List of Third Parties (other than PayPal Customers) with Whom Personal Information May be Shared

Last updated on 1 January 2026

Why does PayPal provide this list?

PayPal's banking licence is issued in Luxembourg. This means that in addition to other European laws, PayPal must comply with Luxembourg Banking Laws, including banking secrecy. PayPal publishes this list as required, to ensure that PayPal customers in the EU, EEA and Switzerland who are covered by the Luxembourg banking laws are informed as to which other companies ('third parties') may receive their data if they request PayPal services.

Why are so many companies listed?

PayPal has a significant number of customers in the EU, EEA and Switzerland that rely on PayPal to process their payments securely and safely. Providing these services efficiently sometimes requires PayPal to use the services provided by other Companies. This list also includes companies used by other members of the PayPal Group, including Hyperwallet, Zettle and Xoom.

Note on outsourced services. Certain third parties and PayPal group companies provide services to PayPal (Europe) S.à r.l. et Cie, S.C.A. (PayPal) in order for PayPal to offer services to you. We may share data with these parties that could include account information such as your personal and/or business details and details of your transactions. These third parties are based in various locations in the European Union (including France, Germany, Ireland, Spain, Netherlands, Bulgaria, Italy, Poland, Cyprus, Sweden, Austria and the United Kingdom), Tunisia, Egypt, El Salvador, the Philippines and the United States.

1. Payment Processors

Party Name and Country	Purpose of Data Sharing	Data Disclosed
First Data Merchant Services LLC (US); First Data Europe Limited (UK); First Data GmbH (EU/EEA)	To allow payment processing, fraud checking and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via First Data Europe Limited and First Data GmbH	Name, address, details of user funding instruments, and details of payment transactions.
Fiserv (Europe) Limited	To allow payment processing, fraud checking and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via First Data	Name, address, details of user funding instruments, and details of payment transactions.
Snowflake Inc (US)	To facilitate the generation of balance details and balance aggregates to drive merchant payouts, reporting, and financial reconciliations.	Name, address, details of payment instruments, and details of payment transactions.
Soft Space Sdn. Bhd. (Malaysia)	To allow payment processing using the Zettle Services and fraud checking.	Details of payment transactions.
Ratepay GmbH, Germany	Processing of open invoice transactions and fraud checking.	Buyer name, DOB, email, phone, address, transaction details, merchant details, proof of shipment, case details for disputes handling.
Barclays Bank Plc (UK), HSBC Bank Plc (UK, Ireland), HSBC Merchant Services LLP (UK), Bank of America N.A. (EMEA, USA), Discover Financial Services (USA), JPMorgan Chase Bank (UK, USA), BNP Paribas (France), Wells Fargo (Ireland, USA), American Express (USA), National Westminster Bank PLC (UK), OmniPay Limited (Ireland), Australia and New Zealand Banking Group Limited (Australia), ANZ National Bank Limited (New Zealand)	To allow payment processing settlement services, and fraud checking.	Name, address, email address, phone number, details of user funding instruments, and details of payment transactions, document identification number.
BNP Paribas (France)	To allow payment processing, fraud checking and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via the BNPP service.	Name, email address, phone number, physical address, IP address, date of birth, PayPal account number, details of user funding instruments and details of payment transactions.
Deutsche Bank AG (Germany, Netherlands, France, Spain)	To allow the processing of direct debits in the SEPA region, and fraud checking.	Name, date of transaction, amount, currency and user's bank account information.
Deutsche India Private Limited; DB Service Centre Ltd. (Ireland); Deutsche Bank AG, London Branch; Deutsche Bank AG, Vienna Branch	Expansion of outsourcing from Deutsche Bank AG, Zurich Branch to Deutsche Bank AG entities abroad and fraud checking.	PayPal (Europe) S.à r.l. et Cie, S.C.A. information.
Royal Bank of Scotland plc (UK)	To allow payment processing, fraud checking, and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via the RBS service.	All account information except details of user financial instruments.
Visa Europe Ltd (UK); Mastercard Europe (Mastercard International Incorporated, USA)	To share risk and fraud information in the mandatory credit card company's database regarding the conduct of a merchant's account.	All account details of merchant account, and circumstances and conduct of the account.
Global Payments UK LLP (UK)	To allow payment processing, fraud checking and dispute handling.	Name, address, details of user funding instruments and details of payment transactions.
WorldPay Limited (UK), Worldpay AP Limited (UK), Worldpay (The Netherlands)	To allow payment processing, fraud checking and dispute handling.	All account information except details of user financial instruments.
JPMorgan Chase Bank, N.A. London Branch	Anti-money laundering, sanctions list checking, compliance checks, and fraud checking.	Name of merchant, country of domicile, and business activity.
Adyen B.V. (Netherlands), Coinbase Inc. (USA), WorldPay, Inc. (USA), WorldPay Limited (UK)	To allow payment processing, settlement services, and fraud checking globally.	Name, address, details of payment instruments, and details of payment transactions.
Allied Irish Bank PLC (UK)	To allow payment processing, fraud checking, and settlement services in Europe.	Name, address, details of payment instruments, and details of payment transactions.
Heartland Payment Systems, Inc. (USA)	To allow payment processing, fraud checking, and settlement services in the United States.	Name, address, details of payment instruments, and details of payment transactions.
Moneris Solutions Corporation (Canada)	To allow payment processing, fraud checking, and settlement services in Canada.	Name, address, details of payment instruments, and details of payment transactions.
National Australia Bank Ltd. (Australia)	To allow payment processing, fraud checking, and settlement services in Australia.	Name, address, details of payment instruments, and details of payment transactions.
Network Merchants, LLC / Network Merchants Inc. (USA)	To allow payment processing, fraud checking, and settlement services in the United States.	Name, address, details of payment instruments, and details of payment transactions.
PPRO	To allow payment processing, fraud checking, and settlement services in Europe.	Name, address, details of payment instruments, and details of payment transactions.
TSYS (UK), TSYS (Germany)	System of record for the revolving credit line (UK) and instalment product (Germany) and fraud checking.	Customer name, date of birth, home address, email address, telephone numbers, income.
Currence (Netherlands)	To allow payment processing settlement services, and fraud checking.	Name, address, details of user funding instruments, and details of payment transactions.
Scotiabank (Canada)	To allow payment processing settlement services, and fraud checking.	Name, address, phone number, email address, account number, date of birth, national identity number and purpose of transaction.
Klarna (SE)	To enable services for payment processing and fraud control.	Name, address, social security number, IP number.
Various Latin American, African and Asian banks and financial institutions (multiple countries incl. CHL, DOM, PAK, SLV, GTM, HND, COL, PER, ECU, NIC, PHL, BRA, CO, MEX, IDN, BOL, URY, NGA, JAM, BGD, LKA, SOM and others)	To allow payment processing settlement services, and fraud checking.	Name, address, details of user funding instruments, and details of payment transactions.
Bank of Montreal (Canada), Citibank (US), D-Local (UK), Danske Bank (Denmark), Earthport PLC (UK), Fidor Bank AG (Germany), FIS (US), Meta Payment Systems (US), Moneygram (US), Valitor (Iceland), Western Union (US), Western Union Business Solutions (US), Skandinaviska Enskilda Banken (Sweden), Adyen B.V. (Sweden), Elavon Financial Services Limited (UK Branch)	To allow payment processing settlement services, and fraud checking.	Name, address, details of user funding instruments, and details of payment transactions.
Stripe (US)	To administer orders and/or purchases and perform fraud checking.	Name, email and card details (last four digits only, expiry and card type).
Modulr Finance Ltd (UK)	To allow payment processing and fraud checking.	Name, account number, sort code.
PPRO Financial Ltd (UK)	To allow payment processing and fraud checking for local payment methods.	Merchant name, account details and information, such as date of birth, address, phone number, tax ID, national identity number, place of birth, website, email address, registration number, ultimate beneficial owners, identity document information.
Standard Chartered Bank Ltd (USA, UK, Europe and Australia)	To allow payment processing, settlement services, and fraud checking.	Name, address, details of payment instruments, and details of payment transactions.

2. Credit Reference and Fraud Agencies

Note: In addition to the stated purposes below, PayPal uses your personal information to detect, prevent, and/or remediate fraud or other illegal actions, or to detect, prevent or remediate violations of policies or applicable user agreements.

Party Name and Jurisdiction	Purpose	Data Disclosed
Pipl Inc (FR, IT, ES, DE)	Assessment of fraud risk.	Name, address, email, phone and IP address.
FaceTec Inc (US), Persona Identities, Inc. (US), Idemia Identity & Security USA LLC	To verify identity; comparison of customer selfie with document image; Training of document recognition.	Name, address, date of birth, documents proving identity and address, images of customer from identity document and selfie image (where supplied).
Paravision Inc (US)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering; automatic data extraction from images of documents, comparison of customer selfie with document image and document validation / forgery detection.	Images of customer from identity document and selfie image (where supplied).
Socure, Inc. (US)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering; automatic data extraction from images of documents, comparison of customer selfie with document image and document validation / forgery detection. Training of document recognition.	Name, address, telephone number, email address, date of birth, IP address, legal form, company registration number, VAT number, shipping information, images of documents, Tax ID, identity documents and selfie image (where supplied).
Explorium Inc. (USA)	Business and Consumer Identity.	Name/Business name, address, email, phone number.
CRIF S.p.A (Italy), Synectics Solutions Limited (UK), Capita Plc (UK), UK Data Limited (UK), ICC Information Limited (UK), Payment Trust Limited (UK), 192.com (UK), Experian Bureau de Credito SA (Spain), CRIBIS D&B S.r.l. (Italy), La Banque de France (France), Black Tiger Belgium NV/SA (BE), Asiakastieto (FI), Central de Información de Riesgos del Banco de España (Spain)	To verify identity, verify linkage between a customer and its bank account or credit/debit card, assist in making decisions concerning a customer's credit worthiness, carry out checks for the prevention and detection of crime including fraud and/or money laundering, assist in debt recovery, manage PayPal accounts and undertake statistical analysis.	Name, address, telephone number, email address, date of birth, length of time at address, proof of identity, legal form, company registration number, VAT number, unique business identifier reference, funding instrument details and relevant transaction information, credit account repayment information, and tax ID or national identity number (if appropriate).
TransUnion International UK Limited (UK), Experian Limited (UK), Equifax Ltd (UK), Dun & Bradstreet Limited (UK), Equifax Ibérica S.L. (Spain), Transunion LLC	To verify identity, verify linkage between a customer and its bank account or credit/debit card, make decisions concerning a customer's credit worthiness, carry out checks for the prevention and detection of crime including fraud and/or money laundering, assist in debt recovery, manage PayPal accounts and undertake statistical analysis.	Customer name, address, telephone number, name of authorised user, email address, national identity number (if appropriate), date of birth, length of time at address, proof of identity, legal form, length of time in business, company registration number, VAT number, funding instrument including bank account and credit/debit card details, account number, relevant transaction information, account balance.
CRIF GmbH (Germany), Informa Solutions GmbH (Germany / Austria)	To verify identity, address, linkage between a customer and its bank account or credit/debit card. To assist in making decisions concerning the credit worthiness of consumers and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth, telephone number, email address, account status, account balance, length of time at address, proof of identity, place of birth, funding instrument details, credit account repayment information, tax ID or national identity number.
SCHUFA Holding AG (Germany)	To verify identity and address, carry out checks for the prevention and detection of failing direct debit payments, checks on the linkage of the customer and bank account, and to determine creditworthiness. To detect criminal activity including fraud and/or money laundering.	Name, address, email address, date of birth, gender, bank account details (including IBAN and BIC), information on failed direct debit payments, information on negative account performance.
Verband der Vereine Creditreform e.V. (Germany)	To determine creditworthiness of customers and merchants. To carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name (including trading as names), address, email address, telephone number, unique business identifier reference.
RSA Security Inc. (USA) and RSA Security Ireland Limited (Ireland)	To verify identity.	All account information.
Creditinfo Decision (Czech Republic)	To assist with PayPal's assessment of merchant risk.	All merchant account information.
TeleSign Corporation (USA, BE)	Telephony based authentication service. To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, phone number, email address.
AZ Direct GmbH (Germany)	To validate and re-structure address data into normalised format and to verify name and address.	Name, address, email address.
Au10tix Limited (Israel)	To verify identity; automatic data extraction from images of documents, comparison of customer selfie with document image and document validation / forgery detection. Training of document recognition.	Name, address, email address, date of birth, legal form, company registration number, VAT number, shipping information, documents proving identity and address, Tax ID, identity documents (if supplied), selfie image (where supplied).
Syniverse Technologies, LLC (USA)	Validate and apply data quality checks to telephone numbers. To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, email address, telephone number.
Signicat AS (Norway)	To verify and authenticate identity.	Name, address, date of birth and ID number.
Fraudscreen Ltd (UK)	To evaluate level of fraud risk.	Name and address, Customer ID, Date of Birth, Address, Postcode, E-mail address, Telephone numbers, all account details and circumstances of the conduct of the account, relevant transaction information, decisioning information.
MaxMind, Inc. (USA)	To detect fraud.	All account information and IP address, credit card information.
Artefacts Solutions LLC (USA)	To detect fraud and mitigate risk related to transaction processing.	Truncated card number, amount of transaction, chargeback ratio, credit ratio, and decline ratio.
Experian Information Solutions, Inc. (USA, DK, NO, NL)	To verify identity, assist in making decisions concerning a customer's credit worthiness, carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, social security number, date of birth, business name, legal name of business, tax ID, business telephone number.
Trulioo Information Services, Inc. (USA)	To verify identity, carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, date of birth, address, phone number, tax ID, national identity number, place of birth, identity document information.
Aire Labs Limited (UK), Creditsafe group companies (UK, USA, Germany, France, Sweden, Ireland), Imagini Europe Limited (trading as VisualDNA) (UK), Bureau Van Dijk Electronic Publishing Ltd (UK), Xero (UK), Ethoca Limited (Canada), Xero Inc. (USA)	To verify identity, verify linkage between a customer and its bank account or credit/debit card, to make decisions concerning a customer's credit worthiness. To carry out risk assessment – checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, telephone number, email address, date of birth, place of birth, tax ID, passport ID, or other government issued identification number. Proof of identity, legal form, length of time in business, company name including "doing business as" or "trading as" names, company address, company tax or other government ID, company owners, controlling managers and beneficial owners.
LexisNexis Risk Solutions FL Inc. (USA), LexisNexis (USA), LexisNexis Risk Solutions UK Limited (UK), LexisNexis Risk Solutions (USA)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering; to assist with customer authentication.	Name, address and date of birth and telephone number. Photo of customer and document images including all information they contain. Tax ID, national identity number, place of birth, identity document information.
SmartKYC Ltd (UK)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address and date of birth.
Dun & Bradstreet Limited (UK), Dun & Bradstreet, Inc. (USA)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth and telephone number.
Refinitiv US LLC (USA)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth and telephone number. Tax ID, national identity number, place of birth, identity document information.
CRIF GmbH (Austria), CRIF Ltd (Switzerland), CRIF AG (Switzerland), CRIF SO. Z O.O (Poland)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth and telephone number.
UPC BVK (Belgium)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth and telephone number.
Royal Mail Group Ltd (UK)	To validate and re-structure address data into normalised format and to verify name and address.	Name, address, email address, telephone numbers.
Credit Kudos Limited (UK)	To evaluate level of fraud risk and credit risk, verification of income and expenditure.	Name and address, Customer ID, Date of Birth, Postcode, E-mail address, Telephone numbers, all account details and circumstances of the conduct of the account, relevant transaction information, decisioning information.
Bisnode Finland Oy (Finland), B&C Technologies (France), Deltavista International AG (Switzerland)	To verify identity, assist in making decisions concerning a customer's credit worthiness, carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth, telephone number.
KAPITOL S.A./NV (Belgium), Orange Espagne S.A.U, SDS (Holland)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address and telephone number.
Precision Marketing Information Ltd. (Ireland)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name and address.
Infocore, Inc. (USA)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address and date of birth.
Neustar Inc. (USA)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering; To establish the most appropriate time to make collections calls to customers.	Name, Address, Telephone Number, Email Address, IP Address and Document Identification Number.
SK ID Solutions AS (Estonia), D-Trust GmbH (DE), Yes.com (DE), Electronic Identification S.L. (Spain)	To enable verification of identity.	Name, address, date of birth, SSN/National Identity Number.
Bouygues Telecom (FR), Orange Espagne SAU (ES), JT (Jersey) Limited (Jersey), Voxbone (Belgium)	To validate phone information for fraud prevention purposes as well as outbound customer contact (phone and SMS).	Name, address, date of birth, mobile device IMEI number and phone number.
Jersey Telecom (Jersey)	To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, date of birth, address, mobile device IMEI number, telephone number, email address, IP Address, tax ID, national identity number, place of birth, identity document information.
DNB ID Solutions AS (Norway)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Identity document information, including electronic information held on chip enabled Passports (if supplied by customer).
Veriff OU (EE)	To authenticate images of identity documents; document recognition; comparison of customer selfie with document image; testing of authentication features; validation of funding instruments; capture data. Training of document recognition.	Name, address, date of birth, identity documents, proof of address images, Tax ID or other documents requested by PayPal. Images of customer from identity document and selfie image (where supplied).
Ekata (US)	Identity Verification, Authentication, Fraud Prevention.	Name, address, email address, date of birth, legal form, company registration number, IP Address, VAT number, shipping information, documents proving identity and address.
Finnish Transport and Communications Agency (Finland), The Finnish Digital Population Data Services Agency (Finland)	To verify identity.	Name, address, date of birth and ID Number.

3. Financial Products

Party Name and Jurisdiction	Purpose	Data Disclosed
Central de Información de Riesgos del Banco de España (Spain)	CIRBE is a database including information on loans (direct exposure) and guarantees/collateral (indirect exposure) granted by banks to their customers.	Tax ID, name, address, economic activity, date of birth, country of birth, gender and any other information required by CIRBE for reporting purposes.
Any successor lender of record for loans that have been granted to a customer by PayPal (Europe) S.à r.l. et Cie, S.C.A [Luxembourg]	Where a customer loan or the underlying claim under the customer loan has been assigned to a third party (under specific circumstances including insolvency, regulatory requirement, or default), to allow identity verification; checks for the prevention and detection of crime including money laundering; servicing loans; carrying out debt collection and recovery.	Information collected by PayPal in connection with loans that have been granted, which may include name, address, telephone number, account number, date of birth, email address, account type, account status.
FIS Avantguard LLC (US)	Providing financial analysis, scoring solutions and advisory services.	Name, payment amount, and check number.
La Poste (France)	To resolve technical issues and user claims (when PayPal is being offered by the merchant through La Poste's payment solution).	Any Account information necessary to resolve the issue or claim.
Santander UK Cards Limited (UK)	To conduct joint marketing campaigns for PayPal Credit, and PayPal MasterCard, risk modelling, enforce terms and conditions for PayPal Credit and PayPal MasterCard.	Name, address, email address and account information (including account status).
Société Générale (France), La Banque Postale (France), BNP Paribas (France) and Crédit Mutuel (France)	Billing purposes.	Only for merchants using PayPal through the partner's payment solution: merchant ID, number of PayPal transactions, transaction volume with PayPal and, as the case may be, termination of the PayPal account.
Deloitte Consulting Inc. (USA)	Financial consulting support services.	Customer name or business name, customer or business address, tax payer identification number, email address, telephone number, account number, account balance, account create date, type of legal entity, citizenship status.
Fichier des Incidents de Remboursement des Crédits aux Particuliers (FICP) (France)	To allow for notification of over-indebtedness.	Name and relevant account and credit history information.
Deloitte GmbH Wirtschaftsprüfungsgesellschaft / Deloitte LLP (DE)	Financial consulting support services.	Market and competitor materials, product materials, marketing materials.

4. Commercial Partnerships

Party Name and Jurisdiction	Purpose	Data Disclosed
Shopware AG (Germany)	To allow Shopware to maintain merchant relationships and support payment services (continuity).	Merchant KYC data – Merchant name, account details and information, such as date of birth, address, phone number, tax ID, national identity number, place of birth, website, email address, registration number, ultimate beneficial owners, identity document information.
Rokt Pte. Ltd. (DE & UK)	Provision of a post-purchase offer for users. Data shared with Rokt allows Rokt to personalise and return an offer to display to the end user.	First name, last name, email address used for customer login, user domain, user agent, IP address, language code, zip code, user impressions on offers served, user clicks on offers served.
Thales DIS USA, Inc. (Germany, Ireland, Netherlands)	To allow payment processing.	Payment card and Device Information.
FingerPrint JS Inc (US)	To provide customized services and assistance to Merchants and Consumers using PayPal.	IP address.
XLN Pay Limited (UK)	To support co-marketing, onboarding, customer service.	Business name, first name, last name, email, phone number. Account sign-up status, date of 10th and last transaction, reader order date and status, Zettle card payment volume.
Good Hood GmbH	To allow management of a joint referral program.	Email address.
Royal Mail Group Plc. (UK)	To provide automated label printing for sellers using PayPal to facilitate postal and delivery services.	Name, address, telephone number and email address.
Trustwave (USA / UK)	To provide customised services and assistance to Merchants using PayPal, and to facilitate the process of becoming PCI DSS compliant.	Name, email address and PayPal account number.
Harrow Council (UK)	Pay out funds to benefit recipients using PayPal.	All Account Information.
Borderlinx (UK)	To provide customised services and assistance to business customers using PayPal.	Customer name, business name, telephone numbers, contact email addresses, website, business industry, number of PayPal transactions, transaction volume with PayPal, domestic/international transaction volume split, shipping details, card details for the payment.
WebInterpret (France)	Providing assistance with PayPal services to business customers.	Customer name, business name, telephone numbers, contact email addresses, website, business industry, number of PayPal transactions, transaction volume with PayPal, domestic/international transaction volume split, shipping details, card details for the payment.
Apple Inc. (USA)	To verify identity and carry out checks for the management of risk, prevention and detection of crime including fraud.	First Name, Last Name, Email, Whether email is verified, Telephone number, Address, Account Status, Account Type, When account was opened, Whether customer purchased anything using PayPal within the last 30 days, Whether billing information changed within the last thirty days.
Schenker (SE)	To facilitate shipping and make it easier to ship sold/bought items on the site.	Name, address, e-mail address, phone number.
Sello (SE)	To service larger sellers, enable shop items, enable bulk listing and order management.	Name, address, e-mail address, phone number, alias.
Twilio Inc (US)	To verify customer identity and establish contact via phone, SMS or alternative messaging service.	Name, address, date of birth, mobile device IMEI number, phone number and email address.
ICT Group Inc. (USA)	To perform and facilitate telephone customer support.	Name, address, telephone number, and PayPal account number.
ePerformax Contact Centers & BPO (USA)	To provide customer services regarding payments globally.	Name, address, telephone number, email addresses, truncated and limited or full funding source information (case dependent), funding source expiration dates, type of PayPal account, proof of identity, account balance and transaction information, customer statements and reports, account correspondence, shipping information, and promotional information.
CallPoint New Europe AD dba TELUS International Europe (Bulgaria)	To operate refunded returns service.	Name, email address, PayPal transaction ID, return information (returned item category, reason for return, amount of return, currency, country of return, type of return) and shipping documentation evidence.
Sumologic, Inc. (USA)	To provide analytics allowing us to troubleshoot errors in the service globally.	Log Data and Aggregated data on the service performance.
CCC Leipzig (Germany), CCC GmbH (Germany)	Global Ops Customer service outsourcing for the German market.	Full Name, Date of Birth, Email address, Physical address, Telephone number, Financials (bank, debit, and credit), Transaction history, Business details including URLs, SSN/TIN/EIN, IP Address, Counterparty details.
Telus International Europe	Customer service contact centre to check reasons for inactivity and investigate any technical issues or problems.	Name, telephone number, user type, email address, user technical historical data.
Teleperformance (SE, Germany, Malaysia, Albania, Greece, Portugal, Sweden, Croatia, Kosovo, Austria)	To service our customers' questions through phone, chat and email.	All account information, name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities.
Giesecke+Devrient Mobile Security entities (UK, DE, AT, FR, ES, IT, IR), Thales DIS Deutschland GmbH (DE)	Manufacture and Mailing of Debit Cards.	Name, Shipping Address, Card Number, Expiry Date of the Card, CVV Code, encrypted PIN of the Card.
Notive B.V. (Netherlands)	To facilitate merchant onboarding and transactions.	Name, date of birth, address, email address, IP address, telephone number, device ID.
Facebook Inc (US)	To facilitate payment processing on Facebook for the joint customers of Facebook and PayPal.	Customer name, email address, account and transaction history.
SendGrid Inc (US)	To allow for customer communication for transactional and marketing emails.	Name, email address, loan reference number, company name, broker invoice, broker firm name, bank account number, sort code, commission amount, payment method and last four digits.
Interactions Inc (US)	To send automated customer emails and text messages.	Full name, date of birth, gender, address, phone number, company information.
Impetus Technologies Inc (US)	Resource augmentation for PayPal partners.	Account details.
Infobip (UK)	To enable provision of mobile network code of the MNO associated with the MSISDN provided by Company.	Telephone number.

5. Marketing and Public Relations

Party Name and Jurisdiction	Purpose	Data Disclosed
Acxiom Ltd (UK), Acxiom Deutschland GmbH (Germany), Acxiom France SAS (France)	To research and identify potential marketing opportunities for PayPal; research the market position of PayPal's products from a demographic perspective.	Name, address, telephone number, email address, PayPal account number, date of opening account and gender.
Syzygy	Search engine optimisation to support PayPal marketing teams and provide feedback on web-design and site issues.	Cookie ID, Customer ID, Country, account type, IP address.
Northstar Research Partners (USA)	To conduct customer service surveys.	Name, email address, type of account, type and nature of the PayPal services offered or used, and relevant transaction information.
FactWorks GmbH (Germany), TNS Deutschland GmbH (Germany), The Tryst Market Research Limited (UK), Hall and Partners Europe Ltd. (UK), Hall and Partners LLC (USA)	To conduct customer service and marketing surveys.	Name, email address, telephone number, country of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used.
Forrester Research, Inc. (USA), Forrester Switzerland GmbH / Forrester Research BV (CH)	To conduct customer service and marketing surveys.	Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used.
I + E Research (Germany)	To conduct customer service and marketing surveys.	Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used.
Adwise (France) and Axance (France)	To conduct marketing surveys.	Name, email address, telephone number, type of account, type and nature of the PayPal services offered or used, and relevant transaction information.
Crowd Guru (DE)	To develop and execute customer promotions.	Name, address and email address.
Salesforce.com, Inc. (USA)	To store merchant contact information as well as other supporting information about the business relationship.	Name, address, telephone number and email address, business name, URL, PayPal Account ID and other supporting information about the business relationship.
Edelman group companies (Germany, Austria, Switzerland, Spain, France, Italy, Netherlands, Greece, Ireland, Sweden, Norway, Denmark)	To answer media enquiries regarding customer queries and assist PayPal in social media activities.	Name, address, and all customer account information relevant to customer queries.
Dataprovider B.V (Netherlands)	To obtain marketing and business information for sales and marketing purposes by acquiring and enriching business information and data profiles of new and existing customers.	Request ID, URL, Domain, Company Name.
TNT Post Italia (Italy)	To assist in the execution of offline direct mail and marketing campaigns.	Name, address, email address, business name, domain name, account status, account preferences, type and nature of the PayPal services offered or used.
Datacolor Dialog-Medien GmbH (Germany), W & J Linney Ltd (UK)	To assist in the execution of offline direct mail and marketing campaigns.	Name, email address, address, business name, domain name, account status, account preferences, type and nature of PayPal services offered or used.
Endlichsommer – werbung in bester gesellschaft mbh (Germany) and Crossover Communication GmbH (Germany)	To assist in the execution of offline direct mail and marketing campaigns.	Name, address, business name, type and nature of PayPal services offered or used.
optivo GmbH (Germany)	To send emails; email marketing.	Name of the merchant, name of the contact person, email address, address, status, client ID and shop system.
Rapp (France), Rapp (UK)	To develop, measure and execute marketing campaigns.	Name, business name, address and registration number of merchant/partner, name, job, title, email address, telephone number of merchant's contact person, merchant website URL, PayPal account number, third party applications used by the merchant.
Business support services - b2s, SAS (France)	To store merchants' contact information for marketing communications to those merchants.	Name of the merchant, name of the contact person, address, email address, telephone number, merchant website URL.
BlueKai, Inc. (USA), Adobe Systems Incorporated (USA), Mediamath Inc. (USA)	To execute retargeting campaigns in order to deliver personalised advertising.	Anonymous ID generated by cookies, pixel tags or similar technologies. Encrypted e-mail address associated with PayPal users (without indicating account relationship).
Google Inc., Google Ireland, Ltd. (Ireland), Google (SE), DoubleClick Europe Ltd (UK), Google Asia Pacific Pte. Ltd. (SG)	To execute retargeting campaigns in order to deliver personalised advertising.	Anonymous ID generated by cookies, pixel tags or similar technologies. Advertising ID and Device ID, encrypted e-mail address, Encrypted Customer ID, Encrypted Merchant ID, Transaction Value.
LinkedIn Ireland Unlimited Company (Ireland), LinkedIn Corporation (US), LinkedIn Singapore Pte. Ltd. (SG)	To execute retargeting campaigns in order to deliver personalised advertising.	Business Name, Encrypted e-mail address associated with PayPal users (without indicating account relationship).
StrikeAd UK Ltd. (UK), InMobi (USA), MoPub Inc. (USA), AdMob Inc (USA)	To execute and measure retargeting campaigns in order to segment users for marketing campaigns.	Anonymous cookie ID, Advertising ID, and/or device ID to segment user groups for marketing purposes.
Fiksu, Inc. (USA)	To execute and measure retargeting campaigns in order to segment users for marketing campaigns involving PayPal mobile applications.	Device ID used for Apple's iOS operating system when a user installs an application, signs up for the PayPal Services, logs in, checks in, or sets a profile picture.
Wire Stone LLC (USA)	To select, notify winners and prize fulfilment for winners of survey sweepstakes. To conduct customer service and marketing surveys.	Name, email address, encrypted ID, country/city of residence/business, transaction frequency, recency and volume, type of account, and all information obtained from surveys.
2engage (Germany) and Quo Vadis (Germany)	To conduct market surveys.	Name, company name, address, telephone number, domain name, e-mail address, type and nature of use of PayPal services, market segment and generalised categorisation of company size.
Facebook, Inc (US), Facebook Ireland Limited (Ireland), Twitter, Inc. (US, Ireland), Yahoo, Facebook Business Manager (SE)	To execute retargeting campaigns in order to deliver personalised advertising.	Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with PayPal users (without indicating account relationship), IP Address, Anonymous ID generated by cookies, pixel tags or similar technologies. Mobile advertiser ID, IP Address and other metadata via Facebook SDK in mobile apps.
Dynamic Logic, Inc. (USA), GfK Custom Research LLC (USA), GfK Polonia Sp. z o.o. (Poland), Millward Brown, Inc. (USA)	To conduct customer service and marketing surveys.	Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used, and all information obtained from surveys.
Nanigans, Inc. (USA)	Help identify behaviour in the mobile app in order to guide decision about targeted marketing; to help efficiently handling and optimising mobile campaigns on social networks and elsewhere in the web.	Anonymous cookie ID, Advertising ID, and Device ID used by a specific person, events in the mobile app about the use of the mobile app by a specific user (including login, successful completion of the transaction), but no payment and financial information details.
CallCenterNet Italy s.r.l. (Italy)	To store merchants' contact information for marketing communications to those merchants.	Name of the merchant, name of the contact person, address, email address, telephone number, merchant website URL.
Iris (Germany)	To develop, measure and execute marketing campaigns.	Name, business name, address and registration number of merchant/partner, name, job title, email address, telephone number of merchant's contact person, merchant website URL, PayPal account number, third party applications used by the merchant.
OC&C Strategy Consultants Limited (UK)	To conduct market research and develop insight.	Anonymised account and transaction information.
PaketPLUS Marketing GmbH (Germany)	Managing marketing campaigns, distributing flyers to merchants and follow up of the campaigns.	Consumer name, Location, Nature and scale of fraud on the account, Business name.
Eye square GmbH (Germany)	To conduct customer service and marketing surveys.	Customer service and marketing survey data.
Rakuten (Global)	To execute retargeting campaigns in order to deliver personalised advertising.	Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users.
Unique Digital Marketing Limited (UK), Havas Media (France), Havas Media Limited, Webguerillas GmbH (Germany), Spark Foundry GmbH (Germany)	Online media agencies to buy digital media to advertise PayPal services and products.	Email address, Device IDs.
Affiperf Conversion Tag (Havas Trading Desk) – EMEA	To execute retargeting campaigns in order to deliver personalised advertising.	Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users.
Pandora	To execute retargeting campaigns in order to deliver personalised advertising.	Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users.
FocusVision Worldwide Inc. (USA), Focus Vision Inc (UK)	To conduct customer service and marketing surveys.	Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used.
Hall & Partners Europe Ltd. (UK)	To conduct customer service and marketing surveys.	Name, email address, telephone number, type of account, type and nature of the PayPal services offered or used and relevant transaction information.
Clear Score Technology Ltd. (UK)	To execute targeted campaigns in order to deliver personalised advertising.	Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users.
Adjust GmbH (Germany)	Help identify behaviour in the mobile app in order to guide decision about targeted marketing; to help efficiently handling and optimising mobile campaigns on social networks and elsewhere in the web.	Anonymous cookie ID, Advertising ID, encrypted customer ID, and Device ID used by a specific person, events in the mobile app about the use of the mobile app by a specific user, but no payment and financial information details.
Quiller Consultants (UK)	Support UK Government Relations work.	PayPal marketing materials and product overviews. Occasional merchant case study. All other data shared will be public record e.g. consultation response. No customer or merchant specific data will be shared.
LoopMe Ltd.	To execute and measure retargeting campaigns, to segment users for marketing campaigns, to deliver personalized advertising.	Anonymous cookie IDs, Advertising IDs, Aggregated data on installs, signups, and conversions.
Altares D&B (EMEA), Informa (EMEA), Cerved (EMEA), Cribis D&B (EMEA), Dun & Bradstreet (EMEA)	Marketing and business information for sales purposes, acquire and enrich business info of new and existing clients.	External leads (prospect business information).
Market Bridge (USA)	To segment customers to enable improved servicing.	Account ID, address, post code, account history, growth data including product utilisation and all transaction data.
AdCompass Ltd (UK), Fyber GmbH (Germany)	To execute and measure retargeting campaigns in order to segment users for marketing campaigns.	Anonymous cookie ID, advertising ID, and/or device ID to segment user groups for marketing purposes.
Debby and Ron digital LTD (IL)	Online media agency to buy digital media to advertise PayPal services and products.	These agencies often process anonymous cookie, device IDs, targeting lists, hashed email lists to reach our consumers via media networks.
Adara, Inc (USA), RadiumOne, Inc (USA)	To execute and measure retargeting campaigns in order to segment users for marketing campaigns, deliver personalised advertising.	Anonymous cookie ID generated by cookies, pixel tags or similar technologies, Advertising ID, and/or device ID.
LookBookHQ (Canada)	To deliver services related to LookbookHQ content experience products.	Customer and prospect IP address, customer email address.
Purestone TFM Limited (UK)	To perform customer and prospect interviews and research as input to the creation of marketing communication assets like testimonials and success stories.	Customer business name, contact name, contact telephone number.
Snap Inc. (USA), Spotify AB (Sweden)	To execute retargeting campaigns in order to deliver personalised advertising.	Advertising ID and device ID used by a specific person, install and in-app data based on those IDs.
Mobext (UK)	To execute retargeting campaigns in order to deliver personalised advertising.	Advertising ID and device ID used by a specific person.
Apple Search Ads (USA / UK)	To set up, execute and measure advertising campaigns on Apple Search Ads platform.	Advertising ID and device ID used by a specific person, install and in-app data based on those IDs.
Batch Media GmbH (Germany)	For ad verification and viewability measurement.	Campaign based data (time, campaign information, location, geo information, browser information) as well as javascript readable creative data and IP address.
Qualtrics (U.S.)	Collect user's feedback on paypal.com website to get their satisfaction scores and specific site improvement recommendations, report site issues directly from the site visitors.	IP Address; User Agent; Browser; Device Type; Screen Resolution; Browser Size; Page URL; Page Referrer; Site Referrer; Page count; Time spent on site; Survey status and content filled if completed; Encrypted Cust_ID; Page name.
RadiumOne (US)	To execute and measure user behaviors (signups and transactions) and retargeting campaigns in order to identify visitors and redirect them through personalised advertising campaigns.	Anonymous ID generated by cookies, pixel tags or similar technologies. Advertising ID and Device ID, encrypted e-mail address, Customer ID, Merchant ID, Transaction Value, Transaction ID, loan approval amount.
XING AG (Germany)	To execute retargeting campaigns in order to deliver personalised advertising.	Company names of existing merchants for matching them with the platform's user base.
Wunderman (Germany)	Data analyses and CRM strategy.	Contact and account information including name, address, email, telephone number, customer ID, date of birth, anonymous cookie ID, advertising ID, segmentation group, transaction ID, number of PayPal transactions, transaction frequency, recency and volume, type of account, exposure to marketing materials.
Marketbridge Corporation (US)	To conduct customer service and marketing surveys.	Country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used, and all information obtained from surveys.
Maru Group LLC (US), Comscore (US), Factsworks (US), Meadowlands Consumer Center Inc (US), 360I LLC (US), MMR Research Associates (US)	To conduct customer service and marketing surveys.	Country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used, and all information obtained from surveys.
Various other market research firms (Galileo Kaleidoscope, Statista, Zpo_Ac Nielsen, The Tryst Market Research, Highgate Research, Nepa Ab, Siriusdecisions, Macromill, Wavelengths Consulting, Dialogue Research, Statista GmbH, Sic Em Advertising, KPMG, Tenthwave Digital, Reflect Foretagsutveckling, Market Resonance, Lonergan Research, InSites)	To conduct customer service and marketing surveys.	Country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used, and all information obtained from surveys.
Accuity Inc. (US), Admerasia Inc. (US), Pierry Inc (US), SixthSense Communications LLC (Singapore), Stewardship Marketing Services (US)	Creative strategy and development, including research, creative services, market research, marketing.	As required: name, email address, business name, address, country residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used.
CallRail Inc (US)	To provide marketing services.	Phone and location.
Chili Piper (US)	To provide marketing services.	Name, e-mail, phone and company name.
Zapier (US)	To provide marketing services.	Phone and location.
Scholz & Friends Group GmbH (Germany)	To develop, measure and execute social media marketing campaigns.	Name, business name, address and registration number of merchant/partner, name, job, title, email address, telephone number of merchant's contact person, merchant website URL, PayPal account number, third party applications used by the merchant.
SensorTower, Inc. (USA)	To conduct customer service and marketing surveys.	Country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, type and nature of the PayPal products/services offered or used, and all information obtained from surveys.

6. Operational Services

Party Name and Jurisdiction	Purpose	Data Disclosed
ID5 Technology Limited (DE & UK)	Arranging advertisements with advertising partners outside of PayPal.	Name, email address, operating system (i.e. web, mobile, device info), Audience Segment, IP address.
Smart AdServer SAS (rebranded as Equativ) (UK & DE)	Arranging advertising campaigns outside of PayPal with advertising partners.	Encrypted user IDs provided by other advertising partners like ID5 Technology Limited.
Eyeota Pte Ltd (UK & DE)	Preparation of advertising campaigns outside of PayPal with other advertising partners.	Name, email address, operating system, Audience Segment, IP address.
Semasio GmbH (UK & DE)	Preparation of advertising campaigns outside of PayPal with other advertising partners.	Name, email address, operating system, Audience Segment, IP address.
Zeotap GmbH (UK & DE)	Preparation of advertising campaigns outside of PayPal with other advertising partners.	Name, email address, operating system, Audience Segment, IP address.
Didomi SAS (UK & DE), Consentmanager GmbH (UK & DE), Ketch Kloud, Inc. (UK & DE)	Consent management platform for advertising purposes.	User ID, time stamps, nature of consent, impressions and clicks on consent prompts.
Kantar (DE & UK)	Measurement of advertising campaigns.	User identifier, advert campaign identifier, advert creative identifier, timestamps of adverts.
adjoe GmbH (DE & UK)	Arranging rewards and advertising offers.	Name, email address, operating system, IP address.
LiveRamp Inc (DE & UK)	Creation of unique customer profiles for personalisation of advertisements with advertising partners outside of PayPal.	Account information except details of user financial instruments, device IDs, and Audience Segment.
Pubmatic (DE & UK), Magnite (DE & UK), Celtra (DE & UK)	Orchestration of advertising campaigns outside of PayPal with other advertising partners.	Encrypted user IDs provided by LiveRamp Inc.
Experian (DE & UK)	Provides additional audience fields for advertising personalisation.	Account information except details of user financial instruments.
Adjust (DE & UK), AppsFlyer, Kochava, Nielsen, iSpot, Cint, Upwave, Experian, Inmarket, Affinity Solutions, Circana, Claritas, Google, Adobe, Tealium, Singular, Innovid, SEMRush, EDO, DISQP, VideoAMP, DoubleVerify, Human, IAS, Neustar, Measured, Foursquare (all DE & UK)	Measurement of advertising campaigns.	Advert impression identifier, advert campaign identifier, advert creative identifier, advert placement identifier, user IP address, browser, device operating system, device type, device vendor, timestamps of adverts.
Concentrix CVG Egypt	Provide debt collection services. AWF agents access customer data through Citrix.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of payment method account, branch code, account balance, details of account transactions and liabilities, name of payment method provider, applicable details of account conduct and copies of all correspondence.
Adzerk, Inc. dba Kevel (DE & UK), Onlinesales Inc. OSMOS (DE & UK)	Ad server for PayPal. PayPal creates advertising campaigns with these partners.	PayerID (a unique identifier), Audience Segment, Clickers, Device Type, Mobile Carrier, IP Address, user impressions on ads served, user clicks on ads served.
TRANSFERTO MOBILE FINANCIAL SERVICES LTD.	Transferring data from Hyperwallet to the partner to execute payouts to Payees bank account in South Korea.	Sender/Merchant Information: Business Name, Address, Business Registration Number. Recipient Information: First name, last name, country, bank account number, bank name.
Aftership Inc. (United States, UK, Germany, France, Spain, Italy)	Aftership Inc. supports PayPal's consumer Package tracking feature by parsing order and shipment tracking information from emails and providing live shipping updates.	eCommerce emails from consumer email accounts that contain order and shipment information, Tracking numbers and carrier names.
Octagon, Inc. (London), Mastercard Europe SA (Belgium), UEFA (Switzerland)	Fulfilment of Mastercard Prize Draw for eligible existing PayPal BDMC cardholders in UK and DE.	Email address used for PayPal merchant login, merchant phone number, merchant first and last name.
Transcom Worldwide Tunisie S.A.R.L (Tunisia), Transcom Worldwide S.P.A (Tunisia, Italy)	To service our customers' questions through phone, chat and email.	All account details.
Majorel Polska Spolka Z Ograniczona (Senegal, Poland)	To service our customers' questions through phone, chat and email.	All account details.
ePerformax Centers, Inc. (Philippines)	To service our customers' questions through phone, chat and email.	All account details.
NICE Systems Inc (US)	Provides the recording platform and other services for our call/email/chat customer interactions. These recordings are ingested and stored for compliance purposes, reference, analytics, coaching, and addressing customer issues and claims.	Customer calls are recorded and saved.
Maileva (France)	Management and sending of postal letters to collect a debt.	Customer's first and last names, address, loan details (loan reference number, loan amount, loan payment default amount, date of loan payment default, product type, repayment due date), merchant details, date at which the customer may be reported to the negative file of the French Central Bank (FICP).
Wescot Credit Services (UK), Australian Receivables Limited (AU), CFR Recouvrement (FR)	To collect debt.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider and copies of all correspondence relating to amounts owed.
KSP Kanzlei Dr. Seegers, Dr. Frankenheim Rechtsanwaltsgesellschaft mbH (DE)	To collect debt.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider and copies of correspondence.
People Data Labs (US, UK, CA)	Research PDL's data for Payments models – Optimising transactions and predicting refunds.	Email, username, address, phone.
The ID Co Limited (global) t/a DirectID	Provides bank transactions through AISP licence. Enables connection between consumer/SME bank account and PayPal. Data provided can be used in raw format or via analytics insights for credit risk and throughout the credit lifecycle.	First and last name, bank account name, number and sort code or routing number.
WhatsApp from Meta (United States)	To send one-time passcodes for authentication purposes.	Telephone number.
Sendbird, Inc.	To provide real time chat messaging capabilities.	Name, profile picture and chat message content.
Zoot Enterprises Inc (US), Zoot Enterprises Ltd (UK), Zoot Deutschland GmbH (DE)	Provide data gateway and third-party data integration services to facilitate and enhance the movement of information between PayPal and sources of data used for credit granting, risk management, fraud detection, identity and authentication purposes.	Customer identity data including documents which verify identity and address, account data and contact information, verification of financial details, credit account performance data.
Taxbit Inc (USA)	Taxbit provides crypto-tax calculation services for PayPal and PayPal's customers. They support real-time crypto gains/loss calculations and crypto tax information in our App and Web. They also file crypto tax forms as required to PayPal by the relevant tax authorities.	First and last name, email, crypto transaction data.
Help Scout (USA)	Help Scout provides customer service email support functions to service Honey email enquiries.	Customer service email and enquiry data.
Unbabel	Translation services.	Name, email address.
Rackspace Inc (USA)	To provide hosting and storage services to assist and/or enable PayPal to provide services to customers.	Name, address, and email address.
Riverty Services GmbH (formerly Paigo GmbH), Riverty entities (Netherlands, France, Belgium, Sweden, Norway, Denmark, Finland)	Provide debt collection services. Assist in debt collection, including sending correspondence; and reporting to credit reporting agencies on defaulting clients.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of payment method account, branch code, account balance, details of account transactions and liabilities, name of payment method provider, applicable details of account conduct and copies of all correspondence.
Team 4 Collection and Consulting (Spain), S.C. Fire Credit S.R.L. (Romania)	To assist with debt collection processes, including sending of correspondence; and reporting to credit reference agencies about defaulting customers.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider, applicable details of account behaviour and copies of all correspondence.
Comas Srl (Italy), RBS RoeverBroennerSusat GmbH & Co. KG (Germany), TDX Group Limited (UK)	To investigate and/or collect debt from potentially and actually insolvent customers.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider and copies of all correspondence.
Webbank (USA)	Only for customers who are also customers of Bill Me Later, Inc.: to help with accounting and recovery services.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, and name of funding source provider.
Research in Motion Limited (USA)	To enable you to access and use PayPal via a mobile device.	Applicable details of your account information which are transmitted as part of your use of PayPal via a mobile device.
Informa Solutions GmbH (Germany)	To request and proceed information from and to Schufa, Buergel and other credit reference and fraud agencies.	Name, date of birth business name, legal form, address, email address, company registration number, VAT number, telephone number, length of time at address, length of time in business, length of time with PayPal, funding instrument including bank account and credit/debit card details and relevant transaction information, credit score received on behalf of PayPal from a credit reference agency, account number, account type, account status, account balance, details of account transactions and liabilities, negative account performance data.
P K Consultancy Limited (UK)	To assess risk and help detect and prevent potentially illegal acts and violations of policies.	Name, address, telephone number, account number, email address, account type, last four digits of financial instruments account, account balance, details of account transactions and liabilities, account status and account performance information as required for the Purpose.
Accenture (UK)	Consultation and data review/analysis with respect to Global Operational Customer Service KPI data and spend incorporating customer feedback and complaints, Teammate performance.	Name, address, telephone number, email address, account number, contact details, account type, account balance, details of account transactions and liabilities, account status and account performance information.
Responsys (USA), e-Dialog, Inc. (USA), Adobe Systems Incorporated (USA), Teradata Corporation	To fulfil email operations in respect of the PayPal services (including operations, customer services, collections, marketing programmes and promotions).	Name, address, email address, business name, business contact details, domain name, account status, account type, account preferences, type and nature of the PayPal services offered or used and relevant transaction and account information.
Salesforce, Inc. (USA)	To fulfil email operations in respect of the PayPal services (including operations, customer services, collections, marketing programmes and promotions).	Name, address, email address, business name, business contact details, domain name, account status, account type, account preferences, type and nature of the PayPal services offered or used and relevant transaction and account information. iZettle customer and contact UUIDs and other supporting information about the business relationship.
ITELLIUM mobile Solutions GmbH (Germany); CartaSi S.p.A – Gruppo ICBPI (Italy)	To assist in the production of innovative payment methods (e.g. applications) and processing of payments through such innovative payment methods.	All account information.
Trustwave Holdings Inc. (USA)	To provide PCI compliance validation services for merchant accounts and merchant integrations.	Business name, address, account number, merchant type, compliance program used, PCI Level, PCI Status, PCI Expiry, name, email address, telephone number of merchant's contact person.
Scorex (UK) Limited (UK)	To provide a technology solution to allow PayPal to process, send and receive credit information of users via its contracted credit reference agencies.	Name, address, email address, date of birth, length of time at address, telephone number, legal form, length of time in business, company registration number, VAT number (if appropriate).
OXID eSales AG (Germany)	Services in connection with the development and operation of a payment system for stationary trade (point of sale).	All account information and transaction information (as appropriate).
Ingram Micro, Inc. (USA) and Ingram Micro (UK) Limited (UK)	To act as PayPal's fulfilment distributor for the PayPal Here product.	Name and address.
Lattice Engines, Inc. (USA)	To develop and optimise predictive models.	Name of the merchant, name of the contact person, address, email address, merchant website URL.
Interact CC Ltd (UK)	Providing assistance with PayPal service to customers.	Customer name, business name, telephone numbers, contact email, website, business industry, shipping details, card details for the payment.
The unbelievable Machine Company GmbH	Hosting BillSafe application on its servers.	All Account information.
Zevas Communications Ltd (Ireland)	Providing marketing screening and sales engagement with PayPal business customers.	Customer name, business name, telephone numbers, contact email addresses, website, business industry, number of PayPal transactions, transaction volume with PayPal, domestic/international transaction volume split, shipping details, card details for the payment.
Trustly Group AB	To allow customers to instantly transfer money from their bank account to their PayPal account, verify identity and ensure that a user is a PayPal account holder, process instant funding requests.	Name, e-mail address, IP-address, KYC/KYB status, account activity information, Country code, PayPal account ID, Account restriction.
Mediamedics BV	To allow customers to instantly transfer money from their bank account to their PayPal account.	Name, e-mail and IP-address.
Google, Inc. (USA)	To provide cloud-based hosting, storage and processing services to assist and/or enable PayPal to manage users' Account Information as well as data generated through their use of PayPal Services and deliver, analyse and improve PayPal Services.	All Account Information, data generated through the use of PayPal Services (in redacted or encrypted form).
Accenture (Ireland)	Optimise Call Routing Technology and Processes.	Customer country, teams that have accessed the customer, unique customer identifier of end customer of PayPal.
Deloitte Tax LLP (US, UK, LUX)	Deloitte Tax LLP is PayPal's third party compliance partner. Deloitte will review PayPal customer and merchant account information to determine if the account holder should be reported to the LUX authorities for FATCA purposes and facilitate the filing of the report with Lux authorities.	PayPal customer account and merchant, and bank information, name address, email address, customer name or business name, customer or business address, tax payer identification number, email address, telephone number, account number, account balance, account create date, type of legal entity, citizenship status.
Syniverse ICX Corporation (United States)	To deliver text messages to customers.	Customer's mobile telephone numbers, international mobile subscriber identity (IMSI) and content of text messages.
US Direct E-Commerce Limited (Ireland)	Provides PayPal merchants the ability to purchase Shipping Labels to ship goods domestically as well as Cross Border.	Name, address, telephone number, email address, list of ready to be shipped transactions details, ready to be shipped transactions value, item information.
Genesys Telecommunications Laboratories Inc (USA)	To assist PayPal technical teams with resolving routing/telephony related issues.	Customer name, telephone number, account number.
Fire Spa Consulting & Debt Management (IT), Lowell Investment GmbH (DE)	To collect debt, to request and proceed information from and to Schufa, Buergel and other credit reference and fraud agencies for PayPal.	Name, address, telephone number, account number, date of birth, business name, email address, account type, account status, last four digits of financial instruments account, account balance, details of account transactions and liabilities, name of funding source provider, credit score received from agency, account performance data.
figo GmbH (Germany), Tink AB (Sweden)	To verify identity, verify link between a customer and bank account, make decisions concerning a customer's credit worthiness, determine customer's risk profile; carry out checks for the prevention and detection of crime including fraud and/or money laundering.	First and last name, account transaction history, available balance, currency of existing account, and IP Address.
Amazon.com Inc – Alexa Web Information Service (USA)	Assess seller website trustworthiness.	Name, email address, physical address.
Optima Legal Services Limited (UK)	To collect debt, to request and proceed information from and to Schufa, Buergel and other credit reference and fraud agencies for PayPal.	Name, address, telephone number, account number, date of birth, business name, email address, account type, account status, last four digits of financial instruments account, account balance, details of account transactions and liabilities, name of funding source provider, credit score received from agency, account performance data.
Gigya, Inc. (US)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering; research and testing as to appropriateness of new products.	Name, address, phone number, email address, customer's spoken words, customer keyboard and cursor behaviour when using PayPal website or App, Social media login's or identity tokens (at customer discretion).
Early Warning Services LLC	Telephony based authentication service. To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, phone number, email address.
Booyami, Inc (dba Finagraph) (US)	Assessment of merchant risk. Research of financial statements.	Business name, financial statements.
Lowell Group (UK), Moorcroft Debt Recovery (UK), Robinson Way Limited (UK), Moreton Smith Receivables (UK), Fire Spa Consulting & Debt Management (Italy), HFG Inkasso GmbH (Germany)	To collect and manage debt, including the evaluation of first and third party collections initiatives.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider and copies of all correspondence.
Lowell Financial Ltd (UK), Lowell UK Shared Services Limited (UK), Lowell Group Shared Services Limited (UK), Cabot Financial (UK), Cabot Financial (Europe) Limited (UK), Cabot UK Holdco Limited (UK), Cabot Financial Securitisation Limited (Ireland)	To receive account and debt information for collections purposes and in support of the evaluation and assessment of account sales.	Name, address, telephone number, account number, date of birth, email address, account type, account status, account transaction details, details of account liabilities, debts and amounts owed, credit history information, repayment history, information including third parties engaged, copies of all correspondence relating to amounts owed.
Cabot Financial France (France)	To receive account and debt information for collections purposes and in support of the evaluation and assessment of account sales. To collect and manage debt following purchase of accounts or receivables.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider and copies of correspondence.
Lowell Portfolio I Ltd (UK)	To receive account and debt information for collections purposes and in support of the evaluation and assessment of account sales. To collect and manage debt following purchase of accounts or receivables.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider and copies of correspondence.
Thomson Reuters GRC Inc. dba Refinitiv (US)	Assessment of criminal and regulatory risks. KYC screening and monitoring (Sanctions, PEPs). Key for international investigations.	First, Last name, Gender, Date of Birth, Country Location, Place of Birth and Nationality.
Foundever B.V. & Co. KG (FKA Sitel GmbH) (Germany), Sitel Group, Sitel GmbH (Germany), Sitel Operating Corporation (Colombia, El Salvador, Egypt)	Providing assistance with PayPal services to customers.	Customer name, business name, telephone numbers, contact email addresses, website, address, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider and copies of correspondence.
Emailage Corp (United States)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, telephone number, email address, date of opening account, IP address.
Amazon Web Services (US), Apptimize, Inc. (US), Bodega Technologies, LLC (US), Call Copy/Uptivity (US), Caribbean Airmail (US), Contentful (US), Elasticsearch, Inc. (US)	To provide hosting and backup, consulting and consumer related services, including call management and analytics, api management, data retention, document sharing, authentication, enterprise management, courier services, mobile solutions, push messaging, email and general testing.	Customer name, business name, telephone numbers, contact email addresses, all account and related information.
ePlus Technology, Inc. (US), Golden Gate BBB, Level 3 Communications, Inc (US), Microsoft Corporation (US), NCC Group Security Services Inc. (UK), Quantum Corporation, Segment.io, Inc, Soluciones BK SA (Guatemala), Splunk Inc., TWILIO, Inc. (US)	To provide hosting and backup, consulting and consumer related services, including call management and analytics, api management, data retention, document sharing, authentication, enterprise management, courier services, mobile solutions, push messaging, email and general testing.	Customer name, business name, telephone numbers, contact email addresses, all account and related information.
Arroweye (US)	Card manufacturing and distribution.	Name, address, details of user card instrument.
BC Records Management Services (Canada)	Records management.	Name and account information.
Blackline (US)	Accounting services.	Name and details of funding instruments.
IRS Compliance (US)	Tax related services.	Name, address, details of user funding instruments, and government identification.
Switch Ltd. (USA)	Data centre facilities.	Name, e-mail, phone, identification information, details of funding instruments and details of payment transactions.
Thames Card Technology Limited (UK)	Card production services.	Name, address, details of user card instrument.
TransPerfect (USA)	Translation services.	Name, address, e-mail, identification information, details of user funding instruments, and details of payment transactions.
Tableau (US)	Reporting and analytics.	Organization_uuids, transactions, transaction value.
Smartling (US)	User experience assistance.	Company name, Merchant name, any content on public websites, email, location information.
Sinch (Global)	To provide our services and products, to fulfil relevant agreements with our merchants and to otherwise administer our business relationship with our merchants.	Merchant DBA name, end customer phone number.
AppSignal (Netherlands)	For customer analysis, to administer iZettle's services, and for internal operations, including troubleshooting, data analysis, testing, research, and statistical purposes.	Merchant logs.
Mailchimp	Merchant communication.	Name, Email.
Google Cloud Platform (US)	Cloud based hosting and processing services.	Account Information as well as data generated through their use of iZettle Services.
Google Firebase (US)	For customer analysis, to administer iZettle's services, and for internal operations, including troubleshooting, data analysis, testing, research, and statistical purposes.	Merchant information and account history.
Hunter.io	To communicate with our merchants in relation to our services.	Name, Email address, phone number, Browser information, IP address.
Infrasec Sweden AB (SE)	To comply with applicable laws, such as anti-money laundering and bookkeeping laws. KYC requirements, to prevent, detect and investigate money laundering, terrorist financing, and fraud.	Merchant organisation number, Merchant business name, business address, financial transactions, information related to invoices.
24 Solutions AB (Sweden)	To comply with applicable laws, such as anti-money laundering and bookkeeping laws. KYC requirements, to prevent, detect and investigate money laundering, terrorist financing, and fraud.	iZettle customers with personal accounts containing full name, username, email address and phone number.
Skopenow Inc. (US)	To verify identity, carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, location, phone number, email address, username, date of birth, jobs, schools.
Scrive AB (Sweden)	E-signing solution.	Email, name.
Mailgun Technologies Inc. (US)	To confirm email address accuracy.	Email address.
Temenos AG (FR)	System of record for closed-end instalment product (France).	Customer name, date of birth, home address, email address, telephone numbers, income.
Cisco Systems Inc (USA)	To enable secure data transfer.	Account information.
Swedbank LC&I, Svenska Handelsbanken AB (SE)	To enable verification of identity.	Name, address, date of birth and ID number.
Vonage Holdings Corp. (US)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth, mobile device IMEI number, phone number, email address.
Zumigo Inc. (US), Payfone Inc. (US), Prove Inc. (US)	Telephony based authentication service. To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, Address, Date of Birth, Telephone Number, Email Address.
Twilio, Inc. (US)	Telephony based authentication service. To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Phone Number, IP Address.
TMT Analytics (UK)	Telephony based authentication service. To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Phone Number.
TMT Analysis LTD. (UK), BICS SA/NV (BE)	Telephony based authentication service. To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Phone Number, Name, Address.
Google Inc. (US), Google Ireland, Ltd. (IE), Google Asia Pacific Pte. Ltd. (SG)	To verify identity; automatic data extraction from images of documents, and document validation/forgery detection. Research and testing as to appropriateness of new products and services; training of document recognition; facial recognition and comparison. For the prevention and detection of crime including fraud and/or money laundering.	Name, address, email address, date of birth, legal form, company registration number, VAT number, customer image, proof of identity, address, or other documents requested by PayPal for Risk and Compliance purposes.
Eircom Limited (IE), PJSC VimpelCom "Beeline" (RU)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth, mobile device IMEI number, phone number, account opening date.
Virgin Group Ltd, "Virgin Mobile" (UK)	To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering.	Name, address, date of birth, mobile device IMEI number, phone number, account opening date.
Cardinal Commerce Corporation (US)	To verify identity and provide secure authentication services.	Name, address, transaction details, country code, financial instrument details, device details, currency code, merchant ID.
Paigo GmbH (Germany) / Arvato Financial Solutions	To collect debt.	Name, address, telephone number, account number, date of birth, email address, account type, account status, last four digits of financial instruments account, sort code, account balance, details of account transactions and liabilities, name of funding source provider and copies of all correspondence.
TP USA, INC	Providing customer support for the PayPal service.	Account number, Address, Phone number, email address.
PayPal Bangalore	Providing customer support for the PayPal service.	Account number, Address, Phone number, email address.

7. Group Companies

PayPal may share data internally between its Group Entities globally. Please see the Privacy Statement section on 'International Transfers of Data' for more information.

8. Commercial Partners

Party Name and Jurisdiction	Purpose	Data Disclosed
EOS Deutscher Inkasso-Dienst GmbH (Germany), Coeo Inkasso GmbH (Germany)	To provide customised services and assistance to business customers using PayPal.	Transaction ID, PayPal Account ID, Amount, Transaction Date, Funding Source.

With respect to the column titled "Purpose", each third party, with the exception of the regulatory agencies, certain of the payment processors and credit reference and fraud agencies and group companies referred to at the end of this table, is carrying out the purpose to fulfil obligations which PayPal has contracted with the entity to fulfil. The regulatory agencies are carrying out their purpose in accordance with their regulatory objectives and requirements. Where explicitly specified in the table, the payment processors and credit reference and fraud agencies may use the information in their respective databases, and forward information to third parties for the purposes of fraud prevention and the assessment of creditworthiness, in accordance with their respective terms.