PayPal Data Protection Addendum for Business Management Products

Menu

PayPal Data Protection Addendum for Business Management Products

PayPal Data Protection Addendum for Business Management Products Last updated on April 7, 2025

This PayPal Data Protection Addendum for Business Management Products (“Addendum”) forms part of and is subject to the terms and conditions of PayPal User Agreement and the Bill Pay for Business Accounts Terms and Conditions, as applicable and as further described in those terms, (together, the “Agreements”) by and between you (“you” or “Company”), as defined in the Agreements, and PayPal (“PayPal”) (each a “Party” and together, the “Parties”).

1. Subject Matter and Duration

• Subject Matter. This Addendum reflects the Parties’ commitment to abide by Data Protection Laws concerning the Processing of Company Personal Information in connection with PayPal’s execution of the Agreement. All capitalized terms that are not expressly defined in this Addendum will have the meanings given to them in the Agreement or applicable Data Protection Laws. If and to the extent language in this Addendum conflicts with the Agreement, this Addendum shall control.
• Duration and Survival. This Addendum will become legally binding upon the effective date of the Agreement or upon the date that the Parties sign this Addendum if it is completed after the effective date of the Agreement. PayPal’s obligations and Company’s rights under this Addendum will continue in effect so long as PayPal Processes Company Personal Information.

2. Definitions

For the purposes of this Addendum, the following terms and those defined within the body of this Addendum apply.

• “Company Personal Information” means Personal Information designated in the Agreements to be Processed by PayPal on behalf of Company.
• “Data Protection Laws” means all applicable data privacy, data protection, and cybersecurity laws, rules and regulations, case law, and other regulatory guidance to which the Company Personal Information is subject. “Data Protection Laws” may include, but are not limited to, the California Consumer Privacy Act (“CCPA”); the Gramm-Leach-Bliley Act (“GLBA”); and industry self-regulatory standards, such as the Payment Card Industry Data Security Standard (“PCI DSS”).
• “Personal Information” has the meaning assigned to the terms “personal data” or “personal information” or similar terminology used under applicable Data Protection Laws, and will, at a minimum, mean any information relating to an identified or identifiable natural person.
• “Process” or “Processing” means any operation or set of operations which is performed on Company Personal Information or sets of Company Personal Information, whether or not by automated means, such as access, collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• “Security Incident(s)” means a breach of security leading to the unavailability of or accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Company Personal Information.
• “Services” means any and all services that PayPal performs related to Company Personal Information under the Agreement.
• “Subprocessor(s)” means PayPal’s vendors and third-party service providers that Process Company Personal Information.