Legal Rights & Agreement Rules · Restriction or exception
Other organizations follow their own privacy policies
This statement does not govern what certain third parties (for example authorities, credit bureaus, acquirers and other financial institutions) do with your Personal Information. Their handling is regulated by their own privacy policies, and PayPal encourages you to read those policies and know your rights before dealing with them.
Supporting quotations
This Privacy Statement does not apply when Personal Information is processed by certain third parties, for example, authorities, credit bureaus, acquirers, and other financial institutions. Instead, the third parties' processing of your Personal Information is regulated by their own privacy policies. We encourage you to read the third parties' privacy policies and know your privacy rights before interacting with them.
Qualifications & exceptions
The examples given are not stated to be a complete list of the third parties covered.
Legal Rights & Agreement Rules · Company practice
Processing and rights can differ by where you live
If you live in certain countries, PayPal may process your Personal Information differently to comply with the privacy laws there, and you may have specific privacy rights depending on where you reside. The statement includes jurisdiction-specific information to help you see which rights apply to you.
Supporting quotations
If you reside in certain countries, we may process your Personal Information differently to comply with applicable privacy laws in those jurisdictions. You may also have specific privacy rights depending on your place of residence. To help you understand what rights apply to you, in this Privacy Statement we provide jurisdiction-specific information that provides more information based on where you reside.
Certain capitalized terms that are not otherwise defined in this Privacy Statement are explained in Definitions.
Not stated here
The countries and the specific differences are not stated in this passage.
Legal Rights & Agreement Rules · Company commitment
How changes to this statement take effect
PayPal may revise this statement from time to time to reflect changes to its business, Services or applicable laws. If the revised version requires notice under applicable law, PayPal will give 30 days' prior notice by posting on its Policy Updates or Privacy Statement web page; otherwise the revised statement takes effect on its published effective date. If you are a new User, or receive the statement for the first time while an upcoming change is described on those pages, that change applies to you on the date indicated. This version states it was last updated on September 28, 2026.
Supporting quotations
Last updated on September 28, 2026
We may revise this Privacy Statement from time to time to reflect changes to our business, Services, or applicable laws. If the revised version requires notice in accordance with applicable law, we will provide you with 30 days' prior notice by posting notice of the change on the [Policy Updates](https://www.paypal.com/legalhub/upcoming-policies-full) or "[Privacy Statement](https://www.paypal.com/legalhub/privacy-full)" page of our website, otherwise the revised Privacy Statement will be effective as of the published effective date. If you are a new User or are receiving this Privacy Statement for the first time, and there is an upcoming change described on the [Policy Updates](https://www.paypal.com/legalhub/upcoming-policies-full) or [Privacy Statement](https://www.paypal.com/legalhub/privacy-full) page at the time you receive this Privacy Statement, such upcoming change will apply to you on the indicated effective date.
Qualifications & exceptions
The 30-day notice applies only if applicable law requires notice.
Notice is by posting on the website, not stated as direct delivery to you.
Legal Rights & Agreement Rules · Company practice
Legal compliance, enforcement and financial risk management
PayPal may use Personal Information to comply with laws and rules (including anti-money laundering, bookkeeping rules of its designated banks and card networks, and know-your-customer rules), to enforce its agreements with you and other users, and to establish, exercise or defend legal claims or collection procedures. It carries out sanction screening and reports to tax, police, enforcement and supervisory authorities, including where it is not compelled by law but has a good faith belief that sharing is necessary to comply with applicable law. It also conducts financial risk management: credit performance and quality, product suitability, identity checks, debt tracing and recovery, preventing crime, fraud and scams, mitigating insurance risks and supporting capital adequacy requirements.
Supporting quotations
Comply with laws and risk oversight. We may use Personal Information to comply with applicable laws and rules (including anti-money laundering ("AML"), bookkeeping laws and rules issued by our designated banks and relevant card networks, and know-your-customer ("KYC")), enforce our agreements with you and other people who use our Services, and establish, and exercise or defend a legal claim or collection procedure. We also carry out sanction screening, report to tax authorities, police and other enforcement authorities, supervisory authorities where we are not compelled by applicable laws but where we have a good faith belief that sharing the information is necessary to comply with applicable law. Further, we will conduct financial risk management, such as credit performance and quality, assess product suitability, check your identity, trace and recover debts, prevent criminal activity, fraud and scams, mitigate insurance risks, and support compliance with capital adequacy requirements under applicable law.
Qualifications & exceptions
Reporting to authorities can happen without a legal compulsion when PayPal holds a good faith belief that sharing is necessary to comply with applicable law.
Legal Rights & Agreement Rules · Context
Lawful bases for processing
Some jurisdictions require a lawful basis for processing Personal Information. The statement points to a separate section on lawful bases under the EU and UK General Data Protection Regulation and says PayPal applies the same lawful bases under other privacy laws that have equivalent requirements.
Supporting quotations
Please note that certain jurisdictions require providing a lawful basis for processing Personal Information. See Our Lawful Basis for Processing Personal Information for more information about our lawful basis for processing Personal Information under the EU and UK General Data Protection Regulation. We apply the same lawful bases for processing under other privacy laws that have equivalent requirements.
Qualifications & exceptions
The "same lawful bases" rule applies to other privacy laws that have equivalent requirements.
Not stated here
The lawful bases themselves are in a separate section.
Legal Rights & Agreement Rules · Company practice
Disclosure to authorities and others required by law
PayPal may disclose Personal Information to authorities (courts, governments, law enforcement and regulators) if compelled by a subpoena, court order or similar process, when necessary to comply with law, or where reasonably necessary to prevent physical harm or financial loss, report suspected illegal activity or investigate violations of the relevant agreement, or as otherwise required by law. It may also be required to give other third parties information about your use of the Services, for example to comply with card association rules, enforce its user agreement or prevent harm or illegal activity. In some cases PayPal may not be permitted to tell you about such disclosures.
Supporting quotations
Authorities. We may disclose Personal Information with authorities if compelled by a subpoena, court order, or similar legal procedure, when necessary to comply with law, or where the disclosure of Personal Information is reasonably necessary to prevent physical harm or financial loss, report suspected illegal activity, or investigate violations of the relevant agreement, or as otherwise required by law. Such authorities include courts, governments, law enforcement, and regulators. We may also be required to provide other third parties information about your use of our Services, for example, to comply with card association rules, to investigate or enforce violations of our user agreement, or to prevent physical harm or illegal activity. In some cases, PayPal may not be permitted to provide you with information about such disclosures.
Qualifications & exceptions
Disclosure is not limited to compelled requests: it also covers cases where it is "reasonably necessary" to prevent harm, report suspected illegal activity or investigate agreement violations.
PayPal may be barred from telling you about a disclosure.
Legal Rights & Agreement Rules · User right or choice
Privacy rights depend on where you live; no penalty for using them
Depending on the country you live in, and subject to exceptions and differences among laws, you may have certain rights about how your Personal Information is collected, stored, used and shared. PayPal says it will not discriminate against you, deny services, charge different prices or provide a different level of service solely because you exercise your privacy rights. Some personalized services for PayPal customers may not be as personalized if you limit the Personal Information you share.
Supporting quotations
Under applicable data protection laws, depending upon the country in which you reside, and subject to applicable exceptions and definitional differences among various laws, you may have certain rights about how your Personal Information is collected, stored, used and shared.
Whether you decide to exercise your privacy rights or not, we will not discriminate or deny you services, charge you different prices, or provide you with a different level of service solely for exercising your privacy rights. Although, certain personalized services for PayPal customers may not provide the same level of personalization if you decide to limit the amount of Personal Information you share with us.
Qualifications & exceptions
Rights vary by country and are subject to applicable exceptions and definitional differences among laws.
Reduced personalization is stated as a possible consequence of limiting shared information and is distinguished from discrimination.
Legal Rights & Agreement Rules · Procedure
How to make a privacy request
PayPal says it provides several ways to exercise privacy rights. You, or an authorized agent where permitted, can follow the instructions below to exercise rights relating to Personal Information in your account profile(s). Even if you have no PayPal account, for example if you pay without a PayPal account, you may find instructions to submit a privacy-rights request through the privacy hub.
Supporting quotations
We recognize the importance of your ability to control the use of your Personal Information and provide several ways for you to exercise your privacy rights.
If you, or an authorized agent, where permitted, want to exercise any of your rights relating to your Personal Information in your account profile(s), please follow the instructions on how to exercise your data protection rights below.
Even if you do not have a PayPal account (for example, where you use Pay without a PayPal account), you may find [instructions](https://www.paypal.com/myaccount/privacy/privacyhub) to submit a privacy-rights request.
Pay without a PayPal Account means our Services may be accessed by individuals without using a PayPal account, a Fastlane profile, or the Unbranded Payment Services. Pay without a PayPal account does not include Venmo, which is subject to its own terms of service and separate privacy statement.
Not stated here
The linked privacy hub is not part of the analyzed text.
Legal Rights & Agreement Rules · Procedure
Identity verification and what happens if a request is denied
PayPal may first need to verify who you are, and if permitted or required by privacy laws it may ask for the information needed to reasonably verify your identity, comparing what you submit with its internal business records. If it cannot verify your identity it may not be able to fulfill your request, unless the right does not require verification. If PayPal denies a request in whole or part, you may have the right to be told its reasons, to appeal its decision, or to lodge a complaint with a supervisory authority and seek a judicial remedy, and PayPal says it will give information about the appeals process. You can also contact PayPal using its contact information.
Supporting quotations
We may first need to verify who you are before we can respond to your request. If permitted or required under privacy laws, we may ask you to provide us with information necessary to reasonably verify your identity before responding to your request. We will compare the information you submit against our internal business records to verify your identity. If we can’t verify your identity, we may not be able to fulfill your request, unless the right does not require verification. If we deny your request in whole or in part, you may have the right to be informed of the reasons we have for not taking action and regarding the possibility to appeal our decision or lodging a complaint with a supervisory authority and seeking judicial remedy. In such circumstances, we will provide you with information regarding the appeals process. You can also contact us, as noted in Our Contact Information.
Qualifications & exceptions
Rights to reasons, appeal, complaint and judicial remedy are stated as things you "may have", depending on law.
Verification is not required where the right does not require it.
Legal Rights & Agreement Rules · Procedure
Requests made by an authorized agent
If a request comes from an authorized agent, PayPal may ask for evidence that you gave the agent a power of attorney or that the agent otherwise has valid written authority to act for you, including a guardianship, conservatorship or other protective arrangement.
Supporting quotations
If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf, including a guardianship, conservatorship or other protective arrangement.
Legal Rights & Agreement Rules · User right or choice
Right to know and to see the list of third parties
To request a copy of the Personal Information PayPal has collected about you, you can log in to your PayPal account(s) or profile management portal and submit a request, or, if you live in the United States, call or contact PayPal; for other countries see Our Contact Information. To request a list of the specific third parties to which your Personal Information has been disclosed, US residents can call or contact PayPal, and people elsewhere can submit a request through the Help Center.
Supporting quotations
Your right to know and request a copy of the Personal Information. If you want to request the Personal Information that we’ve collected about you, you have choices:
Log in to your PayPal account(s) or profile management portal, and submit a request.
If you reside in the United States, Call or contact us and request that we provide you with the data we’ve collected. For other countries, please refer to Our Contact Information.
Your right to request a list of specific third parties. If you want to request a list of the specific third parties to which we have disclosed your Personal Information:
If you reside in the United States, Call or contact us and request that we provide you with the data we’ve disclosed. For other countries, you may also submit a request through the [Help Center](https://www.paypal.com/smarthelp/contact-us/privacy).
Qualifications & exceptions
The phone/contact route is described for US residents; other countries use the contact information or Help Center.
Legal Rights & Agreement Rules · User right or choice
Right to correct your information
To correct certain Personal Information, you can log in to your PayPal account(s) or profile management portal and submit a request. If you live in the United States you can call or contact PayPal; for other countries, see Our Contact Information.
Supporting quotations
Your right to correct your Personal Information. If you want to correct certain of your Personal Information, you can:
Log in to your PayPal account(s) or profile management portal, and submit a request.
If you reside in the United States, Call or contact us and request that we provide you with the data we’ve collected. For other countries, please refer to Our Contact Information.
Qualifications & exceptions
The passage speaks of correcting "certain" Personal Information, not all of it.
Legal Rights & Agreement Rules · User right or choice
Right to delete information or close your account
To delete certain Personal Information, you can log in to your PayPal account(s) or profile management portal and delete information you previously added (for example non-primary addresses in your settings), call or contact PayPal if you live in the United States, or close your PayPal account(s) or profile.
Supporting quotations
Your right to delete your Personal Information. If you want to delete certain of your Personal Information, you can:
Log in to your PayPal account(s) or profile management portal, and delete any information that you've previously added. For example, you may delete your non-primary addresses in your settings.
If you reside in the United States, Call or contact us and request that we provide you with the data we’ve collected. For other countries, please refer to Our Contact Information.
Close your PayPal account(s) or profile.
Qualifications & exceptions
Deletion covers "certain" Personal Information.
Self-service deletion is described as covering information you previously added.
Legal Rights & Agreement Rules · User right or choice
Right to object to legitimate-interest processing and to withdraw consent
Where applicable by law, you can object to PayPal using your Personal Information to pursue its legitimate interests or those of a third party by contacting PayPal. Where PayPal processes your information with your consent, you can withdraw that consent by contacting PayPal. Withdrawing consent does not affect the lawfulness of processing before the withdrawal, or processing that relies on a lawful ground other than consent.
Supporting quotations
Your right to object to legitimate interest processing. Where applicable by law, if you want to object to our use of your Personal Information to pursue our legitimate interests or those of a third party, you can refer to Our Contact Information of this Privacy Statement to contact us. See Our Lawful Basis for Processing Personal Information for more information.
Your right to withdraw your consent. If you want to withdraw consent to our use of your Personal Information in circumstances where we processed it with your consent, you can refer to Our Contact Information of this Privacy Statement to contact us. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted in reliance on a lawful processing ground other than consent.
Qualifications & exceptions
The right to object applies "where applicable by law".
Withdrawal does not undo earlier processing and does not stop processing based on another lawful ground.
Legal Rights & Agreement Rules · User right or choice
Rights about profiling and automated decisions
The statement describes a right to object to or opt out of Profiling in furtherance of Automated Decisions that produce legal or similarly significant effects, and related rights. PayPal says it may use Automated Decision Making and Agentic AI Tools. In the United States, it says these are either exempt practices or do not trigger an opt-out right under applicable US privacy laws. In other jurisdictions, where the right exists, individuals can contact PayPal to seek a review of, object to, or revoke consent for such a decision, and PayPal says it will review the decision with relevant additional circumstances. If you are not approved under an Automated Decision you may not have access to its services; PayPal says it has safety mechanisms, including ongoing review of decision models and random sampling, and you can contact it with concerns so it can determine whether the procedure was performed appropriately.
Supporting quotations
Your right to object to or opt out of Profiling in furtherance of Automated Decisions that produce legal or similarly significant effects on you and related rights.
As explained in AI and Automated Decision Making we may use Automated Decision Making technology and Agentic AI Tools.
In the United States, these are either exempt practices or do not trigger an opt-out right under applicable United States privacy laws. However, in other jurisdictions, individuals may exercise the right to seek a review of, or to object to and/or revoke consent for, an Automated Decision that has legal or similarly significant effects on them (together with the relevant Profiling), where this right exists, by contacting us. We will then review the decision, taking into account relevant additional circumstances.
If you are not approved under the Automated Decisions, you may not have access to our services. PayPal has several safety mechanisms to ensure the decisions are appropriate. These mechanisms include ongoing overviews of our decision models and random sampling in individual cases. If you have any concern about the outcome, you can contact us, and we will determine whether the procedure was performed appropriately.
Profiling means analysis of an individual’s personality, behavior, interest and habits to make predictions or decisions about them, including like terms under applicable laws.
Qualifications & exceptions
The review, objection and revocation rights outside the United States apply "where this right exists".
In the United States PayPal says no opt-out right is triggered.
Not stated here
The passage does not say which non-US jurisdictions give the right.
Legal Rights & Agreement Rules · User right or choice
Consent and permitted purposes for Sensitive Personal Information
Where required by law, PayPal says it will obtain your consent before collecting and processing Sensitive Personal Information, and you can withdraw consent by contacting PayPal. It says it will use Sensitive Personal Information only according to the consent you gave or for permitted purposes to the extent permitted or exempt under applicable law, so a right to limit use and disclosure of it is not needed under US privacy laws. Under US laws the permitted purposes include providing the goods or services you requested; preventing, detecting and investigating security incidents; resisting malicious, deceptive, fraudulent or illegal actions and prosecuting those responsible; verifying or maintaining the quality or safety of a product, service or device; and ensuring physical safety of people. The exemption it relies on for precise geolocation is based on the Gramm-Leach-Bliley Act.
Supporting quotations
Your rights related to Sensitive Personal Information. Where required by law, we will obtain your consent before collecting and processing your Sensitive Personal Information. You can withdraw your consent by contacting us and refer to Our Contact Information of this Privacy Statement.
We will also only use your Sensitive Personal Information in accordance with the consent you have given or for certain permitted purposes to the extent permitted or exempt under applicable law, which is why it is not necessary to exercise a right to limit use and disclosure of Sensitive Personal Information under the United States privacy laws. Under the United States privacy laws, these permitted purposes include providing the goods or services you requested; preventing, detecting, and investigating security incidents; resisting malicious, deceptive, fraudulent, or illegal actions and prosecuting those responsible; verifying or maintaining the quality or safety of a product, service, or device; and ensuring physical safety of natural persons. The exemption we rely on for precise geolocation is based on the Gramm-Leach-Bliley Act.
Qualifications & exceptions
Consent is required only "where required by law".
The permitted purposes listed are the ones PayPal names under US privacy laws.
Legal Rights & Agreement Rules · User right or choice
Right to ask about disclosures for direct marketing
You may request certain details about how your Personal Information is disclosed to third parties for direct marketing purposes. In the United States, you can call or contact PayPal.
Supporting quotations
Your rights related to disclosure of Personal Information to third-parties for direct marketing purposes: You may request certain details about how your Personal Information is disclosed to third parties for direct marketing purposes. In the United States, Call or contact us.
Legal Rights & Agreement Rules · Restriction or exception
Definition of Excluded Services
Excluded Services are companies or separate brands, affiliates or subsidiaries of PayPal that process Personal Information under their own terms of service and separate privacy statements. Examples are Venmo, Honey Science LLC, Chargehound LLC, Paidy Inc., Swift Financial LLC and Bill Me Later, Inc.
Supporting quotations
Excluded Services means companies or separate brands, affiliates, or subsidiaries of PayPal, who process Personal Information in accordance with their own terms of service and separate privacy statements. Examples include Venmo, Honey Science LLC, Chargehound LLC, Paidy Inc., Swift Financial LLC, and Bill Me Later, Inc.
Qualifications & exceptions
The examples are introduced with "Examples include", so the list is not stated to be complete.
Cross-references
related (model-proposed): What this Privacy Statement covers — defines: The definition of Excluded Services supplies the carve-out that limits the scope of the statement.
Legal Rights & Agreement Rules · Procedure
How to contact PayPal, Hyperwallet, Fastlane and Xoom about privacy
If you have questions about this statement or your Personal Information, you can contact PayPal. For a PayPal account or Unbranded Payment Services, call PayPal Customer Service at 1-888-221-1161 or use the Customer Service web portal. For a Hyperwallet account, call Hyperwallet Customer Service at 1-877-546-8220 or log into the Hyperwallet Pay Portal and use the "Privacy Concerns" email form under Support. For a Fastlane profile, call PayPal Customer Service at 1-844-705-3555 or use the Fastlane profile management portal. For a Xoom account, call Xoom Customer Service at 1-877-815-1531 or use the Xoom Help Center web portal.
Supporting quotations
If you have questions about this Privacy Statement or your Personal Information, contact us so we can help. To talk about your PayPal account or Unbranded Payment Services:
Call PayPal Customer Service at 1-888-221-1161; or
Visit our [Customer Service web portal](https://www.paypal.com/smarthelp/contact-us/privacy).
To talk about your Hyperwallet account:
Call Hyperwallet Customer Service at 1-877-546-8220; or
Log into the Hyperwallet Pay Portal (Go to "Support," select "Email" and complete the form for "Privacy Concerns").
To talk about your Fastlane profile:
Call PayPal Customer Service at 1-844-705-3555; or
Visit your [Fastlane profile management portal](https://connect.paypal.com/cshelp/personal).
To talk about your Xoom account:
Call Xoom Customer Service at 1-877-815-1531; or
Visit our [Help Center web portal](https://help.xoom.com/s/contactsupport?language=en_US).
Hyperwallet means the PayPal technology and online service that allows payout capabilities for businesses of all shapes and sizes through a single integration.
Unbranded Payment Services means when you are interacting with and making payments to Partners and Merchants using our card processing and/or ACH origination services that do not carry the PayPal brand or when you use our Braintree services.
Legal Rights & Agreement Rules · User right or choice
Regional contacts table and right to complain to a regulator
A table of country or region contacts follows, giving the data protection officer (DPO) and contact information for each. You may lodge a complaint with the Supervisory Authority for data protection in your region if permitted under applicable law.
Supporting quotations
Please see the table below for additional information relevant to your local country/region. You may lodge a complaint with the Supervisory Authority for data protection in your region if permitted under applicable law.
Country or Region Data Protection Officer ("DPO"), and Contact Information
Qualifications & exceptions
The right to complain is stated "if permitted under applicable law".
In the regional contact table, the rows for Albania, the EU, Norway, Iceland and Liechtenstein (spelled "Lichtenstein" in the source) each name PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, with an online link for privacy queries. Each row has its own country-specific online link.
Supporting quotations
Albania PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449 Luxembourg Contact [Online](https://www.paypal.com/al/smarthelp/contact-us/privacy) for Privacy queries
EU PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg Contact [Online](https://www.paypal.com/de/smarthelp/contact-us/privacy) for Privacy queries
Norway PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg Contact [Online](https://www.paypal.com/no/smarthelp/contact-us/privacy) for Privacy queries
Iceland PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg Contact [Online](https://www.paypal.com/is/smarthelp/contact-us/privacy) for Privacy queries
Lichtenstein PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg Contact [Online](https://www.paypal.com/li/smarthelp/contact-us/privacy) for Privacy queries
Qualifications & exceptions
Each row is scoped to its own country or region; the shared entity does not make the rows interchangeable.
Legal Rights & Agreement Rules · Procedure
Table rows: PayPal Pte. Ltd. (Singapore) contact for several countries
In the regional contact table, the rows for Argentina, Brunei, Hong Kong, Japan, South Korea and Malaysia each name PayPal Pte. Ltd., 5 Temasek Boulevard 09-01, Suntec Tower 5, Singapore 038985, with a country-specific online link for privacy queries. The India row names a different entity, PayPal Payments Private Limited, but gives the same Singapore address.
Supporting quotations
Argentina PayPal Pte. Ltd. 5 Temasek Boulevard 09-01 Suntec Tower 5 Singapore 038985 Contact [Online](https://www.paypal.com/ar/smarthelp/contact-us/privacy) for Privacy queries
Hong Kong PayPal Pte. Ltd. 5 Temasek Boulevard 09-01 Suntec Tower 5 Singapore 038985 Contact [Online](https://www.paypal.com/hk/smarthelp/contact-us/privacy) for Privacy queries
India PayPal Payments Private Limited 5 Temasek Boulevard 09-01 Suntec Tower 5 Singapore 038985 Contact [Online](https://www.paypal.com/in/smarthelp/contact-us/privacy) for Privacy queries
Japan PayPal Pte. Ltd. 5 Temasek Boulevard 09-01 Suntec Tower 5 Singapore 038985 Contact [Online](https://www.paypal.com/jp/smarthelp/contact-us/privacy) for Privacy queries
South Korea PayPal Pte. Ltd. 5 Temasek Boulevard 09-01 Suntec Tower 5 Singapore 038985 Contact [Online](https://www.paypal.com/kr/smarthelp/contact-us/privacy) for Privacy queries
Malaysia PayPal Pte. Ltd. 5 Temasek Boulevard 09-01, Suntec Tower 5 Singapore 038985 Contact [Online](https://www.paypal.com/my/smarthelp/contact-us/privacy) for Privacy queries
Qualifications & exceptions
Each row is scoped to its own country; the India row names a different entity at the same Singapore address.
Legal Rights & Agreement Rules · Procedure
South Korea domestic agent and Data Protection Office
For South Korea, the table states that under the Personal Information Protection Act and the Network Act the domestic agent and Data Protection Office is PayPal Korea Services LLC, with a Seoul address, a telephone number and an email address given in the source.
Supporting quotations
Pursuant to the Personal Information Protection Act and the Network Act, the contact details of the domestic agent and Data Protection Office are as follows:
Name and representative: PayPal Korea Services LLC (representative: Mun Yat Wong) Address, telephone and e-mail: Regus Samsungdong Limited (World Trade Center), 27th, 30th Floor, Trade Tower, 511 Young Dong Street, Gangnam-gu, Seoul, South Korea 06164, (+82) 02 737 5775, skrprivacy@paypal.com
Legal Rights & Agreement Rules · Procedure
Table rows: local PayPal entities in Australia, Canada, Israel and Mexico
In the regional contact table, Australia lists PayPal Australia Pty Ltd (Sydney), Canada lists PayPal Canada Co. (Toronto), Israel lists PayPal Israel Payment Services LTD (Tel-Aviv) and Mexico lists Operadora PayPal de Mexico, S. de R.L. de C.V. (Mexico City), each with a postal address and an online link for privacy queries.
Supporting quotations
Australia PayPal Australia Pty Ltd ABN 93 111 195 389, AFSL 304962 GPO Box 351 Sydney NSW 2001 Contact [Online](https://www.paypal.com/au/smarthelp/contact-us/privacy) for Privacy queries
Canada PayPal Canada Co. MaRS Centre West Tower 661 University Avenue Suite 506 Toronto, ON M5G Contact [Online](https://www.paypal.com/ca/smarthelp/contact-us/privacy) for Privacy queries
Israel PayPal Israel Payment Services LTD 98 Yigal Alon St., Tel-Aviv, Israel 6789141 Contact [Online](https://www.paypal.com/il/smarthelp/contact-us/privacy) for Privacy queries
Mexico Operadora PayPal de México, S. de R.L. de C.V Boulevard Manuel Ávila Camacho 137, Piso 7, Polanco I Sección, Alcaldía Miguel Hidalgo, C.P. 11550, Ciudad de México, México Contact [Online](https://www.paypal.com/mx/smarthelp/contact-us/privacy) for Privacy queries
Qualifications & exceptions
Each row is scoped to its own country.
Legal Rights & Agreement Rules · Procedure
Table rows: Brazil entity and Data Protection Officer
For Brazil, the table lists PayPal do Brasil Instituicao de Pagamento Ltda. (Legal Department, Sao Paulo) with an online link for privacy queries. In compliance with LGPD article 41 it also names a Data Protection Officer and a Deputy DPO, both reachable at latamdpo@paypal.com.
Supporting quotations
Brazil PayPal do Brasil Instituição de Pagamento Ltda. Attention: Legal Department Avenida Paulista, 1048 13th Floor, CEP 01310-100 Sio Paulo, SP – Brazil Contact [Online](https://www.paypal.com/br/smarthelp/contact-us/privacy) for Privacy queries
In compliance with LGPD article 41, the identity and contact information of the Data Protection Officer (DPO) and of his deputy (Deputy DPO) are the following: Data Protection Officer (DPO): Daniel Douglas Diniz DPO contact e-mail: latamdpo@paypal.com Deputy Data Protection Officer: Fabiana Moreira Chaves Deputy DPO contact e-mail: latamdpo@paypal.com
Legal Rights & Agreement Rules · Procedure
Table rows: PayPal Pte. Ltd. (Singapore) contact for more countries
In the regional contact table, the rows for the Philippines, Singapore, Sri Lanka, Switzerland, Taiwan, the United Arab Emirates and Vietnam each name PayPal Pte. Ltd., 5 Temasek Boulevard 09-01, Suntec Tower 5, Singapore 038985, with a country-specific online link for privacy queries.
In the regional contact table, the Russia row names PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, with an online link for privacy queries.
Supporting quotations
Russia PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg Contact [Online](https://www.paypal.com/ru/smarthelp/contact-us/privacy) for Privacy queries
Lichtenstein PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg Contact [Online](https://www.paypal.com/li/smarthelp/contact-us/privacy) for Privacy queries
Legal Rights & Agreement Rules · Procedure
Table rows: Thailand, United Kingdom and United States contacts
In the regional contact table, the Thailand row gives an address at Athenee Tower in Bangkok with an online link for privacy queries, without naming an entity. The UK row names PayPal UK Ltd, 5 Fleet Place, London. The United States row names PayPal Inc., 2211 N. 1st St., San Jose, CA 95131, with an online link for privacy queries.
UK PayPal UK Ltd 5 Fleet Place London, UK EC4M 7RD Contact [Online](https://www.paypal.com/uk/smarthelp/contact-us/privacy) for Privacy queries
United States PayPal Inc. 2211 N. 1st St., San Jose, CA 95131 Contact [Online](https://www.paypal.com/us/smarthelp/contact-us/privacy) for Privacy queries
Qualifications & exceptions
The Thailand row, as written, gives an address but names no entity.
Legal Rights & Agreement Rules · Company commitment
Published metrics about privacy rights requests
PayPal provides, through a linked page, the metrics the CCPA requires about how it handled privacy rights requests.
Supporting quotations
PayPal provides its [metrics](https://www.paypal.com/us/legalhub/paypal/ca-privacy-rights-full) required under the CCPA relating to how it handled privacy rights requests.
Not stated here
The linked metrics page is not part of the analyzed text.
Legal Rights & Agreement Rules · Context
Financial products notice: scope and effective date
The Notice for Consumers of Financial Products and Services does not apply to Unbranded Payment Services, and in this part of the statement "personal information" has the meaning given by the Gramm-Leach-Bliley Act. The notice is dated "Rev. September 28, 2026" and is headed "FACTS: What does PayPal do with your personal information?"
Supporting quotations
The following Notice for Consumers of Financial Products and Services does not apply to Unbranded Payment Services. Please note, the definition of "personal information" for this portion of the Privacy Statement has the meaning given to it by the Gramm-Leach-Bliley Act.
Rev. September 28, 2026
FACTS WHAT DOES PAYPAL DO WITH YOUR PERSONAL INFORMATION?
Unbranded Payment Services means when you are interacting with and making payments to Partners and Merchants using our card processing and/or ACH origination services that do not carry the PayPal brand or when you use our Braintree services.
Qualifications & exceptions
Unbranded Payment Services are excluded from this notice.
The Gramm-Leach-Bliley meaning of "personal information" applies in this notice, not the earlier definition.
Legal Rights & Agreement Rules · Context
Financial products notice: why it exists and what information it covers
The notice explains that financial companies choose how they share your personal information, that federal law gives consumers the right to limit some but not all sharing, and that federal law requires companies to say how they collect, share and protect it. The types of personal information PayPal collects and shares depend on the product or service you have; it can include Social Security number and account balances, payment or transaction history, and credit history or credit scores. When you are no longer a customer, PayPal continues to share your information as described in the notice.
Supporting quotations
Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.
What?
The types of personal information we collect and share depend on the product or service you have with us. This information can include:
Social Security number and account balances
Payment history or transaction history
Credit history or credit scores
When you are no longer our customer, we continue to share your information as described in this notice.
Qualifications & exceptions
The listed types are examples ("can include").
Sharing continues after you stop being a customer.
Legal Rights & Agreement Rules · Restriction or exception
Why you cannot limit all sharing
Federal law gives you the right to limit only sharing information about your creditworthiness for affiliates' everyday business purposes, affiliates using your information to market to you, and sharing for nonaffiliates to market to you. State laws and individual companies may give you additional rights to limit sharing, and the notice points to state-law information below.
Supporting quotations
Why can't I limit all sharing?
Federal law gives you the right to limit only
sharing information about your creditworthiness for affiliates' everyday business purposes
affiliates from using your information to market to you
sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing. See below for more information on your rights under state law.
Qualifications & exceptions
The three limitable categories are those the federal law covers.
Legal Rights & Agreement Rules · Context
Pointers to the general Privacy Statement and state financial privacy notices
The notice points to the general Privacy Statement for other Personal Information handling practices and rights under privacy laws for information not covered by the Gramm-Leach-Bliley Act, and to a separate California, North Dakota and Vermont Supplemental Financial Privacy Notice for state financial privacy laws. It invites you to contact PayPal with questions.
Supporting quotations
Other Privacy Rights: Please see our general [Privacy Statement](https://www.paypal.com/legalhub/privacy-full) to learn more about our Personal Information handling practices and other rights you may have under privacy laws for Personal Information that is not covered by the Gramm-Leach-Bliley Act. In addition, please see our [California, North Dakota, and Vermont Supplemental Financial Privacy Notice](https://www.paypal.com/us/legalhub/privacy-states?locale.x=en_US) for more information about state financial privacy laws. Contact us if you have questions about our Privacy Statement, this consumer notice, or your Personal Information.
Not stated here
The linked supplemental notice is not part of the analyzed text.
Legal Rights & Agreement Rules · User right or choice
Nevada mailing address: marketing calls and complaint contacts
If your PayPal or Xoom account or Fastlane profile has a Nevada mailing address, PayPal gives this notice under Nevada law. If you prefer not to receive marketing calls from PayPal, you can be placed on its internal Do Not Call List by calling 1-888-221-1161 or using its online help page. The notice also gives PayPal's address in La Vista, Nebraska, and contact details for the Nevada Attorney General's Bureau of Consumer Protection in Las Vegas.
Supporting quotations
Nevada: If your PayPal, Xoom account or Fastlane profile has a Nevada mailing address, we are providing this notice pursuant to Nevada law. If you prefer not to receive marketing calls from PayPal, you may be placed on our internal Do Not Call List by calling 1-888-221-1161 or going to [/smarthelp/home](https://www.paypal.com/smarthelp/home). For more information, you can contact PayPal at 12312 Port Grace Blvd, La Vista, NE 68128 or you can contact the Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington St., Suite 3900, Las Vegas, NV 89101; telephone number: 1-702-486-3132; email: Aginfo@ag.nv.gov.
Legal Rights & Agreement Rules · Procedure
Phone and web contacts to talk about a PayPal account, Xoom account or Fastlane profile
To talk about your PayPal account, call PayPal Customer Service at 1-888-221-1161 or use the Customer Service web portal. For a Xoom account, call Xoom Customer Service at 1-877-815-1531 or use the Help Center web portal. For a Fastlane profile, call PayPal Customer Service at 1-844-705-3555 or use the Fastlane profile management portal.
Supporting quotations
To talk about your PayPal account, call PayPal Customer Service at 1-888-221-1161 or visit our [Customer Service web portal](https://www.paypal.com/smarthelp/contact-us/privacy). To talk about your Xoom account, call Xoom Customer Service at 1-877-815-1531 or visit our [Help Center web portal](https://help.xoom.com/s/contactsupport?language=en_US). To talk about your Fastlane profile, call PayPal Customer Service at 1-844-705-3555 or visit your [Fastlane profile management portal](https://connect.paypal.com/help/support).
Legal Rights & Agreement Rules · Context
UK and EEA disclosures: who is the data controller
This section adds disclosures for individuals in the UK and the European Economic Area (EEA) and supplements the main statement. The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you live, which can be found in the contact information.
Supporting quotations
This section contains additional disclosures for individuals in the UK and EEA and supplements PayPal’s Privacy Statement above.
The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you reside, which can be found in Our Contact Information.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Legal Rights & Agreement Rules · Context
Lawful bases under the GDPR
PayPal says it may process Personal Information under the lawful bases set out in a table under the General Data Protection Regulation. The table has three columns: the processing purposes, the types of data, and the lawful basis and any special condition for processing.
Supporting quotations
We may process your Personal Information in accordance with the lawful bases below under the General Data Protection Regulation Types of Data Lawful basis and special condition for processing (if relevant)
Legal Rights & Agreement Rules · Company practice
Basis stated for the first group of purposes: pre-contractual and contractual necessity
In the UK and EEA lawful-basis table (columns: processing purposes, types of data, lawful basis), the lawful basis stated for the first row is that PayPal considers these categories necessary to fulfil its pre-contractual and contractual obligations to you, and that without them you will not be able to use the Services.
Supporting quotations
We collect these categories of Personal Information because we consider them necessary to fulfil our pre-contractual and contractual obligations to you and without which you will not be able to use the Services.
Qualifications & exceptions
The basis is PayPal's own statement that the data is necessary for contract performance.
The source does not name the GDPR article in this cell.
Legal Rights & Agreement Rules · Company practice
Basis stated for the legitimate-interest group
In the UK and EEA lawful-basis table (columns: processing purposes, types of data, lawful basis), the lawful basis stated for the second group is PayPal's legitimate interest in keeping itself a secure financial service, continuing to offer innovative services of interest to you, and optimizing sales efforts by tailoring services to your interests, including ads and offers shown to you. PayPal says it relies on this where its legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Supporting quotations
We have a legitimate interest in ensuring that PayPal remains a secure financial service and continuing to offer services that are innovative and of interest to you as well as to optimize our sales efforts by tailoring our services to your interests including ads and offers you may be shown. We do this where our legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Qualifications & exceptions
Applies only where the data subject's interests or fundamental rights do not override PayPal's legitimate interests.
Legal Rights & Agreement Rules · Company practice
Third group: remaining data categories and the legal-obligation basis
In the UK and EEA lawful-basis table (columns: processing purposes, types of data, lawful basis), the third group's data categories end with information from your use of the Services, technical usage data, device information and location data. The lawful basis stated for this group is a legal obligation under applicable laws to conduct certain processing activities, done where necessary to comply with applicable laws.
Supporting quotations
Information from your use of the Services;
Technical usage data;
Device information; and
Location data.
We have a legal obligation under applicable laws to conduct certain processing activities. We do this where it is necessary to comply with applicable laws.
Qualifications & exceptions
Stated as a legal obligation; the group's purposes include legal claims, misuse prevention, risk management and law compliance.
Legal Rights & Agreement Rules · User right or choice
Fourth group: data categories and the consent basis
In the UK and EEA lawful-basis table (columns: processing purposes, types of data, lawful basis), the data categories listed for the consent-based group are registration and contact information, identification and signature information, biometric data, information from your use of the Services, technical usage data, device information and location data. The lawful basis stated is that, except as otherwise described above, PayPal relies on your explicit and voluntary consent.
Supporting quotations
Necessary categories of Personal Information include:
Registration and contact information;
Identification and signature information;
Biometric data;
Information from your use of the Services;
Technical usage data;
Device information; and
Location data.
Except as otherwise described above, we rely on your explicit and voluntary consent.
Qualifications & exceptions
The consent statement is qualified by "Except as otherwise described above".
Legal Rights & Agreement Rules · User right or choice
UK and EEA rights: to be informed, access, correct, erase, restrict and port data
Individuals in the UK and EEA have the right to be informed about the collection and use of their Personal Information, to access and get copies, to correct it, in certain circumstances to erase it, in certain circumstances to restrict processing, and in certain circumstances to data portability by automated means where processing is based on consent, performance of a contract or assisting you to enter a contract. These rights are further illustrated in the Your Data Protection Rights section.
Supporting quotations
Individuals located in the UK and EEA benefit from the following rights, which are further illustrated in Your Data Protection Rights:
The right to be informed about the collection and use of your Personal Information;
The right to access and request copies of your Personal Information;
The right to correct your Personal Information;
The right, in certain circumstances, to erase your Personal Information;
The right to restrict our processing of your Personal Information in certain circumstances;
The right to data portability of your Personal Information by automated means in certain circumstances where we process your Personal Information based on consent, for performance of a contract or where the processing is required to assist you into entering into a contract.
Qualifications & exceptions
Erasure, restriction and portability apply "in certain circumstances".
Legal Rights & Agreement Rules · User right or choice
UK and EEA rights: to object, to withdraw consent and to have automated decisions reviewed
UK and EEA individuals may in certain circumstances object to processing carried out for tasks in the public interest, official authority, PayPal's legitimate interests, scientific or historical research, statistical purposes or direct marketing. They may withdraw consent, including by opting out of marketing communications, without affecting earlier processing or processing under another lawful ground; for direct marketing they can always change permissions, object and opt out through the unsubscribe link or account settings. They also have the right to have automated decisions reviewed and to be told of the existence of Automated Decision Making, including Profiling, the logic involved and its significance and envisaged consequences.
Supporting quotations
The right to object to processing of your Personal Information in certain circumstances where we process your Personal Information for tasks carried out in the public interest, in the exercise of an official authority, for our legitimate interests, for scientific or historical research, or statistical purposes, or for direct marketing purposes;
The right to withdraw your consent to the Processing of your Personal Information, including through opting-out of marketing communications, though without affecting the lawfulness of processing of your Personal Information based on consent before its withdrawal, nor will it affect processing of your Personal Information conducted in reliance on a lawful processing ground other than consent. If we use your Personal Information for direct marketing, you can always modify your permissions, object and opt out of future direct marketing messages using the unsubscribe link in electronic communications or through your account settings;
The right to have automated decisions reviewed and to be informed of the existence of any Automated Decision Making, including any Profiling, and the logic involved, significance of and the envisaged consequences of any such processing;
Profiling means analysis of an individual’s personality, behavior, interest and habits to make predictions or decisions about them, including like terms under applicable laws.
Qualifications & exceptions
The right to object applies "in certain circumstances".
Withdrawal does not undo earlier consent-based processing or affect processing on another lawful ground.
Legal Rights & Agreement Rules · User right or choice
Right to complain to a supervisory authority
You have the right to complain to your local Supervisory Authority about PayPal's use of your Personal Information. In the EEA you may complain to PayPal's lead supervisory authority, the Luxembourg National Commission for Data Protection (CNPD), at its postal address in Belvaux, Luxembourg. In the UK you may complain to your local data protection authority, the Information Commissioner's Office, at its Manchester address or website. You are not required to contact PayPal first, but PayPal asks that you do so to give it a chance to address your concerns.
Supporting quotations
In addition, you have the right to complain to your local Supervisory Authority about our use of your Personal Information.
In EEA, you may lodge a complaint with our lead supervisory authority for data protection, Luxemburg National Commission for Data Protection (CNPD) by post at Commission Nationale pour la Protection des Donnees, Service des plaints, 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg.
In the UK, you may also lodge a complaint with your local data protection authority, which is the Information Commissioner’s Office: website: [https://ico.org.uk/](https://ico.org.uk/), address: ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL.
However, while you are not required to do so, we ask that you contact us first to give us the opportunity to address your concerns directly before speaking with your Supervisory Authority.
Qualifications & exceptions
Contacting PayPal first is requested, not required.
Legal Rights & Agreement Rules · Permission or license
EEA banking notice: quarterly list updates and deemed acceptance
PayPal may update the list of third parties on the first business day of each quarter (January, April, July and October) and will only start transferring information to new entities, for new purposes or of new types 30 days after the updated list is made public. You are told to review the list each quarter. If you do not object within 30 days of publication you are deemed to have accepted the changes to the list and to the statement; if you do not agree you may close your account and stop using the services. Some information may need to go to other PayPal companies or entities acting as payment providers, processors or account holders, which under local law may have to disclose information to authorities, and your use of the PayPal Services constitutes your consent to the transfer of such information to provide the Services.
Supporting quotations
PayPal may update the list of third parties referred to above on the first business day of every quarter (January, April, July and October). PayPal will only start transferring any Personal Information to any of the new entities or for the new purposes or Personal Information types indicated in each update after 30 days from the date when that list is made public through this Privacy Statement. You should review the list each quarter on the PayPal website on the dates stated above. If you do not object to the new Personal Information disclosure, within 30 days after the publication of the updated list of third parties, you are deemed to have accepted the changes to the list and to this Privacy Statement. If you do not agree with the changes, you may close your account and stop using our services. In order to provide the PayPal Services, certain of the information we collect (as set out in this Privacy Statement) may be required to be transferred to other PayPal related companies or other entities, including those referred to in this section in their capacity as payment providers, payment processors or account holders (or similar capacities). You acknowledge that according to their local legislation, such entities may be subject to laws, regulations, inquiries, investigations, or orders which may require the disclosure of information to the relevant authorities of the relevant country. Your use of the PayPal Services constitutes your consent to our transfer of such information to provide you the PayPal Services.
Qualifications & exceptions
Silence for 30 days is treated as acceptance.
The only stated alternative for someone who disagrees is closing the account.
Recipient entities may be required by their local law to disclose information to authorities.
Legal Rights & Agreement Rules · Company practice
EEA banking notice: FATCA/CRS notice and shared risk information
If you are covered by the FATCA or CRS Law, PayPal is required to give you notice of the information about you that it may transfer to authorities, and it points to a separate explanation of its obligations. PayPal and other organisations, including parties that accept PayPal, may also share, access and use necessary information, including from other countries and including information recorded by fraud prevention agencies, to assess and manage risk, such as preventing fraud, money laundering and terrorist financing. You can contact PayPal for further details of the relevant fraud prevention agencies.
Supporting quotations
If you are covered by the FATCA or CRS Law, we are required to give you notice of the information about you that we may transfer to various authorities. Please read more about PayPal's obligations under the FATCA and CRS Law and how they could affect you as well as take note of the information we may disclose as result. We and other organisations, including parties that accept PayPal, may also share, access and use (including from other countries) necessary information (including, without limitation the information recorded by fraud prevention agencies) to help us and them assess and to manage risk (including, without limitation, to prevent fraud, money laundering and terrorist financing). Please contact us if you want to receive further details of the relevant fraud prevention agencies. Review more information on these Agencies, fraud prevention agencies and other [third parties](https://www.paypal.com/ie/legalhub/paypal/third-parties-list).
Qualifications & exceptions
The FATCA/CRS notice duty applies only if you are covered by those laws.
Risk-related sharing is stated "including, without limitation", so it is not limited to the examples.
Not stated here
The linked FATCA/CRS explanation and third-party list are not part of the analyzed text.
Legal Rights & Agreement Rules · Permission or license
EEA banking notice: disclosures to rights owners, card associations and legal process
PayPal may disclose account information to intellectual property rights owners if, under the national law of an EU member state, they have a claim against PayPal for an out-of-court information disclosure because PayPal Services were used to infringe their rights; the source gives as examples (for example, but without limitation) section 19 paragraph 2 subsection 3 of the German Trademark Act and section 101 paragraph 2 subsection 3 of the German Copyright Act. PayPal may also disclose necessary information in response to the requirements of the credit card associations or a civil or criminal legal process.
Supporting quotations
Disclose Account Information to intellectual property right owners if under the applicable national law of an EU member state they have a claim against PayPal for an out-of-court information disclosure due to an infringement of their intellectual property rights for which PayPal Services have been used (for example, but without limitation, Sec. 19, para 2, sub-section 3 of the German Trademark Act or Sec. 101, para 2, sub-section 3 of the German Copyright Act).
Disclose necessary information in response to the requirements of the credit card associations or a civil or criminal legal process.
Qualifications & exceptions
The German statutes are cited as examples "without limitation"; their text is not supplied in this document.
Not stated here
The cited German Trademark Act and Copyright Act provisions are not supplied; their content is not established by this document.
Legal Rights & Agreement Rules · Permission or license
UK notice: disclosures to authorities, FATCA/CRS notice and shared risk information
For users in the UK, PayPal may disclose necessary information to the police and other law enforcement, security forces, competent governmental, intergovernmental or supranational bodies, regulators and other third parties, including PayPal Group companies, where PayPal is legally compelled and permitted to comply (including under laws implementing FATCA and the OECD Common Reporting Standard), has reason to believe cooperation in investigations of fraud or other actual or potential illegal activity is appropriate, or is investigating violations of the User Agreement (including with your funding source or card provider). If you are covered by FATCA or CRS, PayPal must give you notice of the information about you it may transfer to authorities. PayPal and other organisations, including parties that accept PayPal, may also share, access and use necessary information, including from other countries and including information recorded by fraud prevention agencies, to assess and manage risk, such as preventing fraud, money laundering and terrorist financing, and you can ask for details of the relevant fraud prevention agencies.
Supporting quotations
Disclose necessary information to: the police and other law enforcement agencies; security forces; competent governmental, intergovernmental or supranational bodies; competent agencies, departments, regulatory authorities, self-regulatory authorities or organisations and other third parties, including PayPal Group companies, that (i) we are legally compelled and permitted to comply with, including but without limitation laws implementing the US Foreign Account Tax Compliance Act (“FATCA”) and OECD Common Reporting Standard (“CRS”); (ii) we have reason to believe it is appropriate for us to cooperate with in investigations of fraud or other illegal activity or potential illegal activity, or (iii) to conduct investigations of violations of our User Agreement (including without limitation, your funding source or credit or debit card provider).
If you are covered by FATCA or CRS, we are required to give you notice of the information about you that we may transfer to various authorities.
We and other organisations, including parties that accept PayPal, may also share, access and use (including from other countries) necessary information (including, without limitation the information recorded by fraud prevention agencies) to help us and them assess and to manage risk (including, without limitation, to prevent fraud, money laundering and terrorist financing). Please contact us if you want to receive further details of the relevant fraud prevention agencies.
Qualifications & exceptions
The three grounds for disclosure are alternatives.
The FATCA/CRS notice duty applies only if you are covered.
Risk-related sharing is stated "including, without limitation".
Legal Rights & Agreement Rules · Permission or license
UK notice: disclosures to rights owners, card associations and legal process
For users in the UK, PayPal may disclose account information to intellectual property rights owners if, under applicable law, they have a claim against PayPal for an out-of-court information disclosure because PayPal Services were used to infringe their rights, and may disclose necessary information in response to credit card association requirements or a civil or criminal legal process.
Supporting quotations
Disclose account Information to intellectual property right owners if under applicable law they have a claim against PayPal for an out-of-court information disclosure due to an infringement of their intellectual property rights for which PayPal Services have been used.
Disclose necessary information in response to the requirements of the credit card associations or a civil or criminal legal process.
Legal Rights & Agreement Rules · Context
UK status disclosure: regulation of PayPal UK Ltd
PayPal UK Ltd is authorised and regulated by the Financial Conduct Authority as an electronic money institution, for its regulated consumer credit activities and for cryptocurrency services, under the firm reference numbers given in the source. Some products and services, such as PayPal Working Capital, are not regulated by the FCA and may offer a lower level of protection, and the statement tells you to read the product terms. It gives PayPal UK Ltd's company number and registered office at 5 Fleet Place, London.
Supporting quotations
PayPal UK Ltd is authorised and regulated by the Financial Conduct Authority (FCA) as an electronic money institution (firm reference number 994790); in relation to its regulated consumer credit activities (firm reference number 996405); and for the provision of cryptocurrency services (firm reference number 1000741). Some products and services, such as PayPal Working Capital, are not regulated by the FCA and may offer a lower level of protection. Please read product terms for further details. PayPal UK Ltd's company number is 14741686. Its registered office is 5 Fleet Place, London, United Kingdom, EC4M 7RD.
Qualifications & exceptions
Products such as PayPal Working Capital are not FCA-regulated and may offer a lower level of protection.
Legal Rights & Agreement Rules · Context
Mexico disclosures: scope, data controller and primary and secondary purposes
This section adds disclosures for individuals in Mexico and supplements the main statement. The data controller of your Personal Information is the PayPal entity established where you live, found in the contact information. The section describes PayPal's primary and secondary purposes for processing your Personal Information in a two-column table headed "Primary Purpose" and "Secondary Purpose".
Supporting quotations
This section contains additional disclosures for individuals in Mexico and supplements PayPal’s Privacy Statement above. The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you reside, which can be found in Our Contact Information. Below we describe our primary and secondary purpose for processing your Personal Information.
Primary Purpose Secondary Purpose
Legal Rights & Agreement Rules · User right or choice
Mexico ARCO rights and how to exercise them
Notwithstanding the general data protection rights, PayPal says individuals in Mexico can exercise ARCO Rights: access (right to know), rectification, deletion (cancellation and erasure), objection (opposition), portability, and restriction of processing in whole or in part. With an account, you can exercise them through "Data and Privacy" in Account Settings on the website or mobile app, or by calling the Customer Services line, and PayPal will verify your identity by a security code sent by text message, a call to your registered phone number, or by requiring you to access your Account. Without an account, for example when you pay without a PayPal account, you can exercise ARCO rights for your payment transactions by calling the customer services line.
Supporting quotations
Notwithstanding the data privacy rights set forth under Your Data Protection Rights:
We recognize the importance of your ability to control use of your Personal Information and provide several ways for you to exercise your rights to access (right to know), rectification (correction or update), deletion (cancellation and erasure), objection (opposition), portability (transferring), and to restrict process in whole or in part (collectively your ARCO Rights).
If you have an Account you can exercise your ARCO Rights by accessing “Data and Privacy” from Account Settings in the PayPal Website or mobile app, or you can file your request by calling our Customer Services line. We will verify your identity by (i) a security code via text message; (ii) a phone call to the phone number registered in the platform; or (iii) by requesting you to access to your Account.
If you do not you have an Account (for example, where you use Payment without a PayPal account), you can exercise your ARCO rights for your Payment transactions through calling PayPal customer services line.
Qualifications & exceptions
Identity verification uses one of three methods listed in the source.
Without an account, the stated route covers rights for your payment transactions.
Legal Rights & Agreement Rules · Procedure
Mexico ARCO requests: agents, response time and independent rights
Your duly authorized agent can submit an ARCO request for you through the Customer Services line, and PayPal may require additional information for verification. PayPal says it will respond within twenty business days of your last contact. Exercising one ARCO right does not prevent you from exercising the others.
Supporting quotations
Your duly authorized agent can submit a request on your behalf by contacting our Customer Services line. Please note that we may require additional information for verification.
We will respond to your request within a term of twenty (20) business days of your last contact.
The exercise of any one ARCO rights does not prevent you from exercising your other ARCO rights.
Qualifications & exceptions
The response period runs from your last contact.
Legal Rights & Agreement Rules · Procedure
Mexico: Fastlane profile requests and changes that may need a new account
To exercise rights relating to your Fastlane profile, contact PayPal at the number in the contact information or use your Fastlane profile management portal. If you need to change personal data such as your email address or phone number, you can do so by exercising ARCO rights (access, rectification, cancellation and opposition). Because of operational or technical constraints in some services, PayPal says it may be necessary to create a new account or user profile to make those changes; you will be informed, and a newly created account remains subject to this privacy statement.
Supporting quotations
If you want to exercise any of your rights relating to your Personal Information in your Fastlane profile, contact us at the number provided in the Our Contact Information section or submit your request from your Fastlane profile management portal. In the event that you need to modify your personal data—such as your email address or phone number—you may do so by exercising your ARCO rights (Access, Rectification, Cancellation, and Opposition). However, due to operational or technical constraints inherent to certain services, it may be necessary to create a new account or user profile in order to implement such changes. In such cases, you will be duly informed, and any newly created account will remain subject to this privacy statement.
Fastlane means the online tool whereby individuals can store their payment methods and other Personal Information with PayPal so that they can complete the checkout process faster, create a store or loyalty account, or facilitate other transactions at participating Partners and Merchants with payment card, contact information, shipping data or other data they save in their Fastlane profile as relevant to the specific interaction, participating Partners and Merchants, all without having to manually input payment method details and other Personal Information each time they check out.
Qualifications & exceptions
Making a change may require creating a new account or profile, which stays subject to this statement.
Legal Rights & Agreement Rules · Company practice
Singapore: legitimate interest as an additional basis
PayPal says it also has a legitimate interest in keeping itself a secure financial service, continuing to offer innovative services of interest to you and optimizing its sales efforts by tailoring services, including ads and offers shown to you. In addition to its other lawful bases, it may process Personal Information where its legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Supporting quotations
We also have a legitimate interest in ensuring that PayPal remains a secure financial service and continuing to offer services that are innovative and of interest to you as well as to optimize our sales efforts by tailoring our services to your interests including ads and offers you may be shown. In addition to the other lawful bases under which we process your Personal Information, we may process your Personal Information where our legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Qualifications & exceptions
Applies only where the data subject's interests or fundamental rights do not override PayPal's legitimate interests.