We are a Canadian company, but we work with and process data about individuals across the world. To operate our business, we may send your personal information outside of your state, province, or country, including to the United States. This data may be subject to the laws of the countries where we send it. When we send your information across borders, we take steps to protect your information, and we try to only send your information to countries that have strong data protection laws. If you would like more information about where your information might be sent, please contact us.
Transfers outside of Europe and Switzerland
If you are in Europe or Switzerland, your personal information is controlled by our Irish affiliate, Shopify International Ltd. Your information is then sent to other Shopify locations and to service providers who may be located in other regions, including Canada (where we are based) and the United States. When we send your personal information outside of Europe, we do so in accordance with European law.
If you are in Europe or Switzerland, when we send your personal information to Canada it is protected under Canadian law, which the European Commission has found will adequately protect your information. When we send your personal information directly to the United States, we do so under the EU-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield programs, which set out standards for how we process your personal information in the United States if you are located in Europe or Switzerland. These programs require us to follow the Privacy Shield Principles of notice, choice, accountability for onward transfers, security, data integrity, and purpose limitation, access, recourse, enforcement, and liability. Because we participate in these two programs, we are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.
If you are located in Europe or Switzerland and believe we are not following the Privacy Shield Principles, please reach out to us. If you believe that we haven’t properly addressed your complaint, you can also contact the International Centre for Dispute Resolution®, the international division of the American Arbitration Association® (ICDR/AAA). ICDR/AAA provides independent dispute resolution services at no charge to you. If you feel that your concerns have not been resolved after reaching out to ICDR/AAA, you can request that your complaint be resolved through binding arbitration.
Finally, while we do what we can to protect your information, we may at times be legally required to disclose your personal information (for example, if we receive a valid court order). For information about how we respond to such orders, please review our Guidelines for Legal Requests.