GDPR and data protection
Updated October 3, 2026
Roles and scope
For website inquiries, the party receiving the message handles it for the stated inquiry purpose. Processing for a customer-controlled environment depends on the activity and applicable customer agreement. This overview is not an executable data processing agreement.
Individual rights
Where applicable, you may request access, rectification, erasure, restriction, portability or objection, withdraw consent, and complain to a competent supervisory authority. Rights and exceptions depend on the processing and applicable law.
Request routing
Contact [email protected]. We locate the relevant information, check identity or authority when necessary for the request, review retention obligations and explain the outcome. A customer administrator may need to handle customer-controlled records.
Processing arrangements
Customer processing terms, authorized suppliers, incident assistance and deletion or return arrangements must be established in the relevant agreement. This page does not claim that a signed DPA or complete approved subprocessor inventory is already in place.
International processing
Cloudflare uses a distributed network; email and optional analytics suppliers may process internationally. Regional delivery alone does not determine every support or backup location. Applicable transfer terms and safeguards should be reviewed for the specific supplier and agreement.