Where it becomes necessary to Process your Sensitive Personal Data for any reason, we do so: to comply with applicable law; detect and prevent crime; establish, exercise or defend legal claims; or with your express consent prior to Processing.  If you provide Sensitive Personal Data to us, you must ensure that it is lawful for you to disclose such data to us.

E. Disclosure of Personal Data to Third Parties

Summary: In situations where we need to provide your Personal Data to other parties, we do so with a legitimate purpose in mind, and in accordance with the applicable law.

We may share your Personal Data in a limited number of circumstances, including to:

• you and, where appropriate, your appointed representatives; 
• where relevant, Suppliers to the extent necessary to provide a product or service requested by you.  
• legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation; 
• accountants, auditors, consultants, lawyers and other outside professional advisors to Paddle, subject to binding contractual obligations of confidentiality;
• third-party Processors (such as payment services providers etc.), located anywhere in the world, subject to the requirements noted below in this Section;
• any relevant party, regulatory body, governmental authority, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal claims and with applicable jurisdiction;
• any relevant party, regulatory body, governmental authority, law enforcement agency or court, for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties; 
• any alternative payment provider or reseller appointed by the Supplier or other third party acquirer(s) or successor(s) in title, including but not limited to a sale or transfer of all or any relevant portion of our business or assets, reorganisation, dissolution or liquidation); 
• any relevant third-party provider, where our Sites use third party advertising, plugins or content. If you choose to interact with any such advertising, plugins or content, your Personal Data may be shared with the relevant third party provider. We recommend that you review that third party’s privacy Notice before interacting with its advertising, plugins or content.
• any other relevant third-party outsourced service providers, where our Sites use third parties to perform certain functions otherwise performed by Paddle, subject to binding contractual obligations of confidentiality.

If we engage a third-party Processor to Process your Personal Data, the Processor will be subject to binding contractual obligations.

F. International Transfer of Personal Data

Summary: We transfer Personal Data to recipients in other countries. Where we transfer Personal Data from the UK/EEA to a recipient outside the UK/EEA that is not in an Adequate Jurisdiction, we do so on the basis of Standard Contractual Clauses and in the presence of appropriate safeguards.

Because our business is international, we transfer Personal Data among the various Paddle entities, and to third parties who Process Personal Data on our behalf as noted in Section E above, in connection with the purposes set out in this Notice. This may involve transfers to countries with different data protection laws than those in your location. As a result, your Personal Data may be subject to the laws of those countries, including laws that may permit or require disclosure to legal, regulatory or national security authorities.

Where applicable, we may rely on exemptions (for example, transfers necessary to establish, exercise, or defend legal claims). Otherwise, if we transfer Personal Data from the UK/EEA to countries not deemed to be in an Adequate Jurisdiction, we use Standard Contractual Clauses and other appropriate safeguards. You may request a copy of these by contacting privacy@paddle.com.

If you transfer Personal Data directly to a Paddle entity outside the UK/EEA, that transfer is made at your direction. However, from the point we receive your Personal Data, we will process it in line with this Notice.

G. Data Security

Summary: We have implemented appropriate technical and organisational security measures to protect your Personal Data against unauthorised or unlawful Processing, and against accidental loss, destruction or damage.

We use appropriate technical and organisational security measures to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful or unauthorised forms of Processing, in accordance with applicable law. 

We are not to be held responsible for the security of the manner in which you send your Personal Data to us.

H. Data Retention

Summary: We take every reasonable step to ensure that your Personal Data is only retained for as long as it is needed in connection with its lawful purpose.

We take every reasonable step to ensure that your Personal Data is only Processed for the minimum period necessary for the purposes set out in this Notice. 

We will retain Personal Data in a form that permits identification only for as long as you have an ongoing relationship with us or as required or permitted by applicable law (including to comply with our legal obligations, resolve disputes and enforce our agreements). 

In any case, in line with our internal policies, we retain your Personal Data for the duration of the applicable limitation period under the applicable law (and a short administrative period  thereafter) and while any claim, investigation or dispute that relates to you or the product or service you have purchased from us is ongoing. 

Once the periods noted above, each to the extent applicable, have concluded, we will permanently delete or destroy your Personal Data or anonymise it (where permitted by applicable law).

I. Your Rights

Summary: Based on where you reside, you may have a number of rights in relation to your personal data under applicable data protection laws. In some cases it will be necessary to provide evidence of your identity before we can give effect to these rights.

Subject to applicable law, you may have the following rights regarding the Processing of your Personal Data:

• the right to withhold your Personal Data from us, although this may affect or prevent us from providing how we deliver our Site, and any products or services to you;  the right to request access to, or copies of, your Personal Data, together with information regarding the nature, Processing and disclosure of that Relevant Personal Data;
• the right to request rectification of any inaccuracies in your Personal Data;
• the right to request, on legitimate grounds, erasure of your Personal Data or restriction of Processing of your Personal Data;
• the right to have your Personal Data transferred to another Controller, in a structured, commonly used and machine-readable format, to the extent applicable; 
• where we Process your Personal Data on the basis of your consent, the right to withdraw that consent, although this may affect or prevent us from providing how we deliver our Site, and any products or services to you (and noting that in some circumstances, legal requirements may prevent you from withdrawing your consent); and
• the right to lodge complaints regarding the Processing of your Relevant Personal Data with a Data Protection Authority where you reside.

Subject to applicable law, you may also have the right to object to the Processing of your Personal Data.

To exercise one or more of these rights, or to ask a question about these rights or any other provision of this Notice, or about our Processing of your Personal Data, you may submit your request to our Privacy Officer via https://preferences.paddle.com or email privacy@paddle.com. We will in certain cases request you to provide evidence of your identity.

J. Cookies and Similar Technologies

Summary: We Process Personal Data by using Cookies and similar technologies. For more information, please see our Cookie Notice.

When you visit our Site we may place Cookies on your device, or read Cookies already stored on your device We use necessary Cookies to operate and secure our Site, and non-essential Cookies (with your consent where required by applicable law) for purposes such as analytics, advertising and marketing. This may include recording information about your device, browser, preferences and browsing habits. We Process Personal Data through Cookies and similar technologies, in accordance with our Cookie Notice. You can manage your Cookies choices at any time by clicking Cookie Preferences in our Site footer.

K. Additional information for consumers in the United States

Summary: Some U.S. state privacy laws provide residents with additional rights regarding their personal data. The disclosures in this Section apply to the extent required by applicable law.

In the past 12 months, we have collected the categories of Personal Data set out in Section C of this Notice. We collect and use these categories of Personal Data for the business purposes described in Section D of this Notice. We share the Personal Data with the third parties mentioned in Section E of this Notice. You can exercise your consumer rights using the procedure described in Section I of this Notice.

In addition to the rights set out in Section I, if you reside in California, you are additionally entitled to the following rights: 

• Right to opt out of a Sale or the Sharing of your Personal Information. We do not sell your personal information for monetary benefit. However, some third party Cookies and similar technologies placed on our Site may be considered a ‘sale’ or ‘share’ under U.S. state privacy laws. For more information, see the Sections noted above and our Cookie Notice. You can manage your Cookie choices at any time by clicking Cookie Preferences in our Site footer. 
• Right to limit the use and disclosure of any Sensitive Personal Data.  
• Right to Non-Discrimination. Consumers have the right to be free from discrimination when they exercise their rights under the California Privacy Acts.

Privacy requests (including requests to know or delete data) can be submitted at https://preferences.paddle.com.

We do not offer financial incentives or a price or service difference to encourage consumers to provide personal information.

Appeal:

If we deny your privacy request, you may appeal by following the process set out in Section I above.  If you are not satisfied with the outcome, you may submit a complaint to the appropriate  state regulator.

Authorized Agent: 

You may use an authorized agent to submit a privacy request on your behalf where permitted by applicable law. We may require proof of the agent’s authority (such as a copy of a lawful power of attorney or written authorisation from you) and verification of your identity before processing the request.

L. Details of Controllers

Summary: There are several Paddle entities that act as Controllers for the purposes of this Privacy Notice.

For the purposes of this Notice, the relevant Controllers are:

• Paddle.com Market Limited with address at Judd House, 18-29 Mora Street, London, EC1V 8BT, UK
• Paddle.com Inc. with address at 3811 Ditmars Blvd, #1071 Astoria, New York, 11105-1803, USA
• Paddle Payments Limited with address at The Academy, 42 Pearse Street, Dublin 2, D02 Hv59, Ireland
• Paddle.com Canada Ltd with address at 22 Adelaide Street West, Suite 3400, Toronto, Ontario, M5H 4E3, Canada

M. Definitions

“Adequate Jurisdiction” means a country or territory recognised as providing an adequate level of protection for Personal Data under an adequacy decision made, from time to time, by (as applicable) (i) the Information Commissioner’s Office and/or under applicable UK law (including the UK GDPR), and/ or (ii) the European Commission under the EU GDPR.

“Controller” means the entity that decides how and why Personal Data is Processed. In many jurisdictions, the Controller has primary responsibility for complying with applicable data protection laws.

“Cookie” means a small file that is placed on your device when you visit a website (including our Sites). In this Notice, a reference to a “Cookie” includes analogous technologies.  

“Data Protection Authority” means an independent public authority that is legally tasked with overseeing compliance with applicable data protection laws.

“EEA” means the European Economic Area.

“GDPR” means the General Data Protection Regulation ((EU) 2016/679) (“EU GDPR”); the Data Protection Act 2018 and the UK General Data Protection Regulation 2016/679 (as implemented by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020) (the "UK GDPR"), as applicable.

“Merchant of Record” means the licensed reseller of software and digital products and the business that is carried on by Paddle. 

“Personal Data” and “Personal Information” means information that is about any individual, or from which any individual is directly or indirectly identifiable, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

“Process”, “Processing” or “Processed” means anything that is done with any Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Processor” means any person or entity that Processes Personal Data on behalf of the Controller (other than employees of the Controller).

“Product” means the Supplier’s software product(s) and/or digital content and any subsequent updates and upgrades thereto agreed to be resold or distributed by Paddle.

“Sensitive Personal Data” means Personal Data about race or ethnicity, political opinions, religious or philosophical beliefs, trade union membership, biometric data, physical or mental health, sexual life, any actual or alleged criminal offences or penalties, national identification number, or any other information that is deemed to be sensitive under applicable law. 

“Site” means any website operated, or maintained, by us or on our behalf.

“Standard Contractual Clauses” means i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council incorporating Module 1 (Controller to Controller transfers) (EU SCCs); and ii) where the UK GDPR applies, the template Addendum B.1.0 issued by the UK's Information Commissioner's Office and approved by Parliament in accordance with s119A of the Data Protection Act 2018 (UK Approved Addendum) and the accompanying Mandatory Clauses of the UK Approved Addendum, as updated from time to time and/or replaced by any further version published by the Information Commissioner's Office (UK Mandatory Clauses).

“Supplier” means a party which has appointed Paddle to be the authorised reseller of its Products.

“UK” means the United Kingdom.