Privacy Policy
This update only changes hyperlink URLs (removing a '/de' German-locale path segment and standardizing to '/en' or root paths) throughout the privacy policy. No wording, rights, data practices, or obligations were changed.
Cosmetic change: formatting, typos, or contact details.
| 1 | 1 | ## Introduction |
| 2 | 2 | |
| 3 | 3 | In our mission to make commerce better for everyone at Shopify, we collect and use information about you, our |
| 4 | 4 | |
| 5 | - [**merchants using Shopify**](https://shopify.com/de/legal/privacy/merchants) to power your business | |
| 6 | - [**consumers**](https://shopify.com/de/legal/privacy/consumers) who shop at a Shopify-powered business, or use [**Shopify apps**](https://shopify.com/de/legal/privacy/consumers) and services like [**Shop**](https://shop.app/) or [**Shop Pay**](https://shop.app/shop-pay) | |
| 7 | - [**partners**](https://shopify.com/de/legal/privacy/partners) who develop apps for merchants to use, build stores on behalf of merchants, refer potential entrepreneurs to Shopify, or otherwise help merchants operate or improve their Shopify-powered business | |
| 8 | - visitors to [**Shopify's websites**](https://shopify.com/de/legal/privacy/visitors), or anyone contacting [**Shopify support**](https://shopify.com/de/legal/privacy/visitors) | |
| 5 | - [**merchants using Shopify**](https://shopify.com/legal/privacy/merchants) to power your business | |
± CHANGEDLocale removed from merchant/consumer/partner/visitor privacy links Links to the supplemental privacy pages for merchants, consumers, partners, and visitors were changed from German-locale URLs to generic (default-locale) URLs. The destination content is the same. | ||
| 6 | - [**consumers**](https://shopify.com/legal/privacy/consumers) who shop at a Shopify-powered business, or use [**Shopify apps**](https://shopify.com/legal/privacy/consumers) and services like [**Shop**](https://shop.app/) or [**Shop Pay**](https://shop.app/shop-pay) | |
| 7 | - [**partners**](https://shopify.com/legal/privacy/partners) who develop apps for merchants to use, build stores on behalf of merchants, refer potential entrepreneurs to Shopify, or otherwise help merchants operate or improve their Shopify-powered business | |
| 8 | - visitors to [**Shopify's websites**](https://shopify.com/legal/privacy/visitors), or anyone contacting [**Shopify support**](https://shopify.com/legal/privacy/visitors) | |
| 9 | 9 | |
| 10 | 10 | This overall privacy policy and the supplemental privacy policies (together, the "**Privacy Policy**") will help you better understand how we collect, use, and share your Personal Data. "**Personal Data**" refers to information defined as 'personal data,' 'personal information,' or 'personally identifiable information' (or analogous terms) under applicable data protection laws. Capitalized terms used but not defined in this Privacy Policy shall have the same meaning given to them in the applicable terms of service. If we change our privacy practices, we may update this Privacy Policy. If any changes are significant, we will let you know (for example, through the Shopify admin or by email). |
| 11 | 11 | |
| 12 | 12 | ## Our values |
| 13 | 13 | |
| 14 | 14 | Trust is the foundation of the Shopify platform and includes trusting us to do the right thing with your information. Three main values guide us as we develop our products and services. These values should help you better understand how we think about your information and privacy. |
| 41 | 41 | ## Your rights over your information |
| 42 | 42 | |
| 43 | 43 | We believe you should be able to access and control your Personal Data no matter where you live. Depending on how you use Shopify, you may have the right to request access to, correct, amend, delete, port to another service provider, restrict, or object to certain uses of your Personal Data. We will not charge you more or provide you with a different level of service if you exercise any of these rights. Please note that a number of these rights apply only in certain circumstances, and all of these rights may be limited by law. |
| 44 | 44 | |
| 45 | 45 | Where Shopify acts as processor or service provider of your Personal Data on behalf of Shopify merchants, you need to directly contact the merchant you interacted with. For more information about how merchants collect and use your data when you visit and make purchases in their stores, review the specific merchant's terms and privacy policy. In some cases, we may offer tools and assistance to merchants to help fulfill these requests. |
| 46 | 46 | |
| 47 | If you are a merchant, consumer, partner, website visitor or other individual that Shopify has a direct relationship with or for whom Shopify processes your Personal Data as a Data Controller, please submit your data subject request through the [**privacy portal**](https://privacy.shopify.com/de). We may require you to provide additional documentation to verify your identity and may use third parties to assist us with this process. Further information about rights available to US residents can be found below under the header "United States Regional Privacy Notice". | |
| 47 | If you are a merchant, consumer, partner, website visitor or other individual that Shopify has a direct relationship with or for whom Shopify processes your Personal Data as a Data Controller, please submit your data subject request through the [**privacy portal**](https://privacy.shopify.com/en). We may require you to provide additional documentation to verify your identity and may use third parties to assist us with this process. Further information about rights available to US residents can be found below under the header "United States Regional Privacy Notice". | |
± CHANGEDPrivacy portal link locale changed The link to submit a data subject request was updated from a German-locale URL to an English-locale URL. | ||
| 48 | 48 | |
| 49 | 49 | If you are not happy with our response to a request, you can contact us to resolve the issue. If you are located in the EEA or UK, you also have the right to lodge a complaint with your local data protection or privacy authority at any time. |
| 50 | 50 | |
| 51 | 51 | Finally, because there is no common understanding about what a [**"Do Not Track"**](https://en.wikipedia.org/wiki/Do_Not_Track) signal is supposed to mean, we don't respond to those signals in any particular way. |
| 52 | 52 | |
| 53 | 53 | ## Where we send your information |
| 59 | 59 | #### Transfers outside of the EEA, the UK and Switzerland |
| 60 | 60 | |
| 61 | 61 | If you are located in the EEA, the UK, or Switzerland, your Personal Data is received by our Irish affiliate, Shopify International Ltd. Your information is then sent to other Shopify locations and to service providers who may be located in other regions, including Canada (where we are headquartered) and the United States. When we send your Personal Data outside of the EEA, the UK and Switzerland, we do so in accordance with applicable law. |
| 62 | 62 | |
| 63 | 63 | If you are in the EEA or Switzerland, when we send your Personal Data to any other Shopify entity outside the EEA or Switzerland, it is transferred in accordance with [**Shopify's Binding Corporate Rules**](https://cdn.shopify.com/static/Shopify-Processor-Policy.pdf) (BCRs). Shopify's BCRs have been approved by European data protection authorities and reflect Shopify's commitment to adequately protect Personal Data regardless of where the information resides. If you are in the UK, when we send your Personal Data to any other Shopify entity outside of the UK, EEA or Switzerland, it is transferred pursuant to [**Standard Contractual Clauses**](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) in place between Shopify entities, and may rely on the European Commission's [**adequacy decision**](https://eur-lex.europa.eu/legal-content/en/TXT/) in relation to Canada to support transfers from Shopify International Limited to its Canadian-registered corporate parent Shopify Inc. |
| 64 | 64 | |
| 65 | Where Shopify transfers your Personal Data to any third parties (for example, when we send this information to our [**Subprocessors**](https://help.shopify.com/de//manual/privacy-and-security/privacy/subprocessors)), such transfers are protected by contractual commitments in the form of [**Standard Contractual Clauses**](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) where appropriate. | |
| 65 | Where Shopify transfers your Personal Data to any third parties (for example, when we send this information to our [**Subprocessors**](https://help.shopify.com/en//manual/privacy-and-security/privacy/subprocessors)), such transfers are protected by contractual commitments in the form of [**Standard Contractual Clauses**](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) where appropriate. | |
± CHANGEDSubprocessors link locale removed The link to the list of subprocessors was changed from a German-locale URL to an English-locale URL. ± CHANGEDSupport contact link locale changed The link to Shopify Support was updated from a German-locale URL to an English-locale URL. | ||
| 66 | 66 | |
| 67 | Finally, while we do what we can to protect your information, we may at times be legally required to disclose your Personal Data (for example, if we receive a valid court order). For information about how we respond to such orders, please review our [**Guidelines for Legal Requests**](https://shopify.com/de/legal/gvtaccesspolicy). | |
| 67 | Finally, while we do what we can to protect your information, we may at times be legally required to disclose your Personal Data (for example, if we receive a valid court order). For information about how we respond to such orders, please review our [**Guidelines for Legal Requests**](https://shopify.com/legal/gvtaccesspolicy). | |
± CHANGEDLegal requests guideline link locale removed Links to Shopify's Guidelines for Legal Requests were changed from German-locale URLs to generic URLs, in two places in the document. | ||
| 68 | 68 | |
| 69 | 69 | ## How long do we retain your information |
| 70 | 70 | |
| 71 | 71 | We will retain your Personal Data only for as long as necessary to fulfill the purposes for which we have collected it. To determine the appropriate retention period, we consider the amount, nature and sensitivity of your Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means and the applicable legal requirements. We will also retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes and enforce our policies. If you stop using our services or if you delete your account with us, we will delete your information or store your information in an aggregated and anonymized format. |
| 72 | 72 | |
| 73 | 73 | Depending on whether you are a merchant, consumer, partner, or visitor, please refer to our supplemental privacy policies, as relevant, for further details on the retention of your Personal Data. |
| 75 | 75 | ## Our use of Machine Learning |
| 76 | 76 | |
| 77 | 77 | One of the ways in which we are able to help merchants using Shopify is by using techniques like "machine learning" (some laws, including certain EEA and UK laws, may refer to this as "automated decision-making") to help us improve our services. When we use machine learning, we either: (1) still have a human being involved in the process (and so are not fully automated); or (2) use machine learning in ways that don't have legal or similarly significant effects (for example, reordering how apps might appear when you visit the app store). |
| 78 | 78 | |
| 79 | 79 | ## How we protect your information |
| 80 | 80 | |
| 81 | Our teams work tirelessly to protect your information, and to ensure the security and integrity of our platform. We also have independent auditors assess the security of our data storage and systems that process financial information. However, we all know that no method of transmission over the Internet, and method of electronic storage, can be 100% secure. This means we cannot guarantee the absolute security of your Personal Data. You can find more information about our security measures at [**shopify.com/security**](https://shopify.com/de/security). | |
| 81 | Our teams work tirelessly to protect your information, and to ensure the security and integrity of our platform. We also have independent auditors assess the security of our data storage and systems that process financial information. However, we all know that no method of transmission over the Internet, and method of electronic storage, can be 100% secure. This means we cannot guarantee the absolute security of your Personal Data. You can find more information about our security measures at [**shopify.com/security**](https://shopify.com/security). | |
± CHANGEDSecurity page link locale removed The link to Shopify's security information page was changed from a German-locale URL to a generic URL. | ||
| 82 | 82 | |
| 83 | 83 | ## How we use "cookies" and other tracking technologies |
| 84 | 84 | |
| 85 | 85 | ## How you can reach us |
| 86 | 86 | |
| 87 | If you would like to ask about, make a request relating to, or complain about how we process your Personal Data, please contact [**Shopify Support**](https://help.shopify.com/de/), or mail us at one of the addresses below. If you would like to submit a legally binding request to demand someone else's Personal Data (for example, if you have a subpoena or court order), please review our [**Guidelines for Legal Requests**](https://shopify.com/de/legal/gvtaccesspolicy). | |
| 87 | If you would like to ask about, make a request relating to, or complain about how we process your Personal Data, please contact [**Shopify Support**](https://help.shopify.com/en/), or mail us at one of the addresses below. If you would like to submit a legally binding request to demand someone else's Personal Data (for example, if you have a subpoena or court order), please review our [**Guidelines for Legal Requests**](https://shopify.com/legal/gvtaccesspolicy). | |
| 88 | 88 | |
| 89 | 89 | If you have questions about how a merchant or store processes your Personal Data, you should contact the merchant or visit their privacy policy. |
| 90 | 90 | |
| 91 | 91 | **If you are located in Canada or the United States, your Personal Data is received by:** |
| 92 | 92 | |
| 93 | 93 | **Shopify Inc.** |