Coinbase Commerce Privacy Policy

Last updated: December 3, 2024

Coinbase Commerce is a service that facilitates the acceptance of cryptocurrencies as payment for goods and services provided by Coinbase Bermuda Technologies Limited (“Coinbase Commerce”, “we”,  “us”,  or “our”). We respect and protect the privacy of those who explore our Services (“Users”) and Users who sign up for and access our Services (“Customers”) (together referred to as “you” and “your”). 

This Privacy Policy (the “Policy”) explains how we collect, use, and share personal information when you explore, sign up for or access our “Services”, which include the services offered on  our website at https://commerce.coinbase.com, the Coinbase Commerce service or any Coinbase Commerce application programming interface (“API”) or third party applications relying on such API, or any other websites, pages, features, or content related to the Coinbase Commerce service.

If you reside outside of the UK and the European Economic Area (the “EEA”), accessing and using our Services means that you accept this Policy and its terms. 

This Policy does not apply to any processing which Coinbase Commerce carries out as a processor on behalf of Customers. Coinbase Commerce does not have a direct relationship with Customers’ End Users. A “Customer End User” is an individual that provides their personal information to Customers. We may ask Customers’ End Users to provide us with feedback on the Services. Please note that we do not control websites, applications, or services operated by third parties, and we are not responsible for their actions. We encourage you to review the privacy policies of the other websites and services you use to access or interact with our Services.

We collect the following personal information when providing the Services:

Information you provide

Automatically collected information

Information we obtain from Affiliates and third parties

We may use your personal information for the following purposes or as otherwise described at the time of collection. If you reside outside the United Kingdom or European Economic Area (“EEA”), the legal bases on which we rely in your country may differ from those listed below.

We implement technical and organizational measures designed to protect the confidentiality of your data.

Data use necessary to perform our contract with you

We use certain information that is necessary to conclude and perform our Terms of Service or other relevant contract(s) with you. We will need to terminate your account if we cannot process your personal information for such purposes.

Data use to comply with our legal obligations

Data use for Legitimate Interests

We rely on our legitimate interests or those of third parties (like our other Customers and in some cases, the general public) where they are not outweighed by your rights and freedoms. In the EEA and UK, you have the right to object to, and seek the restriction of, this processing. See [Section 7. Your Privacy Rights and Choices] for more information.

Data use based on your consent

When we use your information based on your consent, you have the right to withdraw your consent at any time on a go-forward basis (which will not affect our prior use of your data, which relied on your previously given consent). You may change your device-based or in-app settings anytime or as described in Section [7]. Your Privacy Rights and Choices.

Data use to protect your or others’ vital interests

If you reside outside the United Kingdom or EEA, the legal bases on which we rely in your country may differ from those listed above.

We work with service providers, partners and other  third-parties providers to help us provide our Services, and as a result we need to share certain information with these third parties. 

Personal information that we process and collect may be transferred betweenAffiliates and employees affiliated with us as a normal part of conducting business and offering our Services to you.

When you use third-party services (like when you use integrations) or websites that are linked through our Services, the providers of those services or products may receive information about you .

We may also share your information with our advisors, regulators, tax authorities, law enforcement, government agencies, and industry partners when needed to:

We retain your information as needed to provide our Services comply with  legal obligations or protect our or others’ interests. While retention requirements vary by country, we maintain internal retention policies on the basis of how information needs to be used. This includes considerations such as when the information was collected or created, whether it is necessary in order to continue offering you our Services, whether we are required to hold the information to comply with our legal obligations, other financial regulatory obligations, or information preservation requirements. We also keep certain information where necessary to protect the safety, security and integrity of our Services and Users.

Please contact us if you have questions about retention periods for a particular aspect of your personal information which is not detailed above.

The Services are not directed to persons under the age of 18, and we do not knowingly request or collect personal information from any person under the age of 18. If you are under the age of 18, please do not provide any personal information through the Sites or Services. If a user submitting personal information is suspected of being younger than 18 years of age, Commerce will require the user to close his or her account and will take steps to delete the information as soon as possible. Please notify us if you know of any individuals under the age of 18 using our Services so we can take action to prevent access to our Services.

To facilitate our global operations, Coinbase Commerce, its Affiliates, third-party partners, and service providers may transfer, store, and process your personal information throughout the world, including Ireland, Germany, Singapore, the UK, the US, and the Philippines. 

If you reside in the EEA, Switzerland, or the United Kingdom, we rely upon a variety of legal mechanisms to facilitate these transfers of your personal information (collectively, “European Personal Data”).

Depending on where you live, you may be able to exercise certain privacy rights related to your personal information. You can make privacy rights requests relating to your personal information by contacting us at commerce@coinbase.com so that we may consider your request under applicable law. If any of the rights listed below are not provided under law for your operating entity or jurisdiction, we have absolute discretion in providing you with these rights. 

To protect your privacy and security, we may take steps to verify your identity before complying with your request and we may decline your request if we are unable to verify your identity.

Under certain US data privacy laws, as well as in Brazil, you may also designate an authorized agent to make these requests on your behalf. 

These rights are not absolute, and may be denied in accordance with applicable law. 

This section is for California residents, and describes how we collect, use, and disclose your personal information. Any terms defined in the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020) (“CCPA”) have the same meaning when used in the California Privacy Notice. The personal information and the sources from which we have collected about California consumers in the past 12 months is described in the “Information We Collect” section above, depending on the nature of your relationship with us. In addition, the personal information that we have disclosed about California consumers for a business purpose is described in the “How We Share Information With Affiliates and Third Parties” section above. Coinbase Commerce does not use or disclose Sensitive Personal Information for purposes other than those expressly permitted under the CCPA with consent.  We do not “sell” or “share” (as those terms are defined under the CCPA) personal information, nor have we done so in the preceding 12 months. Further, we do not have actual knowledge that we “sell” or “share” personal information of residents under 16 years of age. 

California Privacy Rights. As a California resident, you have access, correction, deletion and non-discrimination rights in relation to the personal information that we have collected about you, as described in the “Your Privacy Rights and Choices” section above.

You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

If you have any questions about this Policy, or if you have a complaint,contact us at commerce@coinbase.com or by writing to us at Coinbase Commerce, One Marina Boulevard, #28-00, Singapore 018989.

We’re constantly trying to improve our Services, so we may need to change this Policy from time to time as well. We post any changes we make to our Policy on this page and, where appropriate, we will provide you with reasonable notice of any material changes before they take effect or as otherwise required by law. The date the Policy was last updated is identified at the top of this page. 

We may provide additional "just-in-time" disclosures or additional information about how we collect or use your information in the context of specific Services. These notices may supplement or clarify our privacy practices or may provide you with additional choices about how we use your information.