Categories of Personal Information collected from you, including from your interactions with us and use of the Services:

• Personal identifiers: Such as name, business name, address, phone number, email, IP address, device information, information collected from cookies or other tracking technologies, government-issued identification, signature, and other information necessary to establish an account or profile.
• Records and financial information: Such as identity card numbers, government-issued identification, account header information, bank account and routing numbers, credit and debit card information, income, amount you send or request, your payment instrument, card, financial or funding account in connection with the Services, including issuer name, card type, country code, payment account number, CVV, username, and IBAN information.
• Transaction and experience information: Such as account balances, transaction history and transaction details, online shopping cart information, transaction ID, shopping activity and goods or services considered on Partners and Merchants sites, shipping address, shipping options and associated costs when you check out, purchase history, seller information, such as seller name, industry and postal code, buyer information, purchase information, and order tracking and product information.
• Commercial information: Such as payout amount, payor information, and the record of the Services.
• Geolocation data: Such as Global Positioning System ("GPS"), which we may collect with your consent if you have an account for financial Services, and IP-based geolocation data during your user experience or based on your mobile application settings.
• Internet or network activity: Such as interactions with our Services, information about response time for web pages, download errors, date and time when you used the service, shopping history, location information, such as your IP address, statistics regarding how pages are loaded or viewed, the websites you visited before coming to the Sites, and other usage and browsing information collected through Cookies.
• Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience to authenticate you for certain actions related to your account, including, for example, to verify your identity before you access accounts and Services, recover passwords, update profile information, manage payments and payment methods, lift account limitations, and initiate cryptocurrency transfers.
• Audio, electronic, visual, or similar information: Such as call recordings when you talk to customer service.
• Professional or employment information: Such as business information, job title, contact emails, phone numbers and taxpayer ID numbers.
• Imported contact information: Such as name, address, phone number, images, email address or usernames associated with the contacts you import or enter manually.
• Account profile information: Such as username, profile picture, gender, or personal description, which you add that may include Sensitive Personal Information. You can set your profile to "Private" at any time.
• Information you provide when you contact us: Such as your responses to surveys, recorded conversations, chat conversations with us, email correspondence with us, account or profile status, repayment history, voice identification, vulnerability-related information provided by you and information about others if you choose to share it with us.
• Inferred data: Such as gender, income, browsing and purchasing habits, creditworthiness, fraud and risk assessment, your preferences and shopping behavior, which we may infer based on your transactions and interactions with our Services, ads and offers or with our Partners and Merchants.
• Information related to legal requirements: Such as information from external sanction lists, including name, date of birth, place of birth, occupation, and the reason why the person is on the external sanction lists in question, consistent with applicable law.
• Characteristics of protected classifications: Such as, age or date of birth, nationality, disability, citizenship, and military status.
• Sensitive Personal Information: Such as Social Security and tax ID number, government-issued and other related identification, bank account and routing numbers, credit and debit card information, financial information, biometric data (as described above), or precise geolocation data, depending on applicable privacy law. In certain jurisdictions (e.g. under the GDPR), this may also be referred to as "special category information".
• Information from your device: Such as language settings, browser ID, device ID, device type, cookie preferences, time zone, operating system, platform, screen resolution, and similar information about your device settings, device's web browser, and internet connection, and data collected from Cookies or other tracking technologies.

We may also obtain the above categories of Personal Information from the following categories of sources:

• Excluded Services, including Venmo and PayPal Honey.
• Third parties, including service providers, Partners and Merchants, payment partners, such as payment networks and processors, credit reporting agencies and public and private credit databases ("CRAs"), government entities, data brokers, and financial institutions.
• Linked accounts, including non-financial or financial accounts, such as social network accounts, mail accounts, or bank, card, or investment accounts you agree to link to PayPal. You may unlink your linked accounts at any time. If you choose to link these accounts or share such information with us, we will periodically collect and process it until you unlink the account.
• Third-party applications that you choose to use, including the Apple App Store, Google Play Store, or social networking sites.
• Members of the PayPal corporate group from time to time, such as the PayPal family of companies listed in Our Contact Information.
• When you shop on Partner and Merchant sites, the Partner or Merchant may disclose Personal Information with PayPal that we will use in accordance with this Privacy Statement and the relevant PayPal user agreement.

We may process your Personal Information for a variety of reasons, including to provide our Services, for security and fraud prevention, and to comply with law. We also use Personal Information to allow you to participate in certain features that may be of interest to you, such as syncing your contact list to your account, personalizing content and offers, targeted advertising, or connecting to a third-party platform. Some of these features may be offered with an opt-out or require your consent to enable. You can withdraw your consent at any time, as described in Your Data Protection Rights.

We may collect Personal Information to:

• Provide our Services. We may use Personal Information to help you send, receive or request money, initiate a payment, add monetary value to an account, pay a bill, administer your purchases, display shipping options and associated costs when you check out, show you your profile, account and payment information, send and receive transactions and prove that they have been executed, to assess your creditworthiness in connection with our Services, confirm your identity (also through the use of electronic signature) and your contact information, to authenticate your access to your account or profile and to confirm your account or profile and financial information are accurate and up to date.
• For Visa+, we will receive the recipient's name and payment information from Visa and third-party Visa+ participating digital wallets for the purpose of processing and matching Visa+ payment transactions between participating digital wallets and PayPal.
• We will use information from third parties, including third-party wallets, payment networks, and processors, to process PayPal World transactions.
• If you are using Fastlane, we may recognize you as a Fastlane user when you shop on participating Partner and Merchant sites, and we may prompt you to engage in participating Partner or Merchant interactions, such as registering for a store or loyalty account using your Fastlane profile. We will also use your Personal Information and payment method details to determine whether the payment you are making with a participating Partner or Merchant is authorized by you and likely to be successfully authorized by the payment method you choose to use when you make a purchase using details from your Fastlane profile.
• Provide receipts in connection with PayPal Point of Sale (formerly Zettle by PayPal) services. For buyers using our PayPal Point of Sale services (including Venmo Tap to Pay), you may choose to provide us your contact details so that we can send you digital receipts. If you provide your e-mail address or mobile number to a Partner or Merchant who uses PayPal Point of Sale, we may remember your details for the next time you buy something from a Merchant who uses PayPal Point of Sale in its physical store, if you use the same payment card. This is regardless of whether you have previously bought something from this Merchant or not. This means that your e-mail address or mobile number will be pre-filled in the receipt view for your convenience the next time you buy something from a Merchant who uses PayPal Point of Sale in its physical store.
• Manage, analyze and improve our Services. We may use Personal Information to develop new products and features, to administer our Services, to promote the safety and security of the Services, for customer analysis and internal operations (e.g., for troubleshooting) and procedures, data analysis, testing, research, and statistical purposes. We may also use your transaction and experience data on an aggregated basis to generate business insights. We may share those insights with third parties such as our Partners and Merchants to help improve their products and services.
• AI and Automated Decision Making. We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services. PayPal also uses Automated Decision Making to provide our products and Services, conduct risk analysis, fraud prevention and risk management to protect our customers and business, including to prevent fraud against our Partners and Merchants and strategic ventures. Please see AI and Automated Decision Making to learn more.
• Manage your creditworthiness. Pursuant to applicable law, we will use and exchange Personal Information about you with CRAs to assess creditworthiness and product suitability, check your identity, trace and recover debts, and prevent fraud and criminal activity. This information may be supplied by CRAs to other organizations to perform similar checks and to trace your whereabouts and recover debts that you owe.
• Associate information about you. If you use our Services without a PayPal Account, we may associate such transactions with your PayPal account if you later establish an account. If you use one of the following—Fastlane, Venmo, and PayPal Honey—we may associate information about your transactions and experiences using these Services to personalize content and offers and improve your use of the PayPal Services.
• Market our Services. We may use Personal Information to provide you with information, news, and market our Services including where we partner with others to offer similar services to market about our Partners and Merchants. We use Personal Information, including when we associate information about you, to better understand and cater to your interests.
• Competitions, Offerings and Events. We may use Personal Information to facilitate your participation in competitions, offerings, and events.
• Communicate with you. We may use your Personal Information to communicate with you, such as answering a question you sent to our customer service team.
• Comply with laws and risk oversight. We may use Personal Information to comply with applicable laws and rules (including anti-money laundering ("AML"), bookkeeping laws and rules issued by our designated banks and relevant card networks, and know-your-customer ("KYC")), enforce our agreements with you and other people who use our Services, and establish, and exercise or defend a legal claim or collection procedure. We also carry out sanction screening, report to tax authorities, police and other enforcement authorities, supervisory authorities where we are not compelled by applicable laws but where we have a good faith belief that sharing the information is necessary to comply with applicable law. Further, we will conduct financial risk management, such as credit performance and quality, assess product suitability, check your identity, trace and recover debts, prevent criminal activity, fraud and scams, mitigate insurance risks, and support compliance with capital adequacy requirements under applicable law.
• Process information about your contacts. We may use Personal Information in order to make it easy for you to find and connect your contacts, improve payment accuracy and suggest connections with people you may know. By providing us with information about your contacts you certify that you have permission to provide that information to PayPal for the purposes described in this Privacy Statement.
• Create an account connection between your account and a third-party account or platform. We may use Personal Information to connect with a third-party account, such as your social network account to facilitate payment transactions or a financial institution when you link an account to PayPal or link your PayPal account to another financial institution, directly or through the use of an aggregator.
• Send you locally relevant options and for security. If you agree to let us track your precise geolocation, we can customize our Services by personalizing language and content such as providing location-based options, functionality or offers, ads and search results. Even if you don't allow us to track your precise location, we may still use your address to send you location-based options recommended by businesses that are near your address. In addition, we will use precise geolocation to enhance the security of the Sites and Services. We collect precise geolocation data from Users while they are logged into their financial account.
• Personalize your experience and develop product recommendations. We may use Personal Information to provide you offers and rewards, show ads or otherwise personalize your experience, such as using insights from purchases and other behaviors on our and our Partner or Merchant websites or apps to develop recommendations about products, brands, sizes, preferences and styles that we provide to our Partners and Merchants so that they can recommend relevant products to you.
• Remember your preferences. We may remember your preferences for the next time you use the Services, such as which of your payment methods you prefer or whether you choose to receive digital receipts via email or text when you checkout.
• Website cookies and trackers. When you use Services, as well as other third-party sites and services, we might use tracking technologies like cookies. See Our Use of Cookies and Tracking Technologies for more details.

Please note that certain jurisdictions require providing a lawful basis for processing Personal Information. See Our Lawful Basis for Processing Personal Information for more information about our lawful basis for processing Personal Information under the EU and UK General Data Protection Regulation. We apply the same lawful bases for processing under other privacy laws that have equivalent requirements.

We disclose your Personal Information with service providers and third parties, including those participating in the payment network, to help us provide Services, protect our customers from risk and fraud, market our products, and comply with legal obligations. We may use and disclose your Sensitive Personal Information if permitted to carry out legitimate business activities and as allowed by law (e.g., with consent or for certain purposes that do not require offering a right to limit use and disclosure of Sensitive Personal Information).

We may disclose Personal Information with the following categories of service providers:

• Service providers. We may disclose Personal Information with our service providers that operate at our direction and on our behalf to perform services we outsource to them, such as AI providers, fraud prevention, bill collection, shipping, processing payments, marketing, research, compliance, audits, corporate governance, communications, technical and/or design services, IT development, maintenance, hosting and support customer service operations. Our contracts dictate that these service providers only use your information in connection with the services they perform for us and not for their own benefit. Under applicable data protection laws, depending upon the country/region in which you reside, you may find a link to those third-party service providers including the purpose of disclosure, types of information disclosed, etc.

We may also disclose Personal Information with the following categories of third parties:

• Members of the PayPal corporate group from time to time, such as the PayPal family of companies listed in Our Contact Information, for purposes including (but not limited to) providing the Services you have requested or authorized, managing risk, helping us to detect and prevent potentially illegal and fraudulent acts and other violations of our policies and agreements, and helping us to manage the availability and connectivity of PayPal products, services, and communications.
• Excluded Services. We may disclose Personal Information to the Excluded Services (as defined below), including Venmo to provide you with the Services, personalize your use of the Services, and to manage our business, or with PayPal Honey to manage our Rewards program.
• Authorities. We may disclose Personal Information with authorities if compelled by a subpoena, court order, or similar legal procedure, when necessary to comply with law, or where the disclosure of Personal Information is reasonably necessary to prevent physical harm or financial loss, report suspected illegal activity, or investigate violations of the relevant agreement, or as otherwise required by law. Such authorities include courts, governments, law enforcement, and regulators. We may also be required to provide other third parties information about your use of our Services, for example, to comply with card association rules, to investigate or enforce violations of our user agreement, or to prevent physical harm or illegal activity. In some cases, PayPal may not be permitted to provide you with information about such disclosures.
• Other financial institutions. We may disclose Personal Information with financial institutions to jointly offer a product, such as PayPal Credit, PayPal Savings, PayPal Cashback Mastercard and PayPal Extra Mastercard.
• Payment networks and processors. We may disclose Personal Information with payment networks and processors to facilitate payment processing or to add cards to your electronic wallet. For payment transactions, your Personal Information will be shared with the provider of the payment services for the participating Partner and Merchant to enable the processing of the payment transaction. The payment provider for the Partner and Merchant may be PayPal or a third party payment provider.
• Fraud prevention and identity verification agencies. We may disclose Personal Information with fraud prevention and identity verification agencies and other companies across industries to assist in detecting activities suggestive of fraud.
• Credit reporting and debt collection agencies. We may disclose Personal Information with such agencies to collect unpaid overdue debts through a third party such as a debt collection agency. Please be aware that these parties' privacy notices apply to the processing of Personal Information that you share directly with them, and they may report your unpaid debts to CRAs which may affect your creditworthiness or ability to secure future credit.
• Other PayPal account holders to complete a transaction. We may disclose Personal Information with other PayPal account holders to complete a payment transaction, where necessary. This also applies when you interact with ads or offers we provide relating to one of our Partners and Merchants. The Personal Information that may be shared with other PayPal account holders includes your username, profile photo, first and last name, email, city, and phone number in accordance with your account settings.
• Other Users in accordance with your account settings. In accordance with your account settings or PayPal.Me preferences, your Personal Information can be seen by other account holders (such as users of Venmo or third party payment networks and processors) to help facilitate a transaction. For example, as part of the send money feature, a User may search for your account to initiate a payment. Based on your account settings, the information shown to other Users may include your username, profile photo, first and last name, email, phone number, city and state, month and year of PayPal account creation, and any additional information you include in the details or "about you" section of your account.
• Other Users if you have a business profile. If you have a business profile, we will display a payment link and disclose certain information about you to other Users, including your name or business name, profile picture or logo, and the city associated with your PayPal account, as well as total time selling with us, total number of followers, and total number of unique Users that have paid you in the past year. If you have a business profile, you can choose to display other information to other Users, such as your street address, phone number, email and website, in accordance with your business profile settings.
• Your agent or legal representative. We may disclose Personal Information to your agent or legal representative, such as the holder of a power of attorney that you grant, or a guardian appointed by you.
• Linked accounts. If you choose to link your PayPal account with a third-party account, we may disclose Personal Information with third-parties who facilitate that linking.
• Partners and Merchants, their service providers and others involved in a transaction. We may disclose Personal Information with these parties involved in a transaction such as your user name, address, phone number, email address to enable the purchase and delivery of the goods in the transaction. For example, when you use the Services to initiate online purchases, save your payment information with Fastlane, pay other Users using the Services, pay recipients using Visa+, pay using PayPal World, return goods, or when you participate in transactions through the payment network, we may disclose information about you and your account or Fastlane profile with the other parties (or their service providers) involved in processing your transactions. If you choose to interact with participating Partners and Merchants, we will disclose your profile information with the participating Partners and Merchants and their service providers, and facilitate your transaction, shopping experience or other interaction with participating Partners and Merchants sites. This also applies when you interact with ads or offers we provide relating to one of our Partners and Merchants. Please note that once Personal Information is shared with Partners and Merchants (or their service providers) involved in a transaction, the handling of your Personal Information by the Partners and Merchants (or their service provider) is subject to the Partners' and Merchants' own privacy policies and procedures.
• We may also disclose Personal Information to Partners and Merchants to enable their use of our Services to facilitate your transactions. For example, when you visit a participating Partners and Merchants site or app, the Partners and Merchants can check whether you are a user of PayPal services and present a recommended payment method to you to simplify your checkout process.

For our PayPal customers, we may also disclose your Personal Information to Partners and Merchants that you and we interact with to help ourselves and Partners and Merchants personalize services and offers so you can have a better and more relevant experience. Personal Information we disclose includes, for example, products, sizes, preferences, and styles we think you'll like.

• Unless we are required by law to obtain your consent, we disclose Personal Information collected from you after November 27, 2024 (or from earlier if you consent) for personalized shopping experiences in the United States.
• To opt-out of disclosures of Personal Information to Partners and Merchants for personalized shopping experiences, log into your PayPal account and edit your preferences in the Data and Privacy setting.
• If you opt-out, we will continue to disclose your Personal Information as necessary to complete transactions you initiate but will not disclose Personal Information to Partners and Merchant for personalized shopping experiences.
• Other third parties. We may disclose Personal Information with other third parties. For example, we disclose Personal Information to advertising platforms, at your direction. We also disclose Personal Information to security service providers to help prevent unauthorized access to our Services. This further applies to parties we cooperate with for marketing purposes, in particular to show you ads and offers tailored to your interests. Please be aware that these parties' privacy notice applies to the Personal Information that you share directly with them. For example, we use Google's reCAPTCHA to prevent misuse of our Services, when you access our mobile application. We may also use Google Address Autofill to ensure accuracy of your address. Google's Privacy Policy and Terms of Use apply to the Personal Information you share with them. For marketing purposes, we may use third parties to identify and display ads on our Services tailored to your interests and track interactions with these ads. Your interactions with such ads are governed by their Privacy Policy.
• Buyers in connection with business transfer. We may disclose Personal Information with a buyer in connection with a business transfer. For example, if we are involved in a merger, a purchase, or a sale of all or part of our business or assets, including receivables and debts, we may disclose, under appropriate data protection terms, your Personal Information to an interested or actual buyer of those business or assets. If PayPal or a significant portion of PayPal's assets are acquired by a third party, Personal Information may also be disclosed to that third party.

We may disclose your Sensitive Personal Information as appropriate to carry out legitimate business activities, as you have consented to or as allowed by law. Please also see "Sale" and "Sharing" of Personal Information for additional information for individuals in the United States.

We retain Personal Information for as long as needed or is permitted in context of the purpose for which it was collected and consistent with applicable law.

The criteria used to determine our retention period is as follows:

Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end, unless we need to keep it longer to the extent permitted by applicable law, such as:

• When consistent with a legal obligation to which we are subject, or when permitted under applicable law, such as under applicable bankruptcy laws and AML obligations.
• In connection with litigation, investigations, audit and compliance practices, or to protect against legal claims.
• We retain Personal Information for the least amount of time necessary where retention is advisable in light of litigation, investigations, audit and compliance practices, or to protect against legal claims.

We retain biometric data for as long as needed or permitted given the purpose for which it was collected and no more than 3 years after your account closes, unless otherwise required by applicable law.

We may process your Personal Information using AI and/or Automated Decision Making technology under the circumstances described below:

• Automated Decision Making. PayPal uses Automated Decision Making technology to make assessments or decisions, including related to risk, fraud and creditworthiness, where permitted and in accordance with applicable law. Our Automated Decision Making technology may use profiling techniques to evaluate personal aspects about you, including to analyze or predict your economic situation, reliability and/or behavior. This enables us to assess, for example, whether you display traits indicating possible credit or financial risk, money laundering or fraudulent activity, that are inconsistent with any submissions you have made to us, or that suggest you have hidden your real identity. In making an Automated Decision, PayPal may process Users’ Personal Information. If we determine that you pose a credit, fraud, money laundering or other risk, we may refuse to provide new services to you, stop providing services you currently use, or place limits or restrictions on the services you use. Users may exercise rights related to Automated Decision Making, as described in Your Data Protection Rights.
• Agentic AI. PayPal is committed to offering innovative and personalized experiences, and we may, directly or through our trusted partners, provide you with access to Agentic AI tools (“Agentic AI Tools”). These AI tools are designed to operate with a degree of autonomy, enabling them to perform tasks, make recommendations, and even initiate actions on your behalf, all while learning from your interactions. Agentic AI Tools leverage generative AI technology to enhance your experience on the PayPal platform.

We encourage you to carefully consider the recommendations and actions of Agentic AI Tools. Our Agentic AI Tools are not designed to make decisions that have legal or similarly significant effects, such as decisions with legal, medical, financial, or employment implications, and you must not use (or attempt to use) them for any such purpose. These tools are intended only to provide general assistance and insights, and you should not rely on them to replace your own judgement and expertise.

Agentic AI Tools require access to certain information to function effectively. When you use these tools, they will have access to your Personal Information, including queries, preferences, interests, purchase history, and payment information.

This section provides additional information regarding PayPal’s prior 12-month Personal Information processing activities under the CCPA. In the preceding 12 months, we have collected the categories of Personal Information set forth in the table below. For details about the precise data points we collect and the categories of sources of such collection, please see Categories of Personal Information We Collect. In the preceding 12 months, we have disclosed the following categories of Personal Information for business purposes to the following categories of third parties, which we describe in greater detail in How We Use Personal Information and When and How We Share Personal Information With Others.

PayPal does not “sell” Personal Information or “share” Personal Information for cross-context behavioral or targeted advertising that is subject to non-exempt practices under comprehensive privacy laws in the United States, including for children under the age of 16, and has not done so in the prior 12 months. Some Personal Information collected, processed, or disclosed by a financial institution are subject to federal laws, such as the Gramm-Leach-Bliley Act. Please see Notice for Consumers of Financial Products and Services below for more information about your rights under United States federal law.

PayPal provides its metrics required under the CCPA relating to how it handled privacy rights requests.

The following Notice for Consumers of Financial Products and Services does not apply to Unbranded Payment Services. Please note, the definition of "personal information" for this portion of the Privacy Statement has the meaning given to it by the Gramm-Leach-Bliley Act.

The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you reside, which can be found in Our Contact Information.

When we transfer Personal Information of EU residents within PayPal subsidiaries and affiliated companies, we rely on our Binding Corporate Rules, which have been approved by competent Supervisory Authorities.

For any other transfer of Personal Information to a country outside of the UK (for UK residents) or the EEA (for EEA residents) we will ensure that any such transfers are compliant with EU and UK data protection law, as applicable.

In practice, this means that we will only transfer your Personal Information to a non-EEA or non-UK recipient where: (i) the recipient is located in a country that the European Commission has decided is adequate to receive Personal Information from the EEA or the UK Secretary of State has decided is adequate to receive Personal Information from the UK (as applicable); (ii) the recipient has signed appropriate contractual terms with us that incorporate the European Commission’s Standard Contractual Clauses or the UK Information Commissioner’s International Data Transfer Agreement or International Data Transfer Addendum (as applicable); or (iii) a data transfer derogation applies (for example, where you have consented to the transfer of your personal information).

Individuals located in the UK and EEA benefit from the following rights, which are further illustrated in Your Data Protection Rights:

• The right to be informed about the collection and use of your Personal Information;
• The right to access and request copies of your Personal Information;
• The right to correct your Personal Information;
• The right, in certain circumstances, to erase your Personal Information;
• The right to object to processing of your Personal Information in certain circumstances where we process your Personal Information for tasks carried out in the public interest, in the exercise of an official authority, for our legitimate interests, for scientific or historical research, or statistical purposes, or for direct marketing purposes;
• The right to withdraw your consent to the Processing of your Personal Information, including through opting-out of marketing communications, though without affecting the lawfulness of processing of your Personal Information based on consent before its withdrawal, nor will it affect processing of your Personal Information conducted in reliance on a lawful processing ground other than consent. If we use your Personal Information for direct marketing, you can always modify your permissions, object and opt out of future direct marketing messages using the unsubscribe link in electronic communications or through your account settings;
• The right to have automated decisions reviewed and to be informed of the existence of any Automated Decision Making, including any Profiling, and the logic involved, significance of and the envisaged consequences of any such processing;
• The right to restrict our processing of your Personal Information in certain circumstances;
• The right to data portability of your Personal Information by automated means in certain circumstances where we process your Personal Information based on consent, for performance of a contract or where the processing is required to assist you into entering into a contract.

In addition, you have the right to complain to your local Supervisory Authority about our use of your Personal Information.

In EEA, you may lodge a complaint with our lead supervisory authority for data protection, Luxemburg National Commission for Data Protection (CNPD) by post at Commission Nationale pour la Protection des Donnees, Service des plaints, 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg.

In the UK, you may also lodge a complaint with your local data protection authority, which is the Information Commissioner’s Office: website: https://ico.org.uk/, address: ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL.

However, while you are not required to do so, we ask that you contact us first to give us the opportunity to address your concerns directly before speaking with your Supervisory Authority.

The list of CRAs used in the UK and EEA, including identities of the CRAs used in each relevant country, and a link to their privacy notice from which you can determine the ways in which they use and share Personal Information, including how long they will retain such Personal Information. You can contact the CRAs operating in the country in which you live directly if you have any questions regarding their services, your credit score or the information they have stored about you, or if you wish to exercise your data subject rights towards them.

In general, the Luxembourg laws to which PayPal's handling of user Personal Information is subject (data protection and bank secrecy) require a higher degree of transparency than most other EU laws. This is why, unlike the vast majority of providers of internet-based services or financial services in the EU, PayPal has listed in this Privacy Statement the third party service providers and business partners to whom we may disclose your Personal Information, together with the purpose of disclosure and type of information disclosed. You can review those third parties. By accepting this Privacy Statement and maintaining an account with PayPal, you expressly agree to the transfer of your Personal Information to those third parties for the purposes listed.

PayPal may update the list of third parties referred to above on the first business day of every quarter (January, April, July and October). PayPal will only start transferring any Personal Information to any of the new entities or for the new purposes or Personal Information types indicated in each update after 30 days from the date when that list is made public through this Privacy Statement. You should review the list each quarter on the PayPal website on the dates stated above. If you do not object to the new Personal Information disclosure, within 30 days after the publication of the updated list of third parties, you are deemed to have accepted the changes to the list and to this Privacy Statement. If you do not agree with the changes, you may close your account and stop using our services.
In order to provide the PayPal Services, certain of the information we collect (as set out in this Privacy Statement) may be required to be transferred to other PayPal related companies or other entities, including those referred to in this section in their capacity as payment providers, payment processors or account holders (or similar capacities). You acknowledge that according to their local legislation, such entities may be subject to laws, regulations, inquiries, investigations, or orders which may require the disclosure of information to the relevant authorities of the relevant country. Your use of the PayPal Services constitutes your consent to our transfer of such information to provide you the PayPal Services.

Specifically, you agree to and direct PayPal to do any and all of the following with your information:

1. Disclose necessary information to: the police and other law enforcement agencies; security forces; competent governmental, intergovernmental or supranational bodies; competent agencies, departments, regulatory authorities, self-regulatory authorities or organisations (including, without limitation, the Agencies referenced in the "Agencies" section of the Third Party Provider List and other third parties, including PayPal Group companies, that (i) we are legally compelled and permitted to comply with, including but without limitation the Luxembourg laws of 24 July 2015 on the US Foreign Account Tax Compliance Act ("FATCA Law") and 18 December 2015 on the OECD common reporting standard ("CRS Law"); (ii) we have reason to believe it is appropriate for us to cooperate with in investigations of fraud or other illegal activity or potential illegal activity, or (iii) to conduct investigations of violations of our User Agreement (including without limitation, your funding source or credit or debit card provider).

If you are covered by the FATCA or CRS Law, we are required to give you notice of the information about you that we may transfer to various authorities. Please read more about PayPal's obligations under the FATCA and CRS Law and how they could affect you as well as take note of the information we may disclose as result.
We and other organisations, including parties that accept PayPal, may also share, access and use (including from other countries) necessary information (including, without limitation the information recorded by fraud prevention agencies) to help us and them assess and to manage risk (including, without limitation, to prevent fraud, money laundering and terrorist financing). Please contact us if you want to receive further details of the relevant fraud prevention agencies. Review more information on these Agencies, fraud prevention agencies and other third parties.

2. Disclose Account Information to intellectual property right owners if under the applicable national law of an EU member state they have a claim against PayPal for an out-of-court information disclosure due to an infringement of their intellectual property rights for which PayPal Services have been used (for example, but without limitation, Sec. 19, para 2, sub-section 3 of the German Trademark Act or Sec. 101, para 2, sub-section 3 of the German Copyright Act).
3. Disclose necessary information in response to the requirements of the credit card associations or a civil or criminal legal process.
4. Disclose your name and PayPal link in the PayPal user directory. Your details will be confirmed to other PayPal users in response to a user searching using your name, email address or telephone number, or part of these details. This is to ensure people make payments to the correct user. This feature can be turned off in the PayPal profile settings.
5. If you as a merchant use a third party to access or integrate PayPal, we may disclose to any such partner necessary information for the purpose of facilitating and maintaining such an arrangement (including, without limitation, the status of your PayPal integration, whether you have an active PayPal account and whether you may already be working with a different PayPal integration partner).
6. Disclose necessary information to the payment processors, auditors, customer services providers, credit reference and fraud agencies, financial products providers, commercial partners, marketing and public relations companies, operational services providers, group companies, agencies, marketplaces and other third parties. The purpose of this disclosure is to allow us to provide PayPal Services to you. We also set out in the list of third parties, under each " Category", non-exclusive examples of the actual third parties (which may include their assigns and successors) to whom we currently disclose your Account Information or to whom we may consider disclosing your Account Information, together with the purpose of doing so, and the actual information we disclose (except as explicitly stated, these third parties are limited by law or by contract from using the information for secondary purposes beyond the purposes for which the information was shared).
7. Disclose necessary information to your agent or legal representative (such as the holder of a power of attorney that you grant, or a guardian appointed for you).
8. Disclose aggregated statistical data with our business partners or for public relations. For example, we may disclose that a specific percentage of our users live in Manchester. However, this aggregated information is not tied to Personal Information.
9. Share necessary Account Information with unaffiliated third parties for their use for the following purposes:
1. Fraud Prevention and Risk Management: to help prevent fraud or assess and manage risk.
2. Customer Service: for customer service purposes, including to help service your accounts or resolve disputes (e.g., billing or transactional).
3. Shipping: in connection with shipping and related services for purchases made using PayPal.
4. Legal Compliance: to help them comply with anti-money laundering and counter-terrorist financing verification requirements.
5. Service Providers: to enable service providers under contract with us to support our business operations, such as fraud prevention, bill collection, marketing, customer service and technology services. Our contracts dictate that these service providers only use your information in connection with the services they perform for us and not for their own benefit.

In order to provide the PayPal Services, certain of the information we collect (as set out in this Privacy Statement) may be required to be transferred to other PayPal related companies or other entities, including those referred to in this section in their capacity as payment providers, payment processors or account holders (or similar capacities). You acknowledge that according to their local legislation, such entities may be subject to laws, regulations, inquiries, investigations, or orders which may require the disclosure of information to the relevant authorities of the relevant country.

Specifically, you acknowledge that PayPal may do any and all of the following with your information:

1. Disclose necessary information to: the police and other law enforcement agencies; security forces; competent governmental, intergovernmental or supranational bodies; competent agencies, departments, regulatory authorities, self-regulatory authorities or organisations and other third parties, including PayPal Group companies, that (i) we are legally compelled and permitted to comply with, including but without limitation laws implementing the US Foreign Account Tax Compliance Act (“FATCA”) and OECD Common Reporting Standard (“CRS”); (ii) we have reason to believe it is appropriate for us to cooperate with in investigations of fraud or other illegal activity or potential illegal activity, or (iii) to conduct investigations of violations of our User Agreement (including without limitation, your funding source or credit or debit card provider).

If you are covered by FATCA or CRS, we are required to give you notice of the information about you that we may transfer to various authorities.

We and other organisations, including parties that accept PayPal, may also share, access and use (including from other countries) necessary information (including, without limitation the information recorded by fraud prevention agencies) to help us and them assess and to manage risk (including, without limitation, to prevent fraud, money laundering and terrorist financing). Please contact us if you want to receive further details of the relevant fraud prevention agencies.

2. Disclose account Information to intellectual property right owners if under applicable law they have a claim against PayPal for an out-of-court information disclosure due to an infringement of their intellectual property rights for which PayPal Services have been used.
3. Disclose necessary information in response to the requirements of the credit card associations or a civil or criminal legal process.
4. Disclose your name and PayPal link in the PayPal user directory. Your details will be confirmed to other PayPal users in response to a user searching using your name, email address or telephone number, or part of these details. This is to ensure people make payments to the correct user. This feature can be turned off in the PayPal profile settings.
5. If you as a Partner and Merchant use a third party to access or integrate PayPal, we may disclose to any such third party necessary information for the purpose of facilitating and maintaining such an arrangement (including, without limitation, the status of your PayPal integration, whether you have an active PayPal account and whether you may already be working with a different PayPal integration partner).
6. Disclose necessary information to the payment processors, auditors, customer services providers, credit reference and fraud agencies, financial products providers, commercial partners, marketing and public relations companies, operational services providers, group companies, agencies, marketplaces and other third parties listed here. The purpose of this disclosure is to allow us to provide PayPal Services to you. We also set out in the list of third parties, under each "Category", non-exclusive examples of the actual third parties (which may include their assigns and successors) to whom we currently disclose your account information or to whom we may consider disclosing your account information, together with the purpose of doing so, and the actual information we disclose (except as explicitly stated, these third parties are limited by law or by contract from using the information for secondary purposes beyond the purposes for which the information was shared).
7. Disclose necessary information to your agent or legal representative (such as the holder of a power of attorney that you grant, or a guardian appointed for you).
8. Disclose aggregated statistical data with our business partners or for public relations. For example, we may disclose that a specific percentage of our users live in Manchester. However, this aggregated information is not tied to Personal Data.
9. Share necessary account information with unaffiliated third parties (listed here) for their use for the following purposes:
1. Fraud Prevention and Risk Management: to help prevent fraud or assess and manage risk.
2. Customer Service: for customer service purposes, including to help service your accounts or resolve disputes (e.g., billing or transactional).
3. Shipping: in connection with shipping and related services for purchases made using PayPal.
4. Legal Compliance: to help them comply with anti-money laundering and counter-terrorist financing verification requirements.
5. Service Providers: to enable service providers under contract with us to support our business operations, such as fraud prevention, bill collection, marketing, customer service and technology services. Our contracts dictate that these service providers only use your information in connection with the services they perform for us and not for their own benefit.

Status Disclosure

PayPal UK Ltd is authorised and regulated by the Financial Conduct Authority (FCA) as an electronic money institution (firm reference number 994790); in relation to its regulated consumer credit activities (firm reference number 996405); and for the provision of cryptocurrency services (firm reference number 1000741). Some products and services, such as PayPal Working Capital, are not regulated by the FCA and may offer a lower level of protection. Please read product terms for further details. PayPal UK Ltd's company number is 14741686. Its registered office is 76 Upper Ground, London, United Kingdom, SE1 9PZ.

Notwithstanding the data privacy rights set forth under Your Data Protection Rights:

• We recognize the importance of your ability to control use of your Personal Information and provide several ways for you to exercise your rights to access (right to know), rectification (correction or update), deletion (cancellation and erasure), objection (opposition), portability (transferring), and to restrict process in whole or in part (collectively your ARCO Rights).
• If you have an Account you can exercise your ARCO Rights by accessing “Data and Privacy” from Account Settings in the PayPal Website or mobile app, or you can file your request by calling our Customer Services line. We will verify your identity by (i) a security code via text message; (ii) a phone call to the phone number registered in the platform; or (iii) by requesting you to access to your Account.
• If you do not you have an Account (for example, where you use Payment without a PayPal account), you can exercise your ARCO rights for your Payment transactions through calling PayPal customer services line.
• Your duly authorized agent can submit a request on your behalf by contacting our Customer Services line. Please note that we may require additional information for verification.
• We will respond to your request within a term of twenty (20) business days of your last contact.
• The exercise of any one ARCO rights does not prevent you from exercising your other ARCO rights.

If you want to exercise any of your rights relating to your Personal Information in your Fastlane profile, contact us at the number provided in the Our Contact Information section or submit your request from your Fastlane profile management portal. In the event that you need to modify your personal data—such as your email address or phone number—you may do so by exercising your ARCO rights (Access, Rectification, Cancellation, and Opposition). However, due to operational or technical constraints inherent to certain services, it may be necessary to create a new account or user profile in order to implement such changes. In such cases, you will be duly informed, and any newly created account will remain subject to this privacy statement.