Shopify's Binding Corporate Rules

Shopify

Binding Corporate Rules:

Processor Policy

Contents

Part I: Introduction

This Binding Corporate Rules: Processor Policy ("Processor Policy") applies when Shopify processes personal data as a processor on behalf of a third party controller and transfers such personal data between group members. This Processor Policy applies regardless of whether our group members process personal data by manual or automated means.

This Processor Policy applies to transfers of personal data made by Shopify when acting as a processor on behalf of a third party controller (i) from a group member in Europe to a group member in a third country; and (ii) from a group member in a third country to another group member in a third country, where such personal data falls within the scope of the GDPR in accordance with the extra-territorial scope of the GDPR provided for in Article 3(2) GDPR.

For an explanation of some of the terms used in this Processor Policy, like "controller", "processor", and "personal data", please see the section titled "Important terms used in this Processor Policy" below.

Types of personal data within the scope of this Processor Policy

This Processor Policy applies to all personal data that we process as a processor on behalf of a third party controller (referred to as the " Merchant " in this Processor Policy), such as:

• personal data relating to a Merchant's customers who visits or makes purchases through a Merchant store that uses Shopify's platform or services. This will include, for example, information about the customer's name, contact information, shipping information, details regarding the items or services purchased, and, if the Merchant uses Shopify as a payment processor, payment information.
• information related to a Merchant's customer that a Merchant directly provides to Shopify in relation to the services (such as order information, customer lists, etc.) to the extent that they include any personal data.

Further information on the types of personal data that we process as a processor on behalf of Merchants is contained in Appendix 12 .

Our collective responsibility to comply with this Processor Policy

All group members and their staff must comply with, and respect, this Processor Policy when processing personal data as a processor on behalf of a Merchant, irrespective of the country in which they are located.

In particular, all group members who process personal data as a processor must comply with:

• the rules set out in Part II of this Processor Policy;
• the practical commitments set out in Part III of this Processor Policy;
• the third party beneficiary rights set out in Part IV of this Processor Policy; and
• the related policies and procedures appended in Part V of this Processor Policy.

Responsibility towards the Merchant

As a data processor, Shopify will have a number of direct legal obligations under applicable data protection laws. In addition, however, the Merchant will also pass certain data protection obligations on to Shopify in its contract appointing Shopify as its processor. If Shopify fails to comply with the terms of its contract, this may put the Merchant in breach of its applicable data protection laws and Merchant may bring a legal claim against Shopify for breach of contract, resulting in the payment of compensation or other judicial remedies as set out in the relevant contract.