BigCommerce (BIGC) DRS/A Draft registration statement (amended)

Exhibit 10.20

Pursuant to Item 601(b)(10)(iv) of Regulation S-K, certain identified information marked with [***] has been excluded from the exhibit because it is both (i) not material and (ii) would be competitively harmful if publicly disclosed

PAYPAL COMMERCE PLATFORM

GLOBAL PARTNER AGREEMENT

THIS PAYPAL COMMERCE PLATFORM GLOBAL PARTNER AGREEMENT, together with all SOWs (defined below), attachments, exhibits, schedules, addenda, and other documents attached hereto or incorporated herein by reference (collectively this “Agreement”), effective as of January 1, 2020 (the “Effective Date”), is made by and among:

The following entity/entities (referred to individually and collectively as “PayPal” or the “Company”:

PayPal, Inc., a Delaware corporation, with its principal place of business at 2211 North First Street, San Jose, CA 95131;

PayPal Pte. Ltd, a company incorporated in Singapore, whose address is 5 Temasek Boulevard #09-01, Suntec Tower Five, Singapore 038985;

And the following entity/entities (referred to individually and collectively as “Partner” or “BigCommerce”):

BigCommerce, Inc., 11305 Four Points Drive, Building II, Third Floor, Austin, TX 78726 78726;

BigCommerce Pty Ltd, a company organized in Australia, whose address is 130 Pitt Street, Level 5, Sydney, NSW 2000, Australia;

BigCommerce UK Ltd, a company organized in England and Wales, whose registered address is Highlands House, Basingstoke Road, Spencers Wood, Reading, Berkshire RG7 1NT, United Kingdom;

BigCommerce Software Ireland Limited, a company organized in the Republic of Ireland, whose registered address is 32 Merrion Street Upper, Dublin 2, DO2KW80.

PayPal/Company and Partner/BigCommerce are referred to as a “Party” or together as the “Parties”.

WHEREAS, Partner and Partner Affiliates have numerous existing agreements with PayPal and its Affiliates governing various aspects of the integration of the PayPal Services into the Partner Product and referring merchants to PayPal, including the PayPal Partner Program Agreement (US), as amended by Amendments 1 – 15, the PayPal Partner Program Agreement (AU), as amended, the PayPal Partner Program Agreement (NZ), as amended, and the PayPal Partner Program Agreement (UK), as amended (collectively, the “Existing Agreements”).

WHEREAS, the Parties desire to enter into this Agreement to replace the Existing Agreements with one unified and simplified agreement, and to resolve certain outstanding claims regarding the Existing Agreements, all as further described in this Agreement.

NOW, THEREFORE, in consideration of the mutual promises contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, PayPal and Partner agree as follows:

1 of 22 PayPal Confidential Global Partner Agreement November 2019

DEFINITIONS

Schedule 1 (Definitions) to this Agreement includes certain defined terms used throughout this Agreement.

1. BACKGROUND; THE PROGRAM

1.1. Background. Upon execution of this Agreement and in consideration for PayPal’s payment to Partner of the amounts identified in SOW #1, the Parties agree that the Existing Agreements (excluding any standalone Nondisclosure Agreements), entered into between the Parties prior to the Effective Date shall terminate and, except for provisions in the Existing Agreements stated to survive termination (“Surviving Terms”), such agreements will be of no further force and effect as between the Parties as further described in SOW #1.

1.2. Scope. PayPal has developed a program for its partners to integrate the PayPal Services into the Partner Product, introduce the PayPal Services to its merchants, and refer merchants to PayPal (the “Program”). All Partner Users who are onboarded as PayPal Users through the Program shall enter into a payment processing agreement directly with PayPal, and the Parties acknowledge and agree that Partner is not engaged in, and will not engage in, the processing of payments pursuant to this Agreement or the Program.

1.3. SOW. This Agreement provides a framework for the Party’s relationship, and the specific details of the financial and business commitments, as well as any changes or additions to jurisdictions covered by the Agreement, features of the PayPal Service, Partner Products or their integration, as well as any changes to the Affiliates which are party to this Agreement will be described in individual Statements of Work executed by the Parties from time to time pursuant to this Agreement (each an “SOW”). The order of precedence for any conflicting term between this Agreement and any SOW will be the following: (i) the applicable SOW as to the matters governed by such SOW, and (ii) this Agreement.

1.4. Requirements for participation. PayPal may change the Program at any time upon twelve (12) months written notice to [***] with an additional ninety (90) day period for implementation of such changes unless such changes are required sooner by a court, regulatory agency, Applicable Law, regulatory requirement or material security issue, in which case, PayPal shall notify Partner as soon as reasonably practicable. Notwithstanding the foregoing, except as required by a court, regulatory agency, Applicable Law, regulatory requirement, PayPal shall not change the commissions, revenue share or other financial terms for the Program to the detriment of Partner. In the event Partner and PayPal cannot reach agreement on the changes, the Parties shall work in good faith to escalate the issue to senior management for discussion and resolution and if the Parties are still unable to reach Agreement, the changes will not go into effect for twelve months (12) months from the date the dispute was escalated to senior management (the “Deferral Period”), and on notice to PayPal, Partner will have the right to terminate the Agreement effective as of the end of the Deferral Period, provided that the Tail Period will apply on the terms in place during the Deferral Period. If Partner does not give notice of termination prior to expiration of the Deferral Period, Partner agrees to abide by and be bound by any such revisions or changes. For clarification, both Parties acknowledge and agree that deferment of changes by PayPal for the Deferral Period and Partner’s right to terminate at the end of the Deferral Period if the dispute is not resolved, is the exclusive remedy for Partner and nothing herein shall be interpreted to permit Partner to exercise termination rights under Section 8.1 herein prior to expiration of the Deferral Period.

2. PARTNER OBLIGATIONS

2.1. Partner Development. Partner shall integrate the PayPal Services into the Partner Product in accordance with the integration requirements agreed to by the Parties and included in the applicable SOW.

2 of 22 PayPal Confidential Global Partner Agreement November 2019

2.2. Partner Marketing. In marketing the PayPal Services, Partner will: (a) ensure that all Partner Products shall offer the PayPal Services as a preferred payment platform for its customers as may be further described in an applicable SOW, (b) describe the PayPal Services accurately and in accordance with the marketing materials that have been agreed upon by the Parties prior to use, and (c) strictly adhere to any PayPal branding or marketing requirements or guidelines as may be communicated to Partner from time to time.

2.3. Marketing Plan: Except as may otherwise be provided in an applicable SOW, the following terms will apply to Marketing Plans. Within thirty (30) days following the Effective Date, the Parties shall agree upon a proposed Marketing Plan for the first Program Year which shall embody Partner’s strategic and tactical plans designed to achieve goals mutually agreed to by both parties. For each succeeding Program Year during the Term, the Parties will cooperate to formulate a proposed Marketing Plan prior to the first day of calendar quarter preceding the start of the Program Year. Each Marketing Plan shall be as mutually agreed. Marketing Plans shall contain sufficient detail to guide the Parties’ conduct of marketing for the upcoming Program Year, including: (a) the scope, extent and timing of the campaigns and the specific marketing channels and marketing materials to be used in each campaign; (b) the purpose of the campaigns; and (c) the allocation of costs of marketing activities between Partner and PayPal. No Marketing Plan shall require or contemplate any marketing that would require any Party to take any action in violation of any Applicable Law. If a Marketing Plan is not completed within the applicable timeframe, then the most current Marketing Plan will remain in effect unless and until a replacement Marketing Plan is agreed upon by the Parties. The Parties may jointly agree in writing to revise a Marketing Plan. If this happens, any such revised Marketing Plan shall describe the timing requirements to implement changes made by the revised Marketing Plan, and the revised Marketing Plan shall remain in effect for the remainder of the Program Year or any later date specified in the revised Marketing Plan. In making any such revisions, the Parties shall take into account and balance each Party’s economic, brand, reputation and other relevant interests.

2.4. PayPal Policies and Procedures. Partner agrees to act in good faith and not to engage and shall, to the extent applicable, ensure each subcontractor will not engage in any unfair, deceptive or abusive acts and practices in the course of its provision of products or performance of services and duties under the Program and this Agreement.

2.5. Presentation of PayPal’s Services. Partner agrees that:

(a) as it pertains to the PayPal Branded Products, it shall ensure that such products are treated as a payment method with a level of prominence that complies with the requirements described in the applicable SOW.

(b) in representations to its merchants or in public communications, it will not mischaracterize any PayPal service as a payment method. To the extent PayPal is entitled to receive Preferred Placement as described in an SOW, Partner agrees not to try to dissuade its merchants from using PayPal.

2.6. Customer Support. Partner will be responsible for all customer service relating to the Partner Product. Partner will refer inquiries relating to the PayPal Services to PayPal’s customer service.

2.7. No Incentives or Surcharges. Except with respect to Australia, Partner shall ensure that there are no surcharges placed by Partner on PayPal Services.

(a) With respect to Australia, the Partner agrees that it will not impose a surcharge or any other fee for enabling PayPal as a payment method, that exceeds the amount the Merchant pays PayPal for that transaction or as otherwise required by law, including but not limited to, for Australia, any regulations published by the Reserve Bank of Australia from time to time.

When referring the PayPal Services to the Merchants in Australia, the Partner must always: (a) inform them that only PayPal Australia Pty Ltd (“PayPal Australia”) is able to provide the PayPal services in Australia; (b) provide them with relevant information about how they may contact PayPal; and (c) advise them that the Partner is not an

3 of 22 PayPal Confidential Global Partner Agreement November 2019

agent, or representative of PayPal, or PayPal Australia. The parties acknowledge and agree that the Partner is not an employee, agent, representative or Authorized Representative of PayPal or PayPal Australia, and the Partner must not provide financial services of any kind on behalf of PayPal, or PayPal Australia that would require the Partner to hold an Australian Financial Services License, or be an Authorized Representative in respect of the PayPal Services. “Australian Financial Services Licence” has the meaning set out in the Corporations Act 2001 (Cth) in Australia. “Authorized Representative” has the meaning given to that term in the Corporations Act 2001 (Cth) in Australia.

3. PAYPAL OBLIGATIONS

3.1. Integration. PayPal shall provide access to PayPal technology and documentation which may be revised by PayPal from time to time.

3.2. Provision of the PayPal Service. PayPal shall provide the PayPal Service to Partner Referred Merchants in accordance with the User Agreement (as may be amended by PayPal and such Referred Merchant) and PayPal Privacy Policy applicable to such Referred Merchant.

3.3. Partner Support. PayPal shall respond to Partner’s inquiries in the same manner in which PayPal responds to all similarly situated partners and in accordance with the SLAs. PayPal will be responsible for all customer service relating to the PayPal Services. PayPal will refer inquiries relating to the Partner Product to Partner’s customer service.

4. INTELLECTUAL PROPERTY AND LICENSE RIGHTS

4.1. Marks. Subject to the terms and conditions of this Agreement, each Party grants to the other Party a non-exclusive, non-transferable, worldwide, royalty-free license to use, reproduce, distribute and display the other Party’s name and Marks (defined below) solely: (a) in the case of PayPal’s Marks, solely to enable the PayPal Services for Partner’s customers through the Partner Product, all in accordance with the applicable SOW(s) and the terms of this Agreement; (b) in the case of Partner Marks, to publicize Partner’s usage of the PayPal Services including (i) through press releases, public announcements, and other oral communications at conferences, media events, or other marketing opportunities; (ii) on the PayPal Site or through other electronic communications such as emails to PayPal Users, newsletters, or in materials that PayPal otherwise makes publicly available; and (iii) through any other channel to promote the use of PayPal; and (c) for any other purpose in any other publication with the prior written approval of such Party. Any such use shall be in accordance with the other Party’s standard Mark guidelines and this Agreement. A Party shall be entitled to request removal of any use of its Marks if, in its reasonable discretion, the use by the other Party of the Marks tarnishes, blurs, or dilutes the Marks or misappropriates the associated goodwill and such problem is not cured within five (5) business days of the using Party’s receipt of notice of the problem.

4.2. Company Technology and APIs.

(a) Subject to the terms and conditions of this Agreement, PayPal hereby grants to Partner a non-exclusive, non-transferable, revocable, non-sublicenseable, limited license to use Company Technology solely as required and necessary to enable the PayPal Services for Partner’s customers through the Partner Product, all in accordance with the SOW and the terms and conditions of this Agreement (the “IP License”). Partner has agreed to the terms and conditions of the PayPal Developer Agreement at https://www.paypal.com/us/webapps/mpp/ua/xdeveloper-full?locale.x=en_US in the form effective as of the Effective Date, which govern the use and implementation of PayPal API’s (the “API License”). As used herein, “Company Technology” means the following intellectual property or proprietary rights of Company (or licensed to Company by a third party) used in connection with the Services: published and unpublished works of authorship, whether copyrightable or not (including without limitation databases and other compilations of information). PayPal may change the

4 of 22 PayPal Confidential Global Partner Agreement November 2019

API License from the form in effect on the Effective Date; however, PayPal shall provide Partner at least ninety (90) days’ notice to [***] for any change to the API License that requires Partner to modify Partner’s integration. Further, PayPal shall provide Partner at least twelve (12) months’ notice in the event PayPal deprecates any APIs.

(b) In connection with Partner’s use of PayPal’s API’s, Partner is prohibited from doing any of the following: (i) selling, transferring, sublicensing, or disclosing Partner’s User ID to any third party (other than approved third party service providers); (ii) selling, transferring, sublicensing, and/or assigning any interest in the Confidential Information of PayPal accessed by the APIs; and (iii) collecting any customer’s personally identifiable information that is accessed through the APIs without that customer’s express permission.

(c) In the event of degradation or instability of PayPal’s system(s) or an emergency, PayPal may, in its sole discretion, change or temporarily suspend Partner’s access to any PayPal Service, including but not limited to the APIs and databases and/or information accessed from the APIs, in order to minimize threats to and protect the operational stability and security of PayPal’s systems. Notwithstanding the foregoing, PayPal shall use reasonable efforts to notify Partner of suspension of the PayPal Services, except that such notice shall not be required where, in the reasonable opinion of PayPal, such notice would compromise security of PayPal’s systems or performance of the PayPal Services. PayPal shall further provide the PayPal Services in accordance with the SLAs set forth in Section 11.6.

(d) As between PayPal and Partner, PayPal retains all right, title and interest in and to the PayPal Services, Company Technology, and all intellectual property rights therein. Except as licensed herein, this Agreement does not transfer any intellectual property rights. There are no implied licenses under this Agreement, and any rights not expressly granted to Partner in this Agreement are reserved by PayPal or its suppliers. Partner shall not directly or indirectly reverse engineer, decompile, disassemble or otherwise attempt to derive source code or other trade secrets from the PayPal Services. Except as otherwise provided for herein including during the Tail Period, all rights and licenses granted to Partner in the PayPal Services and the intellectual property shall terminate automatically and revert to PayPal upon termination of this Agreement or upon termination of any PayPal Service to which the rights and licenses relate.

(e) Except as otherwise provided for herein including during the Tail Period, the licenses described in this Section shall terminate automatically upon termination of this Agreement.

4.3. Competitive or Similar Materials. Notwithstanding the foregoing, in no event shall either Party precluded from developing for itself, having developed, acquiring, licensing, or developing for third parties, as well as marketing and/or distributing materials which are competitive with the other Party’s products and/or services, so long as the developing Party does not violate this Section or use confidential information of the other Party in such activity.

5. FINANCIAL TERMS

5.1 Financial terms. The financial terms set forth in each applicable SOW are hereby incorporated into, and made a part of, this Agreement, and shall describe the manner in which Partner shall be compensated for the relationship, including for distribution of the PayPal Services through the Program.

5.2 Financial Reconciliation. During the Term, the Tail Period, and a period of twelve (12) months following the Tail Period, Partner may notify PayPal in writing of any errors or discrepancies related to any fees owed to Partner by PayPal that Partner detects within ninety (90) days following receipt of Partner’s Revenue Share payment. The Parties will use best efforts for forty-five (45) days to resolve the error or discrepancy via mutual

5 of 22 PayPal Confidential Global Partner Agreement November 2019

collaboration. In the event Partner and PayPal cannot reach agreement on the error or discrepancy, the Parties shall escalate the issue to senior management who will use best efforts during an additional forty-five (45) days to discuss and resolve the dispute. At Partner’s reasonable request at any time during the discussions, PayPal will make available to Partner via remote means (such as screen share) supporting documentation relevant to reconcile the Revenue Share amounts, provided that PayPal will have no obligation to provide access to PayPal Confidential Information regarding merchant compensation, cost of transaction to PayPal, PayPal’s margins, or any other confidential transaction data. If the Parties are unable to reach agreement after completion of the process described above, then Partner may elect to terminate the Agreement on notice to PayPal.

6. DATA PROTECTION

6.1. Roles. With regard to any personal data processed by either Party in connection with this Agreement, each Party will be deemed to be a Data Controller in respect to such processing.

6.2. Responsibility. Each Party shall comply with the requirements of the Data Security Addendum, attached as Schedule 2 to this Agreement and the Data Protection Laws applicable to Data Controllers with respect to the performance of its obligations under this Agreement (including without limitation, by implementing and maintaining at all times all appropriate security measures in relation to the processing of personal data and by maintaining a record of all processing activities carried out under this Agreement) and shall not knowingly do anything or permit anything to be done which might lead to a breach by the other Party of the Data Protection Laws.

7. CONFIDENTIALITY

7.1. Confidentiality Obligations. Each Party agrees to maintain the other Party’s Confidential Information in confidence and not to disclose it to third parties or use it for any purpose other than as necessary and required to perform the services pursuant to this Agreement. Such restrictions shall not apply to Confidential Information that: (a) is known by the recipient prior to the date of disclosure by the disclosing Party; (b) becomes publicly known through no act or fault of the recipient; (c) is received by recipient from a third party without a restriction on disclosure or use; or (d) is independently developed by recipient without reference to the Confidential Information. Notwithstanding the foregoing, a Party may share Confidential Information with an affiliate in the event that the other Party requests services from such affiliate and such affiliate shall be bound by this Section. In the event that the receiving Party is required by a court, government agency, regulatory requirement, or similar disclosure requirement to disclose Confidential Information of the disclosing Party, the receiving Party shall immediately notify the disclosing Party and shall use reasonable efforts to obtain confidential treatment or a protection order of any Confidential Information that is required to be disclosed. The obligations hereunder shall survive the termination of this Agreement or until such time as such information becomes public information through no fault of the receiving Party

7.2. Protection of Confidential Information. Each Party acknowledges that monetary damages may not be a sufficient remedy for unauthorized use or disclosure of the other Party’s Confidential Information and that the disclosing Party will be entitled (without waiving any other rights or remedies) to injunctive or equitable relief as may be deemed proper by a court of competent jurisdiction, without obligation to post any bond.

7.3. Return of Confidential Information. Upon termination of this Agreement, at the request of a disclosing Party, the receiving Party shall return to the disclosing Party within ten (10) days all Confidential Information of the Party and all documents or media containing any such Confidential Information and any and all copies or extracts thereof or certify such Confidential Information’s destruction. The foregoing obligation shall not be applicable to any Confidential Information that a Party is required to retain in order to comply with

6 of 22 PayPal Confidential Global Partner Agreement November 2019

applicable law, rules or regulations or pursuant to the receiving Party’s disaster recovery plan, provided such retained Confidential Information will remain subject to the obligations in this Section 7.

7.4. User Data. In the event a Party discloses Confidential User Data to the other Party, such receiving Party understands and agrees that it shall have the right to use the Confidential User Data, and any derivative works thereof, only as strictly required and necessary to perform its obligations under this Agreement and that it is strictly prohibited from combining the Confidential User Data with its own User Data or from directly or indirectly using the Confidential User Data in connection with any marketing activities. Further, the receiving Party shall keep the disclosing Party’s Confidential User Data only for as long as necessary to perform its obligations under this Agreement.

8. TERM AND TERMINATION

8.1. Term. This Agreement is effective as of the Effective Date and shall continue until the fourth anniversary of the Effective Date (“Initial Term”) unless and until terminated as set out below. Following the Initial Term, this Agreement will automatically renew for subsequent one year terms (each, a “Renewal Term”, and together with the Initial Term, the “Term”) unless terminated as provided herein.

8.2. Termination. Neither Party may terminate this Agreement or any SOW for convenience during the Initial Term. After the Initial Term, either Party may terminate this Agreement at any time upon thirty (30) calendar days’ written notice for any reason. Each Party may terminate this Agreement immediately if the other Party breaches a material term of this Agreement and the breach is not cured within thirty (30) calendar days after the breaching Party receives written notice of the breach. This Agreement may be terminated by either Party effective immediately upon written notice, in the event that: (a) the other Party files a petition in bankruptcy, files a petition seeking any reorganization, arrangement, composition, or similar relief under any law regarding insolvency or relief for debtors, or makes an assignment for the benefit of creditors; (b) a receiver, trustee, or similar officer is appointed for the business or property of the other Party; (c) any involuntary petition or proceeding under bankruptcy or insolvency laws is instituted against the other Party and not stayed, enjoined, or discharged within sixty (60) days; or (d) the other Party adopts a resolution for discontinuance of its business or for dissolution.

8.3. Effect of Termination. Upon termination or expiration of this Agreement for any reason, the following shall apply: (a) all rights and licenses under this Agreement will immediately terminate except as otherwise provided, including with regard to ongoing rights during the Tail Period; (b) each Party must destroy any of the Confidential User Data of the other Party in its possession within seven (7) calendar days, except as provided below, and, upon the owning Party’s request, provide proof of such destruction within seven (7) calendar days of receiving such request; and (c) each Party will remain liable for any amounts or other liability under this Agreement that arose prior to the date of termination; and (d) during the Tail Period, (i) PayPal’s obligation to pay the Revenue Share and other payment obligations under an SOW for all Referred Merchants onboarded through expiration of the Tail Period; (ii) PayPal’s grant of the API license as described in Section 4.2(a) as needed to support the Referred Merchants and Partner; (iii) PayPal’s support of the Referred Merchants and the Partner Integration; and (iv) Partner’s right to add new Referred Merchants as provided under this Agreement and each SOW. A Party is not required to destroy Confidential User Data of the other Party where the requested Party (i) is obligated to keep the Confidential User Data for a longer period pursuant to PCI-DSS rules, any rules set by the financial institutions of the merchant or the cardholder, or by Applicable Law, in which case the relevant Party will delete the Confidential User Data when permissible; or (ii) any archival copy retained systemically as a function of the requested Party’s disaster recovery or backup process, provided such retained Confidential Information will remain subject to the obligations in Section 7.

7 of 22 PayPal Confidential Global Partner Agreement November 2019

9. LIMITATION OF LIABILITY

9.1. IN NO EVENT SHALL PAYPAL OR PARTNER (OR EITHER OF THEIR AFFILIATES, DIRECTORS, OFFICERS, EMPLOYEES OR REPRESENTATIVES) BE LIABLE FOR SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES OR LOST PROFITS (HOWEVER ARISING, INCLUDING NEGLIGENCE) ARISING OUT OF OR IN ANY WAY RELATING TO THIS AGREEMENT.

9.2. IN NO EVENT SHALL EITHER PARTY OR ITS AFFILIATES, DIRECTORS, OFFICERS, EMPLOYEES OR REPRESENTATIVES BE LIABLE FOR AN AMOUNT EXCEEDING ANY AMOUNTS PAID BY PAYPAL UNDER THIS AGREEMENT AND THE EXISTING AGREEMENTS IN THE TWELVE MONTHS PRECEDING THE OCCURRENCE OF FACTS THAT FIRST GIVE RISE TO ANY LIABILITY HEREUNDER. THE EXISTENCE OF MORE THAN ONE CLAIM OR EVENT FROM WHICH LIABILITY ARISES WILL NOT ENLARGE THIS AGGREGATE LIMITATION. THIS AGGREGATE LIMIT IS A SINGLE, GLOBAL LIMIT THAT APPLIES COLLECTIVELY (AND NOT INDIVIDUALLY) TO ALL ENTITIES INCLUDED IN THE TERM “PAYPAL”, THE TERM “PARTNER”, AND/OR “ENTITIES” ADDED TO THIS AGREEMENT.

9.3. THE LIMITATIONS IN SECTION 9.2 SHALL NOT APPLY TO PAYPAL’S OR PARTNER’S, AS APPLICABLE: (I) FEE PAYMENT OBLIGATIONS, (II) REFUNDS OR OVERPAYMENTS; (III) LIABILITY TO PAYPAL ARISING OR IMPOSED UNDER AGREEMENTS WITH PAYPAL’S BANKING PARTNERS, UNDER THE ASSOCIATION RULES MENTIONED IN THOSE AGREEMENTS, OR OTHERWISE BY THE ASSOCIATIONS; (IV) THE INDEMNIFICATION OBLIGATIONS DESCRIBED IN SECTION 10 BELOW OR (V) INFRINGEMENT OF EITHER PARTY’S INTELLECTUAL PROPERTY INCLUDING, BUT NOT LIMITED TO, COMPANY TECHNOLOGY AND API LICENSES.

9.4. THE LIMITATIONS OF LIABILITY IN THIS SECTION ARE FUNDAMENTAL ELEMENTS OF THE BASIS OF THE BARGAIN BETWEEN THE PARTIES.

10. MUTUAL INDEMNIFICATION

10.1. Indemnification.

(a) Each Party (the “Indemnifying Party”) will defend, indemnify, and hold harmless the other Party (the “Indemnified Party”) against any claim in a suit filed by a third party: (i) arising out of the Indemnifying Party’s alleged breach of any representation, warranty in this Agreement or (ii) gross negligence or intentional misconduct in performance of such Party’s obligations hereunder; or (iii) alleging that the technology and services that are generally made available by the Indemnifying Party and owned and provided by the Indemnifying Party under this Agreement (“Indemnifying Party’s Technology”), when used as expressly permitted by this Agreement and in the form provided by the Indemnifying Party to the Indemnified Party, directly infringes such third party’s intellectual property rights (each, a “Claim”);

(b) Notwithstanding any other provision in this Agreement, the Indemnifying Party shall have no obligation for any claims of infringement from: (i) any goods or services that the Indemnified Party or any third party sells or attempts to sell, (ii) any modification to, or combination of other technology with, the Indemnifying Party’s Technology, or (iii) wilful infringement by the Indemnified Party;

(c) The obligations of the Indemnifying Party in this Section are conditioned upon the Indemnified Party: (i) notifying the Indemnifying Party promptly in writing of each Claim, but shall only relieve the Indemnifying Party to the extent of any prejudice caused by delay in notification, (ii) allowing the Indemnifying Party sole control of the defense of the Claim, related settlement negotiations and settlement of the Claim (for which written consent is not required so long as no financial or material burden is imposed on the Indemnified Party), (iii) cooperating and, at the Indemnifying Party’s request and reasonable expense, assisting in a timely manner in such defence, and (iv) complying with the terms of this Agreement. The Indemnified Party shall have the right to participate in such defense with its own counsel, at its own expense. Neither Party shall have any obligation to indemnify the other Party if the Claim would not have arisen but for the breach of this Agreement by the Party claiming indemnification;

8 of 22 PayPal Confidential Global Partner Agreement November 2019

(d) If a Claim is made under Section 10.1(a)(ii), the Indemnifying Party may, at its sole option and expense: (i) procure for the Indemnified Party the right to continue exercising the rights granted by the Indemnifying Party under this Agreement, (ii) replace or modify the applicable Indemnifying Party’s Technology so it becomes non-infringing without materially changing its functionality, or (iii) terminate this Agreement and provide the Indemnified Party a refund of any pre-paid amounts that are unaccrued as of the date of such termination;

(e) This Section states each Party’s sole and exclusive remedy with respect to any direct or indirect infringement (whether actual or alleged) of any patent, trade secret, copyright, database right, trademark or other intellectual property right or any claim or action relating thereto.

11. MISCELLANEOUS

11.1. Compliance with Laws, Regulations and Applicable Association Rules.

(a) The Parties will comply with all applicable laws, regulations, and card network rules in connection with the Program and this Agreement including, but not limited to, the California Consumer Privacy Act of 2018 and other state privacy laws and Data Protection Laws, anti-corruption, anti-bribery, anti-kickback, anti-fraud, anti-money laundering, anti-terrorist financing, anti-narcotics, anti-boycott, anti-slavery and human trafficking, export control, sanctions, embargo, and import control laws, in each case, as it relates to the performance of such Party’s obligations under this Agreement and each SOW.

(b) Partner and PayPal each represents, warrants and covenants that it shall at all times comply with the applicable PCI-DSS, as such may be amended from time to time, with respect to any card data received by it in connection with this Agreement and any applicable card network data security requirements (including those made available by Visa, MasterCard, American Express, and Discover) with regards to such Party’s use, access, and storage of applicable credit card non-public personal information that constitutes Confidential User Data of such Party. PayPal acknowledges that it is responsible for the security of cardholder data it possesses or otherwise stores, processes or transmits, or to the extent that Company could impact the security of the cardholder data environment.

(c) Partner acknowledges and agrees that Partner is responsible for the integrity and security of the Partner Product and is solely liable for any losses suffered as a result of a compromise of Partner Platform’s security including, but not limited to, unauthorized use of Partner User credentials. PayPal acknowledges and agrees that PayPal is responsible for the integrity and security of the PayPal Product and is solely liable for any losses suffered as a result of a compromise of PayPal Services security including, but not limited to, unauthorized use of PayPal User credentials.

(d) To the extent applicable and required in connection with the Program and this Agreement, Partner shall register with any required card network programs through PayPal’s acquiring bank.

11.2. Power and Authority. Each Party represents, warrants and covenants that (a) it has full power and authority to enter into and perform this Agreement and (b) its execution and performance of this Agreement does not violate, conflict with, or result in a material default under any other contract or agreement to which it is a party or by which it is bound. The representations and warranties contained in or made under or in connection with this Agreement shall survive the Effective Date, and, shall be deemed to have been made by each Party upon entering into this Agreement and each amendment or supplement hereto.

11.3. Contracting Entity. This Agreement shall be construed as establishing a series of bilateral contractual relationships between the parties as set forth in the table below. This Agreement shall apply only as between the PayPal Entity listed on each row and the Big Commerce Entity listed on that same row, and not in relation to any other parties.

9 of 22 PayPal Confidential Global Partner Agreement November 2019

Agreement shall apply only as between the PayPal Entity listed on each row and the Big Commerce Entity listed on that same row, and not in relation to any other parties.

PayPal Entity	BigCommerce Entity	Governing Law	Courts with Exclusive Jurisdiction
PayPal, Inc.	BigCommerce, Inc	The State of California	Santa Clara County, California, or Omaha, Nebraska
PayPal Pte. Ltd.	BigCommerce Pty Ltd	Singapore	Singapore or where the defendant is located (in PayPal’s case, Singapore, and in Partner’s case, Partner’s home address or principal place of business)
PayPal Pte. Ltd.	BigCommerce UK Ltd	Singapore	Singapore or where the defendant is located (in PayPal’s case, Singapore, and in Partner’s case, Partner’s home address or principal place of business)
PayPal Pte. Ltd.	BigCommerce Software Ireland Limited	Singapore	Singapore or where the defendant is located (in PayPal’s case, Singapore, and in Partner’s case, Partner’s home address or principal place of business)

11.4. Notice.

(a) Partner agrees that PayPal may provide notice to Partner regarding regular Program updates applicable to all Partners generally by email sent to the email address listed in its Program account, or for all other notices, by email or by mail or courier to the address below, or in each case to such other address of which Partner gives PayPal written notice under this Section.

BigCommerce

11305 Four Points Drive

Building II, Third Floor

Austin, TX 78726

Attn: General Counsel

Email: [***]

(b) Unless Partner is communicating with PayPal about a matter where PayPal has specified another notice address, written notices to PayPal must be sent by mail or courier to the address below:

PayPal Inc.

Attention. USA: Legal Department,

2211 North First Street,

San Jose, CA 95131

PayPal Pte. Ltd.

Attention: Legal Department,

10 of 22 PayPal Confidential Global Partner Agreement November 2019

5 Temasek Boulevard #09-01,

Suntec Tower Five,

Singapore 038985

11.5. Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY LAW, EACH PARTY DISCLAIMS ANY REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THE MATTERS COVERED BY THIS AGREEMENT, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. EACH PARTY’S SITE AND SERVICES ARE PROVIDED “AS-IS,” AND NEITHER PARTY MAKES ANY WARRANTY THAT THE ITS SITE AND/OR SERVICES ARE, OR WILL BE, UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE.

11.6. Service Levels. PayPal will provide the PayPal Site and the PayPal Services in accordance with the following service and support levels (“SLAs��) as follows:

(a) Operational Availability

PayPal is responsible for the operational availability of Supported Services and will use commercially reasonable efforts to meet the availability stated below (“Operational Availability”), including monitoring to maintain a continuous pulse on Operational Availability. PayPal does not provide support to any integration issues where a PayPal staging environment is being used after Partner launches the PayPal Services. The term “Supported Services” shall mean PayPal Branded Products and PayPal Unbranded Products gateway services.

Service	Operational Availability
Payment Services	[***]% or greater measured monthly, minus Excluded Event and other maintenance events mutually agreed to by both parties in accordance with this Section
Payment Services Response Time	Response Time for internet / API connections shall be less than [***] seconds for [***]% of interactions, except for high usage variability that is beyond PayPal’s control.

“Excluded Events” means any event that adversely impacts the PayPal Services related to (a) the acts or omissions of Partner, its employees, customers, contractors or agents; (b) scheduled maintenance, alteration or implementation; (c) the failure of dependent services such as cloud services, network processors, or third party internet connections except those directly utilized by PayPal for hosting; or (d) any force majeure event.    

(b) Issue Classification. Issues are classified and defined in the following table:

Priority	Criteria
P1 / Critical	Any issue without a known commercially reasonable workaround that breaks or materially impacts performance of logins, authorizations, critical data flow, movement of money, registration or customer service operations; or Any issue that results in the complete outage of PayPal account administration or fraud management systems.

11 of 22 PayPal Confidential Global Partner Agreement November 2019

P2 / Serious	Any issue with a known commercially reasonable workaround that: •  breaks or materially impacts performance of logins, authorizations, critical data flow, movement of money, registration or customer service operations; or •  materially degrades other PayPal production payment services. or Any issue without a known commercially reasonable workaround that impairs other PayPal production Payment Services.
P3 / Degraded	Any issue with a known commercially reasonable workaround that minimally impairs PayPal production payment services.
P4 / Minimal	Any issue that does not impair PayPal production payment services.

(c) Operational Issue Resolution Times. The following table specifies the maximum elapsed time per classification for an initial response from PayPal and for Resolution (defined below) of an issue. Time is measured from the point of Issue Notification to PayPal. PayPal will use best efforts to respond to Partner in a manner and time commensurate with the priority of classification.

Priority	Best Efforts Resolution*
P1 / Critical	Within 24 hours
P2 / Serious	Within 2 weeks
P3 / Degraded	Within next available release cycle
P4 / Minimal	As appropriate

“Issue Notification” means Partner’s notification to PayPal that an issue exists and shall include a description of the issue, an initial classification of the issue and sufficient information for PayPal to investigate the cause of the issue.

* “Resolution” means a correction, temporary patch, or work around being provided that allows supported services to continue as normal with no direct financial impact. PayPal will strive to provide a fix or a workaround for an issue as soon as possible. P1 and P2 incidents will be worked continuously until a satisfactory resolution can be reached. PayPal will make best efforts to inform Partner of progress when this does not reduce PayPal’s ability to resolve the issue promptly. PayPal and Partner will apply immediate and continuing best efforts to achieve issue resolution.

(d) Change Management. For any change requiring a PayPal outage of any length, as well as any PayPal change related, but not limited to, performance, data integrity or location, application code, physical facilities, or security, PayPal will make commercially reasonable efforts to meet the notification targets listed below:

12 of 22 PayPal Confidential Global Partner Agreement November 2019

• Normal Changes: Will be planned 10 business days or more before they are implemented. Typically, there is no immediate technical or business requirements to implement the change within a shorter timeframe and any resulting service outage to the Services would occur during normal maintenance windows.

• Urgent Changes: May be implemented with no advance notice. This category is reserved for remediation of the PayPal Services outage or impending outage, a degradation of performance, or an information security-related incident. Notification to Partner will occur promptly following the implementation of a resolution and where practical, upon identification of the issue.

(e) Remedies. Partner acknowledges and agrees that in the event PayPal fails any its obligations hereunder (including without limitation Operational Availability levels), Partner’s sole remedy is termination such that for three (3) months in any twelve (12) month period, or if Operational Availability is below 99.5% in any single month, then Partner may terminate this Agreement without penalty upon ten (10) days prior written notice. For clarity, if PayPal does not meet the Operational Availability or other commitments in this SLA, it will be counted as a failure to meet the SLA whether or not PayPal used commercially reasonable efforts.

11.7. Service Providers. Partner may use third-party service providers to exercise Partner’s rights or perform Partner’s obligations under this Agreement so long as any such service provider expressly agrees to terms consistent with this Agreement. Partner agrees that it will be responsible for any act or omission by its service providers under this Agreement.

11.8. Expenses. Notwithstanding any other provision in this Agreement to the contrary, in no event will PayPal be obligated to pay any expenses, fees, costs or other amounts to any subcontractor, person, or entity other than Partner as a result of this Program.

11.9. Independent Contractors. Partner and PayPal are independent contractors and shall have no power or authority to assume or create any obligation or responsibility on behalf of each other. This Agreement shall not be construed to create or imply any partnership, agency or joint venture.

11.10. Press Releases. Neither Party shall, or shall permit, issue or cause the publication of any press release or other public announcement relating to the transactions contemplated by this Agreement without the consent of the other Party, which consent shall not unreasonably be withheld.

11.11. Non-Disparagement. In representations to Referred Merchants or in public communications, neither Party shall make disparaging or derogatory statements about the other Party, or any of the other Party’s Products or Services, as a brand, service or corporation; provided, however nothing herein shall prohibit complaints by employees of a Party may in their individual capacity as consumers or customers of the other Party or its affiliates.

11.12. Non-Solicitation of Referred Merchants. During the term of this Agreement, neither Party will use information provided by the other Party pursuant to this Agreement to promote or market competitors of the other Party solely on the basis of the intended recipient being a Referred Merchant. This paragraph will not apply to general solicitations, marketing and promotions (including via email). If there is an instance of targeted promotions or marketing described in this Section, each Party’s sole remedy will be to notify the other Party and the other Party will use reasonable efforts to discontinue that targeted promotion or marketing.

11.13. User Consents. Each Party must obtain from its users all necessary consents and authorizations as required under all Applicable Laws, in accordance with the Party’s own published policies.

11.14. Assignment. Partner may not transfer or assign any rights or obligations Partner has under this Agreement without PayPal’s prior written approval. Notwithstanding the foregoing, Partner may assign this Agreement in its entirety, without PayPal’s consent but on prompt written notice (“Assignment Notice”), to (i) its Affiliate, or (ii) in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of Partner’s assets. If Partner assigns this Agreement to a Competitive Business, PayPal may terminate this

13 of 22 PayPal Confidential Global Partner Agreement November 2019

Agreement by giving notice within 60 days of the date of the Assignment Notice, and this Agreement will terminate 60 days after such notice, subject to the Party’s ongoing obligations during the Tail Period. “Competitive Business” means any of the following entities: Amazon.com, Inc., Google LLC, Apple, Inc., and Shopify Inc. PayPal reserves the right to transfer or assign this Agreement or any right or obligation under this Agreement by providing Partner with written notice of such transfer or assignment.

11.15. No Waiver. No failure or delay by either Party in enforcing any provision of this Agreement will be deemed a waiver of such Party’s ability to enforce the same provision of this Agreement at a future date.

11.16. Severability. If any provision of this Agreement is found illegal or unenforceable, it will be enforced to the maximum extent permissible, and the legality and enforceability of the other provisions of this Agreement will not be affected.

11.17. Force Majeure. Neither Party is responsible for any failure to perform its obligations under this Agreement if such failure is caused by acts of God, war, terrorism, civil insurrection, acts of militia or military, strikes, revolutions, lack or failure of transportation or communications facilities, laws or governmental regulations, or other causes that are beyond such Party’s reasonable control. In the event of such a failure, the affected Party’s obligations shall be suspended until such time as the cessation of any cause of such failure.

11.18. Complete Agreement. This Agreement constitutes the entire agreement between the parties relating to this subject matter and supersedes all prior or contemporaneous oral or written agreements concerning this subject matter, including without limitation, the Existing Agreements as described in Section 1.1.

11.19. Amendments in Writing. This Agreement may be modified, or any rights under it waived, only by a written document executed by the Parties.

11.20. Survival. The following sections shall survive termination of this Agreement: Intellectual Property and License Rights, Financial Reconciliation, Confidentiality, Term and Termination, Miscellaneous, and Definitions, as well as any other terms of this Agreement and any SOW which by their nature should survive termination of this Agreement (including without limitation those provisions necessary to implement the rights which continue during the Tail Period).

11.21. Counterparts, Originals and Electronic Acceptance. This Agreement may be executed in counterparts, each of which shall constitute an original, and all of which shall constitute one agreement. A photographic or electronic copy of the signature evidencing a Party’s execution of this Agreement shall be effective as an original signature and may be used in lieu thereof.

14 of 22 PayPal Confidential Global Partner Agreement November 2019

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives as of the dates below.

BigCommerce, Inc.		PAYPAL, INC.
By:	/s/ Russ Klein	By:	/s/ Daniel Leberman
Name:	Russ Klein	Name:	Daniel Leberman
Title:	SVP, Corporate Development	Title:	VP Channel Partners
Date:	April 2, 2020	Date:	April 3, 2020
BigCommerce Pty.		PAYPAL PTE. LTD.
By:	/s/ Russ Klein	By:	/s/ Matt Lucas
Name:	Russ Klein	Name:	Matt Lucas
Title:	SVP, Corporate Development	Title:	Finance Director
Date:	April 2, 2020	Date:	April 5, 2020
BigCommerce UK Ltd
By:	/s/ Russ Klein
Name:	Russ Klein
Title:	SVP, Corporate Development
Date:	April 2, 2020
BigCommerce Software Ireland Limited
By:	/s/ Russell Klein
Name:	Russell Klein
Title:	Chief Development Officer
Date:	April 2, 2020

15 of 22 PayPal Confidential Global Partner Agreement November 2019

SCHEDULE 1

(DEFINITIONS)

In addition to the capitalized terms defined in the Agreement, the following capitalized terms are defined as follows:

(a) “Affiliate” of a Party means, an entity which controls, is controlled by, or is under common control with such Party. For purposes of this definition, the term “control” means: (a) beneficial ownership of at least 50% of the voting securities of a corporation or other business organization with voting securities (or such lesser percentage which is the maximum allowance by a foreign corporation in a particular jurisdiction); (b) a 50% or greater interest in the net assets or profits of a partnership or other business organization without voting securities; or (c) the ability to direct the affairs of any such entity

(b) “API Credentials” means Partner’s application program interface (API) username and password, and either an API signature or an API certificate.

(c) “Applicable Laws” means all applicable federal, provincial, national, state, and local laws, statutes, regulations, rules, orders, supervisory requirements, directions, circulars, opinions, interpretive letters, and other official releases of or by any federal, provincial, national, state, or local governmental authority or entity, and any other applicable regulations and/or operating rules relating to a Party, or its users, as the case may be, and/or its products and/or services, including rules promulgated by the card networks and Data Protection Laws as defined herein.

(d) “Confidential Information” means all information that either Party provides to the other Party under this Agreement, including but not limited to the following: (i) PayPal Content and all other information received through the PayPal APIs or otherwise related to the Partner Product, (ii) the API Credentials and User ID and passwords, (iii) all information disclosed in writing and marked “confidential,” “proprietary,” or with a substantially similar marking, (iv) all information disclosed orally and identified as confidential at the time of disclosure, and (v) all other information that by its very nature the receiving Party should reasonably understand to be the disclosing Party’s confidential information.

(e) “Confidential User Data” means User Data of one Party disclosed to the other Party that such receiving Party has not otherwise collected in the course of providing its services to the applicable user,

(f) “Data Controller” have the meanings given to those terms under the Data Protection Laws.

(g) “Data Protection Laws” means EU Directive 95/46/EC or Regulation (EU) 2016/679 (GDPR) and any associated regulations or instruments and any other data protection laws, regulations, regulatory requirements and codes of practice applicable to the provision of the PayPal Services.    

(h) “Marketing Plan” means the plans established pursuant to this Agreement by the Partner and approved by PayPal that outlines strategies and tactics designed to promote the Program to Partner Users.

(i) “Marks” means, with respect to a Party, the trademarks, including registered and common law trademarks, trade names, service marks, logos, buttons, domain names and designations owned, licensed or used by the Party.    

(j) “Partner Product” means the ecommerce or retail related product or solution offered by Partner to its customers.

(k) “Partner User” means a customer that has entered into a relationship with Partner to purchase goods or services, including the Partner Product, as well as a prospective customer of the Partner. A Partner User that has a PayPal account is also a PayPal User.

[Type here]

(l) “PayPal APIs” means the application programming interfaces used by PayPal merchants to interface with PayPal’s facilities, hardware, software and processes in connection with their use of the PayPal Services

(m) “PayPal Branded Products” means PayPal’s payment processing services that are branded with PayPal’s Marks.

(n) “PayPal Content” means all the data passed through the PayPal APIs, including any User Data of PayPal or its merchants. PayPal Content does not include any data that Partner obtains independent of PayPal and the PayPal APIs.

(o) “PayPal Credit” means the credit and financing services that PayPal makes available to PayPal account holders for use in making payments for purchases, through PayPal’s and its affiliates’ web and mobile applications.

(p) “PayPal Services” means the payment services provided by PayPal, including PayPal Branded Products and PayPal Unbranded Products, the functionality and branding of which may change from time to time.

(q) “PayPal Site” means www.paypal.com or such other website(s) provided by PayPal for its users located in particular countries or jurisdictions.

(r) “PayPal Unbranded Products” means PayPal’s payment processing services that are not branded with PayPal’s Marks.

(s) “PayPal User” mean a person who accesses a PayPal Site or uses the PayPal Services.

(t) “PCI-DSS” means the applicable Payment Card Industry Data Security Standards, as they may be amended from time to time.

(u) “Program Year” means the twelve calendar month period of time commencing with the Effective Date and each succeeding twelve calendar month period of time during the Term.

(v) “Tail Period” means the [***] period following termination or expiration of this Agreement.

(w) “User Data” means information, including personally identifiable information, collected from a customer or user of a Party.

(x) “User ID” means the unique confidential identification code, certificate, and user ID issued by PayPal to Partner that permits Partner to integrate the PayPal Services and the Partner Product.    

[Type here]

SCHEDULE 2

(DATA SECURITY ADDENDUM)

Data Security Addendum                

“Underlying Agreement”	Global Partner Agreement	“Underlying Agreement Effective Date”
Parties
“Partner”	PayPal, Inc. PayPal Pte. Ltd.	“BigCommerce” or “BC”	BigCommerce, Inc. BigCommerce Pty. Ltd.
Purpose	Data protection	Duration	Coterminous with Underlying Agreement

The parties in the table above enter this Data Security Addendum (this “DSA”) as an attachment to the Underlying Agreement. Capitalized terms have the meanings ascribed them in the Underlying Agreement or as set forth below. If any provision of this DSA conflicts with any provision of the Underlying Agreement, the provision in this DSA will supersede the provision in the Underlying Agreement.

1. Definitions.

1.1. “Applicable Law” means all applicable laws, rules and regulations in all jurisdictions in which either party’s Confidential Information may be stored or processed, including without limitation those relating to privacy and data security.

1.2. “Confidential Information” has the meaning ascribed it in Amendment7.

1.3. “Industry Best Practice” means globally recognized information security management standards such as those established by the International Organization for Standardization, the International Electrotechnical Commission, the Information Systems Audit and Control Association, and the National Institute of Standards and Technology, such as ISO/IEC 27001 and ISAE 3402 SOC 2.

1.4. “Personally Identifiable Information” or “PII” means any information that identifies an individual person as defined by Applicable Law. In any jurisdiction that regulates “personal information” or “personal data,” such data will be considered “PII” under the terms of this DSA.

1.5. “Security Incident” means (a) actual or suspected unauthorized acquisition (including hostaging), loss or distribution of Confidential Information of the other party, (b) actual or suspected security breach concerning a party’s Systems or Facilities that contain, or permit access to, Confidential Information of the other party, or (c) either party reasonably believes that the foregoing has occurred or is at risk of occurring and will impact the Confidential Information of the other party.

1.6. “Services” has the meaning of PayPal Working Capital/PayPal Business Loans provided in Amendment 7.

1.7. “Facility” means a facility used to collect, access, store, route, transmit, display, host or process Confidential Information, regardless of whether such facility is owned and operated by a party or by a third party on the party’s behalf.

1.8. “Systems” means the systems, equipment, hardware, software, mobile and other applications, and networks used in the provision of the Services or used to collect, access, store, route, transmit, display, host or process Confidential Information,

[Type here]

regardless of whether each of the foregoing is owned and operated by a party or by a third party on the party’s behalf, including without limitation any hosting services.

1.9. “Vulnerability Redactions ”means, with respect to a given document, that (a) the providing party will provide only summary rather than detailed information and will redact any exploitable information, and (b) the summary will not redact high-level, non-exploitable information about vulnerabilities or omit disclosure of vulnerabilities altogether

2. Purpose. Each party will process PII only as specified by the Purpose and consistent with the consent provided by the data subject.

3. Failure. If a party can no longer meet its obligations under this DSA, then it will (a) notify the other party, (b) cease processing PII, and (c) take any reasonable and appropriate steps to remediate any unauthorized processing.

4. Disclosure of Privacy Provisions. Notwithstanding any confidentiality obligations, either party may provide a summary or a representative copy of the relevant privacy provisions, including this DSA, to the United States Department of Commerce upon request, pursuant to the requirements of the EU-US Privacy Shield Framework.

5. Termination. Each party will destroy the Confidential Information of the other party in its possession using a secure means of disposal when such data is no longer required under Amendment 7 or by Applicable Law.

6. Security Controls. Each party will follow Industry Best Practices for data security.

6.1. No External Data Processing. If a party has access to the other party’s Confidential Information (an “Accessing Party”) through systems managed by the other party, then the Accessing Party will comply with the following (the “Data Processing Prerequisites”):

a) Data Security Assessment. Upon written request, the Accessing Party will reasonably cooperate with the other party’s data security

assessment efforts, including responding to questionnaires to the extent the Accessing Party makes such information generally available to its partners. The Accessing Party may provide the SSAE 16 SOC2 report and PCI Attestation of Compliance in lieu of completing any questionnaires. Parties agree to reasonably cooperate by answering additional questions.

b) Reasonable Security Measures. The Accessing Party will implement and maintain reasonable security measures appropriate to the nature of the Confidential Information.

c) Upgrades. The Accessing Party must maintain processes and procedures that, having regard to the state of technological development, the Accessing Party’s cost of implementing them, and the nature of the Confidential Information, ensure a level of security appropriate based upon risk analysis of Accessing Party to meet Industry Best Practice.

6.2. External Data Processing. If the Accessing Party has access to the other party’s Confidential Information outside of the systems managed by the other party, then the Accessing Party will comply with the Data Processing Prerequisites and the following:

a) Security Management. The Accessing Party will establish and maintain a written information security policy, assign segregated roles and responsibilities for information security, provide necessary support and resources, and monitor and continuously improve the security program.

b) Information Security Officer. Appoint an Information Security Officer, who is a senior employee responsible for:

• carrying out your information security program; and

[Type here]

• communicating with the other party on matters affecting the security and integrity of the Confidential Information.

c) Communication. The Accessing Party’s Information Security Officer must themselves be, or appoint one or more representatives to be, available to discuss any Data security concerns with the other party. The Accessing Party must promptly notify the other party if the Information Security Officer or any of its appointed representatives changes.

d) Threat Assessment and Remediation. The Accessing Party will implement, maintain and periodically conduct (no less than once per year and upon any material changes to its systems or practices) an information security risk assessment process that identifies and remediates risks to Confidential Information, its Systems, and the Services.

e) Identity and Access Management. The Accessing Party will permit access to the other party’s Confidential Information, and, if applicable, its Systems, solely on a need-to-know basis, and the Accessing Party will review such access on an ongoing basis. The Accessing Party will implement identity and access management of all account credentials including but not limited to: segregated accounts and credentials for each unique user, strict management of administrative accounts, and password best practices, strong passwords, removal of default passwords, and secure password storage. The Accessing Party will remove access of all Personnel who no longer require access to the other party’s Systems in accordance with the Accessing Party’s policies including immediate termination on involuntary separation.

f) Configuration Management. The Accessing Party will maintain secure configuration of its Systems in accordance with its own configuration management policies.

g) Vulnerability Management. The Accessing Party will continuously identify and remediate or mitigate vulnerabilities on its Systems, including without limitation by implementing quarterly vulnerability scans and regularly updating and patching software. Upon written request by the other

party, the Accessing Party will provide written evidence of its performance of vulnerability scans.

h) Boundary Defense and Security Segmentation. The Accessing Party will monitor, detect, and restrict the flow of information on a multilayered basis using tools such as firewalls, proxies, DMZ perimeter networks, and network-based intrusion detection and intrusion protection systems. The Accessing Party will design and implement multilayered and secure network and system segmentation.

i) Data Loss Prevention and Encryption. The Accessing Party will implement best practices for data loss prevention including without limitation: encryption of Confidential Information containing PII in motion, automated tools to identify attempts to exfiltrate data, use of certificate based security and secure key management policies and procedures.

j) Monitoring, Auditing, Logging. The Accessing Party will implement best practices for monitoring, auditing, alerting, and escalating threats. The Accessing Party will implement best practices for logging including without limitation: the use of logging tools to collect and correlate event log data from the Accessing Party Systems, routing log data for aggregation to separate, secure Systems, maintaining log data for no less than one year, and conversion or normalization of log data into standard formats. Upon written request and subject to Vulnerability Redactions, the Accessing Party will regularly send the other party the log data files in a format mutually agreed by the parties.

k) Secure System and Software Development and Maintenance. The Accessing Party will implement best practices to manage the secure lifecycle of Systems and software from design, development, test, and use to discontinuation, including without limitation: segregating development, test, and production environments, using web application firewalls to address common attacks such as cross-site scripting, SQL injection, and command injection, testing code for common coding errors and vulnerabilities, testing software for performance under denial of service and other

[Type here]

resource exhaustion attacks, and otherwise implementing the OWASP Top Ten recommendations.

l) Shared Security Model for Cloud Services. In the event that the Accessing Party uses third-party cloud-based services in connection with the Services, the Accessing Party will meet or exceed the industry best practices for using cloud service providers. The Accessing Party will ensure that no third party is given license to access or use Confidential Information for any purpose other than as necessary under the Agreement.

m) Physical Security. The Accessing Party will establish, maintain and continuously improve an access control system that enables the Accessing Party to monitor and control physical access to each of its Facilities and, if applicable, the other party’s Facilities, including without limitation limiting access to authorized personnel only.

7. Personnel and Subcontractors.

7.1. Personnel. Each party will impose the requirements of this DSA on all access to and use of Systems, Facilities and/or Confidential Information by its personnel or independent contractors (collectively, “Personnel”). The Accessing Party will (a) subject to Applicable Law, perform Personnel background screening, (b) provide security training to its Personnel at the Accessing Party’s expense no less than on an annual basis, maintain records documenting the training materials, the name of each Personnel who receives that training and the date on which the training was completed and agree to provide written confirmation of compliance with the foregoing upon the reasonable request of the other party, and (c) require all Personnel to abide by the confidentiality and security obligations of this Agreement.

7.2. Subcontractors. If a party subcontracts or delegates any of its obligations to a

subcontractor, business partner, or other third party (each a “Subcontractor”), then it will ensure that each Subcontractor (a) is bound by security terms substantially as protective as this DSA, (b) processes Confidential Information only in accordance with the subcontracting party’s instructions.

7.3. Liability for Personnel and Subcontractors. Each party will be liable for the actions and omissions of its Personnel and Subcontractors.

8. Verification of Security Controls.

8.1. Annual Third Party Audits. On an annual basis, each party will conduct a PCI-DSS audit and make the summary Attestation of Compliance available upon written request. Each party will, at its own expense and according to their vulnerability management policy.

9. Security Incidents.

9.1. Notification. Each party will implement best practices for incident management to identify, contain, respond to, and resolve Security Incidents. Each party will notify, by email to [***] (if notification is to PayPal) or to [***] (if notification is to BigCommerce), the primary and backup contacts of the other party within 48 hours of its detection of a material Security Incident, and provide the following information, to the extent known:

a) a summary of the Security Incident,

b) an expected resolution time (if known), or notice that the resolution path is unknown at the time of notification,

c) the name, email, and phone number of the breached party’s contacts for incident updates, and

d) a description of any impact such Security Incident may have on the other party,

e) the date of the Security Incident,

f) the nature and extent of the Confidential Information potentially involved in the Security Incident,

g) Identification of the persons who are known or are reasonably suspected to have improperly accessed or obtained the Confidential Information,

[Type here]

h) a description of the location in which the Confidential Information is known or reasonably suspected to have been improperly transmitted, sent or utilized,

i) a description of the probable cause(s) of the Security Incident; and

j) any other relevant information that is reasonably necessary to help remedy the Security Incident.

9.2. Security Incident Procedures. In the event of a Security Incident, the Accessing Party will (a) cooperate with any investigation concerning the Security Incident, regulators and/or law enforcement, (b) cooperate with the other party to comply with Applicable Laws concerning such Security Incident, including any notification to consumers, and once cause has been determined by a mutually agreed upon third party and in accordance with Limitation of Liability, and (c) be liable for any expenses associated with the Security Incident, subject to Indemnification and Limitation of Liability, including without limitation:

(i) the cost of any required legal compliance (e.g., notices required by Applicable Laws), (ii) the cost of providing credit monitoring services or other assistance to affected consumers, and (iii) expenses related to the investigation and remediation. Except as required by law, the Accessing Party will not serve any notice of or otherwise publicize a Security Incident without the prior written consent of the other party.

9.3. Reporting. The other party may report Security Incidents to affected persons and/or any governmental authority or agency having supervisory or oversight authority.

9.4. Corrective Measures. The breached party will undertake a procedural review and audit to determine measures to avoid occurrence of a similar situation, notify the other party of the corrective measures undertaken, and take additional measures reasonably requested by the other party.

End

[Type here]