Checkout.com Privacy

This document is Checkout.com's Privacy Policy governing the collection, use, storage, and sharing of personal data by Checkout.com Ltd and its group entities, with legal bases including contract performance, legitimate interests, legal obligations, and consent under GDPR and equivalent frameworks. The policy states that Checkout.com collects identity data, contact data, financial data, transaction data, technical data, usage data, and communications data from merchants, their end customers (cardholders), job applicants, and website visitors, and the terms authorize sharing this data with payment networks, issuing banks, fraud prevention agencies, credit reference agencies, regulators, and third-party service providers. A notable operational distinction is that Checkout.com processes data both as a data controller (for its own merchant and website visitor relationships) and as a data processor (on behalf of merchants for cardholder data), which creates layered accountability structures where merchants bear primary responsibility for their end customers' data rights. The policy engages GDPR and UK GDPR as primary frameworks, with additional references to CCPA-adjacent rights for California residents and sector-specific financial regulation; international data transfers are addressed via Standard Contractual Clauses and adequacy decisions, creating compliance dependencies that vary by jurisdiction and transfer destination. Material considerations include the breadth of data sharing with fraud and credit reference agencies, which may interact with consumer credit reporting obligations, and the policy's acknowledgment of automated decision-making in fraud screening contexts, which may require evaluation under GDPR Article 22.