Paddle

Paddle is a payment processing company incorporated in England and Wales.

4.8/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? No

10/10

Score

Yes

Yes, but you may opt-out

35%

Yes, but you must opt-in

70%

100%

Citation

We do not share your personal information with third parties without your consent other than: With third parties who work on our behalf provided such third parties adhere to the data protection principles set out in the European Union Directive and/or Regulation on Data Protection or other applicable legilsation, or enter into a written agreement with Paddle requiring that the third party provide at least the same level of privacy protection as is required by such Principles; To comply with laws or to respond to lawful requests and legal process (provided that Paddle will endeavour to notify you if Paddle has received a lawful request for your information); To protect the rights and property of Paddle, our agents, customers and others including to enforce our agreements, policies and terms of use; In an emergency, including to protect the personal safety of any person; and For the purposes of a business deal (or negotiation of a business deal) involving sale or transfer of all or a part of our business or assets (business deals may include, for example, any merger, financing, acquisition, divestiture or bankruptcy transaction or proceeding).

Does the service allow you to permanently delete your personal data? Yes, by contacting someone

3/5

Does the service allow third-party access to private personal data? Yes

0/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

Notes

According to NoScript, some notable connections are to Cloudfront, "js.hsforms.net" (CRM), and "identity.netlify.com" (CDN), as well as the notable Google Tag Manager.

When does the policy allow law enforcement access to personal data? Only when required by a court order or subpoena

4/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

To comply with laws or to respond to lawful requests and legal process (provided that Paddle will endeavour to notify you if Paddle has received a lawful request for your information);

Transparency

Does the policy outline the service's general security practices? Somewhat

1/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

Paddle takes the protection of customer data extremely seriously. Technical measures are in place to prevent unauthorised or unlawful access to data and against accidental loss or destruction of, or damage to, data.
[...]
Paddle takes reasonable steps to help protect your personal information in an effort to prevent loss, misuse, and unauthorised access, disclosure, alteration and destruction. It is your responsibility to protect your user names and passwords to help prevent anyone from accessing or abusing your accounts and services. You should not use or reuse the same passwords you use with other accounts as your password for our services.

Is the policy's history made available? Only the date it was last modified

3/5

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Will affected users be notified when the policy is meaningfully changed? No

0/5

Collection

Does the service collect personal data from third parties? Yes

0/10

Is it clear why the service collects the personal data that it does? Yes

10/10

Score

Somewhat

30%

Mostly

70%

Yes

100%

N/A

The service doesn't collect any personal information.

100%

Citation

We use the information we collect primarily to provide, maintain, protect and improve our current products and to develop new ones. We use personal information collected through our Site as described in this Policy or on our Site. For example, we may use your information to: Improve our services, Site and how we operate our business; Understand and enhance your experience using our Site, products and services; Provide and deliver products and services you request; Process, manage, complete, and account for transactions; Provide customer support and respond to your requests, comments and inquiries; Invite you to participate in customer research; Create and manage online accounts you establish; Send you related information, including confirmations, invoices, technical notices, updates, security alerts and support and administrative messages; Communicate with you about promotions, upcoming events and news about products and services offered by Paddle and our selected partners; Link or combine it with other information we get from third parties, to help understand your needs and provide you with better service; and Comply with and enforce applicable legal requirements, industry standards, our policies, and our terms of use; and Protect, investigate and deter against fraudulent, unauthorised or illegal activity.

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? On an opt-out basis, for all non-critical data/uses

6/10

Some services allow users to opt-out or opt-in to of non-critical collection or use of personal data, such as collecting data for personalized advertisements.

Score

On an opt-out basis, but only for some non-critical data/uses

30%

On an opt-out basis, for all non-critical data/uses

60%

On an opt-in basis

60%

N/A (no data used for non-critical purposes)

100%

Citation

You may opt out of receiving promotional emails from Paddle by following the instructions in those emails. If you opt out, we may still send you non-promotional emails, such as emails about your Paddle projects or our ongoing business relationship. You may also send requests about your contact preferences, changes and deletions to your information including requests to opt-out of sharing your personal information with third parties by emailing help@paddle.com. Paddle will respond within thirty (30) days to any request to delete your information. Individuals who have provided information to Paddle’s customers must send requests to change or delete such information to the particular Paddle customer.

Does the policy list the personal data it collects? Yes, generally

7/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

We collect information primarily to provide better services to all of our customers. We collect information you provide to us on our Site such as your name, email address, postal address, phone number, company name, payment information and demographics. We may also obtain information from other sources and combine that with information we collect on our Site.

When you visit our Site, some information is automatically collected. This may include information such as the Operating System (OS) running on your device, Internet Protocol (IP) address, access times, browser type, and language, and the website you visited before our Site. We also collect information about how you use Paddle’s product(s).

We automatically collect information using “cookies” and Web beacons. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Site or in our emails. Among other things, cookies help us improve our Site, our marketing activities, and your experience. We use cookies to see which areas and features are popular and to count visits to our Site.

Most Web browsers are set to accept cookies by default. If you prefer, you can choose to set your browser to remove cookies and to reject cookies. If you set your browser to reject cookies, some features will be unavailable. For more information on how to reject cookies, see your browser’s instructions on changing your cookie settings.

Last Updated

June 24, 2020

Sources

Source #1 ↗

Contributors

doamatto