Data Processing Addendum

Shopify Data Processing Addendum

Last updated on: July 7, 2026

Shopify Data Processing Addendum

I. PURPOSE

This Shopify Data Processing Addendum ("DPA") supplements and is incorporated by reference into the Shopify Terms of Service, together with any terms applicable to any additional Shopify services that you choose to use (the "Terms") by and between You (or "Merchant"), and the Shopify Contracting Entity as set forth in the Terms ("Shopify"), which outline the specific business purposes and services related to this DPA. In case of any conflict between the Terms and this DPA, the DPA shall prevail with respect to the processing of Your Customer Personal Data, as defined below.

You and Shopify (each a "Party", together the "Parties"), agree that this DPA sets forth the Parties' obligations governing the processing of Your Customer Personal Data. You shall act as a Data Controller and Shopify shall act as a Data Processor with respect to the processing of Your Customer Personal Data, in connection with Your use of our Services that rely on our processing of Your Customer Personal Data, except for the services described in Appendix E.

Where the processing of Personal Data under this DPA is subject to data protection requirements in the European Economic Area (the "EEA"), the United Kingdom (the "UK") or Switzerland, and Shopify acts as a Data Processor, Appendix C supplements this DPA. In case of any conflict between Appendix C and other sections of this DPA, Appendix C shall prevail with respect to the processing of Your Customer Personal Data subject to EEA, UK and Swiss data protection requirements. For the avoidance of doubt, Appendix C shall not apply to the processing activities described in Appendix E.

Where the processing of Personal Data under this DPA is subject to U.S. Data Protection Laws, and Shopify acts as a Data Processor or Service Provider, Appendix D supplements this DPA. In case of any conflict between Appendix D and other sections of this DPA, Appendix D shall prevail with respect to the processing of Your Customer Personal Data subject to U.S. Data Protection Laws. For the avoidance of doubt, Appendix D shall not apply to the processing activities described in Appendix E.

If you receive Enhanced Services from Shopify (as defined in Section 9.2 of the Terms of Service) Shopify shall process Your Customer Personal Data as a Data Controller or Business as set forth in Appendix E. In case of any conflict between Appendix E and other sections of this DPA, Appendix E shall prevail with respect to Shopify's processing of Your Customer Personal Data as a Data Controller or Business.

For the avoidance of doubt, this DPA shall not apply to Shopify's processing of any Personal Data about Customers that it receives as a result of the Customer's relationship with Shopify through services like Shop and Shop Pay.

II. DEFINITIONS

Capitalized terms used but not defined in this DPA shall have the same meaning given to them in the Terms:

A. Applicable Data Protection Law(s): Any data protection or privacy laws applicable to Shopify's processing of Personal Data under the Terms, their implementing regulations and secondary legislation, each as may be amended, updated or replaced from time to time, including such laws that apply based on the location or residence of Merchant and/or Your Customer(s).

B. Customer: An individual or entity that visits, engages with, and/or purchases a product, good, or service from Your Store(s).