Tools and automation
GDPR Make
In an indie stack, Make is used for Automation between applications. Entity cited: Celonis, Inc.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Make
Yes. Public PDF. It states that, for an EEA customer contracting with Celonis, Inc., the Data Privacy Framework under which Celonis, Inc. is registered is the primary transfer mechanism.
Stated role
For personal data processed under the Make DPA, the customer is controller and Celonis is processor of the Make-branded services. An EEA customer may also contract with an EEA Celonis entity.
Personal data
Account data (name, identifier, contact details, logs, and protocol data), other categories depending on the customer's use, personal data of the customer's employees, other categories of data subjects depending on use.
Sub-processors of Make
The DPA refers to Celonis affiliates and the sub-processors listed on the terms page.
Transfers outside the EU
Hosting / location
The security page states that the infrastructure is on private Amazon AWS EC2 instances (Amazon VPC), the cluster being deployed across two zones. AWS country or region: not disclosed.
EU–United States Data Privacy Framework
Celonis Inc. is registered. EU-U.S. Data Privacy Framework status: Active. Celonis Labs LLC is a covered entity. Search for “Make.com” and “Integromat”: no distinct participant.
Cookies
The cookie notice (stated update: July 2026) concerns the make.com site: necessary, performance, functional, and marketing cookies, including the Facebook pixel, Google Analytics and Ads, the LinkedIn Insight Tag, the Microsoft cookies MSPTC and MUID, Cloudflare, and Salesforce Pardot. Cookies set on a customer's site: not disclosed.
Typical use, written by StackLégal and not by the vendor: Automation between applications.
History
Last update: October 4, 2026.
Hosting and cookies taken from Make's security and cookies pages, in place of "not disclosed".
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Make a processor within the meaning of the GDPR?
For personal data processed under the Make DPA, the customer is controller and Celonis is processor of the Make-branded services. An EEA customer may also contract with an EEA Celonis entity.
What DPA does Make publish?
Yes. Public PDF. It states that, for an EEA customer contracting with Celonis, Inc., the Data Privacy Framework under which Celonis, Inc. is registered is the primary transfer mechanism. https://www.make.com/data-processing-agreement.pdf
Which further sub-processors does Make publish?
The DPA refers to Celonis affiliates and the sub-processors listed on the terms page. https://www.make.com/en/terms-and-conditions
Where does Make state that it processes data, including outside the EU?
The security page states that the infrastructure is on private Amazon AWS EC2 instances (Amazon VPC), the cluster being deployed across two zones. AWS country or region: not disclosed.
Is Make registered under the EU–United States Data Privacy Framework?
Celonis Inc. is registered. EU-U.S. Data Privacy Framework status: Active. Celonis Labs LLC is a covered entity. Search for “Make.com” and “Integromat”: no distinct participant. https://www.dataprivacyframework.gov/participant/5446
Which personal data does Make mention?
Account data (name, identifier, contact details, logs, and protocol data), other categories depending on the customer's use, personal data of the customer's employees, other categories of data subjects depending on use.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.