Adyen Privacy Policy

This document is Adyen's privacy statement governing the collection, processing, and sharing of personal data for individuals who interact with Adyen's payment processing platform, website, and related services, with legal bases including contractual necessity, legitimate interests, legal obligations, and consent as applicable under GDPR and equivalent frameworks. The statement asserts that Adyen processes a broad range of personal data categories including identification data, financial and transaction data, device and behavioral data, and in limited contexts special categories of data such as biometric data for KYC purposes, with the terms authorizing sharing with financial institution partners, fraud prevention networks, government authorities, and third-party service providers globally. Notably, the policy discloses that Adyen processes data as both a data controller and a data processor depending on the service context, a distinction that materially affects which rights individuals may exercise directly against Adyen versus the merchant using Adyen's infrastructure. The document engages GDPR, UK GDPR, CCPA and California Privacy Rights Act, and regional frameworks across APAC and LATAM markets, with explicit acknowledgment of cross-border data transfer mechanisms including Standard Contractual Clauses for transfers outside the EEA. Material compliance considerations include the dual controller-processor role, the breadth of legitimate interests asserted as a processing basis, and the adequacy of consent mechanisms for cookie-based and behavioral data collection.