Shopify — Transparency Report
Shopify is committed to maintaining the trust of our 1,000,000+ merchants and their customers around the globe. We know that transparency is essential to that trust, and we want our merchants, customers, and partners to understand how we safeguard their personal information.
In order to provide greater understanding of how we protect our users’ information when responding to legal requests for disclosure of personal information, we published our Guidelines on Legal Requests for Information. Our first annual Transparency Report provides data on how these principles are applied in practice, and includes requests we received from January 1, 2018 through December 31, 2018.
Our guiding principles
Shopify is committed to protecting the privacy of our merchants, customers, partners, and everyone who entrusts us with their personal information. We believe that merchants own their personal information and the personal information of their customers. We are publishing this Transparency Report to:
- Make commerce better for everyone by building consumer confidence through transparency, as recommended by the Office of the Privacy Commissioner of Canada.
- Support an informed public debate on privacy rights by joining other members of our industry in reporting on government and other legal requests for access to data.
- Comply with the spirit of and the principles underlying PIPEDA (the Canadian federal private sector privacy law) and the GDPR (the European Union’s data protection regulation).
To protect the privacy of our merchants, customers, and partners, we follow the below process upon receipt of a request to produce information about a merchant, a merchant’s customer, or a partner:
- We will refuse to disclose personal information without a subpoena or court order issued by a body that has jurisdiction over Shopify.
- Legal requests must be addressed to the correct Shopify entity (such as Shopify Inc. or Shopify International Limited).
- We will always notify affected individuals before we disclose information, unless prohibited by law, and minimize the amount of personal information that we disclose.
In 2018, we received 115 legal requests for information. Of those requests, 66 resulted in the disclosure of information, of which we notified the affected individual 45 times. We objected to 49 requests for information.
We review the following factors to ensure that each order is legally and procedurally valid, broken down by heading below:
- Jurisdiction and authority of requester
- Type of legal request
- Shopify location and type of information requested