https://www.figma.com/legal/privacy-resources

·Privacy FAQ - Figma Platform This FAQ summarizes how Figma processes Personal Data when providing the Figma Platform.

·For full details, please refer to Figma's Privacy Policy and Data Processing Addendum. What data does Figma Process?

·Figma processes three main types of data:

11. Customer Content - Files, designs, whiteboards, comments, and other materials created or uploaded by Customers.

·Customer Content includes authorized user name and email email, optional photo, 2FA phone number (if enabled) and visitors to Figma Sites / Make. The Customer acts as the Controller of Personal Data contained in Customer Content and Figma acts as a Processor in accordance with the Data Processing Addendum.

·Figma does not use Customer Content to train generative AI models without Customer permission. For more information, see: https://www.figma.com/ai/our-approach/

22. Administrator Account Information - Contact details and billing information used to create and manage accounts, used for the specific and limited purposes set out in the Privacy Policy.

33. Usage Data - Limited information about the access, use, and performance of the Figma Platform such as technical logs, metadata, device data, and telemetry data.

·How long does Figma retain Customer Content?

·Figma retains Customer Content for the duration of the Customer's subscription.

·Upon request or termination of services, Figma deletes Personal Data within 30 days, except where retention is required by law. Does Figma use Sub-processors?

·Yes. Figma engages trusted Sub-processors to help provide the Figma Platform.

·A current list of Sub-processors, including their functions and locations, along with a mechanism to subscribe to receive updates, is available at: https://www.figma.com/sub-processors.

·Customers may object to new Sub-processors as described in the Data Processing Addendum. Where is data processed?

·Figma processes data in the United States and other regions where Figma and its Sub-processors operate.

·Figma provides Customer support through a globally distributed team operating on a "follow-the-sun" model, enabling continuous support coverage across regions.

·Support personnel may occasionally access Customer Content or account information when necessary to respond to a Customer's support request or resolve technical issues. Any such access is governed by Figma's contractual obligations, confidentiality requirements, and security controls.

·Figma supports international data transfers using legally recognized safeguards, including Standard Contractual Clauses where required.

·For more information, see our Privacy Trust Center.

·Eligible Enterprise organizations may enable EU data hosting for certain Figma and Figjam file data. More information about the types of Figma data that can be hosted within the EU can be found at:

·https://www.figma.com/blog/eu-hosting-for-figma-and-figjam-files/ and https://help.figma.com/hc/en-us/articles/15643274574871-Enable-localized-file-hosting.

·Is Figma certified under any international data protection frameworks?

·Yes. Figma participates in the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, administered by the U.S. Department of Commerce. Under these frameworks, Figma commits to providing Personal Data transferred from the EU, UK, and Switzerland with protections consistent with the Data Privacy Framework Principles.

·Figma's certification status is publicly available on the U.S. Department of Commerce's Data Privacy Framework website.

·Read more about our commitments under the Data Privacy Framework in our Privacy Policy.

·Is Figma listed under the EU Cloud Code of Conduct?

·Figma is listed as an adherent service under the EU Cloud Code of Conduct. The EU Cloud Code of Conduct is one of two SaaS-specific codes approved by the European Data Protection Board (EDPB) and recognized by EU data protection authorities.

·Adherence to the EU Cloud Code of Conduct demonstrates alignment with GDPR requirements as applied to cloud service providers.

·Figma's listing may be verified through the EU Cloud Code Conduct's publicly available register:

·https://eucoc.cloud/en/public-register/list-of-adherent-services.

·How does Figma protect Customer Content?

·Figma implements technical and organizational measures designed to protect the confidentiality, integrity, and availability of Customer Content.

·These measures include encryption in transit (TLS 1.2+) and encryption at rest, access controls, security monitoring, and regular independent audits.

·Figma maintains SOC 2 Type II and ISO 27001 and ISO 27018 certifications, which are independently assessed on an annual basis.

·Additional details are available in the Security Center: https://www.figma.com/security.

·How does Figma handle security incidents?

·Figma maintains an incident response program aligned with industry standards.

·If Figma becomes aware of a security incident affecting Customer Content, Figma will notify affected Customers without undue delay in accordance with its contractual obligations in the Data Processing Addendum and applicable law.

·What happens if Figma receives a government request for data?

·If Figma receives a legally binding request for Customer Content, Figma reviews the request for legal validity, notifies the Customer where permitted, and discloses only what is required by law.

·Information about how Figma evaluates and responds to government and other third-party requests is available in Figma's Principles Regarding Government and Other Third-Party Requests for Customer Personal Data Figma publishes a Transparency Report describing government data requests.

·How can Customers sign Figma's Data Processing Addendum?

·Figma's Data Processing Addendum applies automatically to Customers who are on the ToS or SSA. There is no need to sign the Data Processing Addendum separately.

·Customers who require a signed copy for their records may obtain one through Figma's self-service process by completing this form.