USER CORPORATE RULES

These User Corporate Rules are available to Users at any time via a link accessible in the applicable
Service Privacy Policy.
I.

OBJECTIVE
eBay’s goal is to apply uniform, adequate and global data protection and privacy standards for the handlingof user (User) personal information (User Information) throughout eBay Inc. and eBay affiliates, subsidiaries and joint ventures (collectively, eBay Entities). For the purposes of these Corporate Rules, eBay Entity
means eBay and any entity directly or indirectly controlled by eBay, that processes User Information, where
Control means the ownership of greater than fifty percent (50%) of the voting power to elect the directorsof the company, or greater than fifty percent (50%) of the ownership interest in the company.

II.

SCOPE
These Binding Corporate Rules (Corporate Rules) are corporate guidelines that apply to the processing ofUser Information by eBay Entities.
User Information means information relating to an identifiable User. An identifiable User is an individual
who can be identified, directly or indirectly, based upon the information collected about the individual in
the context of an eBay Entity providing a Service to them. The term Service applies to a website or otherproduct offered by an eBay Entity for use by a User. The term User applies to individuals that have utilizeda Service provided by an eBay Entity.
eBay Entities do not knowingly process User Information revealing racial or ethnic origin, political opinions,religious or philosophical beliefs, trade-union membership, or concerning health, sexual life or criminal
records (Sensitive Information). To the extent Sensitive Information is manifestly made public by the Userhim/herself and provided to eBay Entities, eBay Entities do not process it for their own purposes.

III.

APPLICATION OF LAWS
With varying legal requirements throughout the world relating to data protection, eBay’s Corporate Rules
establishes a consistent set of requirements to help ensure the appropriate use of User Information. While
the Corporate Rules create a baseline requirement for eBay Entities to comply with, eBay Entities willcomply with applicable laws that may impose a stricter standard than those set forth in these Corporate
Rules.
All eBay Entities are obligated to comply with these Corporate Rules. Additionally, all employees of eBay
should follow these Corporate Rules, which are part of the eBay Code of Business Conduct.
The Corporate Rules are global User Information processing guidelines for eBay Entities. Collection andprocessing of User Information shall occur in accordance with the Service’s term and conditions, the law
applicable to the User and the guidelines established by these Corporate Rules. Where applicable law
is more protective than the guidelines set forth by the Corporate Rules, eBay Entities will process User
Information in accordance with the applicable law. If applicable law provides for a lower level of protection,
the guidelines of the Corporate Rules shall apply. The Corporate Rules are binding obligations and failure tofollow them may result in employee corrective action, including termination and other penalties as provided
by law.

USER CORPORATE RULES

Where an eBay Entity has reason to believe that applicable law may prevent compliance with the
Corporate Rules resulting in a substantial effect on the protections provided by the Corporate
Rules, the eBay Entity will promptly inform the eBay privacy team, which will, in turn, informthe relevant data protection authorities (except where prohibited by law enforcement or othergovernment official).
Where there are multiple interpretations of the commitments, terms or definitions made in these
Corporate Rules, eBay Entities shall interpret the Corporate Rules in a way that is most consistent
with the basic concepts of the principles of EU Directive 95/46/EC.

IV.

PRINCIPLES FOR PROCESSING PERSONAL INFORMATION
Processing means any operation or set of operations which is performed upon User Information, whether
or not by automatic means such as collection, recording, organization, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available,alignment or combination, blocking erasure or destruction.
eBay Entities observe the following processing principles for User Information:•

process User Information fairly and lawfully;•

provide notice to Users about the processing of their personal information and their rights;•

collect User Information for specified, legitimate purposes and not process further in ways incompatible
with those purposes;•

maintain User Information in adequate and relevant ways, in relation to the purposes for which they arecollected;•

keep User Information accurate and up-to-date as reasonably possible;•

process User Information in a way that is relevant and not excessive for the purposes which they arecollected and used;•

store User Information for as long as necessary for the Services; and•protect User Information with appropriate physical, technical and organizational security measures toprevent unauthorized access, unlawful processing and unauthorized or accidental loss, destruction anddamage.

Where the processing involves automatic decision-making or processing which significantly affects theUser (Automated Decisions), eBay Entities shall provide suitable measures to safeguard the User’s
legitimate interests, such as providing the User an opportunity to have a customer support representative
review the decision manually and permit the User to provide their point of view.

V.

PURPOSES FOR PROCESSING USER INFORMATIONeBay Data Controllers must provide a privacy policy and disclose the nature and type of User Information
processed and transferred. Generally, eBay Data Controllers process User Information to facilitate theServices Users request, resolve disputes, troubleshoot problems, process transactions, collect fees owed,

USER CORPORATE RULES

measure consumer interest in eBay’s Services, inform Users about online and offline offers, products,
Services, and updates, customize Users’ experiences, detect and protect eBay against error, fraud andother criminal activity, enforce the Service’s terms and conditions and as otherwise described to Users at
the time of collection.
Where the Data Controller transfers User Information to a Data Processor, the Service’s privacy policy mustdescribe the processing performed by the Data Processor and the nature and type of Data Processors.
Processing of User Information is limited to the purposes and conditions described above, the disclosures
made in the Service’s privacy policy and the directions of the Data Controller. Further processing in a way
incompatible with those purposes will not take place unless a User is notified and consent is received
according to applicable law.
The Services’ privacy policy shall be accessible via a link in a prominent location of each Service and/or displayed during registration provides additional details according to applicable law regarding thecollection, processing, protection and transfer of User Information.

VI.

SECURITY, CONFIDENTIALITY AND PRIVACY AWARENESS TRAINING
eBay Entities use physical, technical and organizational security controls commensurate with the amountand sensitivity of the User Information to prevent unauthorized access, use, loss, destruction and damage.
eBay Entities use encryption, firewalls, access controls, standards and other procedures to protect User
Information from unauthorized access. Physical and logical access to electronic and hard copy files isfurther restricted based upon job responsibilities and business needs.
eBay Entities conduct privacy and information security awareness training to emphasize and inform
employees of the need to protect and secure User Information. Access to User Information shall determine
the need for additional training relating to specific policies as well as these Corporate Rules. Employees arealso required to review the Company Confidentiality Agreement and these Corporate Rules. eBay Entities
inform employees that failure to comply with these policies may result in disciplinary actions. A copy ofthese Corporate Rules and other relevant privacy and security related policies and procedures are available
to employees at any time.

VII.

USER CHOICES
Users that do not wish to receive marketing communications from eBay Entities should indicate theirpreference on their account profile page or by following the directions provided in an email or from a link on
the advertisement.
eBay Entities will strive to provide Users with the opportunity to review, access and rectify their own User
Information using the appropriate online tool or self service process as is described on the Service’s
website they visited. In all cases, Users have the right to submit a data subject access request to view User
Information not accessible via the Service’s website. User should contact customer support via directions
provided by the Service. eBay Entities will comply with reasonable requests in a commercially reasonable
period of time so long as it does not require a disproportionate effort to retrieve and where applicable law
requires access. In these instances, Users may be required to provide proof of their identity and may besubject to a servicing fee as permitted by applicable law.

USER CORPORATE RULES

Users who object to the processing of their User Information may request to have their accounts closed
by following the instructions provided via the Service’s website. eBay Entities will remove or renderanonymous a User’s information from a Service as soon as reasonably possible based upon accountactivity and in accordance with applicable law. In some instances, eBay Entities may delay the closure ofan account or retain User Information to conduct an investigation or where required by law. eBay Entities
may also retain User Information from closed accounts to comply with law, prevent fraud, collect any fees
owed, resolve disputes, troubleshoot problems, assist with any investigations, enforce a Service’s terms
and conditions, comply with legal requirements and take other actions otherwise permitted by applicable
law.

VIII.

TRANSFERRING AND SHARING USER INFORMATIONeBay Entities share User Information in the normal course and scope of business with other eBay Entities
worldwide to facilitate the Services Users request, prevent fraud, provide joint content and Services andas described in the Services Privacy Policy or at the time of collection. eBay Entities may transfer User
Information to other eBay Entities worldwide under the authority and only on the instructions of the Data
Controller (except where required by the relevant eBay Entities’ local law or local competent authorities)
when there is a legitimate business need, sufficient technical and organizational security measures exist
and the recipient has complied with the Corporate Rules or provides an adequate level of protection whenprocessing User Information (for instance by entering into contracts based on the model clauses for thetransfer of EU User Information to processors or controllers established in third countries published by theEuropean Commission).
eBay Entities may share User Information with third party processors (such as service providers or vendors)
worldwide who help with their business operations. The Service’s Privacy Policy further describes the typesof third parties eBay Entities may share User Information with and under what circumstances. Contracts
with third party processors require sufficient technical and organizational security measures, limit the use ofUser Information to purposes defined by the Data Controller and retain control of User Information whereapplicable. Additionally, eBay Entities will only transfer User Information of Users located in the EU to
third party processors that provide an adequate level of protection when processing User Information (forinstance by entering into contracts based on the model clauses for the transfer of EU User Information toprocessors established in third countries published by the European Commission). Agreements with third
party processors provide for legal remedies in the event of a breach of the agreement.
According to applicable law, treaties or applicable international conventions, eBay Entities may share User
Information with law enforcement, regulatory authorities or other third parties when: required as a matter oflaw; it is necessary to protect eBay’s rights; it is necessary to keep the Services free from abuse; or there
is a legitimate purpose (e.g., to prevent imminent physical harm, financial loss or to report suspected illegal
activity).
eBay Entities may disclose User Information to other third parties for the third party’s own purposes inaccordance with the User’s instructions or with the unambiguous informed consent of the User (wherepermissible under applicable law).

USER CORPORATE RULES

IX.

DIRECT MARKETING
eBay Entities do not sell or rent User Information to third parties for their marketing purposes without
the User’s prior consent. With the exception to those Users who have selected not to receive certain
communications, eBay Entities may use User Information to target communications to Users based on theirinterests according to applicable law.

X.

COMPLAINT HANDLING PROCESS
If a User believes that his/her User Information has been processed in violation of the Corporate Rules,
the User may report concerns to the customer support of the Data Controller (i.e., the eBay Entity
identified within the terms and conditions of the Services the User has requested) (Data Controller) via
the Service’s website, email, or as otherwise indicated in the Service’s terms and conditions. Users cangenerally find answers to the most common privacy questions and concerns by typing the word “privacy”
into the relevant Service’s help section, which will usually direct the User to a privacy specific page orpolicy. The “help” section of the relevant Service is the unique entry point for all Users’ queries relating totheir privacy or the processing of their User Information and provides User’s the opportunity to contact
customer support. Customer support shall investigate and attempt to resolve concerns raised by Users.
Employees responsible for addressing privacy related concerns work closely with the eBay privacy teamand issue comments consistent with the policies, procedures and guidance issued by the eBay privacy
team. If a User believes their concern has not been addressed adequately, they can request their concern
be escalated to the legal department or the eBay privacy team. Escalation paths shall be determined based
upon the nature and scope of the concern and shall be forwarded to the appropriate team without delays.
A response to the complaint shall be provided to the User within a reasonable timeframe.
The eBay privacy team is a corporate team reporting into eBay Inc. and is responsible for privacy mattersfor all eBay Entities globally. The eBay privacy team develops and coordinates implementation of its
compliance strategy across eBay Entities. The eBay privacy team is led by the Global Privacy Leader (asenior position within eBay Inc.) and interacts with other groups such as operations, information security,
risk and internal audit to ensure consistent privacy communications and policies. Additionally, the eBay
privacy team has direct and indirect representatives throughout the eBay Entities that help to ensurecompliance with the Corporate Rules and applicable data protection laws.

XI.

LIABILITY AND THIRD PARTY BENEFICIARY RIGHTS
eBay Entities will comply with these Corporate Rules. The Corporate Rules are binding obligations andfailure to follow them may result in employee corrective action, including termination and other penalties asprovided by law.
eBay Europe S.à r.l., a Luxembourg private limited liability company, as advised by the eBay privacy team,accepts responsibility for and agrees to oversee the Group’s adherence to the Corporate Rules and shallhelp ensure non-EU eBay Entities take the necessary action to remedy the acts of noncompliance relating
to these Corporate Rules.
If an EU User suspects a breach of the Corporate Rules based upon User Information transferred from the
EU to an entity located outside of the EU, the User should report his/her concern to the Data Controller’scustomer support via the Service’s website, email or as otherwise indicated in the Service’s terms andUSER CORPORATE RULES

conditions. The Data Controller will investigate claims of non- compliance to determine if a violation of the
Corporate Rules has occurred. If the violation is confirmed, the Data Controller and other concerned eBay
Entities shall work together to address and resolve the violation within a commercially reasonable time.
EU Users that suspect a breach of the Corporate Rules have the right to claim enforcement of the
Corporate Rules or liability as third party beneficiaries for the following sections of the Corporate Rules: III,
IV, V, VI, VII, VIII, IX, X, XI and XIV and, where appropriate compensation from the exporting Data Controller
in the EU or its EU Headquarters (as defined in the Service’s terms and conditions) before the relevant dataprotection authority or courts in accordance with the terms set up in the Corporate Rules and applicablelaw. While it is not required, an EU User should first report his/her concern directly to the Data Controller
rather than the data protection authorities or the courts. This enables an efficient and prompt response fromthe Data Controller and minimizes possible delays from data protection authorities or court procedures. The
exporting Data Controller and its EU headquarters shall not be liable if they reasonably demonstrate thatthe non- EU Entity has not violated the Corporate Rules or is not responsible for the act resulting in thedamage claimed by the EU User.
The enforcement rights and mechanisms described above are in addition to other remedies or rights
provided by eBay or available under applicable law.

XII.

AUDIT PROCEDURES
To help ensure compliance with the Corporate Rules, the eBay privacy team reviews, on a regular basis,
User Information processing activities and practices or recommends that eBay’s internal audit teamconduct a review of the identified activities and practices. The internal audit team is an independentand objective advisor to management and the Board of Directors, through the audit committee andcommunicates audit findings to the Board of Directors. The internal audit team and the eBay privacy teamshall, if necessary, require an action plan to ensure compliance with the Corporate Rules. To the extent thatinternal groups do not resolve matters adequately, eBay may appoint independent external auditors forfurther resolution.
The eBay privacy team shall review and address matters relating to non-compliance with the Corporate
Rules identified in the course of a review or upon notice by an eBay Entity, User, employee or otherindividual. Audit findings are available to relevant data protection authorities upon request. eBay will redact
portions of the audit to ensure confidentiality of proprietary or otherwise company confidential information.
Further, eBay will only provide audit findings relating to privacy.

XIII.

MODIFICATIONS TO THE CORPORATE RULES
eBay reserves the right to modify the Corporate Rules as necessary, for example, to comply with changes
in laws, regulations, eBay Entities’ practices, procedures and organizational structure or requirements
imposed by data protection authorities. The eBay privacy team must approve all changes to the Corporate
Rules and shall track all modifications to the Corporate Rules as well as any change in the eBay Entities
bound by the Corporate Rules. eBay shall report to the relevant data protection authorities changes to the
Corporate Rules where approval is required or at least on an annual basis.

USER CORPORATE RULES

Changes to the Corporate Rules shall be applicable to all existing entities bound by the Corporate Ruleson the effective date of implementation. Newly formed or acquired entities shall be bound by the Corporate
Rules or guarantee an adequate level of protection prior to processing User Information.
eBay Entities will provide notice of material changes to Users in accordance with their Service preferences
and/or shall post the revised Corporate Rules on select external websites accessible by Users. Revisions to
the Corporate Rules are effective within a reasonable period after eBay notifies the User and/or posts therevised Corporate Rules.

XIV.

OBLIGATIONS TOWARD DATA PROTECTION AUTHORITIESeBay Entities will respond diligently and appropriately to requests from data protection authorities about
the Corporate Rules and their compliance with privacy laws and regulations. If an employee receives
such a request from a data protection authority, he or she should immediately inform a member of theeBay privacy team or legal department so that the relevant eBay Entity can provide the data protection
authorities with names and contact details of relevant contact persons within eBay who will reply to thedata protection authority.
With regard to transfers of User Information between eBay Entities, the importing and exporting entities
will cooperate with inquiries and accept audits from the data protection authority responsible for the entity
exporting the data, and respect decisions, consistent with applicable law and due process rights.