Privacy policy clauses for PayPal
PayPal is an online payment processor that handles checkout and transaction processing on our website. We use PayPal to securely process customer payments, verify identities, and transfer funds without exposing sensitive financial information directly to our servers.
Free scan · No signup · Results in 60 seconds
What data PayPal collects
Your privacy policy must disclose each of the following data types when you use PayPal.
When does PayPal trigger privacy obligations?
Installation triggers immediate obligations
The moment PayPal's checkout or payment gateway is integrated into your site or app, you begin collecting and transferring payment card data, billing addresses, email addresses, transaction records, and IP addresses to PayPal Holdings Inc (a US processor). This is not optional data — it flows the instant a customer initiates checkout.
Applicable regulations by jurisdiction
GDPR (EU/UK users): PayPal processes personal data as your processor under GDPR Article 28. You must execute a Data Processing Agreement (DPA) with PayPal before processing any EU user data. Article 5(1)(a) requires lawful basis (typically performance of contract); Article 13/14 requires you to disclose to customers what data PayPal receives and why. The tsrce cookie is subject to ePrivacy Directive Article 5(3) — it's categorized strictly_necessary, so it requires no prior consent, but you must still document this in your cookie policy.
