Contentful

What Contentful is and how it fits in a website

Contentful is a Berlin headquartered headless content management system that has become a reference in the API first CMS category. Editors define content models, write entries and reference rich assets in the Contentful web app at app.contentful.com. Developers then consume the content through the GraphQL Content API, the REST Content Delivery API or the Preview API and render it in a Next.js, Nuxt, Astro or native mobile front end. The CMS layer sits behind the public website, so visitors typically interact with Contentful only indirectly.

What data Contentful processes

Contentful stores three categories of data: editor account information (name, email, organisation, role assignments, API keys), content entries and assets uploaded by editors (including any personal data deliberately embedded in articles such as author photos or testimonial quotes), and operational telemetry generated by the content APIs. The public front end does not typically receive cookies from Contentful, but the admin app at app.contentful.com sets session cookies, anti CSRF tokens and limited analytics cookies (Segment based) for editor authentication and product analytics.

GDPR and ePrivacy implications

Contentful GmbH is a processor for the content entries and editor accounts of its customers and acts as a controller for limited account, billing and product analytics purposes. Because the public website does not load Contentful scripts in the visitor browser, the ePrivacy consent rule is generally not triggered for end users. Legitimate interest under Article 6(1)(f) GDPR is the natural legal basis for backend content delivery. Editor data in app.contentful.com is processed on the basis of the Contentful Data Processing Addendum and the customer relationship.

International data transfers

Contentful production spaces can be hosted on AWS in eu-central-1 (Frankfurt), us-east-1 (Northern Virginia) or ap-southeast-1 (Singapore), with the CDN spread across additional regions. Even for EU spaces, support staff and monitoring infrastructure in the United States can access metadata. Transfers rely on the Contentful Data Processing Addendum, the EU Standard Contractual Clauses under Article 46(2)(c) GDPR and the EU US Data Privacy Framework, with TLS 1.3 in transit, encryption at rest, ISO 27001, SOC 2 Type II and HIPAA controls for healthcare customers.

Practical compliance steps

Sign the Contentful Data Processing Addendum, choose an EU production space when EU residency matters, configure access controls and Single Sign On for editors, and define retention rules for content versions and uploaded assets. Document Contentful in your record of processing activities, mention Contentful GmbH and the AWS hosting region in the privacy notice, and audit which integrations (Algolia, Segment, Salesforce, OpenAI) may forward visitor data through Contentful webhooks or app actions.