PayPal Extended Identifier Usage Terms

These PayPal Extended Identifier (“PPEI”) Usage Terms (“PPEI Terms”) govern your access and use of the PPEI and data derived from PPEI (collectively “PPEI Data”), an identification technology used by the PayPal entity with which you have contracted with under agreements referencing these PPEI Terms (such entity referred to herein as “PayPal” and such agreements referred to herein as “Agreements”) to provide its advertising and analytics services. We may amend or otherwise revise these PPEI Terms in accordance with the terms of the PayPal User Agreement.

a. Notwithstanding anything to the contrary in our Agreements, you agree that PayPal may use the PPEI Data to combine and link information about individuals from your site(s) or service(s) with other information across different sites, services, and platforms, including to provide advertising and analytics services to you under our Agreements.

b. You acknowledge that all rights, title, and interest to the PPEI and PPEI Data are owned and licensed by PayPal.

c. Your use of PPEI and PPEI Data is considered PayPal technology (sometimes referred to as Company Technology) licensed to you and subject to the license terms of your Agreements. If you use an API, SDK, or related technologies for PPEI, your use of those technologies is subject to all relevant PayPal Agreements.

d. You agree that PPEI Data will be considered and treated as Personal Data (or Personal Information and any variations of similar terms as used in the Agreements) and PayPal’s Confidential Information.

e. You will be responsible for complying with all obligations that apply to your processing of PPEI Data under applicable privacy and data protection law. If you share any information with any other entity related to your activities under the PPEI Terms, you will require such entities to comply with all applicable privacy and data protection law and the PPEI Terms.

f. Where applicable, you will obtain all necessary consents and provide all notices and controls as required by applicable laws, rules, and regulations to enable you to collect and process PPEI Data in accordance with the permitted purposes defined in the applicable Agreements.

g. You will only process PPEI Data in accordance with the permitted purposes defined in the applicable Agreements and with any consent, user preference or opt-out signals or strings associated with it.

h. You will implement appropriate technical and organizational measures to protect PPEI Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and always in accordance with the data protection and security terms set out in the applicable Agreements.

i. You will promptly delete PPEI Data when it is no longer required to conduct the activities described in the Agreements and in accordance with applicable law.

j. You will promptly notify PayPal of any correspondence, inquiry, or complaint (“Correspondence”) received from a data subject, regulator, or third party regarding the collection, processing, or sharing of PPEI Data under these PPEI Terms and shall co-operate with PayPal in good faith to respond to such Correspondence in accordance with applicable data protection law.

k. To the extent that the processing of PPEI Data is governed by EU Data Protection Law, Swiss Data Protection Law, and/or UK Data Protection Law, Appendix A shall also apply.

You will not (directly or indirectly through any vendor, partner, agent, or third party), and you will not allow others to, access or use the PPEI Data: (1) other than as permitted by the Agreements and these PPEI Terms; (2) other than for the permitted purposes defined in the Agreements; (3) other than in connection with PayPal advertising related services; (4) other than in accordance with any applicable consent, user preference, or opt-out signals or strings; (5) to attempt to identify an individual; (6) to map or connect the PPEI Data with personally identifying information or directly identifiable information, such as names, email addresses, phone numbers; (7) to map or connect the PPEI Data with other identifiers, such as advertising identifiers, device identifiers, or unique identifiers; (8) to make determinations or inferences about an individual’s health care, insurance, employment, financial products or services, credit, housing, criminal justice, educational enrollment or opportunities, or access to essential goods or services; (9) to infer attributes or data about an individual that would be deemed to be, or could infer, sensitive or special category Personal Data or Personal Information under applicable law, including without limitation, data about a known child or minor, an individual’s membership in a protected class, contents of communications to which you are not an intended recipient, or precise geolocation data; (10) to target advertisements to individuals under the age of 18 unless you have all required consents and permissions required by applicable law; (11) in any way that would be in conflict with PayPal’s Privacy Statement and/or the PayPal User Agreement or other PayPal Terms or Agreements; (12) to reverse engineer the PPEI or PPEI Data; (13) to create data or identifiers from the PPEI Data; or (14) in violation of applicable laws, rules, or regulations.

You will not disclose (directly or indirectly through any vendor, partner, agent, or third party), or allow others to disclose, PPEI Data to any person or entity other than: (1) as expressly required by applicable law; (2) as expressly permitted by the Agreements and these PPEI Terms; (3) as needed in connection with your use or facilitation of PayPal advertising related services; and (4) in accordance with any applicable user consents, user preference, or opt-out signals or strings.

If you disclose PPEI Data to any vendor, partner, agent, or third party, or you allow any vendor, partner, agent, or third party to collect or access PPEI Data, you must contractually require such person or entity to comply with these PPEI Terms or contractual terms that contain substantially equivalent terms.

You will be fully liable, and will indemnify, defend, and hold PayPal harmless, from any third party, including but not limited to governmental or regulatory authority, claims, actions, investigations, proceedings, fines, penalties or damages that relate to any breach of these PPEI Terms by you or by any vendor, partner, agent, or third party to which you disclose PPEI Data or allow to collect or access PPEI Data. No limitation of liability in any agreement(s) with PayPal will apply to these indemnification, defense, and hold harmless requirements.

PayPal can immediately suspend your right to use the PPEI Data upon notice to you if PayPal reasonably believes that you (or any vendor, partner, agent, or third party to which you disclose PPEI Data or that you allow to collect or access PPEI Data) have breached these PPEI Terms or the Agreements.

This Appendix A applies where and to the extent that the processing of PPEI Data pursuant to these PPEI Terms are subject to EU Data Protection Law, Swiss Data Protection Law, and/or UK Data Protection Law.
In this Appendix A, the following terms shall have the following meanings:

1.  International Transfers

1.1 Transfers between PayPal and You: To the extent that any transmission, sharing, or transferring of PPEI Data from one party to the other party is a Restricted Transfer, the Standard Contractual Clauses shall be incorporated into these PPEI Terms and apply as follows:

a) where the Restricted Transfer is an EU Restricted Transfer, the EU SCCs will apply between each party (as the data exporter) and the other party (as the data importer) as follows:

i. Module One will apply;

ii. in Clause 7, the optional docking Clause will apply;

iii. in Clause 11, the optional language will not apply;

iv. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Luxembourg law;

v. in Clause 18(b), disputes shall be resolved before the courts of Luxembourg;

vi. in Annex I:

(a) Parts A and B shall be deemed completed with the information set out in the applicable Agreements;

(b) Part C shall be deemed completed in accordance with the criteria set out in Clause 13(a) of the EU SCCs; and

vii. Annex II shall be deemed completed with the security measures set out in section h. of PPEI Terms.

b) where the Restricted Transfer is a UK Restricted Transfer, the UK Addendum will apply between the parties as follows:

i. the EU SCCs, completed as set out above shall apply between the parties, and shall be modified by the UK Addendum (completed as set out in sub-clause (ii) below); and

ii. tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from the EU SCCs, completed as set out above, and the options "Exporter" and "Importer" shall be deemed checked in table 4. The start date of the UK Addendum (as set out in table 1) shall be the effective date as set out in the applicable Agreements.

c) where the Restricted Transfer is a Swiss Restricted Transfer, the EU SCCs will apply between Customer and Partner with the following modifications:

i. references to "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss DPA;

ii. references to specific Articles of "Regulation (EU) 2016/679" shall be replaced with the equivalent article or section of the Swiss DPA;

iii. references to "EU", "Union", "Member State" and "Member State law" shall be replaced with references to "Switzerland" or "Swiss law" (as applicable);

iv. the term "member state" shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (i.e., Switzerland);

v. Clause 13(a) and Part C of Annex I are not used and the "competent supervisory authority" is the Swiss Federal Data Protection and Information Commissioner;

vi. references to the "competent supervisory authority" and "competent courts" shall be replaced with references to the "Swiss Federal Data Protection and Information Commissioner" and "applicable courts of Switzerland";

vii. in Clause 17, the EU SCCs shall be governed by the laws of Switzerland.

1.2 Onward Restricted Transfers: You will not make a Restricted Transfer of PPEI Data to a third party unless you have done all such acts and things as are necessary to ensure that the Restricted Transfer is compliant with applicable data protection law and any Standard Contractual Clauses it has executed with the other party.