Candidate Privacy Notice
This notice provides information on how Shopify processes personal information that it receives when you apply for a position, refer a candidate or are being considered for a role at Shopify.
Which Shopify entity is responsible for your personal information
The Shopify entity responsible for your personal information is the Shopify entity that would be responsible for your employment if you receive an offer.
What information we collect about you
Information You Provide
This policy covers the types of personal information that Shopify may receive directly from you (which may include sensitive personal information, depending on the jurisdiction where you reside) including:
| Types of Information | Example |
|---|---|
| Contact Information | Name, postal address, email address, and telephone number. |
| Date of Birth | Date of Birth. |
| Employment History | Copy of resume or CV, references from previous employers, cover letter, details of professional accomplishments and current or previous roles. |
| Identity Verification Documents | Birth certificate or passport, residence history. |
| Information on Right to Work in Country of Hire | Copy of passport and/or other national identity documents, government identification number such as Social Security Number in the USA, work authorization documents, or visas. |
| Education History | Copy of education degrees or certificates obtained, university or other educational institution transcripts, and membership in professional bodies. |
| Preferences | Your preferences in respect of being contacted in the future regarding other job positions, which may be of interest to you. |
| National ID/Tax ID Number | Social Security Number, National Tax ID Number, or similar ID numbers. |
| Demographic Information | Race/ethnicity, gender identity, sexual orientation, and disability |
| Any special needs or health condition and information relating to accommodations | Auditory or visual assistance needs |
Information Shopify May Be Collecting from Other Sources
The following lists the types of personal information that Shopify may receive from other sources (which may include sensitive personal information, depending on the jurisdiction where you reside) including:
| Types of Information | Example | Source |
|---|---|---|
| Background Check Information | Previous employment, extended education review, sanctions check, bankruptcy history, criminal history and public profiles (including any social media or other online platforms—whether professional or personal—where you have a profile that is publicly accessible). | Law enforcement agencies, educational institutions, third-party service providers, and social media or other online platforms where you have a publicly accessible profile. |
| When voluntarily supplied to a third party by the Candidate, Contact Information, Employment History, Education History | Candidate’s resume, recruiters’ notes from initial interview with a Candidate. | Recruitment agencies |
| Information related to candidate screening and assessment | Outputs and results of any assessments you may take during the process | Service providers acting on Shopify’s behalf |
| Information that is publicly available, such as work experience information and other data online | Work experience information and other information, such as your activity on professional or personal social media accounts or other sites that are publicly accessible | Public-facing sites |
| Referral information | If you're being referred, we process information that the person referring you provides about you | Referrer |
How do we use this information?
In the table below we explain the business purposes for which Shopify processes your personal information, what information is processed, and the lawful basis Shopify relies on to do so (to the extent applicable law requires a lawful basis to process personal information).
| Types of Information | How we use it | Legal Justification (where applicable) |
|---|---|---|
| Contact Information, Information on Right to Work in Country of Hire, Preferences. | To communicate with you during the recruitment process | Pre-contractual necessity; Legitimate interest in communicating with potential candidates. |
| Contact Information, Information on Right to Work in Country of Hire, Preferences. | To communicate with you in relation to open role positions which may be of interest to you | Legitimate interest in communicating new opportunities to potential candidates. |
| Contact Information. | To arrange to send a laptop and/or mobile phone to a Candidate prior to their first day | Legitimate Interest in providing prospective employees with essential work equipment to carry out their duties. |
| Contact Information, Employment History, Information on Right to Work in Country of Hire, Education History, Information Related to Candidate Screening and Assessment. | To evaluate your attributes, qualifications and skills to determine if you are eligible for the role | Legitimate Interest in determining the skills and qualifications of a candidate. |
| Contact Information, Employment History, Information on Right to Work in Country of Hire, Education History. | To prepare for interviews or screening discussions | Legitimate Interest in identifying candidates qualified for open roles. |
| Contact Information, Identity Verification Documents, Date of Birth, National ID/Tax ID Number, Education History, and any information or activity on social media profiles (whether professional or personal) that are publicly accessible. | To conduct a background check where lawful to do so and where such checks are considered relevant to the role | Legitimate interests (or consent to the extent legally required) |
| Information on Right to Work in Country of Hire. | To verify employment authorization/eligibility in the country of hire | Compliance with a legal obligation (i.e., to ensure an employee has the right to work under applicable laws) |
| Personal information Shopify processes as listed herein | To facilitate internal research, analysis, internal reporting, including research/analysis/reporting in relation to diversity and inclusion, business talent needs, business planning, and improving recruitment processes | Legitimate Interest for the rest of the information discussed in this Candidate Notice; Consent to the extent legally required. |
| Demographic Information | To evaluate our diversity and belonging efforts. | Consent to the extent legally required |
Candidates may optionally choose to self-identify their race/ethnicity, gender identity, sexual orientation, age, and disability. These answers will help us evaluate our diversity and belonging efforts. You do not have to answer these questions—and if you do, your answers will not be linked to your name or job application, will not be visible to the hiring manager reviewing your application, and will in no way affect your job application. If you have any questions about the collection or use of this information, please contact shopify-applicant-privacy@shopify.com .
When and with whom we share your information
Shopify uses a number of third party tools and service providers to help us operate and carry out the business purposes listed above. We may share your information with those service providers to support these efforts, as well as with other third parties. For example, we may share your information with:
| Service Provider | Purpose | Types of Data |
|---|---|---|
| Other Entities of the Shopify Group | To provide services and support across the Shopify group for recruitment and onboarding purposes. | Contact Information, Right to Work in Country of Hire |
| Ashby | When you apply for a position, refer a candidate, or are being considered for a role at Shopify, your information is stored with Ashby, in accordance with our agreement with them. We use this information to evaluate your candidacy for the posted position. We may also store this information, and may use it in relation to future positions to which you apply, or which we believe may be relevant to you given your background. | Contact Information, Employment History, Information on Right to Work in Country of Hire, Education History, Potential of salary expectations, Reference notes, Interview notes, Job application history (internal/external applicants), Demographic Information, Information Related To Candidate Screening and Assessment |
| Other Third Parties | Shopify might also share your information described in the ‘Information Shopify May Collect About You’ Section above with regulators, law enforcement, other government agencies, industry partners, our advisors if we have a good-faith belief that it is necessary to: respond pursuant to applicable law or regulations, court orders, legal process, or government requests. For example, sharing with regulators, law enforcement, or other government agencies in response to legal requests or sharing with civil litigants pursuant to court orders; protect the rights, property and safety of our company, our employees, or others, including to prevent death or imminent bodily harm. For example, sharing with law enforcement, in emergency situations where we learn that a person’s life is at risk. | Contact Information, Employment History, Education History, SIN, Address history (Provided for social/background checks through Sterling) - Collected and seen through third party but not received by Shopify |
| Formstack | To prepare offers of employment for candidates. | Contact information (Name) - Only kept in Formstack for 7 days. |
| Helpdesk | To send offers of employment to candidates. | Contact information (Email) |
| Offer Bot | To prepare offers of employment for candidates. | Contact information (Name). Kept in iHub for 30 days. |
| Slack | To prepare offers of employment for candidates. | Contact Information (Name). Retention period of two months. |
When we share your information with third party service providers, we take commercially reasonable steps to ensure, both technically and contractually, that they will protect your information like we do.
We may also be legally required in certain circumstances to share information with third parties, for example if we receive a court order or subpoena requiring us to share information with law enforcement.
Shopify does not sell the personal information of applicants, nor do we share it for purposes of cross-context behavioral advertising.
International Transfers
Shopify has employees and contractors working around the world, including in Europe. If you have applied for a position in Europe, the UK, or Switzerland, your personal information is controlled by the Shopify entity you applied for a position with. We may transfer your data to Canada and the United States so that we can process all of our candidate information centrally, to facilitate the recruitment and onboarding process. When we send your information across borders, we take steps to protect your information.
Your information may be sent to other Shopify locations and to service providers who may be located in other regions, including Canada (where we are headquartered) and the United States. When we send your personal information outside of Europe, we do so in accordance with European law, including appropriate safeguards such as the Standard Contractual Clauses.
If you reside in Europe, the UK, or Switzerland, when we send your personal information to Canada, it is protected under Canadian law, which the European Commission has found will adequately protect your information.
Finally, while we do what we can to protect your information, we may at times be legally required to disclose your personal information (for example, if we receive a valid court order). For information about how we respond to such orders, please review our Guidelines for Legal Requests.
How long we retain your personal information
We store your personal information for as long as necessary for the purposes outlined in this privacy policy, including to fulfil our contractual obligations to you, to comply with our legal obligations and where it is in our legitimate interests to do so. When we have no ongoing legitimate business purpose to process your information, we will either delete or anonymize it.
Notice to UK, EEA, AU, and California Candidates
- You have rights to correct, update, and request access to your personal information and information about our processing of your personal information;
- request rectification of your personal information held by us;
- request that we cease or suspend the processing your personal information;
- request that we delete your personal information;
- request that we port your personal information to another service provider;
- request that we restrict our processing of your personal information (including limiting the use of sensitive personal information, as applicable);
- object to certain processing activities (e.g. profiling activities based on our legitimate interests, automated decision making, etc.);
- lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. In Ireland, the Data Protection Commission is the relevant supervisory authority. You can contact them using the contact information provided on their website.
When Shopify has obtained your consent to process your personal information, under applicable law your consent may be withdrawn at any time with future effect. If this applies and you withdraw consent, it will not invalidate (1) the lawfulness of any processing Shopify conducted prior to the withdrawal, or (2) Shopify’s continued processing of some or all of your personal information under other legal bases, where applicable.
Please note that we may need to verify your identity before facilitating or enabling you to exercise your personal information rights, and thus may request certain information from you when you submit any such requests. Under applicable law, you may also submit personal information requests through an authorized agent, in which case, we may request further information to verify the authenticity of the request and the agent’s authorization to act on your behalf.
If you have any questions about how we use or process your information, or if you would like to exercise your personal information rights (where applicable), please contact Shopify’s privacy team through Shopify Support or our Data Subject Request Portal .
If you live in the European Economic Area, you have the right to lodge a complaint with Shopify lead supervisory authority, the Data Protection Commission, or your local supervisory authority.
How you can reach us
If you would like to ask about, make a request relating to, or complain about how we process your personal information, please contact shopify-applicant-privacy@shopify.com , or mail us at one of the addresses below. If you would like to submit a legally binding request to demand someone else’s personal information (for example, if you have a subpoena or court order), please review our Guidelines for Legal Requests .
ATTN: Privacy Officer
151 O’Connor Street
Ground floor,
Ottawa, ON K2P 2L8
Canada
If you are located in Europe, the Middle East, South America, or Africa:
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
If you are located in Asia, Australia, or New Zealand:
Attn: Data Protection Officer
77 Robinson Road,
#13-00 Robinson 77,
Singapore 068896