Statement covers PayPal group accounts, Sites and Services, but not Excluded Services
PayPal, Inc. and its subsidiaries and affiliates ("PayPal") say this Privacy Statement describes how they use your Personal Information when you use your PayPal account(s), visit their Sites, or apply for or use their Services, to the extent those Services are available in your jurisdiction. It does not apply to Excluded Services, which the Statement defines as separate brands, affiliates or subsidiaries (examples named: Venmo, Honey Science LLC, Chargehound LLC, Paidy Inc., Swift Financial LLC, Bill Me Later, Inc.) that follow their own terms and separate privacy statements. "Services" is defined broadly (payments, rewards, PayPal Ads, Fastlane, Xoom, Pool, Hyperwallet, credit and financing, crypto services offered by PayPal Digital Inc., merchant tools and more) and "Sites" covers websites, mobile apps and official social network platforms that post or link to this Statement.
Details not recorded for this card
Supporting quotations
PayPal, Inc. and our subsidiaries and affiliated companies
This Privacy Statement does not apply to Excluded Services.
Excluded Services means companies or separate brands, affiliates, or subsidiaries of PayPal, who process Personal Information in accordance with their own terms of service and separate privacy statements.
Services refers to all PayPal-branded or unbranded payment, financial, and personalization products and solutions
Sites means the websites, mobile apps, official social network platforms, or other online properties through which PayPal offers the Services and which has posted or linked to this Privacy Statement.
means any information that directly or indirectly identifies you or is reasonably capable of being associated with you or your household
Qualifications & exceptions
Applies to Services only "to the extent available in your jurisdiction".
Does not apply to Excluded Services, which have their own terms and privacy statements.
"Sites" means online properties that have posted or linked to this Privacy Statement.
Not stated here
The Statement does not list every Excluded Service; the named brands are examples only.
Processing and privacy rights can differ depending on where you live
If you live in certain countries, PayPal says it may process your Personal Information differently to comply with local privacy laws, and you may have specific privacy rights depending on your place of residence. The Statement provides jurisdiction-specific information to show which rights apply.
Details not recorded for this card
Supporting quotations
If you reside in certain countries, we may process your Personal Information differently to comply with applicable privacy laws in those jurisdictions.
You may also have specific privacy rights depending on your place of residence.
Qualifications & exceptions
Only if you reside in certain countries; the Statement does not list them in this passage.
Legal Rights & Agreement Rules · Company practice
PayPal may revise the Statement; 30 days' prior notice only where applicable law requires notice
PayPal may revise this Privacy Statement from time to time to reflect changes to its business, Services or applicable laws. The version covered here says "Last updated on October 12, 2026". If a revised version requires notice under applicable law, PayPal says it will give 30 days' prior notice by posting on its Policy Updates or Privacy Statement page. Otherwise the revised Statement takes effect on its published effective date. For a new User or someone receiving the Statement for the first time, an upcoming change described on those pages applies on its indicated effective date.
Details not recorded for this card
Supporting quotations
We may revise this Privacy Statement from time to time to reflect changes to our business, Services, or applicable laws.
If the revised version requires notice in accordance with applicable law, we will provide you with 30 days' prior notice by posting notice of the change on the
otherwise the revised Privacy Statement will be effective as of the published effective date.
such upcoming change will apply to you on the indicated effective date.
Last updated on October 12, 2026
Qualifications & exceptions
The 30-day prior notice applies only "if the revised version requires notice in accordance with applicable law".
Notice, where given, is by posting on the Policy Updates or Privacy Statement page of the PayPal website.
Where notice is not required by law, the revision is effective on the published effective date.
Not stated here
The passage does not say which changes legally require notice.
The text of the linked Policy Updates and Privacy Statement pages is not supplied here, so this card cannot say what upcoming changes they list.
Legal Rights & Agreement Rules · Context
Where lawful bases are required, EU and UK GDPR bases are applied equally under other equivalent laws
PayPal notes that some jurisdictions require a lawful basis for processing Personal Information and refers readers to Our Lawful Basis for Processing Personal Information for the basis under the EU and UK General Data Protection Regulation. It says it applies the same lawful bases under other privacy laws that have equivalent requirements.
Details not recorded for this card
Supporting quotations
Please note that certain jurisdictions require providing a lawful basis for processing Personal Information.
We apply the same lawful bases for processing under other privacy laws that have equivalent requirements.
Our Lawful Basis for Processing Personal Information
Qualifications & exceptions
Applies to jurisdictions that require a lawful basis; same bases applied under other laws with "equivalent requirements".
Not stated here
Which other laws count as having equivalent requirements is not stated here.
Legal Rights & Agreement Rules · Restriction or exception
Agentic AI tools are not designed for legal, medical, financial or employment decisions and must not be used for them
PayPal encourages you to carefully consider the recommendations and actions of its Agentic AI Tools. It says they are not designed to make decisions with legal or similarly significant effects (such as legal, medical, financial or employment implications) and that you must not use, or attempt to use, them for such a purpose. They are intended only for general assistance and insights, and you should not rely on them to replace your own judgement and expertise.
Details not recorded for this card
Supporting quotations
Our Agentic AI Tools are not designed to make decisions that have legal or similarly significant effects, such as decisions with legal, medical, financial, or employment implications, and you must not use (or attempt to use) them for any such purpose.
These tools are intended only to provide general assistance and insights, and you should not rely on them to replace your own judgement and expertise.
Qualifications & exceptions
The prohibition is on your use for decisions with legal or similarly significant effects.
Not stated here
The passage does not say what consequences follow if you use the tools for such a purpose.
Legal Rights & Agreement Rules · Context
Your privacy rights depend on where you live and applicable law
PayPal says that under applicable data protection laws, depending on the country where you reside and subject to applicable exceptions and definitional differences among laws, you may have certain rights about how your Personal Information is collected, stored, used and shared.
Details not recorded for this card
Supporting quotations
Under applicable data protection laws, depending upon the country in which you reside, and subject to applicable exceptions and definitional differences among various laws, you may have certain rights about how your Personal Information is collected, stored, used and shared.
Qualifications & exceptions
Depends on country of residence, exceptions and definitional differences among laws.
Not stated here
This passage does not list which rights apply in which country.
Legal Rights & Agreement Rules · Context
"Excluded Services" are separate brands that follow their own terms and privacy statements
"Excluded Services" means companies or separate brands, affiliates or subsidiaries of PayPal that process Personal Information in accordance with their own terms of service and separate privacy statements. The examples given are Venmo, Honey Science LLC, Chargehound LLC, Paidy Inc., Swift Financial LLC and Bill Me Later, Inc.
Details not recorded for this card
Supporting quotations
Excluded Services means companies or separate brands, affiliates, or subsidiaries of PayPal, who process Personal Information in accordance with their own terms of service and separate privacy statements.
Examples include Venmo, Honey Science LLC, Chargehound LLC, Paidy Inc., Swift Financial LLC, and Bill Me Later, Inc.
Qualifications & exceptions
Examples are given with "Include", so the list is not stated to be complete.
Not stated here
The separate privacy statements of the Excluded Services are not supplied here.
"Partners and Merchants" and "Users" are defined broadly, with Users including non-account holders
"Partners and Merchants" means PayPal's partners and the merchants, partners or businesses that its Users transact with to obtain goods or services. "Users" means other account holders and non-account holders of the PayPal Services.
Details not recorded for this card
Supporting quotations
Partners and Merchants means our partners and the merchants, partners or businesses that our Users transact with for the purpose of obtaining goods or services.
Users means other account holders and non-account holders of the PayPal Services.
"Pay without a PayPal Account" and "Unbranded Payment Services" cover guest and Braintree-type payments, not Venmo
"Pay without a PayPal Account" means the Services may be accessed without using a PayPal account, a Fastlane profile or the Unbranded Payment Services; it does not include Venmo, which has its own terms and privacy statement. "Unbranded Payment Services" means interacting with and making payments to Partners and Merchants using PayPal's card processing and/or ACH origination services that do not carry the PayPal brand, or using its Braintree services.
Details not recorded for this card
Supporting quotations
Pay without a PayPal Account means our Services may be accessed by individuals without using a PayPal account, a Fastlane profile, or the Unbranded Payment Services.
Pay without a PayPal account does not include Venmo, which is subject to its own terms of service and separate privacy statement.
Unbranded Payment Services means when you are interacting with and making payments to Partners and Merchants using our card processing and/or ACH origination services that do not carry the PayPal brand or when you use our Braintree services.
Qualifications & exceptions
Venmo is excluded from "Pay without a PayPal Account".
"Services" covers PayPal-branded and unbranded products, including ads, crypto and credit, except Excluded Services
"Services" refers to all PayPal-branded or unbranded payment, financial and personalization products and solutions, including transactions, rewards, advertising (including PayPal Ads), PayPal Groups, Fastlane, Xoom, Pool, Hyperwallet, credit and financing (including Partner and Merchant offerings), cryptocurrency services offered by PayPal Digital Inc. (a PayPal affiliate), merchant tools and emerging financial technologies, with the exception of Excluded Services. It also includes related websites, platforms, applications and future innovations offered or supported by PayPal, and your use of Services includes interaction with the Sites.
Details not recorded for this card
Supporting quotations
Services refers to all PayPal-branded or unbranded payment, financial, and personalization products and solutions
with the exception of Excluded Services. It also includes all related websites, platforms, applications, and future innovations offered or supported by PayPal.
Your use of Services includes interaction with our Sites.
Qualifications & exceptions
Excludes Excluded Services.
Includes future innovations offered or supported by PayPal.
"Sites" covers websites, mobile apps and official social network platforms that post or link to the Statement
"Sites" means the websites, mobile apps, official social network platforms or other online properties through which PayPal offers the Services and which has posted or linked to this Privacy Statement.
Details not recorded for this card
Supporting quotations
Sites means the websites, mobile apps, official social network platforms, or other online properties through which PayPal offers the Services and which has posted or linked to this Privacy Statement.
Qualifications & exceptions
Limited to properties that have posted or linked to this Privacy Statement.
Legal Rights & Agreement Rules · User right or choice
A regional table gives local contacts, and you may complain to your data protection authority if permitted
PayPal refers readers to a table with additional information relevant to their local country or region, listing a Data Protection Officer or contact information. It says you may lodge a complaint with the Supervisory Authority for data protection in your region if permitted under applicable law.
Details not recorded for this card
Supporting quotations
Please see the table below for additional information relevant to your local country/region. You may lodge a complaint with the Supervisory Authority for data protection in your region if permitted under applicable law.
Country or Region Data Protection Officer ("DPO"), and Contact Information
Qualifications & exceptions
A complaint to the Supervisory Authority is available "if permitted under applicable law".
Not stated here
The table does not list the United States.
Legal Rights & Agreement Rules · Context
For Albania, the EU, Norway, Iceland and Liechtenstein the listed contact entity is PayPal (Europe) in Luxembourg
The regional contact table lists PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, with an online privacy-query contact, for Albania, the EU, Norway, Iceland and Lichtenstein (spelled as in the source).
Details not recorded for this card
Supporting quotations
Albania PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449 Luxembourg
EU PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg
Norway PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg
Iceland PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg
Lichtenstein PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg
Qualifications & exceptions
Applies to the listed countries or regions only.
Legal Rights & Agreement Rules · Context
Argentina, Brunei, Hong Kong, India, Japan, South Korea and Malaysia list a PayPal address in Singapore
The regional contact table lists PayPal Pte. Ltd. (or, for India, PayPal Payments Private Limited), 5 Temasek Boulevard 09-01, Suntec Tower 5, Singapore 038985, with an online privacy-query contact, for Argentina, Brunei, Hong Kong, India, Japan, South Korea and Malaysia.
For Australia, Brazil, Canada, Israel and Mexico the listed contact is a local PayPal entity
The regional contact table lists local PayPal entities with addresses and online privacy-query contacts: PayPal Australia Pty Ltd (Sydney), PayPal do Brasil Instituição de Pagamento Ltda. (Brazil, attention Legal Department), PayPal Canada Co. (Toronto), PayPal Israel Payment Services LTD (Tel-Aviv) and Operadora PayPal de México, S. de R.L. de C.V (Mexico City).
Details not recorded for this card
Supporting quotations
Australia PayPal Australia Pty Ltd ABN 93 111 195 389, AFSL 304962 GPO Box 351 Sydney NSW 2001
Brazil PayPal do Brasil Instituição de Pagamento Ltda. Attention: Legal Department
Canada PayPal Canada Co. MaRS Centre West Tower 661 University Avenue Suite 506 Toronto, ON M5G
Israel PayPal Israel Payment Services LTD 98 Yigal Alon St., Tel-Aviv, Israel 6789141
Mexico Operadora PayPal de México, S. de R.L. de C.V Boulevard Manuel Ávila Camacho 137
Qualifications & exceptions
Applies to the listed countries only.
Legal Rights & Agreement Rules · Context
Brazil: the source names a Data Protection Officer and deputy under LGPD article 41
For Brazil, the Statement says that in compliance with LGPD article 41 it identifies a Data Protection Officer and a Deputy Data Protection Officer, both reachable at the e-mail address latamdpo@paypal.com.
Details not recorded for this card
Supporting quotations
In compliance with LGPD article 41, the identity and contact information of the Data Protection Officer (DPO) and of his deputy (Deputy DPO) are the following:
DPO contact e-mail: latamdpo@paypal.com
Qualifications & exceptions
Applies to Brazil.
Legal Rights & Agreement Rules · Context
South Korea: a domestic agent and Data Protection Office are listed under Korean law
For South Korea, the Statement says that pursuant to the Personal Information Protection Act and the Network Act, the contact details of the domestic agent and Data Protection Office are given: PayPal Korea Services LLC, with an address in Seoul, a telephone number and an e-mail address.
Details not recorded for this card
Supporting quotations
Pursuant to the Personal Information Protection Act and the Network Act, the contact details of the domestic agent and Data Protection Office are as follows:
Name and representative: PayPal Korea Services LLC
United States: PayPal Inc., 2211 N. 1st St., San Jose, CA is the listed contact with an online privacy contact
The regional contact table lists PayPal Inc., 2211 N. 1st St., San Jose, CA 95131, with an online contact for privacy queries, for the United States.
Details not recorded for this card
Supporting quotations
United States PayPal Inc. 2211 N. 1st St., San Jose, CA 95131
Qualifications & exceptions
Applies to the United States row of the table.
Not stated here
The linked online privacy contact page is not supplied here.
Legal Rights & Agreement Rules · Context
Philippines, Singapore, Sri Lanka, Switzerland, Taiwan, the UAE and Vietnam list a PayPal address in Singapore
The regional contact table lists PayPal Pte. Ltd., 5 Temasek Boulevard 09-01, Suntec Tower 5, Singapore 038985, with an online privacy-query contact, for the Philippines, Singapore, Sri Lanka, Switzerland, Taiwan, the United Arab Emirates and Vietnam.
Russia: the listed contact entity is PayPal (Europe) in Luxembourg
The regional contact table lists PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, with an online privacy-query contact, for Russia.
Details not recorded for this card
Supporting quotations
Russia PayPal (Europe) S.a.r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449, Luxembourg
Qualifications & exceptions
Applies to the Russia row of the table.
Legal Rights & Agreement Rules · Context
Thailand and the UK list a local address; the Thailand row does not name an entity
The regional contact table lists, for Thailand, an address at Athenee Tower in Bangkok with an online privacy contact; the row does not name a PayPal entity. For the UK it lists PayPal UK Ltd, 76 Upper Ground, London SE1 9PZ, with an online privacy contact.
UK PayPal UK Ltd 76 Upper Ground London, United Kingdom, SE1 9PZ
Qualifications & exceptions
Applies to the Thailand and UK rows only.
Not stated here
The Thailand row gives an address but no named entity.
Legal Rights & Agreement Rules · Context
US disclosures supplement the Statement and summarize the prior 12 months of CCPA processing
This section adds disclosures for individuals in the United States and supplements the Privacy Statement above. It provides information about PayPal's Personal Information processing in the prior 12 months under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA). PayPal says that in the preceding 12 months it collected the categories of Personal Information in the table below and disclosed those categories for business purposes to the categories of third parties shown, described in more detail in the uses and sharing sections.
Details not recorded for this card
Supporting quotations
This section contains additional disclosures for individuals in the United States and supplements PayPal’s Privacy Statement above.
This section provides additional information regarding PayPal’s prior 12-month Personal Information processing activities under the CCPA.
In the preceding 12 months, we have collected the categories of Personal Information set forth in the table below.
In the preceding 12 months, we have disclosed the following categories of Personal Information for business purposes to the following categories of third parties
Qualifications & exceptions
Covers the preceding 12 months and individuals in the United States, with CCPA-specific information for California.
Not stated here
The table gives categories of data, purposes and recipient categories per row; it does not map each purpose to each recipient.
Legal Rights & Agreement Rules · Company commitment
PayPal provides metrics on how it handled privacy rights requests under the CCPA
PayPal says it provides its metrics required under the CCPA relating to how it handled privacy rights requests, through a linked page.
Details not recorded for this card
Supporting quotations
CCPA Privacy Rights Reporting
PayPal provides its
required under the CCPA relating to how it handled privacy rights requests.
Not stated here
The linked metrics page is not supplied here, so the metrics themselves are not stated.
Legal Rights & Agreement Rules · Restriction or exception
Federal financial notice excludes Unbranded Payment Services and uses the Gramm-Leach-Bliley definition
The Notice for Consumers of Financial Products and Services does not apply to Unbranded Payment Services, and for that part of the Privacy Statement "personal information" has the meaning given to it by the Gramm-Leach-Bliley Act. The notice is dated "Rev. September 28, 2026".
Details not recorded for this card
Supporting quotations
Notice for Consumers of Financial Products and Services
The following Notice for Consumers of Financial Products and Services does not apply to Unbranded Payment Services.
the definition of "personal information" for this portion of the Privacy Statement has the meaning given to it by the Gramm-Leach-Bliley Act.
Rev. September 28, 2026
Unbranded Payment Services means when you are interacting with and making payments to Partners and Merchants using our card processing and/or ACH origination services that do not carry the PayPal brand or when you use our Braintree services.
Qualifications & exceptions
Does not apply to Unbranded Payment Services (card processing and/or ACH origination not carrying the PayPal brand, or Braintree services).
"Personal information" in this notice follows the Gramm-Leach-Bliley Act definition.
Federal notice is provided by PayPal, Inc. for personal PayPal and Xoom accounts and Fastlane profiles
The notice says it is provided by PayPal, Inc. and applies to your personal PayPal and Xoom accounts and Fastlane profile.
Details not recorded for this card
Supporting quotations
Who we are
This privacy notice is provided by PayPal, Inc. and is applicable to your personal PayPal and Xoom accounts, and Fastlane profile.
Qualifications & exceptions
Applies to personal PayPal and Xoom accounts and Fastlane profiles.
Legal Rights & Agreement Rules · Procedure
Federal notice points to the general Statement and a California, North Dakota and Vermont notice
The notice refers readers to the general Privacy Statement for PayPal's Personal Information handling practices and other rights under privacy laws for information not covered by the Gramm-Leach-Bliley Act. It also refers to a California, North Dakota, and Vermont Supplemental Financial Privacy Notice for state financial privacy laws, and says to contact PayPal with questions.
Details not recorded for this card
Supporting quotations
Other Privacy Rights: Please see our general
to learn more about our Personal Information handling practices and other rights you may have under privacy laws for Personal Information that is not covered by the Gramm-Leach-Bliley Act.
Contact us if you have questions about our Privacy Statement, this consumer notice, or your Personal Information.
Not stated here
The linked Supplemental Financial Privacy Notice is not supplied here, so what it says about state rights is not stated.
Legal Rights & Agreement Rules · Context
UK and EEA section supplements the Statement; the controller is the PayPal entity where you live
This section contains additional disclosures for individuals in the UK and the European Economic Area (EEA) and supplements the Privacy Statement above. The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you reside, which can be found in Our Contact Information.
Details not recorded for this card
Supporting quotations
Disclosures for Individuals in the United Kingdom (“UK”) and European Economic Area (“EEA”)
This section contains additional disclosures for individuals in the UK and EEA and supplements PayPal’s Privacy Statement above.
Data Controller
The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you reside, which can be found in Our Contact Information.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Legal Rights & Agreement Rules · Company practice
UK/EEA lawful basis, first row: contract-necessary purposes include Services, payments and identity checks
For individuals in the UK and EEA, a table sets out lawful bases under the General Data Protection Regulation. In the first row, the processing purposes include: to provide our Services, to fulfil relevant agreements with you and to otherwise administer our business relationship with you; to administer your payment for products and the customer relationship; to assess your creditworthiness in connection with your application, confirm your identity and your contact information, and protect you and others from fraud; to confirm your identity, also through the use of electronic signature, and verify your personal and contact details; to prove that transactions have been executed; to establish, exercise or defend a legal claim or collection procedure; to comply with internal procedures; to assess which payment options and services to offer you, for example by carrying out internal and external credit assessments. PayPal says it collects the necessary categories of Personal Information for this row because it considers them necessary to fulfil its pre-contractual and contractual obligations to you and without which you will not be able to use the Services.
Details not recorded for this card
Supporting quotations
We may process your Personal Information in accordance with the lawful bases below under the General Data Protection Regulation Types of Data Lawful basis and special condition for processing (if relevant)
These processing purposes include:
to provide our Services, to fulfil relevant agreements with you and to otherwise administer our business relationship with you;
to administer your payment for products and the customer relationship;
to assess your creditworthiness in connection with your application, confirm your identity and your contact information, and protect you and others from fraud;
to confirm your identity, also through the use of electronic signature, and verify your personal and contact details;
to prove that transactions have been executed;
to establish, exercise or defend a legal claim or collection procedure;
to comply with internal procedures;
to assess which payment options and services to offer you, for example by carrying out internal and external credit assessments;
We collect these categories of Personal Information because we consider them necessary to fulfil our pre-contractual and contractual obligations to you and without which you will not be able to use the Services.
Qualifications & exceptions
Applies to individuals in the UK and EEA (GDPR lawful bases).
Row 1 of the lawful basis table; purposes continue in the next card.
Not stated here
This card lists purposes in the first part of the row; the rest follow in the next card.
Legal Rights & Agreement Rules · Company practice
UK/EEA lawful basis, first row (cont.): analysis, security, legal compliance, Visa+, Fastlane and receipts
Continuing the first row of the lawful basis table, the processing purposes also include: for customer analysis, to administer our Services, and for internal operations, for example troubleshooting, data analysis, testing, research and statistical purposes; to communicate with you in relation to our Services; to promote the security of the Services; to comply with applicable laws, such as AML and bookkeeping laws and rules issued by our designated banks and relevant card networks; Visa+ transaction matching using recipient name and payment information from Visa and participating wallets; use of third-party information to process PayPal World transactions; Fastlane recognition and authorization checks for Fastlane users; and Point of Sale receipts, where contact details you provide may be remembered and pre-filled for later purchases with the same payment card.
Details not recorded for this card
Supporting quotations
for customer analysis, to administer our Services, and for internal operations, for example troubleshooting, data analysis, testing, research and statistical purposes;
to communicate with you in relation to our Services;
to promote the security of the Services;
to comply with applicable laws, such as AML and bookkeeping laws and rules issued by our designated banks and relevant card networks;
specifically for Visa+, we will receive the recipient’s name and payment information from Visa and third-party Visa+ participating digital wallets for the purpose of processing and matching Visa+ payment transactions between participating digital wallets and PayPal;
We will use information from third parties, including third-party wallets, payment networks, and processors, to process PayPal World transactions.
For Fastlane users, we may recognize you as a Fastlane user when you shop on participating Partner and Merchant sites, and we may prompt you to engage in participating Partner or Merchant interactions, such as registering for a store or loyalty account using your Fastlane profile. We will also use your Personal Information and payment method details to determine whether the payment you are making with a participating Partner or Merchant is authorized by you and likely to be successfully authorized by the payment method you choose to use when you make a purchase using details from your Fastlane profile; and
provide receipts in connection with PayPal Point of Sale services. For buyers using our PayPal Point of Sale services (including Venmo Tap to Pay), you may choose to provide us your contact details so that we can send you digital receipts. If you provide your e-mail address or mobile number to a Partner or Merchant who uses PayPal Point of Sale, we may remember your details for the next time you buy something from a Merchant who uses PayPal Point of Sale in its physical store, if you use the same payment card. This is regardless of whether you have previously bought something from this Merchant or not. This means that your e-mail address or mobile number will be pre-filled in the receipt view for your convenience the next time you buy something from a Merchant who uses PayPal Point of Sale in its physical store.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
The Visa+, PayPal World, Fastlane and receipts items repeat practices described in the main Statement.
Legal Rights & Agreement Rules · Company practice
UK/EEA lawful basis, second row: content, misuse prevention, eligibility and risk analysis purposes
In the second row of the table, the processing purposes listed so far include: to ensure that content is presented in the most effective way for you and your device; to prevent misuse of our Services as part of our efforts to keep our platform safe and secure; to determine your eligibility for and to communicate with you about Services for which you may qualify or that may be of interest to you, for example by carrying out internal credit assessments; to carry out risk analysis, fraud prevention and risk management (e.g., through Automated Decision Making and AI). This row continues in the next section of the source.
Details not recorded for this card
Supporting quotations
These processing purposes include:
to ensure that content is presented in the most effective way for you and your device;
to prevent misuse of our Services as part of our efforts to keep our platform safe and secure;
to determine your eligibility for and to communicate with you about Services for which you may qualify or that may be of interest to you, for example by carrying out internal credit assessments;
to carry out risk analysis, fraud prevention and risk management (e.g., through Automated Decision Making and AI);
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Risk analysis and fraud prevention are described as including Automated Decision Making and AI.
Not stated here
The lawful basis and data types for this row appear after these purposes, in the next section.
Legal Rights & Agreement Rules · Company practice
UK/EEA lawful basis, second row (cont.): improving services, marketing, legal compliance and risk management
For individuals in the UK and EEA, the second row of the lawful basis table continues its processing purposes: to manage and improve our Services and for general business development purposes, for example improving risk models to minimize fraud, develop new products and features, for internal operations (e.g., for troubleshooting), data analysis, testing, research, statistical purposes, and explore new business opportunities; to keep your account and financial information up to date; for marketing, product and customer analysis, including where we partner with others to offer similar services to market about our Partners and testing, for example to improve our product range and optimize our customer offerings; to comply with applicable laws, such as AML, bookkeeping laws, regulatory capital adequacy requirements, and rules issued by our designated banks and relevant card networks. For example, when we process Personal Information for KYC requirements, to prevent, detect and investigate money laundering, terrorist financing and fraud. We also carry out sanction screening, report to tax authorities, police enforcement authorities, enforcement authorities, supervisory authorities where we are not compelled by applicable laws but where we have a good faith belief that sharing the information is necessary to comply with applicable law; to facilitate your participation in competitions, offerings, and events; to conduct financial risk management obligations, such as credit performance and quality, assess product suitability, check your identity, trace and recover debts, and prevent criminal activity, insurance risks and compliance with capital adequacy requirements under applicable law.
Details not recorded for this card
Supporting quotations
to manage and improve our Services and for general business development purposes, for example improving risk models to minimize fraud, develop new products and features, for internal operations (e.g., for troubleshooting), data analysis, testing, research, statistical purposes, and explore new business opportunities;
to keep your account and financial information up to date;
for marketing, product and customer analysis, including where we partner with others to offer similar services to market about our Partners and testing, for example to improve our product range and optimize our customer offerings;
to comply with applicable laws, such as AML, bookkeeping laws, regulatory capital adequacy requirements, and rules issued by our designated banks and relevant card networks. For example, when we process Personal Information for KYC requirements, to prevent, detect and investigate money laundering, terrorist financing and fraud. We also carry out sanction screening, report to tax authorities, police enforcement authorities, enforcement authorities, supervisory authorities where we are not compelled by applicable laws but where we have a good faith belief that sharing the information is necessary to comply with applicable law;
to facilitate your participation in competitions, offerings, and events;
to conduct financial risk management obligations, such as credit performance and quality, assess product suitability, check your identity, trace and recover debts, and prevent criminal activity, insurance risks and compliance with capital adequacy requirements under applicable law;
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Reporting to authorities without legal compulsion requires a good faith belief that sharing is necessary to comply with applicable law.
The second row continues its purposes: to process information about your contacts to make it easy for you to find and connect them and improve payment accuracy. By providing us with information about your contacts you certify that you have permission to provide that information to PayPal for the purposes described in this Privacy Statement; to provide you with information, news, and marketing about our Services, including rewards or ads from us or where we partner with others to offer similar services; to associate information about you to identify your use of Services without a PayPal account (e.g., Pay without a PayPal account) or Unbranded Payment Services (e.g., Braintree) and to associate such transactions with your account, if you have one or later establish an account; to remember your preferences for the next time you use the Services, such as which of your payment methods you prefer or whether you choose to receive digital receipts via email or text when you checkout; and; we will use precise geolocation to enhance the security of the Sites and Services. We collect precise geolocation data from Users while they are logged into their financial account. The guest-transaction purpose refers to Pay without a PayPal Account and Unbranded Payment Services as defined in the Statement.
Details not recorded for this card
Supporting quotations
to process information about your contacts to make it easy for you to find and connect them and improve payment accuracy. By providing us with information about your contacts you certify that you have permission to provide that information to PayPal for the purposes described in this Privacy Statement;
to provide you with information, news, and marketing about our Services, including rewards or ads from us or where we partner with others to offer similar services;
to associate information about you to identify your use of Services without a PayPal account (e.g., Pay without a PayPal account) or Unbranded Payment Services (e.g., Braintree) and to associate such transactions with your account, if you have one or later establish an account;
to remember your preferences for the next time you use the Services, such as which of your payment methods you prefer or whether you choose to receive digital receipts via email or text when you checkout; and
we will use precise geolocation to enhance the security of the Sites and Services. We collect precise geolocation data from Users while they are logged into their financial account.
Pay without a PayPal Account means our Services may be accessed by individuals without using a PayPal account, a Fastlane profile, or the Unbranded Payment Services.
Unbranded Payment Services means when you are interacting with and making payments to Partners and Merchants using our card processing and/or ACH origination services that do not carry the PayPal brand or when you use our Braintree services.
Users means other account holders and non-account holders of the PayPal Services.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
You certify permission for contact information you provide.
Precise geolocation is collected from Users while logged into their financial account.
UK/EEA: legitimate interest in a secure, innovative service and tailored ads, unless overridden
For the second row, the lawful basis column says PayPal has a legitimate interest in ensuring it remains a secure financial service, continuing to offer innovative services of interest to you, and optimizing sales efforts by tailoring services to your interests, including ads and offers you may be shown. It does this where its legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Details not recorded for this card
Supporting quotations
We have a legitimate interest in ensuring that PayPal remains a secure financial service and continuing to offer services that are innovative and of interest to you as well as to optimize our sales efforts by tailoring our services to your interests including ads and offers you may be shown.
We do this where our legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Relied on only where not overridden by the data subject's interests or fundamental rights and freedoms.
Legal Rights & Agreement Rules · Company practice
UK/EEA lawful basis, third row: services, identity, legal claims, misuse prevention, risk analysis and legal compliance
The third row of the lawful basis table lists these processing purposes: to provide our Services and products; to verify your identity, also for signature purposes, and verify your personal and contact details; to establish, exercise or defend a legal claim or collection procedure; to prevent misuse of our Services as part of our efforts to keep our platform safe and secure; to carry out risk analysis, fraud prevention and risk management (e.g., through Automated Decision Making and AI); and; to comply with applicable laws, such as AML and bookkeeping laws and regulatory capital adequacy requirements and rules issued by our designated banks and relevant card networks. For example, when we process Personal Information for KYC requirements, to prevent, detect and investigate money laundering, terrorist financing and fraud. We also carry out sanction screening, and report to tax authorities, police enforcement authorities, enforcement authorities, and supervisory authorities.
Details not recorded for this card
Supporting quotations
These processing purposes include:
to provide our Services and products;
to verify your identity, also for signature purposes, and verify your personal and contact details;
to establish, exercise or defend a legal claim or collection procedure;
to prevent misuse of our Services as part of our efforts to keep our platform safe and secure;
to carry out risk analysis, fraud prevention and risk management (e.g., through Automated Decision Making and AI); and
to comply with applicable laws, such as AML and bookkeeping laws and regulatory capital adequacy requirements and rules issued by our designated banks and relevant card networks. For example, when we process Personal Information for KYC requirements, to prevent, detect and investigate money laundering, terrorist financing and fraud. We also carry out sanction screening, and report to tax authorities, police enforcement authorities, enforcement authorities, and supervisory authorities.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Not stated here
The lawful basis for this row is shown in a later cell of the table, in the next section of the source.
Legal Rights & Agreement Rules · Company practice
UK/EEA lawful basis, third row: legal obligation applies where processing is necessary to comply with law
The third row of the lawful basis table lists these remaining necessary data categories: Information from your use of the Services; Technical usage data; Device information; and; Location data. Its lawful basis column says PayPal has a legal obligation under applicable laws to conduct certain processing activities, and does this where necessary to comply with applicable laws.
Details not recorded for this card
Supporting quotations
Information from your use of the Services;
Technical usage data;
Device information; and
Location data.
We have a legal obligation under applicable laws to conduct certain processing activities. We do this where it is necessary to comply with applicable laws.
Information from your connected financial accounts;
Device Information means data that can be automatically collected from any device used to access the Services.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Relied on "where it is necessary to comply with applicable laws".
The fourth row of the lawful basis table lists these processing purposes: participate in certain features that while not necessary for use of the Services may be of interest to you, such as syncing your contact list to your account; providing biometric data for identification purposes; certain targeted advertising; linking your email account for package tracking; linking any non-financial or financial accounts, such as social network accounts, mail accounts, or bank, card, or investment accounts you agree to link to facilitate payments or for other purposes for which you agree to link such external account; or; Connecting to a third party platform or third party wallet; and; if you agree to let us track your precise geolocation, we can customize our Services by using the right language and personalizing content such as providing location-based options, functionality or offers, ads and search results. Even if you don’t allow us to track your precise location, we may still use your address to send you location-based options recommended by businesses that are near your address. As in the main Statement, personalization from precise location happens if you agree, while address-based location options may still be sent if you do not.
Details not recorded for this card
Supporting quotations
These processing purposes include:
participate in certain features that while not necessary for use of the Services may be of interest to you, such as syncing your contact list to your account;
providing biometric data for identification purposes;
certain targeted advertising;
linking your email account for package tracking;
linking any non-financial or financial accounts, such as social network accounts, mail accounts, or bank, card, or investment accounts you agree to link to facilitate payments or for other purposes for which you agree to link such external account; or
Connecting to a third party platform or third party wallet; and
if you agree to let us track your precise geolocation, we can customize our Services by using the right language and personalizing content such as providing location-based options, functionality or offers, ads and search results. Even if you don’t allow us to track your precise location, we may still use your address to send you location-based options recommended by businesses that are near your address.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Precise geolocation personalization is "if you agree"; address-based options may still be sent otherwise.
Legal Rights & Agreement Rules · Company practice
UK/EEA lawful basis, fourth row: PayPal relies on explicit and voluntary consent for these features
For the fourth row, necessary categories of Personal Information include: Registration and contact information; Identification and signature information; Biometric data; Information from your use of the Services; Technical usage data; Device information; and; Location data. The lawful basis column says that, except as otherwise described above, PayPal relies on your explicit and voluntary consent.
Details not recorded for this card
Supporting quotations
Necessary categories of Personal Information include:
Registration and contact information;
Identification and signature information;
Biometric data;
Information from your use of the Services;
Technical usage data;
Device information; and
Location data.
Except as otherwise described above, we rely on your explicit and voluntary consent.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
"Except as otherwise described above" limits this statement to processing not covered by earlier rows.
Legal Rights & Agreement Rules · User right or choice
UK and EEA: you may complain to your Supervisory Authority; PayPal asks you to contact it first but does not require it
You have the right to complain to your local Supervisory Authority about PayPal's use of your Personal Information. In the EEA, you may lodge a complaint with PayPal's lead supervisory authority, the Luxembourg National Commission for Data Protection (CNPD), by post at the address given. In the UK, you may lodge a complaint with your local data protection authority, the Information Commissioner's Office (address given in Manchester). While you are not required to, PayPal asks that you contact it first to give it the opportunity to address your concerns directly before speaking with your Supervisory Authority.
Details not recorded for this card
Supporting quotations
In addition, you have the right to complain to your local Supervisory Authority about our use of your Personal Information.
In EEA, you may lodge a complaint with our lead supervisory authority for data protection, Luxemburg National Commission for Data Protection (CNPD)
In the UK, you may also lodge a complaint with your local data protection authority, which is the Information Commissioner’s Office:
address: ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL.
However, while you are not required to do so, we ask that you contact us first to give us the opportunity to address your concerns directly before speaking with your Supervisory Authority.
Qualifications & exceptions
Applies to individuals in the UK and EEA.
Contacting PayPal first is requested, not required.
Legal Rights & Agreement Rules · Permission or license
EEA banking notice: the third-party list may change quarterly; no objection within 30 days counts as acceptance
For EEA users, PayPal says it may update the third-party list on the first business day of each quarter (January, April, July and October) and will only start transferring information to new entities, for new purposes or for new information types after 30 days from publication. It says you should review the list each quarter, and that if you do not object within 30 days of publication you are deemed to have accepted the changes to the list and to the Privacy Statement; if you disagree you may close your account and stop using the services. It adds that information may need to be transferred to other PayPal companies or entities acting as payment providers, processors or account holders, that those entities may be subject to local laws requiring disclosure to authorities, and that your use of the PayPal Services constitutes your consent to the transfer.
Details not recorded for this card
Supporting quotations
PayPal may update the list of third parties referred to above on the first business day of every quarter (January, April, July and October).
PayPal will only start transferring any Personal Information to any of the new entities or for the new purposes or Personal Information types indicated in each update after 30 days from the date when that list is made public through this Privacy Statement.
If you do not object to the new Personal Information disclosure, within 30 days after the publication of the updated list of third parties, you are deemed to have accepted the changes to the list and to this Privacy Statement. If you do not agree with the changes, you may close your account and stop using our services.
You acknowledge that according to their local legislation, such entities may be subject to laws, regulations, inquiries, investigations, or orders which may require the disclosure of information to the relevant authorities of the relevant country. Your use of the PayPal Services constitutes your consent to our transfer of such information to provide you the PayPal Services.
Qualifications & exceptions
Applies to Users in the EEA.
New transfers begin only after 30 days from publication.
Deemed acceptance applies if you do not object within 30 days after publication.
Not stated here
The passage does not say how to object other than closing your account.
Legal Rights & Agreement Rules · Context
UK status disclosure: PayPal UK Ltd is FCA-authorised, but some products such as Working Capital are not regulated
PayPal says PayPal UK Ltd is authorised and regulated by the Financial Conduct Authority as an electronic money institution (firm reference number 994790), for regulated consumer credit activities (996405) and for cryptocurrency services (1000741). It says some products and services, such as PayPal Working Capital, are not regulated by the FCA and may offer a lower level of protection, and refers to the product terms. It gives the company number (14741686) and registered office (76 Upper Ground, London SE1 9PZ).
Details not recorded for this card
Supporting quotations
Status Disclosure
PayPal UK Ltd is authorised and regulated by the Financial Conduct Authority (FCA) as an electronic money institution (firm reference number 994790); in relation to its regulated consumer credit activities (firm reference number 996405); and for the provision of cryptocurrency services (firm reference number 1000741).
Some products and services, such as PayPal Working Capital, are not regulated by the FCA and may offer a lower level of protection.
PayPal UK Ltd's company number is 14741686. Its registered office is 76 Upper Ground, London, United Kingdom, SE1 9PZ.
Qualifications & exceptions
Applies to PayPal UK Ltd.
Some products and services are not FCA-regulated and may offer a lower level of protection.
Not stated here
The product terms referred to are not supplied here.
Legal Rights & Agreement Rules · Context
Mexico section supplements the Statement; the controller is the PayPal entity where you live
This section contains additional disclosures for individuals in Mexico and supplements the Privacy Statement above. The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you reside, which can be found in Our Contact Information. The section describes primary and secondary purposes for processing your Personal Information.
Details not recorded for this card
Supporting quotations
Disclosures for Individuals in Mexico
This section contains additional disclosures for individuals in Mexico and supplements PayPal’s Privacy Statement above. The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you reside, which can be found in Our Contact Information.
Below we describe our primary and secondary purpose for processing your Personal Information.
Qualifications & exceptions
Applies to individuals in Mexico.
Legal Rights & Agreement Rules · Context
Singapore section supplements the Statement for individuals in Singapore
This section contains additional disclosures for individuals in Singapore and supplements the Privacy Statement above.
Details not recorded for this card
Supporting quotations
Disclosures for Individuals in Singapore
This section contains additional disclosures for individuals in Singapore and supplements PayPal’s Privacy Statement above.
Qualifications & exceptions
Applies to individuals in Singapore.
Legal Rights & Agreement Rules · Company practice
Singapore: PayPal also relies on legitimate interests where not overridden by individuals' rights
For individuals in Singapore, PayPal says it also has a legitimate interest in ensuring it remains a secure financial service, continuing to offer innovative services of interest to you, and optimizing its sales efforts by tailoring services to your interests, including ads and offers. In addition to its other lawful bases, it may process Personal Information where its legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Details not recorded for this card
Supporting quotations
We also have a legitimate interest in ensuring that PayPal remains a secure financial service and continuing to offer services that are innovative and of interest to you as well as to optimize our sales efforts by tailoring our services to your interests including ads and offers you may be shown.
we may process your Personal Information where our legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Qualifications & exceptions
Applies to individuals in Singapore.
Relied on only where not overridden by the data subject's interests or fundamental rights and freedoms.