Privacy policy — Shopify

Cited by

Facts read from this source

• Canadian company Report an error

  “We are a Canadian company, but we work with and process data about individuals across the world.”

• Bcrs approved Report an error

  “Shopify's BCRs have been approved by European data protection authorities”

• UK transfers sccs Report an error

  “If you are in the UK, when we send your Personal Data to any other Shopify entity outside of the UK, EEA or Switzerland, it is transferred pursuant to Standard Contractual Clauses in place between Shopify entities”

• Third party transfers sccs Report an error

  “Where Shopify transfers your Personal Data to any third parties (for example, when we send this information to our Subprocessors), such transfers are protected by contractual commitments in the form of Standard Contractual Clauses where appropriate.”

• Eea recipient entity Report an error

  “If you are located in the EEA, the UK, or Switzerland, your Personal Data is received by our Irish affiliate, Shopify International Ltd.”

• North america recipient entity Report an error

  “If you are located in Canada or the United States, your Personal Data is received by: Shopify Inc.”

• Apac recipient entity Report an error

  “If you are located in Asia, Australia, or New Zealand, your Personal Data is received by: Shopify Commerce Singapore Pte. Ltd.”

• Retention merchant store Report an error

  “If you are a merchant operating a Shopify-powered store, and you close the store, stop paying your subscription fees, or we terminate your account, we retain store information for two years before we begin the deletion process.”

• Deletion on account close Report an error

  “If you stop using our services or if you delete your account with us, we will delete your information or store your information in an aggregated and anonymized format.”

• Machine learning human involvement Report an error

  “When we use machine learning, we either: (1) still have a human being involved in the process (and so are not fully automated); or (2) use machine learning in ways that don't have legal or similarly significant effects”

• Independent security audits Report an error

  “We also have independent auditors assess the security of our data storage and systems that process financial information.”

• Do not track Report an error

  “we don't respond to those signals in any particular way.”

• Do not sell Report an error

  “We do not "sell" your Personal Data as that term is defined under US Privacy Laws.”

• US privacy laws covered Report an error

  “such as the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act”

• Data subject request portal Report an error

  “please submit your data subject request through the privacy portal.”

• Privacy tools for merchants Report an error

  “We also provide detailed FAQs and documentation covering the most important privacy topics, and respond to privacy-related questions we receive.”

• Third party data refusal Report an error

  “If a third party requests your Personal Data, we will refuse to share it unless you give us permission or we are legally required.”

• Categories Report an error

  “We work with third party subprocessors for cloud hosting, content delivery, data analysis, internal logging, fulfillment services and email transmission, among others, to provide you with our services.”

• Rights no discrimination Report an error

  “We will not charge you more or provide you with a different level of service if you exercise any of these rights.”

• Policy update notification Report an error

  “If any changes are significant, we will let you know (for example, through the Shopify admin or by email).”

• Shop data deletion URL Report an error

  “If you use Shop or Shop Pay, please visit https://shop.app/delete-account for instructions on how to request deletion of your information.”

• Eea UK complaint right Report an error

  “If you are located in the EEA or UK, you also have the right to lodge a complaint with your local data protection or privacy authority at any time.”

Scores citing this record

• The B2B Seller Tax & German legal correctness
• The B2B Seller Data ownership & exit
• The B2B Seller European sovereignty
• The B2B Seller Data ownership & exit
• The B2B Seller European sovereignty
• The Data Protection Officer Data ownership & exit
• The Data Protection Officer European sovereignty
• The Data Protection Officer Data ownership & exit
• The Data Protection Officer European sovereignty
• The Developer Data ownership & exit
• The Developer European sovereignty
• The Developer Data ownership & exit
• The Developer European sovereignty
• The Merchant Order operations & back office
• The Merchant Data ownership & exit
• The Merchant European sovereignty
• The Merchant Data ownership & exit
• The Merchant European sovereignty
• The Operations Lead Data ownership & exit
• The Operations Lead European sovereignty
• The Operations Lead Data ownership & exit
• The Operations Lead European sovereignty
• The Skeptic Data ownership & exit
• The Skeptic European sovereignty
• The Skeptic Tax & German legal correctness
• The Skeptic Data ownership & exit
• The Skeptic European sovereignty