Squarespace stores and processes data in the United States, and transfers personal information from the EU and UK using standard contractual clauses, a legally recognized but periodically scrutinized transfer mechanism.
This analysis describes what Squarespace's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
EU and UK users' personal data is subject to US legal frameworks once transferred, and the adequacy of standard contractual clauses as a transfer mechanism has been subject to legal challenge and regulatory scrutiny.
Interpretive note: The adequacy of SCCs as a sole transfer mechanism depends on whether supplementary transfer impact assessments have been completed and whether US surveillance law risks have been adequately addressed, which the policy does not detail.
If you are an EU or UK user, your personal data is transferred to and stored in the United States under standard contractual clauses, which may afford different levels of protection than EU or UK data protection law provides domestically.
How other platforms handle this
When we transfer personal data outside the European Economic Area, United Kingdom, or Switzerland, we use appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, to ensure your data is protected.
Personal data collected by Unity may be transferred to and processed in countries outside of the European Economic Area, including the United States, where data protection laws may differ from those in your country. Where we transfer personal data from the EEA or the UK, we rely on appropriate safeg...
We may transfer, process, and store all personal information we collect anywhere in the world. Different countries have different data protection laws. If we transfer personal information from the European Economic Area, Switzerland, Brazil and/or the United Kingdom to a country that does not provid...
Monitoring
Squarespace has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"Squarespace is based in the United States and the information we collect is governed by U.S. law. If you are accessing our services from outside of the United States, please be aware that information collected through our services may be transferred to, processed, stored, and used in the United States and other jurisdictions. Data protection laws in the U.S. and other jurisdictions may be different from those in your country of residence. We rely on the European Commission-approved standard contractual clauses to transfer personal information from the EU and the UK to the U.S. and other third countries.— Excerpt from Squarespace's Squarespace Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V (Articles 44-49) governing international data transfers, and UK GDPR equivalent provisions. The Court of Justice of the EU's Schrems II ruling (Case C-311/18) established that transfers to the US require supplementary measures in addition to SCCs where US surveillance law creates risks for data subjects. The European Commission issued updated SCCs in 2021, and compliance teams should verify Squarespace's SCCs are current. The Irish DPC is the primary supervisory authority. GOVERNANCE EXPOSURE: Medium. SCCs are a recognized transfer mechanism, but post-Schrems II requirements for transfer impact assessments and supplementary measures create ongoing compliance obligations. Organizations relying on Squarespace for EU or UK data processing should verify that adequate TIAs have been conducted and that SCCs reflect the 2021 updated versions. JURISDICTION FLAGS: EU/EEA and UK users face the most direct exposure. The EU-US Data Privacy Framework may also be relevant depending on whether Squarespace is certified under that framework, though the policy does not specify this. UK-specific transfer mechanisms under the UK GDPR also apply separately. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams onboarding Squarespace as a vendor for EU or UK operations should request copies of applicable SCCs, confirm they cover all relevant processing activities, and assess whether transfer impact assessments have been completed. Sub-processor chains should be mapped to identify all jurisdictions where data may be processed. COMPLIANCE CONSIDERATIONS: Organizations using Squarespace for EU or UK customer data should include Squarespace's international transfer arrangements in their GDPR Article 30 records of processing activities. Legal teams should periodically review whether Squarespace's transfer mechanisms remain current with evolving regulatory guidance and court decisions.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
EU and UK users' personal data is subject to US legal frameworks once transferred, and the adequacy of standard contractual clauses as a transfer mechanism has been subject to legal challenge and regulatory scrutiny.
If you are an EU or UK user, your personal data is transferred to and stored in the United States under standard contractual clauses, which may afford different levels of protection than EU or UK data protection law provides domestically.
ConductAtlas has identified this type of provision across 11 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Squarespace.