Privacy Policy

Date of Last Revision: February 1, 2023

BigCommerce wants to help you better understand how we collect, use, protect, and share your personal data. This Privacy Policy is designed to help you understand your privacy choices when you visit our site, access our mobile app, or use our services. It does not apply to other websites or services that we do not control, including websites or services of other BigCommerce users.

This Privacy Policy is incorporated into, and forms an integral part of, the BigCommerce Terms of Service. Capitalized terms have the meanings ascribed them in the Definitions section or our Terms of Service. Please note that our services may vary by region.

We encourage you to read this Privacy Policy carefully and take the time to get to know our practices. If you have questions about this Privacy Policy or our privacy practices, please contact us at privacy@BigCommerce.com.

Definitions.
1. Information Types.
  - “Account Information” means data about how and when a BigCommerce account is accessed and the features used, including Store Information.
  - “Browser Information” means provided by a browser, including the IP address, the website visited, network connection, device information, and other data, including Cookies.
  - “Contact Information” means basic personal and business information, such as first and last name, company name, email address, postal address, phone number, and may include social media account information.
  - “Device Information” means information about your device, such as device ID number, model, and manufacturer, version of your operating system and geographical region, collected from any devices when accessing our website, using the Mobile App, or any of our services.
  - “Payment Information” means, for example, credit card, ACH or other payment information.
  - “Security Information” means user ID, password and password hints, and other security information used for authentication and account access.
  - “Store Information” means information about your store, its products, and its architecture.
  - “Support Information” includes information about your hardware and software, authentication data, chat session contents, error reports, performance data, and other communication or technical information and may, with express permission, include remote access to facilitate troubleshooting.
  - “Transaction Information” means the data related to transactions that occur on our platform, including product, order, shipping information, Contact Information, and Payment Information.
  - “Usage Information” means information collected when you interact with the BigCommerce website, mobile application or any of our services, including functionalities accessed, pages visited, and other interaction data.
2. “Automated Decision Making” means a decision made solely by automated means without human involvement.
3. “Controller” means an entity that determines the purposes and means of the Processing of Personal Data.
4. “Cookie” means a small file that resides on your computer’s hard drive that often contains an anonymous unique identifier that is accessible by the website that placed it there, but is not accessible by other sites.
5. “Merchant” means an entity that has used or is using the services for ecommerce.
6. “Mobile App” means the BigCommerce Mobile Application available through third-party app stores for mobile devices.
7. “Partner” means a separate legal entity that is a participant in our Agency Partner Program, our Technology Partner Program or other third-party technology integration with the BigCommerce platform, a theme designer, reseller, or referrer of the services.
8. “Personal Data” means information that (i) relates to an identified or identifiable natural person, or (ii) identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
9. “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, including, but not limited to, alteration, collection, organization, recording, retrieval, storage, transmission, and use.
10. “Processor” means the entity which processes Personal Data on behalf of the Controller.
11. “Sensitive Personal Data” means any data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning health or a natural person’s sex life and/or sexual orientation.
12. “Shopper” means an entity or natural person that interacts with the ecommerce offering of a Merchant through the BigCommerce platform.

Merchants.
1. Merchant Policies. Merchants should help Shoppers understand how the Merchant, BigCommerce and relevant third parties collect and process Shoppers’ Personal Data. To that end, Merchants must:
  - post an accurate privacy policy on their storefront that complies with all applicable laws and regulations;
  - process Personal Data in accordance with applicable laws and, to the extent required under such laws, provide notice to and obtain informed consent from Shoppers for the use and access of their Personal Data by BigCommerce and other third parties; and
  - if the Merchant is collecting any Sensitive Personal Data from Shoppers, obtain affirmative, explicit, and informed consent and allow such Shoppers to revoke their consent to the use and access of Sensitive Personal Data at any time.
2. Information Collected.
  - When a Merchant interacts with our Website, for example, by signing up for a trial, a subscription, or a newsletter or other content, or performing transactions, BigCommerce may collect and control information such as Account Information, Browser Information, Contact Information, Payment Information, Support Information, Device Information, Security Information, Transaction Information, Usage Information and set a Cookie.
  - When a Merchant interacts with our Mobile App, BigCommerce may collect and control information such as Account Information, Contact Information, Device Information, Usage Information and Security Information.
3. Information Usage. We use this information as a Controller to provide Merchants with our services, confirm identities, provide support such as debugging, troubleshooting, automated decision making such as the detection of fraudulent account creation when signing up for our service, for advertising and marketing, invoicing, to resolve incidents related to the use of our Website and services, to improve and personalize our services, such as push notifications regarding your store activities, and to comply with legal requirements. Subject, where applicable, to confidentiality obligations, we may disclose certain information, including Account Information, Contact Information, Support Information and Transaction Information, to Partners that refer Merchants to us or may be engaged by a Merchant to provide services, apps or products relating to the Merchant’s store(s) or use of our Website and services, or to confirm identities and improve and personalize our interactions and services. We may use this information in other cases as consented.
Partners.
1. Information Collected. When a Partner signs up for a partner account or refers a Merchant to us, BigCommerce may collect and control information such as Account information, Browser Information, Contact Information, Payment Information, Support Information, Security Information, and Usage Information.
2. Information Usage. We use this information as a Controller to provide Partners with our services, confirm identities, provide support, for advertising and marketing, invoicing, to resolve incidents related to the use of our Website and services, to improve and personalize our services, and to comply with legal requirements. We may use this information in other cases as consented.

Visitors.
1. Information Collected. When visitors browse our Website, or engage in communications with us online or offline, we may collect and control, as applicable, Browser Information, Support Information, Contact Information, and Usage Information submitted or communicated to us.
2. Information Usage. We use this information as a Controller to provide our services, and improve and personalize communications, interactions, our services, and provide support if needed. We may use this information in other cases as consented.

Shoppers.
1. Information Collected. When Shoppers interact with a Merchant’s ecommerce offering through the BigCommerce platform, we may collect and process Browser Information and Transaction Information of the Shopper on behalf of the Merchant.
2. Information Usage. We use this information as a Processor to provide our services to Merchants, support and process orders, and manage risk and fraud. The Merchant is the Controller of this information and Shoppers who have questions about our use of this information should contact the Merchant. We may also use certain information as a Controller to improve and personalize our services, and manage risk and fraud.

Legal Basis for Processing (EEA Residents).
1. Lawful Basis. We generally collect Personal Data from you only where (i) we need the Personal Data to perform a contract with you, (ii) the processing is in our legitimate interests and not overridden by your rights, or (iii) we have your consent to do so. In some cases, we may also have a legal obligation to collect Personal Data from you or may otherwise need the Personal Data to protect your vital interests or those of another person.
2. Notice. If we ask you to provide Personal Data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Data is mandatory or not, as well as of the possible consequences if you do not provide your Personal Data.
3. Legitimate Interest. If we collect and use your Personal Data in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are. For instance, we may rely on our legitimate interests when responding to your queries, improving and personalizing our platform, undertaking marketing, or for the purposes of detecting or preventing illegal activities (e.g. checking your identity, fraud prevention).
4. Questions. If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, please contact us using the contact details provided below.

Communications.
1. Promotional. We may send promotional communications to existing and prospective Merchants, Partners, and visitors, by email, phone, and other channels, such as LinkedIn. For example, we may notify a Merchant when a subscription is ending, or invite the recipient to participate in a survey. You can opt-out of receiving promotional communications from us at any time. For information about managing email subscriptions and promotional communications, please go to our email preferences page.
2. Account. We send certain required communications, such as account notices or information, to users of our services. You may not opt out of receiving these communications if you have an active storefront.

Information Sharing. Our services are possible because of a variety of third parties and service providers. Sometimes it is necessary to share Merchant, Partner, or Shopper Personal Data with them to support our services. We may access, transfer, disclose, and/or retain that Personal Data with consent or in the following circumstances.
1. Compliance. If we have a good faith belief that doing so is necessary to: (i) comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies; or (ii) protect the rights or property of BigCommerce, including enforcing the terms governing the use of the services.
2. Protection. If we have a good faith belief that doing so is necessary to: (i) protect Merchants, Partners, Shoppers, or visitors; for example, to prevent spam or attempts to defraud us or users of our services, or in response to threats of safety of any person; or (ii) operate and maintain the security of our products, including to prevent or stop an attack on our computer systems or networks.
3. Affiliates. We share Personal Data among BigCommerce-controlled affiliates and subsidiaries for the purposes described in this Privacy Policy.
4. Service Providers. BigCommerce may use from time to time a limited number of third-party service providers, data processors, contractors, and other businesses to assist us in providing our services for the purposes described in this Privacy Policy.
5. SDKs and APIs. BigCommerce may include third-party libraries such as Software Development Kits (SDKs) or Application Interfaces (APIs) within our applications (including the Mobile App) for the purposes described in this Privacy Policy, including the following:
  1) Functional SDKs: these are software libraries we use to enhance the end user experience and functionality within the application, such as graphics and display of images within the app, and in-app notifications according to preferences.
  2) Analytics SDKs: these are external third-party sub processors’ libraries we use in collecting device and usage data for application performance monitoring.
6. Payment Processing. We share payment data with banks and other entities that process payment transactions or provide other financial services, and for fraud prevention and credit risk reduction.
7. Apps. Upon receiving a Merchant’s consent to install an application, we will share the Merchant’s Contact Information and other information requested by the app with the app Partner.
8. Merger; Sale. We may also disclose Personal Data as part of a corporate transaction such as a merger or sale of assets.

Automated Decision-Making. Some Personal Data may be used in Automated Decision Making to help us screen accounts for risk, fraud, or abuse concerns. You can object to profiling, including profiling for marketing purposes, or contest or dispute such decisions by contacting us here. Subject to applicable law, we can provide you with details underlying the automated decision-making review and rectification of any inaccuracies.

Cookies.
1. Usage. BigCommerce and its third-party service providers use cookies, web beacons, and similar tracking technologies to recognize you when you visit our website, remember your preferences, and give you a personalized experience. When you visit our websites, we, or an authorized third party, may place a cookie on your device that collects information, including Personal Data, about your online activities over time and across different sites. Cookies allow us to track use, infer browsing preferences, and improve and customize your browsing experience.
2. Persistence. We use both session-based and persistent cookies on our websites. Persistent cookies remain on your computer when you have gone offline, while session cookies are deleted as soon as you close your web browser. A website may set a cookie if the browser’s preferences allow it. A browser only permits a website to access the cookies that it has set, not those set by other websites.
3. Types.
  - Essential. These cookies are necessary for our website to work as intended.
  - Functional. These cookies enable enhanced functionality, like videos and live chat. Without these cookies, certain functions may become unavailable.
  - Analytics. These cookies provide statistical information on site usage. For example, these cookies enable web analytics that allow us to improve our website over time.
  - Targeting and Advertising. These cookies are used to create profiles or personalize content to enhance your experience.
4. Control. It is possible to disable cookies through your device or browser settings, but doing so may affect your ability to use our website. For instance, we may not be able to recognize your computer or mobile device and you may need to log in every time you visit our website. The method for disabling cookies may vary by device and browser, but can usually be found in preferences or security settings. Please use the following links for further instructions:
5. Other Resources. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit allaboutcookies.org, or aboutcookies.org.
Third Party Application Stores: Third party application stores, such as Apple’s App Store or Google’s Google Play, might collect additional information and share them with us. Please refer to the application store’s Privacy Policy to better understand how they process any of the Personal Data they collect and share with app publishers like ourselves.
Information Protection and Retention.
1. Information Protection. We maintain administrative, technical, and physical security measures designed to provide reasonable protection for Personal Data against unauthorized access, disclosure, alteration, loss, and misuse. These security measures include access controls, encryption, and firewalls. We are certified as a PCI DSS Level 1 compliant service provider, which is the highest level of compliance available, and our platform is audited annually by independent third-party qualified security assessors against the ISO 27001 security standard. Unfortunately, no method of Internet use, data transmission, or electronic storage is completely secure, so we cannot guarantee the absolute security of Personal Data.
2. Your Responsibilities. While we are dedicated to securing our Website and services, you are responsible for securing and maintaining the privacy of your passwords and account information. We are not responsible for protecting Personal Data shared with a third-party based on an account connection that you have authorized.
3. Retention. We use and retain your Personal Data for, and as long as, necessary for the purpose for which it was provided, including any purposes set for in this Privacy Policy (e.g., for services, products, or interactions that you have requested or initiated; for communications with you; for invoicing, advertising, and marketing; for improving user experience, such as troubleshooting, optimization, and personalization; and to comply with legal, contractual, and regulatory obligations). We may also use and retain information for other purposes where you have given consent, such as in response to a pricing or hiring inquiry, or where a legitimate commercial interest exists.
Accountability and Safeguards for Onward Transfer.
1. Data Transfer. We provide services around the world. To provide our services, it may be necessary to transmit Personal Data outside of the country, state, or province where the data was received, including to the United States in circumstances where BigCommerce acts as Controller. Such international data transfers may involve the flow of data from certain countries or regions to others that have different, and potentially less protective, privacy laws. To account for this, BigCommerce strives to maintain appropriate internal and external data protections, including (i) relying on legally or contractually adequate mechanisms to lawfully transfer data across borders in accordance with applicable laws; and (ii) obligating third parties, including applicable Processors and vendors, to provide at least the same level of data protection and use restriction as maintained by BigCommerce and required by applicable laws.
2. Privacy Shield. As a participant in the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework, we comply with Privacy Shield principles and are subject to the regulatory and enforcement powers of the U.S. Federal Trade Commission (FTC). Additional information about BigCommerce’s participation in Privacy Shield can be found in Section 14 of this Privacy Policy.
3. Standard Contractual Clauses. For third-country transfers outside of the EU/EEA we also use the Standard Contractual Clauses adopted by the EU Commission in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 as an adequate level of protection. We use these Standard Contractual Clauses as modified by the UK International Data Transfer Addendum for data transfers outside of the UK.
4. Remedial Measures. If we learn Personal Data is not protected according to our contract, or is being processed beyond your consent, we will take reasonable steps to protect your information and/or cease its illegitimate processing.
Privacy Shield and EU-US Data Privacy Framework. BigCommerce complies with, and is a member of, the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, retention, and onward transfer of Personal Data transferred from the European Union, the United Kingdom, and Switzerland to the United States. BigCommerce intends to comply with any successor framework that implements Privacy Shield principles, including the EU-US Data Privacy Framework, which received a draft adequacy decision from the European Commission on 13 December 2022. If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit the U.S. Department of Commerce site at https://www.privacyshield.gov/.

BigCommerce also commits to periodically reviewing and verifying the accuracy of this Privacy Policy and the company’s compliance with the Privacy Shield Principles, and remedying issues identified. All employees of BigCommerce that have access to Personal Data covered by this Privacy Policy are responsible for conducting themselves in accordance with this Privacy Policy. Failure of a BigCommerce employee to comply with this Privacy Policy may result in disciplinary action.

For additional information on how to contact BigCommerce or initiate a Privacy Shield complaint for third-party dispute resolution, please refer to Section 16. If your complaint is not resolved through these channels, under certain conditions a binding arbitration option may be available before a Privacy Shield Panel. For additional information, please visit https://www.privacyshield.gov/article?id=ANNEX-I-introduction
Data Subject Rights.
1. Generally. Under applicable law, you may have the ability to exercise certain rights over your Personal Data. Because BigCommerce values your Privacy, we strive to provide reasonable steps to allow you to access, rectify, erase, port, and restrict or object to the use of your Personal Data regardless of whether a specific statutory right to do so exists. When collection is based on your consent, we attempt to provide you with notice at collection and the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal by applicable law. If permitted by applicable law, you may also have the right to lodge a complaint with a supervisory or regulatory authority if you believe that the processing of your personal data infringes your rights. Exercise of certain rights, including requests for deletion of Personal Data, may be limited in certain circumstances and may adversely affect our ability to serve you.
2. Merchants, Partners, and Visitors. Merchants and Partners are able to update and control many types of Personal Data collected by BigCommerce directly within their accounts. Please contact us if you are a Visitor or otherwise unable to access or otherwise change your Personal Data within your account.
3. Shoppers. We serve as a Processor for Merchants. Shoppers may wish to contact Merchants directly regarding their Personal Data, as Merchants act as Controllers over such Personal Data. When appropriately identified, we can forward Shopper requests for access or deletion to Merchants, but we are unable to delete Merchant data.
4. Laws that may grant particular rights. Several jurisdictions have enacted privacy laws to codify certain rights for their residents. The goals and requirements of these laws are consistent with our longstanding commitment to data protection and transparency, including the general principles, disclosures, and data subject rights articulated in this Privacy Policy. These laws include, but are not limited to:
  - The General Data Protection Regulation EU (2016/679)(GDPR)
  - The Brazil Lei Geral de Proteção de Dados (LGPD)
  - The California Consumer Privacy Act, as modified by the California Privacy Rights Act (CCPA)
  - The Virginia Consumer Data Protection Act
  - The Colorado Privacy Act
  - The Connecticut Data Protection Act
  - The Utah Consumer Privacy Act
  - The Nevada Privacy Law
  Depending on the jurisdiction, these laws provide individuals with rights to:
  - Access or know about their information
  - Correct their information, if inaccurate
  - Delete or erase their information
  - Opt-out if a business “sells” their information or uses or “shares” it for certain advertising purposes
  - Control how a business uses their sensitive information
  - Be notified about a business’s data practices
  - Restrict or object to certain types of processing
  - Nondiscrimination for exercising privacy rights
  - Contact BigCommerce’s privacy team or external DPO
  - Appeal or complain if a business refuses to delete, correct, or provide their information
5. How to Exercise Your Rights. To exercise your rights under this provision or submit a request to delete your Personal Data, please click here.
6. Authentication. To protect your Personal Data, we may need to verify your identity by a method appropriate to the type of request you are making. We may also request that your authorized agent have appropriate written permission from you to make requests on your behalf, and we may also need to verify your authorized agent's identity to protect your Personal Data. We reserve any and all rights to decline requests to the extent permitted by applicable law.
Contact Information; Enforcement; Recourse.
California Disclosures (California Residents).
1. CCPA Rights. The CCPA provides certain rights to California consumers, including the following:
  - Notice at Collection: At or before the time of collection, you have the right to receive notice of our Personal Data practices and, where applicable, notice that your data may be collected;
  - Right to Know: You have the right to request that we disclose certain details to you about the Personal Data we collect, use, or disclose, as well as about our data practices, including the categories of Personal Data have collected from you in the past twelve (12) months and categories of third parties with whom we have shared it;
  - Right to Request Deletion: You have the right to request that we delete certain Personal Data that we have collected from you;
  - Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.
  These rights are not absolute, and there may be cases when we decline your request as permitted by law. Further, if you are a California resident and a Merchant, Partner or Visitor, we generally only collect and process Personal Data about you as a result of your business dealings with us. This may limit the extent to which consumer rights under the CCPA apply to you. If you are a California resident and a Shopper, BigCommerce only processes your Personal Data as a service provider acting on behalf of a Merchant. You should contact the Merchant to exercise any rights under the CCPA.
2. Selling or Sharing. BigCommerce does not “sell” Personal Data. BigCommerce also does not “share” Personal Data as defined by California law for purposes of cross-context behavioral advertising or unauthorized third party direct marketing purposes. In accordance with this Privacy Policy, we may share Personal Data with authorized service providers or business partners who, where necessary based on the nature of the sharing and purpose for which the Personal Data was provided, have agreed to contractual limitations as to their retention, use, and disclosure of such Personal Data. We may also share Personal Data if you use our services to interact with third parties or direct or otherwise authorize us to disclose your Personal Data to third parties.
3. Information Collected. As set forth in this Privacy Policy, we collect the following types of information from you, your device(s), or from third parties:
  - identifiers, such as Browser Information, Device Information, and Security Information;
  - commercial information, such as Account Information, Contact Information, Transaction Information, and Usage Information;
  - internet or network information, such as Browser Information and Device Information;
  - geolocation data, such as Browser Information and Device Information;
  - financial information, such as Payment Information;
  - other Personal Data, such as Support Information; and
  - information derived from other categories, which could include your preferences, interests, and other information used to personalize your experience.
  We may disclose this Personal Data to the categories of third parties and for the business purposes described in this Privacy Policy, such as disclosures to service providers that assist us with securing our services or marketing our products.
4. Exercising Your Rights. To exercise your rights under the CCPA, please refer to Section 15 and use this form or contact us at privacy@bigcommerce.com.
5. Do Not Track.Because there is no common understanding about what a 'Do Not Track' signal is supposed to mean or how it should be interpreted, our website does not respond to such signals in any particular way.
Children. As a general rule, our services and website are not targeted toward children or those under the age of majority under any applicable law. We do not knowingly collect the Personal Data of children, or use it in a manner not permitted by the U.S. Children’s Privacy Protection Act (COPPA). If you are a parent or guardian and you believe we have collected information from your child in a manner not permitted by law, please submit a data subject request under Section 15 or contact us at privacy@bigcommerce.com. We will remove the data to the extent required by applicable laws.
Updates. We may update this Privacy Policy from time to time in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws. You can see when this Privacy Policy was last updated by checking the “Date of Last Revision” date displayed at the top of this Privacy Policy.