The notice establishes a set of data subject rights including access, correction, erasure, processing restriction, objection, consent withdrawal, and objection to automated decision-making, all exercisable by contacting dpo@checkout.com, with the notice qualifying that availability of these rights depends on jurisdiction and that erasure may be declined where legal retention obligations apply.
This analysis describes what Checkout.com's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operative mechanism for individuals to exercise data subject rights and qualifies the scope of those rights by jurisdiction and by Checkout's legal retention obligations, which are relevant parameters for compliance teams assessing the practical scope of data subject access and erasure requests.
The updated policy establishes formal complaint procedures for UK and Australia users, requiring Checkout to acknowledge complaints within 30 days and respond without undue delay. For UK users specifically, the policy clarifies that complaints must first be raised with Checkout before escalating to the Information Commissioner's Office. The policy also discloses that transaction information collection now includes country data alongside currency and amount. For Australia users, the policy clarifies that identity verification is a legal requirement and cannot be provided anonymously or pseudonymously. Users in these jurisdictions can submit data protection complaints through Checkout's designated process and escalate to their respective regulatory authorities if dissatisfied with Checkout's response.
View change record →The agreement establishes that data subject rights including access, erasure, correction, and objection to automated processing are exercisable by contacting dpo@checkout.com, with the notice stating that erasure requests may be declined where Checkout has legal retention obligations. Jurisdiction determines which specific rights are available to a given individual.
Cross-platform context
See how other platforms handle Data Subject Rights and Contact Mechanism and similar clauses.
Compare across platforms →"Depending on your jurisdiction, you have rights and choices over the way your information is used by us: Right to opt-out of direct marketing communications: This enables you to opt-out of receiving marketing communications from us. You can do this at any time by clicking on the 'unsubscribe' link included in any email marketing material we send to you, or by informing us by emailing dpo@checkout.com. Right to request access to your personal data: This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. In some cases, you have a right to receive a copy of this information in a reusable format and have it transmitted to another organisation. Right to request erasure of your personal data: This enables you to ask us to delete or remove your personal data. Please note that in some cases, for example if we need to retain your data to comply with legal obligations, we may be unable to comply with such requests.Excerpt from Checkout.com's Privacy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the operative mechanism for individuals to exercise data subject rights and qualifies the scope of those rights by jurisdiction and by Checkout's legal retention obligations, which are relevant parameters for compliance teams assessing the practical scope of data subject access and erasure requests.
The agreement establishes that data subject rights including access, erasure, correction, and objection to automated processing are exercisable by contacting dpo@checkout.com, with the notice stating that erasure requests may be declined where Checkout has legal retention obligations. Jurisdiction determines which specific rights are available to a given individual.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Checkout.com.