EX-10.20





 Exhibit 10.20 

Pursuant to Item 601(b)(10)(iv) of Regulation S-K, certain identified information marked with [***] has been excluded from the exhibit
because it is both (i) not material and (ii) would be competitively harmful if publicly disclosed 
 PAYPAL COMMERCE PLATFORM

 GLOBAL PARTNER AGREEMENT 
 THIS
PAYPAL COMMERCE PLATFORM GLOBAL PARTNER AGREEMENT, together with all SOWs (defined below), attachments, exhibits, schedules, addenda, and other documents attached hereto or incorporated herein by reference (collectively this
“Agreement”), effective as of January 1, 2020 (the “Effective Date”), is made by and among: 
 The following
entity/entities (referred to individually and collectively as “PayPal” or the “Company”: 
 PayPal,
Inc., a Delaware corporation, with its principal place of business at 2211 North First Street, San Jose, CA 95131; 
 PayPal Pte.
Ltd, a company incorporated in Singapore, whose address is 5 Temasek Boulevard #09-01, Suntec Tower Five, Singapore 038985; 
 And the following
entity/entities (referred to individually and collectively as “Partner” or “BigCommerce”): 

BigCommerce, Inc., 11305 Four Points Drive, Building II, Third Floor, Austin, TX 78726 78726; 

BigCommerce Pty Ltd, a company organized in Australia, whose address is 130 Pitt Street, Level 5, Sydney, NSW 2000, Australia; 

BigCommerce UK Ltd, a company organized in England and Wales, whose registered address is Highlands House, Basingstoke Road, Spencers
Wood, Reading, Berkshire RG7 1NT, United Kingdom; 
 BigCommerce Software Ireland Limited, a company organized in the Republic of
Ireland, whose registered address is 32 Merrion Street Upper, Dublin 2, DO2KW80. 
 PayPal/Company and Partner/BigCommerce are referred to as a
“Party” or together as the “Parties”. 
 WHEREAS, Partner and Partner Affiliates have numerous existing agreements
with PayPal and its Affiliates governing various aspects of the integration of the PayPal Services into the Partner Product and referring merchants to PayPal, including the PayPal Partner Program Agreement (US), as amended by Amendments 1 – 15,
the PayPal Partner Program Agreement (AU), as amended, the PayPal Partner Program Agreement (NZ), as amended, and the PayPal Partner Program Agreement (UK), as amended (collectively, the “Existing Agreements”). 

WHEREAS, the Parties desire to enter into this Agreement to replace the Existing Agreements with one unified and simplified agreement, and to resolve
certain outstanding claims regarding the Existing Agreements, all as further described in this Agreement. 
 NOW, THEREFORE, in consideration of the
mutual promises contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, PayPal and Partner agree as follows: 

  

					
		  	1 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019















 DEFINITIONS 

Schedule 1 (Definitions) to this Agreement includes certain defined terms used throughout this Agreement. 

 

	1.	 BACKGROUND; THE PROGRAM 



 

	 	1.1.	 Background. Upon execution of this Agreement and in consideration for PayPal’s payment to Partner
of the amounts identified in SOW #1, the Parties agree that the Existing Agreements (excluding any standalone Nondisclosure Agreements), entered into between the Parties prior to the Effective Date shall terminate and, except for provisions in the
Existing Agreements stated to survive termination (“Surviving Terms”), such agreements will be of no further force and effect as between the Parties as further described in SOW #1. 



 

	 	1.2.	 Scope. PayPal has developed a program for its partners to integrate the PayPal Services into the Partner
Product, introduce the PayPal Services to its merchants, and refer merchants to PayPal (the “Program”). All Partner Users who are onboarded as PayPal Users through the Program shall enter into a payment processing agreement directly
with PayPal, and the Parties acknowledge and agree that Partner is not engaged in, and will not engage in, the processing of payments pursuant to this Agreement or the Program. 



 

	 	1.3.	 SOW. This Agreement provides a framework for the Party’s relationship, and the specific details of
the financial and business commitments, as well as any changes or additions to jurisdictions covered by the Agreement, features of the PayPal Service, Partner Products or their integration, as well as any changes to the Affiliates which are party to
this Agreement will be described in individual Statements of Work executed by the Parties from time to time pursuant to this Agreement (each an “SOW”). The order of precedence for any conflicting term between this Agreement and any
SOW will be the following: (i) the applicable SOW as to the matters governed by such SOW, and (ii) this Agreement. 


  

	 	1.4.	 Requirements for participation. PayPal may change the Program at any time upon twelve (12) months
written notice to [***] with an additional ninety (90) day period for implementation of such changes unless such changes are required sooner by a court, regulatory agency, Applicable Law, regulatory requirement or material security issue, in
which case, PayPal shall notify Partner as soon as reasonably practicable. Notwithstanding the foregoing, except as required by a court, regulatory agency, Applicable Law, regulatory requirement, PayPal shall not change the commissions, revenue
share or other financial terms for the Program to the detriment of Partner. In the event Partner and PayPal cannot reach agreement on the changes, the Parties shall work in good faith to escalate the issue to senior management for discussion and
resolution and if the Parties are still unable to reach Agreement, the changes will not go into effect for twelve months (12) months from the date the dispute was escalated to senior management (the “Deferral Period”), and on
notice to PayPal, Partner will have the right to terminate the Agreement effective as of the end of the Deferral Period, provided that the Tail Period will apply on the terms in place during the Deferral Period. If Partner does not give notice of
termination prior to expiration of the Deferral Period, Partner agrees to abide by and be bound by any such revisions or changes. For clarification, both Parties acknowledge and agree that deferment of changes by PayPal for the Deferral Period and
Partner’s right to terminate at the end of the Deferral Period if the dispute is not resolved, is the exclusive remedy for Partner and nothing herein shall be interpreted to permit Partner to exercise termination rights under Section 8.1
herein prior to expiration of the Deferral Period. 


  

	2.	 PARTNER OBLIGATIONS 



 

	 	2.1.	 Partner Development. Partner shall integrate the PayPal Services into the Partner Product in accordance
with the integration requirements agreed to by the Parties and included in the applicable SOW. 



  

					
		  	2 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















	 	2.2.	 Partner Marketing. In marketing the PayPal Services, Partner will: (a) ensure that all Partner
Products shall offer the PayPal Services as a preferred payment platform for its customers as may be further described in an applicable SOW, (b) describe the PayPal Services accurately and in accordance with the marketing materials that have
been agreed upon by the Parties prior to use, and (c) strictly adhere to any PayPal branding or marketing requirements or guidelines as may be communicated to Partner from time to time. 



 

	 	2.3.	 Marketing Plan: Except as may otherwise be provided in an applicable SOW, the following terms will apply
to Marketing Plans. Within thirty (30) days following the Effective Date, the Parties shall agree upon a proposed Marketing Plan for the first Program Year which shall embody Partner’s strategic and tactical plans designed to achieve goals
mutually agreed to by both parties. For each succeeding Program Year during the Term, the Parties will cooperate to formulate a proposed Marketing Plan prior to the first day of calendar quarter preceding the start of the Program Year. Each
Marketing Plan shall be as mutually agreed. Marketing Plans shall contain sufficient detail to guide the Parties’ conduct of marketing for the upcoming Program Year, including: (a) the scope, extent and timing of the campaigns and the
specific marketing channels and marketing materials to be used in each campaign; (b) the purpose of the campaigns; and (c) the allocation of costs of marketing activities between Partner and PayPal. No Marketing Plan shall require or
contemplate any marketing that would require any Party to take any action in violation of any Applicable Law. If a Marketing Plan is not completed within the applicable timeframe, then the most current Marketing Plan will remain in effect unless and
until a replacement Marketing Plan is agreed upon by the Parties. The Parties may jointly agree in writing to revise a Marketing Plan. If this happens, any such revised Marketing Plan shall describe the timing requirements to implement changes made
by the revised Marketing Plan, and the revised Marketing Plan shall remain in effect for the remainder of the Program Year or any later date specified in the revised Marketing Plan. In making any such revisions, the Parties shall take into account
and balance each Party’s economic, brand, reputation and other relevant interests. 


  

	 	2.4.	 PayPal Policies and Procedures. Partner agrees to act in good faith and not to engage and shall, to the
extent applicable, ensure each subcontractor will not engage in any unfair, deceptive or abusive acts and practices in the course of its provision of products or performance of services and duties under the Program and this Agreement.



  

	 	2.5.	 Presentation of PayPal’s Services. Partner agrees that: 



 

	 	(a)	 as it pertains to the PayPal Branded Products, it shall ensure that such products are treated as a payment
method with a level of prominence that complies with the requirements described in the applicable SOW. 


  

	 	(b)	 in representations to its merchants or in public communications, it will not mischaracterize any PayPal service
as a payment method. To the extent PayPal is entitled to receive Preferred Placement as described in an SOW, Partner agrees not to try to dissuade its merchants from using PayPal. 



 

	 	2.6.	 Customer Support. Partner will be responsible for all customer service relating to the Partner Product.
Partner will refer inquiries relating to the PayPal Services to PayPal’s customer service. 


  

	 	2.7.	 No Incentives or Surcharges. Except with respect to Australia, Partner shall ensure that there are no
surcharges placed by Partner on PayPal Services. 


  

	 	(a)	 With respect to Australia, the Partner agrees that it will not impose a surcharge or any other fee for enabling
PayPal as a payment method, that exceeds the amount the Merchant pays PayPal for that transaction or as otherwise required by law, including but not limited to, for Australia, any regulations published by the Reserve Bank of Australia from time to
time. 


 When referring the PayPal Services to the Merchants in Australia, the Partner must always: (a) inform
them that only PayPal Australia Pty Ltd (“PayPal Australia”) is able to provide the PayPal services in Australia; (b) provide them with relevant information about how they may contact PayPal; and (c) advise
them that the Partner is not an 

  

					
		  	3 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019















 
agent, or representative of PayPal, or PayPal Australia. The parties acknowledge and agree that the Partner is not an employee, agent, representative or Authorized Representative of PayPal or
PayPal Australia, and the Partner must not provide financial services of any kind on behalf of PayPal, or PayPal Australia that would require the Partner to hold an Australian Financial Services License, or be an Authorized Representative in respect
of the PayPal Services. “Australian Financial Services Licence” has the meaning set out in the Corporations Act 2001 (Cth) in Australia. “Authorized Representative” has the meaning given to that term in the
Corporations Act 2001 (Cth) in Australia. 
  

	3.	 PAYPAL OBLIGATIONS 



 

	 	3.1.	 Integration. PayPal shall provide access to PayPal technology and documentation which may be revised by
PayPal from time to time. 


  

	 	3.2.	 Provision of the PayPal Service. PayPal shall provide the PayPal Service to Partner Referred Merchants
in accordance with the User Agreement (as may be amended by PayPal and such Referred Merchant) and PayPal Privacy Policy applicable to such Referred Merchant. 



 

	 	3.3.	 Partner Support. PayPal shall respond to Partner’s inquiries in the same manner in which PayPal
responds to all similarly situated partners and in accordance with the SLAs. PayPal will be responsible for all customer service relating to the PayPal Services. PayPal will refer inquiries relating to the Partner Product to Partner’s customer
service. 


  

	4.	 INTELLECTUAL PROPERTY AND LICENSE RIGHTS 



 

	 	4.1.	 Marks. Subject to the terms and conditions of this Agreement, each Party grants to the other Party a
non-exclusive, non-transferable, worldwide, royalty-free license to use, reproduce, distribute and display the other Party’s name and Marks (defined below) solely: (a) in the case of PayPal’s Marks, solely to enable the PayPal
Services for Partner’s customers through the Partner Product, all in accordance with the applicable SOW(s) and the terms of this Agreement; (b) in the case of Partner Marks, to publicize Partner’s usage of the PayPal Services
including (i) through press releases, public announcements, and other oral communications at conferences, media events, or other marketing opportunities; (ii) on the PayPal Site or through other electronic communications such
as emails to PayPal Users, newsletters, or in materials that PayPal otherwise makes publicly available; and (iii) through any other channel to promote the use of PayPal; and (c) for any other purpose in any other publication
with the prior written approval of such Party. Any such use shall be in accordance with the other Party’s standard Mark guidelines and this Agreement. A Party shall be entitled to request removal of any use of its Marks if, in its reasonable
discretion, the use by the other Party of the Marks tarnishes, blurs, or dilutes the Marks or misappropriates the associated goodwill and such problem is not cured within five (5) business days of the using Party’s receipt of notice
of the problem. 


  

	 	4.2.	 Company Technology and APIs. 



 

	 	(a)	 Subject to the terms and conditions of this Agreement, PayPal hereby grants to Partner a non-exclusive,
non-transferable, revocable, non-sublicenseable, limited license to use Company Technology solely as required and necessary to enable the PayPal Services for Partner’s customers through the Partner Product, all in accordance with the SOW and
the terms and conditions of this Agreement (the “IP License”). Partner has agreed to the terms and conditions of the PayPal Developer Agreement at https://www.paypal.com/us/webapps/mpp/ua/xdeveloper-full?locale.x=en_US in the form
effective as of the Effective Date, which govern the use and implementation of PayPal API’s (the “API License”). As used herein, “Company Technology” means the following intellectual property or proprietary
rights of Company (or licensed to Company by a third party) used in connection with the Services: published and unpublished works of authorship, whether copyrightable or not (including without limitation databases and other compilations of
information). PayPal may change the 



  

					
		  	4 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















	 	
API License from the form in effect on the Effective Date; however, PayPal shall provide Partner at least ninety (90) days’ notice to [***] for any change to the API License that
requires Partner to modify Partner’s integration. Further, PayPal shall provide Partner at least twelve (12) months’ notice in the event PayPal deprecates any APIs. 


 

	 	(b)	 In connection with Partner’s use of PayPal’s API’s, Partner is prohibited from doing any of the
following: (i) selling, transferring, sublicensing, or disclosing Partner’s User ID to any third party (other than approved third party service providers); (ii) selling, transferring, sublicensing, and/or assigning any
interest in the Confidential Information of PayPal accessed by the APIs; and (iii) collecting any customer’s personally identifiable information that is accessed through the APIs without that customer’s express permission.



  

	 	(c)	 In the event of degradation or instability of PayPal’s system(s) or an emergency, PayPal may, in its sole
discretion, change or temporarily suspend Partner’s access to any PayPal Service, including but not limited to the APIs and databases and/or information accessed from the APIs, in order to minimize threats to and protect the operational
stability and security of PayPal’s systems. Notwithstanding the foregoing, PayPal shall use reasonable efforts to notify Partner of suspension of the PayPal Services, except that such notice shall not be required where, in the reasonable
opinion of PayPal, such notice would compromise security of PayPal’s systems or performance of the PayPal Services. PayPal shall further provide the PayPal Services in accordance with the SLAs set forth in Section 11.6.



  

	 	(d)	 As between PayPal and Partner, PayPal retains all right, title and interest in and to the PayPal Services,
Company Technology, and all intellectual property rights therein. Except as licensed herein, this Agreement does not transfer any intellectual property rights. There are no implied licenses under this Agreement, and any rights not expressly granted
to Partner in this Agreement are reserved by PayPal or its suppliers. Partner shall not directly or indirectly reverse engineer, decompile, disassemble or otherwise attempt to derive source code or other trade secrets from the PayPal Services.
Except as otherwise provided for herein including during the Tail Period, all rights and licenses granted to Partner in the PayPal Services and the intellectual property shall terminate automatically and revert to PayPal upon termination of this
Agreement or upon termination of any PayPal Service to which the rights and licenses relate. 


  

	 	(e)	 Except as otherwise provided for herein including during the Tail Period, the licenses described in this
Section shall terminate automatically upon termination of this Agreement. 


  

	 	4.3.	 Competitive or Similar Materials. Notwithstanding the foregoing, in no event shall either Party
precluded from developing for itself, having developed, acquiring, licensing, or developing for third parties, as well as marketing and/or distributing materials which are competitive with the other Party’s products and/or services, so long as
the developing Party does not violate this Section or use confidential information of the other Party in such activity. 


  

	5.	 FINANCIAL TERMS 



 

	 	5.1	 Financial terms. The financial terms set forth in each applicable SOW are hereby incorporated into, and
made a part of, this Agreement, and shall describe the manner in which Partner shall be compensated for the relationship, including for distribution of the PayPal Services through the Program. 



 

	 	5.2	 Financial Reconciliation. During the Term, the Tail Period, and a period of twelve (12) months
following the Tail Period, Partner may notify PayPal in writing of any errors or discrepancies related to any fees owed to Partner by PayPal that Partner detects within ninety (90) days following receipt of Partner’s Revenue Share payment.
The Parties will use best efforts for forty-five (45) days to resolve the error or discrepancy via mutual 



  

					
		  	5 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















	 	
collaboration. In the event Partner and PayPal cannot reach agreement on the error or discrepancy, the Parties shall escalate the issue to senior management who will use best efforts during an
additional forty-five (45) days to discuss and resolve the dispute. At Partner’s reasonable request at any time during the discussions, PayPal will make available to Partner via remote means (such as screen share) supporting documentation
relevant to reconcile the Revenue Share amounts, provided that PayPal will have no obligation to provide access to PayPal Confidential Information regarding merchant compensation, cost of transaction to PayPal, PayPal’s margins, or any other
confidential transaction data. If the Parties are unable to reach agreement after completion of the process described above, then Partner may elect to terminate the Agreement on notice to PayPal. 


 

	6.	 DATA PROTECTION 



 

	 	6.1.	 Roles. With regard to any personal data processed by either Party in connection with this Agreement,
each Party will be deemed to be a Data Controller in respect to such processing. 


  

	 	6.2.	 Responsibility. Each Party shall comply with the requirements of the Data Security Addendum, attached as
Schedule 2 to this Agreement and the Data Protection Laws applicable to Data Controllers with respect to the performance of its obligations under this Agreement (including without limitation, by implementing and maintaining at all times all
appropriate security measures in relation to the processing of personal data and by maintaining a record of all processing activities carried out under this Agreement) and shall not knowingly do anything or permit anything to be done which might
lead to a breach by the other Party of the Data Protection Laws. 


  

	7.	 CONFIDENTIALITY 



 

	 	7.1.	 Confidentiality Obligations. Each Party agrees to maintain the other Party’s Confidential
Information in confidence and not to disclose it to third parties or use it for any purpose other than as necessary and required to perform the services pursuant to this Agreement. Such restrictions shall not apply to Confidential Information that:
(a) is known by the recipient prior to the date of disclosure by the disclosing Party; (b) becomes publicly known through no act or fault of the recipient; (c) is received by recipient from a third party without a
restriction on disclosure or use; or (d) is independently developed by recipient without reference to the Confidential Information. Notwithstanding the foregoing, a Party may share Confidential Information with an affiliate in the event
that the other Party requests services from such affiliate and such affiliate shall be bound by this Section. In the event that the receiving Party is required by a court, government agency, regulatory requirement, or similar disclosure requirement
to disclose Confidential Information of the disclosing Party, the receiving Party shall immediately notify the disclosing Party and shall use reasonable efforts to obtain confidential treatment or a protection order of any Confidential Information
that is required to be disclosed. The obligations hereunder shall survive the termination of this Agreement or until such time as such information becomes public information through no fault of the receiving Party 



 

	 	7.2.	 Protection of Confidential Information. Each Party acknowledges that monetary damages may not be a
sufficient remedy for unauthorized use or disclosure of the other Party’s Confidential Information and that the disclosing Party will be entitled (without waiving any other rights or remedies) to injunctive or equitable relief as may be deemed
proper by a court of competent jurisdiction, without obligation to post any bond. 


  

	 	7.3.	 Return of Confidential Information. Upon termination of this Agreement, at the request of a disclosing
Party, the receiving Party shall return to the disclosing Party within ten (10) days all Confidential Information of the Party and all documents or media containing any such Confidential Information and any and all copies or extracts thereof or
certify such Confidential Information’s destruction. The foregoing obligation shall not be applicable to any Confidential Information that a Party is required to retain in order to comply with




  

					
		  	6 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















	 	
applicable law, rules or regulations or pursuant to the receiving Party’s disaster recovery plan, provided such retained Confidential Information will remain subject to the obligations in
this Section 7. 

  

	 	7.4.	 User Data. In the event a Party discloses Confidential User Data to the other Party, such receiving
Party understands and agrees that it shall have the right to use the Confidential User Data, and any derivative works thereof, only as strictly required and necessary to perform its obligations under this Agreement and that it is strictly prohibited
from combining the Confidential User Data with its own User Data or from directly or indirectly using the Confidential User Data in connection with any marketing activities. Further, the receiving Party shall keep the disclosing Party’s
Confidential User Data only for as long as necessary to perform its obligations under this Agreement. 


  

	8.	 TERM AND TERMINATION 



 

	 	8.1.	 Term. This Agreement is effective as of the Effective Date and shall continue until the fourth
anniversary of the Effective Date (“Initial Term”) unless and until terminated as set out below. Following the Initial Term, this Agreement will automatically renew for subsequent one year terms (each, a “Renewal
Term”, and together with the Initial Term, the “Term”) unless terminated as provided herein. 


  

	 	8.2.	 Termination. Neither Party may terminate this Agreement or any SOW for convenience during the Initial
Term. After the Initial Term, either Party may terminate this Agreement at any time upon thirty (30) calendar days’ written notice for any reason. Each Party may terminate this Agreement immediately if the other Party breaches a material
term of this Agreement and the breach is not cured within thirty (30) calendar days after the breaching Party receives written notice of the breach. This Agreement may be terminated by either Party effective immediately upon written notice, in
the event that: (a) the other Party files a petition in bankruptcy, files a petition seeking any reorganization, arrangement, composition, or similar relief under any law regarding insolvency or relief for debtors, or makes an assignment
for the benefit of creditors; (b) a receiver, trustee, or similar officer is appointed for the business or property of the other Party; (c) any involuntary petition or proceeding under bankruptcy or insolvency laws is
instituted against the other Party and not stayed, enjoined, or discharged within sixty (60) days; or (d) the other Party adopts a resolution for discontinuance of its business or for dissolution. 



 

	 	8.3.	 Effect of Termination. Upon termination or expiration of this Agreement for any reason, the following
shall apply: (a) all rights and licenses under this Agreement will immediately terminate except as otherwise provided, including with regard to ongoing rights during the Tail Period; (b) each Party must destroy any of the
Confidential User Data of the other Party in its possession within seven (7) calendar days, except as provided below, and, upon the owning Party’s request, provide proof of such destruction within seven (7) calendar days of receiving
such request; and (c) each Party will remain liable for any amounts or other liability under this Agreement that arose prior to the date of termination; and (d) during the Tail Period, (i) PayPal’s obligation to pay
the Revenue Share and other payment obligations under an SOW for all Referred Merchants onboarded through expiration of the Tail Period; (ii) PayPal’s grant of the API license as described in Section 4.2(a) as needed to support the
Referred Merchants and Partner; (iii) PayPal’s support of the Referred Merchants and the Partner Integration; and (iv) Partner’s right to add new Referred Merchants as provided under this Agreement and each SOW. A Party is not
required to destroy Confidential User Data of the other Party where the requested Party (i) is obligated to keep the Confidential User Data for a longer period pursuant to PCI-DSS rules, any rules set by the financial institutions of the
merchant or the cardholder, or by Applicable Law, in which case the relevant Party will delete the Confidential User Data when permissible; or (ii) any archival copy retained systemically as a function of the requested Party’s
disaster recovery or backup process, provided such retained Confidential Information will remain subject to the obligations in Section 7. 



  

					
		  	7 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















	9.	 LIMITATION OF LIABILITY 



 

	 	9.1.	 IN NO EVENT SHALL PAYPAL OR PARTNER (OR EITHER OF THEIR AFFILIATES, DIRECTORS, OFFICERS, EMPLOYEES OR
REPRESENTATIVES) BE LIABLE FOR SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES OR LOST PROFITS (HOWEVER ARISING, INCLUDING NEGLIGENCE) ARISING OUT OF OR IN ANY WAY RELATING TO THIS AGREEMENT. 



 

	 	9.2.	 IN NO EVENT SHALL EITHER PARTY OR ITS AFFILIATES, DIRECTORS, OFFICERS, EMPLOYEES OR REPRESENTATIVES BE LIABLE
FOR AN AMOUNT EXCEEDING ANY AMOUNTS PAID BY PAYPAL UNDER THIS AGREEMENT AND THE EXISTING AGREEMENTS IN THE TWELVE MONTHS PRECEDING THE OCCURRENCE OF FACTS THAT FIRST GIVE RISE TO ANY LIABILITY HEREUNDER. THE EXISTENCE OF MORE THAN ONE CLAIM OR EVENT
FROM WHICH LIABILITY ARISES WILL NOT ENLARGE THIS AGGREGATE LIMITATION. THIS AGGREGATE LIMIT IS A SINGLE, GLOBAL LIMIT THAT APPLIES COLLECTIVELY (AND NOT INDIVIDUALLY) TO ALL ENTITIES INCLUDED IN THE TERM “PAYPAL”, THE TERM
“PARTNER”, AND/OR “ENTITIES” ADDED TO THIS AGREEMENT. 


  

	 	9.3.	 THE LIMITATIONS IN SECTION 9.2 SHALL NOT APPLY TO PAYPAL’S OR PARTNER’S, AS APPLICABLE:
(I) FEE PAYMENT OBLIGATIONS, (II) REFUNDS OR OVERPAYMENTS; (III) LIABILITY TO PAYPAL ARISING OR IMPOSED UNDER AGREEMENTS WITH PAYPAL’S BANKING PARTNERS, UNDER THE ASSOCIATION RULES MENTIONED IN THOSE AGREEMENTS, OR
OTHERWISE BY THE ASSOCIATIONS; (IV) THE INDEMNIFICATION OBLIGATIONS DESCRIBED IN SECTION 10 BELOW OR (V) INFRINGEMENT OF EITHER PARTY’S INTELLECTUAL PROPERTY INCLUDING, BUT NOT LIMITED TO, COMPANY TECHNOLOGY AND API LICENSES.



  

	 	9.4.	 THE LIMITATIONS OF LIABILITY IN THIS SECTION ARE FUNDAMENTAL ELEMENTS OF THE BASIS OF THE BARGAIN BETWEEN THE
PARTIES. 


  

	10.	 MUTUAL INDEMNIFICATION 



 

	 	10.1.	 Indemnification. 



 

	 	(a)	 Each Party (the “Indemnifying Party”) will defend, indemnify, and hold harmless the other
Party (the “Indemnified Party”) against any claim in a suit filed by a third party: (i) arising out of the Indemnifying Party’s alleged breach of any representation, warranty in this Agreement or
(ii) gross negligence or intentional misconduct in performance of such Party’s obligations hereunder; or (iii) alleging that the technology and services that are generally made available by the Indemnifying Party and
owned and provided by the Indemnifying Party under this Agreement (“Indemnifying Party’s Technology”), when used as expressly permitted by this Agreement and in the form provided by the Indemnifying Party to the Indemnified
Party, directly infringes such third party’s intellectual property rights (each, a “Claim”); 


  

	 	(b)	 Notwithstanding any other provision in this Agreement, the Indemnifying Party shall have no obligation for any
claims of infringement from: (i) any goods or services that the Indemnified Party or any third party sells or attempts to sell, (ii) any modification to, or combination of other technology with, the Indemnifying Party’s
Technology, or (iii) wilful infringement by the Indemnified Party; 


  

	 	(c)	 The obligations of the Indemnifying Party in this Section are conditioned upon the Indemnified Party:
(i) notifying the Indemnifying Party promptly in writing of each Claim, but shall only relieve the Indemnifying Party to the extent of any prejudice caused by delay in notification, (ii) allowing the Indemnifying Party sole
control of the defense of the Claim, related settlement negotiations and settlement of the Claim (for which written consent is not required so long as no financial or material burden is imposed on the Indemnified Party),
(iii) cooperating and, at the Indemnifying Party’s request and reasonable expense, assisting in a timely manner in such defence, and (iv) complying with the terms of this Agreement. The Indemnified Party shall have the right to
participate in such defense with its own counsel, at its own expense. Neither Party shall have any obligation to indemnify the other Party if the Claim would not have arisen but for the breach of this Agreement by the Party claiming indemnification;




  

					
		  	8 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















	 	(d)	 If a Claim is made under Section 10.1(a)(ii), the Indemnifying Party may, at its sole option and expense:
(i) procure for the Indemnified Party the right to continue exercising the rights granted by the Indemnifying Party under this Agreement, (ii) replace or modify the applicable Indemnifying Party’s Technology so it
becomes non-infringing without materially changing its functionality, or (iii) terminate this Agreement and provide the Indemnified Party a refund of any pre-paid amounts that are unaccrued as of the date of such termination;



  

	 	(e)	 This Section states each Party’s sole and exclusive remedy with respect to any direct or indirect
infringement (whether actual or alleged) of any patent, trade secret, copyright, database right, trademark or other intellectual property right or any claim or action relating thereto. 



 

	11.	 MISCELLANEOUS 



 

	 	11.1.	 Compliance with Laws, Regulations and Applicable Association Rules. 



 

	 	(a)	 The Parties will comply with all applicable laws, regulations, and card network rules in connection with the
Program and this Agreement including, but not limited to, the California Consumer Privacy Act of 2018 and other state privacy laws and Data Protection Laws, anti-corruption, anti-bribery, anti-kickback, anti-fraud, anti-money laundering,
anti-terrorist financing, anti-narcotics, anti-boycott, anti-slavery and human trafficking, export control, sanctions, embargo, and import control laws, in each case, as it relates to the performance of such Party’s obligations under this
Agreement and each SOW. 


  

	 	(b)	 Partner and PayPal each represents, warrants and covenants that it shall at all times comply with the
applicable PCI-DSS, as such may be amended from time to time, with respect to any card data received by it in connection with this Agreement and any applicable card network data security requirements (including those made available by Visa,
MasterCard, American Express, and Discover) with regards to such Party’s use, access, and storage of applicable credit card non-public personal information that constitutes Confidential User Data of such Party. PayPal acknowledges that it is
responsible for the security of cardholder data it possesses or otherwise stores, processes or transmits, or to the extent that Company could impact the security of the cardholder data environment. 



 

	 	(c)	 Partner acknowledges and agrees that Partner is responsible for the integrity and security of the Partner
Product and is solely liable for any losses suffered as a result of a compromise of Partner Platform’s security including, but not limited to, unauthorized use of Partner User credentials. PayPal acknowledges and agrees that PayPal is
responsible for the integrity and security of the PayPal Product and is solely liable for any losses suffered as a result of a compromise of PayPal Services security including, but not limited to, unauthorized use of PayPal User credentials.



  

	 	(d)	 To the extent applicable and required in connection with the Program and this Agreement, Partner shall register
with any required card network programs through PayPal’s acquiring bank. 


  

	 	11.2.	 Power and Authority. Each Party represents, warrants and covenants that (a) it has full
power and authority to enter into and perform this Agreement and (b) its execution and performance of this Agreement does not violate, conflict with, or result in a material default under any other contract or agreement to which it is a
party or by which it is bound. The representations and warranties contained in or made under or in connection with this Agreement shall survive the Effective Date, and, shall be deemed to have been made by each Party upon entering into this
Agreement and each amendment or supplement hereto. 


  

	 	11.3.	 Contracting Entity. This Agreement shall be construed as establishing a series of bilateral contractual
relationships between the parties as set forth in the table below. This Agreement shall apply only as between the PayPal Entity listed on each row and the Big Commerce Entity listed on that same row, and not in relation to any other parties.




  

					
		  	9 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019















 
Agreement shall apply only as between the PayPal Entity listed on each row and the Big Commerce Entity listed on that same row, and not in relation to any other parties. 

 

							
	 PayPal Entity
	  	 BigCommerce
Entity
	  	 Governing Law
	  	
Courts with Exclusive
Jurisdiction

	PayPal, Inc.	  	BigCommerce, Inc	  	The State of California	  	Santa Clara County, California, or Omaha, Nebraska
				
	PayPal Pte. Ltd.	  	BigCommerce Pty Ltd	  	Singapore	  	Singapore or where the defendant is located (in PayPal’s case, Singapore, and in Partner’s case, Partner’s home address or principal place of business)
				
	PayPal Pte. Ltd.	  	BigCommerce UK Ltd	  	Singapore	  	Singapore or where the defendant is located (in PayPal’s case, Singapore, and in Partner’s case, Partner’s home address or principal place of business)
				
	PayPal Pte. Ltd.	  	BigCommerce Software Ireland Limited	  	Singapore	  	Singapore or where the defendant is located (in PayPal’s case, Singapore, and in Partner’s case, Partner’s home address or principal place of business)

  

	 	11.4.	 Notice. 


  

	 	(a)	 Partner agrees that PayPal may provide notice to Partner regarding regular Program updates applicable to all
Partners generally by email sent to the email address listed in its Program account, or for all other notices, by email or by mail or courier to the address below, or in each case to such other address of which Partner gives PayPal written notice
under this Section. 


 BigCommerce 

11305 Four Points Drive 

Building II, Third Floor 

Austin, TX 78726 
 Attn: General
Counsel 
 Email: [***] 
  

	 	(b)	 Unless Partner is communicating with PayPal about a matter where PayPal has specified another notice address,
written notices to PayPal must be sent by mail or courier to the address below: 


 PayPal Inc. 

Attention. USA: Legal Department, 

2211 North First Street, 
 San
Jose, CA 95131 
 PayPal Pte. Ltd. 

Attention: Legal Department, 

  

					
		  	10 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019















 5 Temasek Boulevard #09-01, 

Suntec Tower Five, 
 Singapore
038985 
  

	 	11.5.	 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY LAW, EACH
PARTY DISCLAIMS ANY REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THE MATTERS COVERED BY THIS AGREEMENT, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT. EACH PARTY’S SITE AND SERVICES ARE PROVIDED “AS-IS,” AND NEITHER PARTY MAKES ANY WARRANTY THAT THE ITS SITE AND/OR SERVICES ARE,
OR WILL BE, UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE. 


  

	 	11.6.	 Service Levels. PayPal will provide the PayPal Site and the PayPal Services in accordance with the
following service and support levels (“SLAs”) as follows: 


  

	 	(a)	 Operational Availability 



PayPal is responsible for the operational availability of Supported Services and will use commercially reasonable efforts to meet the
availability stated below (“Operational Availability”), including monitoring to maintain a continuous pulse on Operational Availability. PayPal does not provide support to any integration issues where a PayPal staging environment is
being used after Partner launches the PayPal Services. The term “Supported Services” shall mean PayPal Branded Products and PayPal Unbranded Products gateway services. 

 

			
	 Service
	  	 Operational Availability

	Payment Services	  	[***]% or greater measured monthly, minus Excluded Event and other maintenance events mutually agreed to by both parties in accordance with this Section
		
	Payment Services Response Time	  	Response Time for internet / API connections shall be less than [***] seconds for [***]% of interactions, except for high usage variability that is beyond PayPal’s control.

 “Excluded Events” means any event that adversely impacts the PayPal Services related to
(a) the acts or omissions of Partner, its employees, customers, contractors or agents; (b) scheduled maintenance, alteration or implementation; (c) the failure of dependent services such as cloud services, network processors, or third
party internet connections except those directly utilized by PayPal for hosting; or (d) any force majeure event.     
  

	 	(b)	 Issue Classification. Issues are classified and defined in the following table: 



 

			
	 Priority
	  	 Criteria

	P1 / Critical	  	Any issue without a known commercially reasonable workaround that breaks or materially impacts performance of logins, authorizations, critical data flow, movement of money, registration or customer service operations; or Any issue
that results in the complete outage of PayPal account administration or fraud management systems.


  

					
		  	11 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















			
	 P2 / Serious
	  	 Any issue with a known commercially reasonable workaround that:
  

•  breaks or materially impacts performance of logins, authorizations, critical data flow, movement
of money, registration or customer service operations; or
  

•  materially degrades other PayPal production payment services.

 
 or
  

Any issue without a known commercially reasonable workaround that impairs other PayPal production Payment Services.

		
	 P3 / Degraded
	  	Any issue with a known commercially reasonable workaround that minimally impairs PayPal production payment services.
		
	 P4 / Minimal
	  	Any issue that does not impair PayPal production payment services.

  

	 	(c)	 Operational Issue Resolution Times. The following table specifies the maximum elapsed time per
classification for an initial response from PayPal and for Resolution (defined below) of an issue. Time is measured from the point of Issue Notification to PayPal. PayPal will use best efforts to respond to Partner in a manner and time commensurate
with the priority of classification. 


  

			
	 Priority
	  	 Best Efforts Resolution*

	 P1 / Critical
	  	Within 24 hours
	 P2 / Serious
	  	Within 2 weeks
	 P3 / Degraded
	  	Within next available release cycle
	 P4 / Minimal
	  	As appropriate

 “Issue Notification” means Partner’s notification to PayPal that an issue exists and
shall include a description of the issue, an initial classification of the issue and sufficient information for PayPal to investigate the cause of the issue. 

* “Resolution” means a correction, temporary patch, or work around being provided that allows supported services to continue
as normal with no direct financial impact. PayPal will strive to provide a fix or a workaround for an issue as soon as possible. P1 and P2 incidents will be worked continuously until a satisfactory resolution can be reached. PayPal will make best
efforts to inform Partner of progress when this does not reduce PayPal’s ability to resolve the issue promptly. PayPal and Partner will apply immediate and continuing best efforts to achieve issue resolution. 

 

	 	(d)	 Change Management. For any change requiring a PayPal outage of any length, as well as any PayPal change
related, but not limited to, performance, data integrity or location, application code, physical facilities, or security, PayPal will make commercially reasonable efforts to meet the notification targets listed below: 



  

					
		  	12 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















	 	•	 	 Normal Changes: Will be planned 10 business days or more before they are implemented. Typically, there is no
immediate technical or business requirements to implement the change within a shorter timeframe and any resulting service outage to the Services would occur during normal maintenance windows. 



 

	 	•	 	 Urgent Changes: May be implemented with no advance notice. This category is reserved for remediation of the
PayPal Services outage or impending outage, a degradation of performance, or an information security-related incident. Notification to Partner will occur promptly following the implementation of a resolution and where practical, upon identification
of the issue. 


  

	 	(e)	 Remedies. Partner acknowledges and agrees that in the event PayPal fails any its obligations hereunder
(including without limitation Operational Availability levels), Partner’s sole remedy is termination such that for three (3) months in any twelve (12) month period, or if Operational Availability is below 99.5% in any single month,
then Partner may terminate this Agreement without penalty upon ten (10) days prior written notice. For clarity, if PayPal does not meet the Operational Availability or other commitments in this SLA, it will be counted as a failure to meet the
SLA whether or not PayPal used commercially reasonable efforts. 


  

	 	11.7.	 Service Providers. Partner may use third-party service providers to exercise Partner’s rights or
perform Partner’s obligations under this Agreement so long as any such service provider expressly agrees to terms consistent with this Agreement. Partner agrees that it will be responsible for any act or omission by its service providers under
this Agreement. 


  

	 	11.8.	 Expenses. Notwithstanding any other provision in this Agreement to the contrary, in no event will PayPal
be obligated to pay any expenses, fees, costs or other amounts to any subcontractor, person, or entity other than Partner as a result of this Program. 


  

	 	11.9.	 Independent Contractors. Partner and PayPal are independent contractors and shall have no power or
authority to assume or create any obligation or responsibility on behalf of each other. This Agreement shall not be construed to create or imply any partnership, agency or joint venture. 



 

	 	11.10.	 Press Releases. Neither Party shall, or shall permit, issue or cause the publication of any press
release or other public announcement relating to the transactions contemplated by this Agreement without the consent of the other Party, which consent shall not unreasonably be withheld. 



 

	 	11.11.	 Non-Disparagement. In representations to Referred Merchants or
in public communications, neither Party shall make disparaging or derogatory statements about the other Party, or any of the other Party’s Products or Services, as a brand, service or corporation; provided, however nothing herein shall prohibit
complaints by employees of a Party may in their individual capacity as consumers or customers of the other Party or its affiliates. 


  

	 	11.12.	 Non-Solicitation of Referred Merchants. During the term of this
Agreement, neither Party will use information provided by the other Party pursuant to this Agreement to promote or market competitors of the other Party solely on the basis of the intended recipient being a Referred Merchant. This paragraph will not
apply to general solicitations, marketing and promotions (including via email). If there is an instance of targeted promotions or marketing described in this Section, each Party’s sole remedy will be to notify the other Party and the other
Party will use reasonable efforts to discontinue that targeted promotion or marketing. 


  

	 	11.13.	 User Consents. Each Party must obtain from its users all necessary consents and authorizations as
required under all Applicable Laws, in accordance with the Party’s own published policies. 


  

	 	11.14.	 Assignment. Partner may not transfer or assign any rights or obligations Partner has under this
Agreement without PayPal’s prior written approval. Notwithstanding the foregoing, Partner may assign this Agreement in its entirety, without PayPal’s consent but on prompt written notice (“Assignment Notice”), to
(i) its Affiliate, or (ii) in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of Partner’s assets. If Partner assigns this Agreement to a Competitive Business, PayPal may terminate
this 



  

					
		  	13 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















	 	
Agreement by giving notice within 60 days of the date of the Assignment Notice, and this Agreement will terminate 60 days after such notice, subject to the Party’s ongoing obligations during
the Tail Period. “Competitive Business” means any of the following entities: Amazon.com, Inc., Google LLC, Apple, Inc., and Shopify Inc. PayPal reserves the right to transfer or assign this Agreement or any right or obligation under
this Agreement by providing Partner with written notice of such transfer or assignment. 

  

	 	11.15.	 No Waiver. No failure or delay by either Party in enforcing any provision of this Agreement will be
deemed a waiver of such Party’s ability to enforce the same provision of this Agreement at a future date. 


  

	 	11.16.	 Severability. If any provision of this Agreement is found illegal or unenforceable, it will be enforced
to the maximum extent permissible, and the legality and enforceability of the other provisions of this Agreement will not be affected. 


  

	 	11.17.	 Force Majeure. Neither Party is responsible for any failure to perform its obligations under this
Agreement if such failure is caused by acts of God, war, terrorism, civil insurrection, acts of militia or military, strikes, revolutions, lack or failure of transportation or communications facilities, laws or governmental regulations, or other
causes that are beyond such Party’s reasonable control. In the event of such a failure, the affected Party’s obligations shall be suspended until such time as the cessation of any cause of such failure. 



 

	 	11.18.	 Complete Agreement. This Agreement constitutes the entire agreement between the parties relating to this
subject matter and supersedes all prior or contemporaneous oral or written agreements concerning this subject matter, including without limitation, the Existing Agreements as described in Section 1.1. 



 

	 	11.19.	 Amendments in Writing. This Agreement may be modified, or any rights under it waived, only by a written
document executed by the Parties. 


  

	 	11.20.	 Survival. The following sections shall survive termination of this Agreement: Intellectual Property and
License Rights, Financial Reconciliation, Confidentiality, Term and Termination, Miscellaneous, and Definitions, as well as any other terms of this Agreement and any SOW which by their nature should survive termination of this Agreement (including
without limitation those provisions necessary to implement the rights which continue during the Tail Period). 


  

	 	11.21.	 Counterparts, Originals and Electronic Acceptance. This Agreement may be executed in counterparts, each
of which shall constitute an original, and all of which shall constitute one agreement. A photographic or electronic copy of the signature evidencing a Party’s execution of this Agreement shall be effective as an original signature and may be
used in lieu thereof. 



  

					
		  	14 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019















 IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized
representatives as of the dates below. 
  

									
	BigCommerce, Inc.	 		 	PAYPAL, INC.
					
	By:	 	 /s/ Russ Klein
	 		 	By:	 	 /s/ Daniel Leberman

					
	Name:	 	 Russ Klein
	 		 	Name:	 	 Daniel Leberman

					
	Title:	 	 SVP, Corporate Development
	 		 	Title:	 	 VP Channel Partners

					
	Date:	 	 April 2, 2020
	 		 	Date:	 	 April 3, 2020

			
	BigCommerce Pty.	 		 	PAYPAL PTE. LTD.
					
	By:	 	 /s/ Russ Klein
	 		 	By:	 	 /s/ Matt Lucas

					
	Name:	 	 Russ Klein
	 		 	Name:	 	 Matt Lucas

					
	Title:	 	 SVP, Corporate Development
	 		 	Title:	 	 Finance Director

					
	Date:	 	 April 2, 2020
	 		 	Date:	 	 April 5, 2020

				
	BigCommerce UK Ltd	 		 		 	
					
	By:	 	 /s/ Russ Klein
	 		 		 	
					
	Name:	 	 Russ Klein
	 		 		 	
					
	Title:	 	 SVP, Corporate Development
	 		 		 	
					
	Date:	 	 April 2, 2020
	 		 		 	
				
	BigCommerce Software Ireland Limited	 		 		 	
					
	By:	 	 /s/ Russell Klein
	 		 		 	
					
	Name:	 	 Russell Klein
	 		 		 	
					
	Title:	 	 Chief Development Officer
	 		 		 	
					
	Date:	 	 April 2, 2020
	 		 		 	


  

					
		  	15 of 22	  	 PayPal

Confidential
 Global Partner
Agreement
 November 2019
















 



 
  

 SCHEDULE 1 

(DEFINITIONS) 
 In addition
to the capitalized terms defined in the Agreement, the following capitalized terms are defined as follows: 
  

	 	(a)	 “Affiliate” of a Party means, an entity which controls, is controlled by, or is under common
control with such Party. For purposes of this definition, the term “control” means: (a) beneficial ownership of at least 50% of the voting securities of a corporation or other business organization with voting securities
(or such lesser percentage which is the maximum allowance by a foreign corporation in a particular jurisdiction); (b) a 50% or greater interest in the net assets or profits of a partnership or other business organization without voting
securities; or (c) the ability to direct the affairs of any such entity 


  

	 	(b)	 “API Credentials” means Partner’s application program interface (API) username and
password, and either an API signature or an API certificate. 


  

	 	(c)	 “Applicable Laws” means all applicable federal, provincial, national, state, and local laws,
statutes, regulations, rules, orders, supervisory requirements, directions, circulars, opinions, interpretive letters, and other official releases of or by any federal, provincial, national, state, or local governmental authority or entity, and any
other applicable regulations and/or operating rules relating to a Party, or its users, as the case may be, and/or its products and/or services, including rules promulgated by the card networks and Data Protection Laws as defined herein.



  

	 	(d)	 “Confidential Information” means all information that either Party provides to the other Party
under this Agreement, including but not limited to the following: (i) PayPal Content and all other information received through the PayPal APIs or otherwise related to the Partner Product, (ii) the API Credentials and User ID
and passwords, (iii) all information disclosed in writing and marked “confidential,” “proprietary,” or with a substantially similar marking, (iv) all information disclosed orally and
identified as confidential at the time of disclosure, and (v) all other information that by its very nature the receiving Party should reasonably understand to be the disclosing Party’s confidential information.



  

	 	(e)	 “Confidential User Data” means User Data of one Party disclosed to the other Party that such
receiving Party has not otherwise collected in the course of providing its services to the applicable user, 


  

	 	(f)	 “Data Controller” have the meanings given to those terms under the Data Protection Laws.



  

	 	(g)	 “Data Protection Laws” means EU Directive 95/46/EC or Regulation (EU) 2016/679 (GDPR) and any
associated regulations or instruments and any other data protection laws, regulations, regulatory requirements and codes of practice applicable to the provision of the PayPal Services.     



 

	 	(h)	 “Marketing Plan” means the plans established pursuant to this Agreement by the Partner and
approved by PayPal that outlines strategies and tactics designed to promote the Program to Partner Users. 


  

	 	(i)	 “Marks” means, with respect to a Party, the trademarks, including registered and common law
trademarks, trade names, service marks, logos, buttons, domain names and designations owned, licensed or used by the Party.     


  

	 	(j)	 “Partner Product” means the ecommerce or retail related product or solution offered by Partner
to its customers. 


  

	 	(k)	 “Partner User” means a customer that has entered into a relationship with Partner to purchase
goods or services, including the Partner Product, as well as a prospective customer of the Partner. A Partner User that has a PayPal account is also a PayPal User. 



  
 [Type here] 














 



 
  


	 	(l)	 “PayPal APIs” means the application programming interfaces used by PayPal merchants to
interface with PayPal’s facilities, hardware, software and processes in connection with their use of the PayPal Services 


  

	 	(m)	 “PayPal Branded Products” means PayPal’s payment processing services that are branded
with PayPal’s Marks. 


  

	 	(n)	 “PayPal Content” means all the data passed through the PayPal APIs, including any User
Data of PayPal or its merchants. PayPal Content does not include any data that Partner obtains independent of PayPal and the PayPal APIs. 


  

	 	(o)	 “PayPal Credit” means the credit and financing services that PayPal makes available to PayPal
account holders for use in making payments for purchases, through PayPal’s and its affiliates’ web and mobile applications. 


  

	 	(p)	 “PayPal Services” means the payment services provided by PayPal, including PayPal Branded
Products and PayPal Unbranded Products, the functionality and branding of which may change from time to time. 


  

	 	(q)	 “PayPal Site” means www.paypal.com or such other website(s) provided by PayPal for its users
located in particular countries or jurisdictions. 


  

	 	(r)	 “PayPal Unbranded Products” means PayPal’s payment processing services that are not
branded with PayPal’s Marks. 


  

	 	(s)	 “PayPal User” mean a person who accesses a PayPal Site or uses the PayPal Services.



  

	 	(t)	 “PCI-DSS” means the applicable Payment Card Industry
Data Security Standards, as they may be amended from time to time. 


  

	 	(u)	 “Program Year” means the twelve calendar month period of time commencing with the Effective
Date and each succeeding twelve calendar month period of time during the Term. 


  

	 	(v)	 “Tail Period” means the [***] period following termination or expiration of this Agreement.



  

	 	(w)	 “User Data” means information, including personally identifiable information, collected from a
customer or user of a Party. 


  

	 	(x)	 “User ID” means the unique confidential identification code, certificate, and user ID issued
by PayPal to Partner that permits Partner to integrate the PayPal Services and the Partner Product.     



  
 [Type here] 














 



 
  

 SCHEDULE 2 

(DATA SECURITY ADDENDUM) 

Data Security Addendum                 

 

							
	“Underlying Agreement”	  	Global Partner Agreement	  	“Underlying
Agreement Effective Date”	  	 
	Parties	  		  		  	 
	“Partner”	  	 PayPal, Inc.

PayPal Pte. Ltd.
	  	“BigCommerce” or “BC”	  	 BigCommerce,
Inc.
 BigCommerce Pty. Ltd.

	Purpose	  	Data protection	  	Duration	  	Coterminous with Underlying Agreement

 The parties in the table above enter this Data Security Addendum (this “DSA”) as an attachment to the
Underlying Agreement. Capitalized terms have the meanings ascribed them in the Underlying Agreement or as set forth below. If any provision of this DSA conflicts with any provision of the Underlying Agreement, the provision in this DSA will
supersede the provision in the Underlying Agreement. 

 


	1.	 Definitions. 


  


	 	1.1.	 “Applicable Law” means all applicable laws, rules and regulations in all jurisdictions in
which either party’s Confidential Information may be stored or processed, including without limitation those relating to privacy and data security. 


  

	 	1.2.	 “Confidential Information” has the meaning ascribed it in Amendment7. 



 

	 	1.3.	 “Industry Best Practice” means globally recognized information security management standards
such as those established by the International Organization for Standardization, the International Electrotechnical Commission, the Information Systems Audit and Control Association, and the National Institute of Standards and Technology, such as
ISO/IEC 27001 and ISAE 3402 SOC 2. 


  

	 	1.4.	 “Personally Identifiable Information” or “PII” means any information that
identifies an individual person as defined by Applicable Law. In any jurisdiction that regulates “personal information” or “personal data,” such data will be considered “PII” under the terms of this
DSA. 





	 	1.5.	 “Security Incident” means (a) actual or suspected unauthorized acquisition
(including hostaging), loss or distribution of Confidential Information of the other party, (b) actual or suspected security breach concerning a party’s Systems or Facilities that contain, or permit access to, Confidential
Information of the other party, or (c) either party reasonably believes that the foregoing has occurred or is at risk of occurring and will impact the Confidential Information of the other party. 



 

	 	1.6.	 “Services” has the meaning of PayPal Working Capital/PayPal Business Loans provided in
Amendment 7. 


  

	 	1.7.	 “Facility” means a facility used to collect, access, store, route, transmit, display, host or
process Confidential Information, regardless of whether such facility is owned and operated by a party or by a third party on the party’s behalf. 


  

	 	1.8.	 “Systems” means the systems, equipment, hardware, software, mobile and other applications, and
networks used in the provision of the Services or used to collect, access, store, route, transmit, display, host or process Confidential Information,




 


  
 [Type here] 














 



 
  



	 	
regardless of whether each of the foregoing is owned and operated by a party or by a third party on the party’s behalf, including without limitation any hosting services. 


 

	 	1.9.	 “Vulnerability Redactions ”means, with respect to a given document, that (a) the
providing party will provide only summary rather than detailed information and will redact any exploitable information, and (b) the summary will not redact high-level, non-exploitable information about
vulnerabilities or omit disclosure of vulnerabilities altogether 


  

	2.	 Purpose. Each party will process PII only as specified by the Purpose and consistent with the consent
provided by the data subject. 


  

	3.	 Failure. If a party can no longer meet its obligations under this DSA, then it will
(a) notify the other party, (b) cease processing PII, and (c) take any reasonable and appropriate steps to remediate any unauthorized processing. 



 

	4.	 Disclosure of Privacy Provisions. Notwithstanding any confidentiality obligations, either party may
provide a summary or a representative copy of the relevant privacy provisions, including this DSA, to the United States Department of Commerce upon request, pursuant to the requirements of the EU-US Privacy
Shield Framework. 


  

	5.	 Termination. Each party will destroy the Confidential Information of the other party in its possession
using a secure means of disposal when such data is no longer required under Amendment 7 or by Applicable Law. 


  

	6.	 Security Controls. Each party will follow Industry Best Practices for data security.



  

	 	6.1.	 No External Data Processing. If a party has access to the other party’s Confidential Information
(an “Accessing Party”) through systems managed by the other party, then the Accessing Party will comply with the following (the “Data Processing Prerequisites”): 



 

	 	a)	 Data Security Assessment. Upon written request, the Accessing Party will reasonably cooperate with the
other party’s data security







	 	
assessment efforts, including responding to questionnaires to the extent the Accessing Party makes such information generally available to its partners. The Accessing Party may provide the SSAE
16 SOC2 report and PCI Attestation of Compliance in lieu of completing any questionnaires. Parties agree to reasonably cooperate by answering additional questions. 


 

	 	b)	 Reasonable Security Measures. The Accessing Party will implement and maintain reasonable security
measures appropriate to the nature of the Confidential Information. 


  

	 	c)	 Upgrades. The Accessing Party must maintain processes and procedures that, having regard to the state of
technological development, the Accessing Party’s cost of implementing them, and the nature of the Confidential Information, ensure a level of security appropriate based upon risk analysis of Accessing Party to meet Industry Best Practice.



  

	 	6.2.	 External Data Processing. If the Accessing Party has access to the other party’s Confidential
Information outside of the systems managed by the other party, then the Accessing Party will comply with the Data Processing Prerequisites and the following: 


  


	 	a)	 Security Management. The Accessing Party will establish and maintain a written information security
policy, assign segregated roles and responsibilities for information security, provide necessary support and resources, and monitor and continuously improve the security program. 



 

	b)	 Information Security Officer. Appoint an Information Security Officer, who is a senior employee
responsible for: 


  

	 	•	 	carrying out your information security program; and 


 


  
 [Type here] 














 



 
  



	 	•	 	communicating with the other party on matters affecting the security and integrity of the Confidential Information. 

  

	c)	 Communication. The Accessing Party’s Information Security Officer must themselves be, or appoint
one or more representatives to be, available to discuss any Data security concerns with the other party. The Accessing Party must promptly notify the other party if the Information Security Officer or any of its appointed representatives changes.



  

	d)	 Threat Assessment and Remediation. The Accessing Party will implement, maintain and periodically conduct
(no less than once per year and upon any material changes to its systems or practices) an information security risk assessment process that identifies and remediates risks to Confidential Information, its Systems, and the Services.



  

	e)	 Identity and Access Management. The Accessing Party will permit access to the other party’s
Confidential Information, and, if applicable, its Systems, solely on a need-to-know basis, and the Accessing Party will review such access on an ongoing basis. The
Accessing Party will implement identity and access management of all account credentials including but not limited to: segregated accounts and credentials for each unique user, strict management of administrative accounts, and password best
practices, strong passwords, removal of default passwords, and secure password storage. The Accessing Party will remove access of all Personnel who no longer require access to the other party’s Systems in accordance with the Accessing
Party’s policies including immediate termination on involuntary separation. 


  

	f)	 Configuration Management. The Accessing Party will maintain secure configuration of its Systems in
accordance with its own configuration management policies. 


  

	g)	 Vulnerability Management. The Accessing Party will continuously identify and remediate or mitigate
vulnerabilities on its Systems, including without limitation by implementing quarterly vulnerability scans and regularly updating and patching software. Upon written request by the other







	 	
party, the Accessing Party will provide written evidence of its performance of vulnerability scans. 

  

	h)	 Boundary Defense and Security Segmentation. The Accessing Party will monitor, detect, and restrict the
flow of information on a multilayered basis using tools such as firewalls, proxies, DMZ perimeter networks, and network-based intrusion detection and intrusion protection systems. The Accessing Party will design and implement multilayered and secure
network and system segmentation. 


  

	i)	 Data Loss Prevention and Encryption. The Accessing Party will implement best practices for data loss
prevention including without limitation: encryption of Confidential Information containing PII in motion, automated tools to identify attempts to exfiltrate data, use of certificate based security and secure key management policies and procedures.



  

	j)	 Monitoring, Auditing, Logging. The Accessing Party will implement best practices for monitoring,
auditing, alerting, and escalating threats. The Accessing Party will implement best practices for logging including without limitation: the use of logging tools to collect and correlate event log data from the Accessing Party Systems, routing log
data for aggregation to separate, secure Systems, maintaining log data for no less than one year, and conversion or normalization of log data into standard formats. Upon written request and subject to Vulnerability Redactions, the Accessing Party
will regularly send the other party the log data files in a format mutually agreed by the parties. 


  

	k)	 Secure System and Software Development and Maintenance. The Accessing Party will implement best
practices to manage the secure lifecycle of Systems and software from design, development, test, and use to discontinuation, including without limitation: segregating development, test, and production environments, using web application firewalls to
address common attacks such as cross-site scripting, SQL injection, and command injection, testing code for common coding errors and vulnerabilities, testing software for performance under denial of service and other




  

 

 [Type here] 














 



 
  



	 	
resource exhaustion attacks, and otherwise implementing the OWASP Top Ten recommendations. 

  

	l)	 Shared Security Model for Cloud Services. In the event that the Accessing Party uses third-party
cloud-based services in connection with the Services, the Accessing Party will meet or exceed the industry best practices for using cloud service providers. The Accessing Party will ensure that no third party is given license to access or use
Confidential Information for any purpose other than as necessary under the Agreement. 


  

	m)	 Physical Security. The Accessing Party will establish, maintain and continuously improve an access
control system that enables the Accessing Party to monitor and control physical access to each of its Facilities and, if applicable, the other party’s Facilities, including without limitation limiting access to authorized personnel only.



  

	7.	 Personnel and Subcontractors. 



 

	 	7.1.	 Personnel. Each party will impose the requirements of this DSA on all access to and use of Systems,
Facilities and/or Confidential Information by its personnel or independent contractors (collectively, “Personnel”). The Accessing Party will (a) subject to Applicable Law, perform Personnel background screening,
(b) provide security training to its Personnel at the Accessing Party’s expense no less than on an annual basis, maintain records documenting the training materials, the name of each Personnel who receives that training and the date
on which the training was completed and agree to provide written confirmation of compliance with the foregoing upon the reasonable request of the other party, and (c) require all Personnel to abide by the confidentiality and security
obligations of this Agreement. 


  

	 	7.2.	 Subcontractors. If a party subcontracts or delegates any of its obligations to a





 subcontractor, business partner, or other third party (each a “Subcontractor”),
then it will ensure that each Subcontractor (a) is bound by security terms substantially as protective as this DSA, (b) processes Confidential Information only in accordance with the subcontracting party’s instructions.

  

	 	7.3.	 Liability for Personnel and Subcontractors. Each party will be liable for the actions and omissions of
its Personnel and Subcontractors. 


  

	8.	 Verification of Security Controls. 



 

	 	8.1.	 Annual Third Party Audits. On an annual basis, each party will conduct a
PCI-DSS audit and make the summary Attestation of Compliance available upon written request. Each party will, at its own expense and according to their vulnerability management policy. 



 

	9.	 Security Incidents. 



 

	 	9.1.	 Notification. Each party will implement best practices for incident management to identify, contain,
respond to, and resolve Security Incidents. Each party will notify, by email to [***] (if notification is to PayPal) or to [***] (if notification is to BigCommerce), the primary and backup contacts of the
other party within 48 hours of its detection of a material Security Incident, and provide the following information, to the extent known: 


  

	 	a)	 a summary of the Security Incident, 



 

	 	b)	 an expected resolution time (if known), or notice that the resolution path is unknown at the time of
notification, 


  

	 	c)	 the name, email, and phone number of the breached party’s contacts for incident updates, and



  

	 	d)	 a description of any impact such Security Incident may have on the other party, 



 

	 	e)	 the date of the Security Incident, 



 

	 	f)	 the nature and extent of the Confidential Information potentially involved in the Security Incident,



  

	 	g)	 Identification of the persons who are known or are reasonably suspected to have improperly accessed or obtained
the Confidential Information, 



 


  
 [Type here] 














 



 
  



	 	h)	 a description of the location in which the Confidential Information is known or reasonably suspected to have
been improperly transmitted, sent or utilized, 


  

	 	i)	 a description of the probable cause(s) of the Security Incident; and 



 

	 	j)	 any other relevant information that is reasonably necessary to help remedy the Security Incident.



  

	 	9.2.	 Security Incident Procedures. In the event of a Security Incident, the Accessing Party will (a)
cooperate with any investigation concerning the Security Incident, regulators and/or law enforcement, (b) cooperate with the other party to comply with Applicable Laws concerning such Security Incident, including any notification to
consumers, and once cause has been determined by a mutually agreed upon third party and in accordance with Limitation of Liability, and (c) be liable for any expenses associated with the Security Incident, subject to Indemnification and
Limitation of Liability, including without limitation:





 (i) the cost of any required legal compliance (e.g., notices required by Applicable
Laws), (ii) the cost of providing credit monitoring services or other assistance to affected consumers, and (iii) expenses related to the investigation and remediation. Except as required by law, the Accessing Party will not serve
any notice of or otherwise publicize a Security Incident without the prior written consent of the other party. 
  

	 	9.3.	 Reporting. The other party may report Security Incidents to affected persons and/or any governmental
authority or agency having supervisory or oversight authority. 


  

	 	9.4.	 Corrective Measures. The breached party will undertake a procedural review and audit to determine
measures to avoid occurrence of a similar situation, notify the other party of the corrective measures undertaken, and take additional measures reasonably requested by the other party. 



End 

 


  
 [Type here]