with it and your choices and rights.
 By using any of Squarespace's Services, you confirm you have agreed to the [Terms of Service](https://www.squarespace.com/terms-of-service) and read and understood this Privacy Policy and our [Cookie Policy](https://www.squarespace.com/cookie-policy).
 If you are in California, the "[California Residents]()" section below provides additional information in accordance with the CCPA.
     - To analyze and improve the safety and security of our Services - we do this as it is necessary to pursue our legitimate interests in ensuring Squarespace is secure, such as by implementing and enhancing security measures and protections and protecting against fraud, spam and abuse.
     - To provide and improve the Services, including any personalized services - we do this as it is necessary to pursue our legitimate interests of providing an innovative and tailored offering to our Users on a sustained basis.
     - To share your personal information with other Squarespace group companies that help us provide and improve the Services.
+    - To comply with a court order or binding law enforcement request.
     - To anonymize and subsequently use anonymized information.
 - **Protecting you and others**. To protect your vital interests, or those of others.
 - **Others' legitimate interests.** Where necessary for the purposes of a third party's legitimate interests, such as our partners who have a legitimate interest in delivering tailored advertising to you and monitoring and measuring its effectiveness or our Users who have a legitimate interest in having their sites function properly and securely and analyzing the usage of their sites so they can understand trends and improve their services.
 Personal information that you submit through the Services may be transferred to countries other than where you live, such as, for example, to our servers in the U.S. We also store personal information locally on the devices you use to access the Services.
 Your personal information may be transferred to countries that do not have the same data protection laws as the country in which you initially provided the information.
 We rely upon a number of means to transfer personal information which is subject to the European General Data Protection Regulation ("GDPR") in accordance with Chapter V of the GDPR. These include:
+- **Privacy Shield.** We transfer, in accordance with Article 45 of the GDPR, personal information to companies that have certified their compliance with the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks (each individually and jointly, the "Privacy Shield"), including Squarespace, Inc.
+- **Standard data protection clauses.** We transfer, in accordance with Article 46 of the GDPR, personal information to recipients that have entered into the European Commission approved contract for the transfer of personal data outside the European Economic Area.
+- **Standard data protection clauses.** We may, in accordance with Article 46 of the GDPR, transfer personal information to recipients that have entered into the European Commission approved contract for the transfer of personal data outside the European Economic Area.
+- **Other means**. We may, in accordance with Articles 45 and 46 of the GDPR, transfer personal information to recipients that are in a country the European Commission or a European data protection supervisory authority has confirmed, by decision, offers an adequate level of data protection, pursuant to an approved certification mechanism or code of conduct, together with binding, enforceable commitments from the recipient to apply the appropriate safeguards, including as regards data subjects' rights, or to processors which have committed to comply with binding corporate rules.
+- **Other means**. We may, in accordance with Articles 45 and 46 of the GDPR, transfer personal information to recipients that are in a country the European Commission or a European data protection supervisory authority has confirmed, by decision, offers an adequate level of data protection, pursuant to an approved certification mechanism or code of conduct, together with binding enforcement commitments from the recipient to apply the appropriate safeguards, including as regards data subjects' rights, or to processors which have committed to comply with binding corporate rules.
+You can find out more information about these transfer mechanisms [here](https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_en) or you can request a copy from us.
+You can find out more information about these transfer mechanisms [here](https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_en).
 **11\. Privacy Shield**
+Squarespace, Inc. has certified its compliance to the Privacy Shield.
+While Squarespace no longer relies upon the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks (each individually and jointly, the "Privacy Shield") to provide a legal basis for transfers to the US, Squarespace, Inc. has certified its compliance to the Privacy Shield, which continues to apply.
+Squarespace is committed to treating personal information received from the European Economic Area, Switzerland and the United Kingdom pursuant to the Privacy Shield Frameworks in accordance with the applicable Principles. You can find our certification [here](https://www.privacyshield.gov/participant) and you can learn more about the Frameworks and Principles by visiting [https://www.privacyshield.gov/](https://www.privacyshield.gov/).
+Squarespace is committed to treating personal information received from the European Economic Area, Switzerland and the United Kingdom pursuant to the Privacy Shield in accordance with the applicable Principles. You can find our certification [here](https://www.privacyshield.gov/participant) and you can learn more about the Privacy Shield and Principles by visiting [https://www.privacyshield.gov/](https://www.privacyshield.gov/).
+Our accountability for personal information we receive under the Privacy Shield and subsequently transfer to a third party is described in the Privacy Shield Principles. In particular, we may use third parties to process data on our behalf as described in this Privacy Policy, and we remain liable if they do so in a manner inconsistent with the Privacy Shield Principles, unless we prove that we are not responsible for the event giving rise to the damage.
+Our accountability for personal information we receive and subsequently transfer to a third party is described in the Privacy Shield Principles. In particular, we may use third parties to process data on our behalf as described in this Privacy Policy, and we remain liable if they do so in a manner inconsistent with the Privacy Shield Principles, unless we prove that we are not responsible for the event giving rise to the damage.
 If you have a question or complaint you believe to be within the scope of our Privacy Shield certification, please contact us first at [privacy@squarespace.com](mailto:privacy@squarespace.com), or using the contact details in the "How to contact us" section below. We'll respond within 45 days.
 For any complaints that we can't resolve directly, JAMS is the independent organization responsible for reviewing and resolving complaints about our Privacy Shield compliance. You can contact JAMS free of charge at [https://www.jamsadr.com/eu-us-privacy-shield](https://www.jamsadr.com/eu-us-privacy-shield). JAMS is an alternative dispute resolution provider based in the U.S.
 If your concern still isn't addressed by JAMS, you may be entitled to a binding arbitration under the Privacy Shield Principles. For purposes of enforcing compliance with the Privacy Shield, Squarespace, Inc. is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission.
+Nothing in Privacy Shield affects your rights as a data subject under any European Commission approved standard data protection clauses we use for transfers to the US.
 **12\. End Users' personal information**
 Our customers who have created a site using Squarespace are responsible for what they do with the personal information they collect, directly or through Squarespace, about their End Users. This Section 12 is directed to such customers.
 **a. Your relationship with End Users**