Party Name and Jurisdiction (in brackets)

1. Payment Processors

Barclays Bank Plc (UK), HSBC Bank Plc (UK, Ireland), HSBC Merchant Services LLP (UK), Bank of America N.A. (EMEA, USA BA Continuum India Private Limited (India), Discover Financial Services (USA), JPMorgan Chase Bank (UK, USA), BNP Paribas (France), Netgiro (Sweden), Wells Fargo (Ireland, USA), American Express (USA), National Westminster Bank PLC (UK), OmniPay Limited (Ireland), Australia and New Zealand Banking Group Limited (Australia), ANZ National Bank Limited (New Zealand), Transaction Network Services UK Limited (UK). To allow payment processing settlement services, and fraud checking. Name, address, email address, phone number, details of user funding instruments, and details of payment transactions, document identification number.

BNP Paribas (France) To allow payment processing, fraud checking and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via the BNPP service. Name, email address, phone number, physical address, IP address, date of birth, PayPal account number, details of user funding instruments and details of payment transactions.

VTB24 (Russia) To allow payment processing, fraud checking and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via the VTB 24 service. Name, address, email address, phone number, details of user funding instruments and details of payment transactions.

Deutsche Bank AG (Germany, Netherlands, France, Spain) To allow the processing of direct debits in the SEPA region. Name, date of transaction, amount, currency and user’s bank account information.

Royal Bank of Scotland plc (UK) (“RBS”) To allow payment processing and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via the RBS service. All account information except details of user financial instruments.

Visa Europe Ltd (UK) including Visa’s VMAS system; Mastercard Europe (Master Card International Incorporated. (USA) including Mastercard’s MATCH system To share risk and fraud information in the mandatory credit card company’s database regarding the conduct of a merchant’s account thereby reducing exposure to fraud and breaches of scheme rules and standards. All account details of merchant account, and circumstances and conduct of the account.

Global Payments UK LLP (UK) To allow payment processing, fraud checking and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via the Global Payments service. Name, address, details of user funding instruments and details of payment transactions.

WorldPay (UK) Limited, Worldpay AP Limited, (UK) Worldpay. (The Netherlands) To allow payment processing, fraud checking and dispute handling for transactions of PayPal users when those users transact with a merchant who uses the PayPal service via Worldpay service. All account information except details of user financial instruments.

American Express Travel Related Services Company, Inc. To allow payment processing settlement services, and fraud checking. Unique Seller ID. Seller MCC Seller DBA Authorized signer Seller address, postal and country code Seller telephone number. Seller email address Seller URL Date of birth (for sole proprietors only) For non-publicly traded Sponsored Merchants only (e.g. privately held company, sole proprietor), the following information for a Significant Owner (as defined below): First and last name

Home address, postal code and country code

SSN or date of birth Significant owner means an individual who has 25% or greater ownership of a business. Unique seller ID* Sponsored Merchant MCC Sponsored Merchant DBA Sponsored Merchant location (city, street, postal code and country code) Sponsored Merchant telephone number.

JPMorgan Chase Bank, N.A. London Branch Anti-money laundering, sanctions list checking and compliance checks. Name of merchant, country of domicile, and business activity.

Adyen B.V. (Netherlands) To allow payment processing and settlement services globally. Name, address, details of payment instruments, and details of payment transactions.

Allied Irish Bank PLC (UK) To allow payment processing and settlement services in Europe. Name, address, details of payment instruments, and details of payment transactions.

Coinbase Inc. (USA) To allow payment processing and settlement services globally. Name, address, details of payment instruments, and details of payment transactions.

Heartland Payment Systems, Inc. (USA) To allow payment processing and settlement services in the United States. Name, address, details of payment instruments, and details of payment transactions.

Merchant e-Solutions, Inc. (USA) To allow payment processing and settlement services in the United States. Name, address, details of payment instruments, and details of payment transactions.

Moneris Solutions Corporation (Canada) To allow payment processing and settlement services in Canada. Name, address, details of payment instruments, and details of payment transactions.

National Australia Bank Ltd. (Australia) To allow payment processing and settlement services in Australia. Name, address, details of payment instruments, and details of payment transactions.

Network Merchants, LLC. (USA); Network Merchants Inc. (USA) To allow payment processing and settlement services in the United States. Name, address, details of payment instruments, and details of payment transactions.

Stockholms Enskilda Bank AB (Sweden) To allow payment processing and settlement services in Europe. Name, address, details of payment instruments, and details of payment transactions.

WorldPay, Inc. (USA); WorldPay Ltd. (UK) To allow payment processing and settlement services globally. Name, address, details of payment instruments, and details of payment transactions.

Carta Worldwide (UK) Processing of Payments and Marketing forVodafone Wallet. First Name, Last Name, e-mail Address, Mobile Number, Billing Address (Street Name, House Number, City, State, Postal Code, Country), Payer ID, Billing Agreement ID, Given Payment Method, CMID / Client Metadata ID.

Nostrum Group Limited (UK) To process PayPal customer applications for credit products. Name, address, telephone number, email address, date of birth, length of time at address, proof of identity, legal form, length of time in business, company registration number,VAT number, funding instrument including bank account and credit /debit card details (if appropriate)and relevant transaction information (if appropriate). All information supplied when applying for a product or account functionality (including information obtained from social media accounts or online reputation data).

TSYS (UK), TSYS (Germany)) System of the record for the revolving credit line (UK) and instalment product (Germany). Customer name, date of birth, home address, email address, telephone numbers, income.

Amex Multi-Currency (via Digital River) To enable access and use of PayPal when using French PLCs, Amex International, Maestro, Cielo, Redecard, Bancomer. Authorisation and settlement data.

Sofort GmbH (Germany) To allow payment processing settlement services, and fraud checking. Name, telephone number.

Currence (Netherlands) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

J.P. Morgan AG.(Germany) To allow the processing of direct debits in the SEPA region. Name, date of transaction, amount, currency and user’s bank account information.

Scotiabank (Canada), Westpac (US) To allow payment processing settlement services, and fraud checking. Name, address, phone number, email address, account number, date of birth, national identity number and purpose of transaction.

Swish (SE) To enable services for payment processing Phone number

Klarna (SE), To enable services for payment processing and fraud control Name, address, social security number, ip-number

Access Payments System (Greece), AFEX Transferencias Y Cambios LTDA (CHL), Agente de Cambio Caribe Express (DOM), Allied Bank Limited (PAK), Axis Bank Ltd (IND), Banco Agricola S.A. (SLV), Banco America Central SA (GTM), Banco Azteca de El Salvador (SLV), Banco Azteca de Guatemala S.A. (GTM), Banco Azteca de Honduras S.A. (HND), Banco BHD, S.A. - Banco Multiple (DOM), To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Banco Davivienda S.A. (COL), Banco De Credito Del Peru (PER), Banco de Guayaquil S.A. (ECU), Banco de la Producción (NIC), Banco de Oro a.k.a. BDO Unibank, Inc (PHL), Banco de Reservas de la To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Republica Dominicana Banco de Servicios Multiples S.A. (DOM), Banco Industrial S.A. (GTM), Banco Internacional Del Peru S.A. (PER), Banco Pichincha C.A. (ECU), Banco Popular Dominicano, S. A. - Banco Multiple (DOM), Banco Rendimento (BR), Bancolombia S.A. (CO), Bancomer Transfer Services Inc. (Bolivia, Colombia, Dominican Republic, Ecuador, Guatemala, Honduras, Mexico, Nicaragua, Peru, El Salvador, Uruguay) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Bank Alfalah Limited (Pakistan), Bank Negara Indonesia (BNI) (Indonesia), Bank of the Philippine Islands (Philippines), Barclays Wealth Intermediaries (Austria, Belgium, Cyprus, Estonia, Finland, France, Germany, Greece, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Monaco, Netherlands, Portugal, San Marino, Slovakia, Slovenia, Spain, United Kingdom) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Cebuana Lhuillier Services Corporation, "Continental Exchange Solutions, Inc, ""RIA"" (US)", Dutch Bangla Bank Ltd (Bangladesh), Earthport (France, Hong Kong, Ireland, Italia, Netherlands, Singapore, Vietnam, Romania, Sweden, Hungary, Bulgaria, Czech Republic, Denmark, Croatia, Norway) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Envoy Services Limited a.k.a. Worldpay (Canada, Federal Republic of Germany, Spain, Poland, New Zealand, Switzerland), eTranzact International PLC (Nigeria), Everest Bank (Nepal), Exchange4Free (South Africa), Extole (US), Financiera Pagos Internacionales S.A. Compania de Financiamiento Comercial (Columbia), First Global Money (Guyana) Inc., GCS Systems, Ltd. (Dominican Republic), Globalenvios S.A. (Ecuador), G-Xchange Inc.(Philippines) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Hatton National Bank PLC (Sri Lanka), HDFC Bank Limited (NEFT) (India), JMMB Capital and Credit (CCRL) (Jamaica), Joint Stock Commercial Bank For Foreign Trade Of Vietnam "Vietcombank" (Vietnam), Landbank of the Philippines (Philipines), LBC Express, Inc.(Philippines), Metropolitan Bank and Trust Company (Philippines), Michel J. Lhuillier Financial Services Inc. (Philippines), To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Money Swap Exchange Limited (China), More Money Transfer S.A. f.k.a. Gamerly S.A. (Argentina, Bolivia, Chile, Uruguay), MSBB Money Ltd (Brazil) , Muslim Commercial Bank Limited, National Bank of Pakistan, Nepal Investment Bank Ltd. (Nepal), Nueva Elektra del Milenio S.A. de C.V. (MX), To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Pagos Intermex S.A. De C.V. (Mexico), PayKii Inc.(Mexico), Philippine National Bank, Pozcta Polska (Poland), Prabhu Group (Bangladesh, Nepal), Pronet S.A.(Guatamela), Punjab National Bank (India) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Punto Express S.A. de C.V. (El Salvador), Punto Facil S.A. (Nicaragua), Queen Bee Capital Co., Ltd., Rizal Commercial Banking Corporations (RCBC) , Red Efectiva S.A. de C.V. (Mexico), Remesas Teledolar S.A. (Costa Rica), Royal Exchange (USA) Inc "Muthoot" (India), Rupali Bank Limited (Bangladesh), Sai Gon Thuong Tin Commercial Join Stock Bank (Vietnam), Sampath (Sri Lanka) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

SBM Bank Limited (Kenya) , Social Islamic Bank Limited (Bangladesh), Sonali Bank Limited (Somalia) , TENGO a.k.a. Astra Honduras S.A. de C.V., TransferTo Inc. (US) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

TransNetwork Corporation (Colombia, Ecuador, Mexico, Costa Rica, Guatemala, Honduras, Nicaragua, Panama, El Salvador)", Ultra Chile Sociedad Anonima (Argentina), United Bank Limited (Pakistan), Uniteller Financial Services, Inc. a.k.a. Banorte (Guatemala, Mexico, Honduras), Unitransfer S.A. (Haiti), Vietnam Payment Solution Joint Stock Company, VMBS Money Transfer Services Limited (Jamaica), Westpac Banking Corporation (AUS), Yes Bank Limited (India) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions.

Bank of Montreal (Canada), Cardpro (FIS) (US), Citibank (US), D-Local (UK), Danske Bank (Denmark), Earthport PLC (UK), Fidor Bank AG (Germany), FIS (US), GoCardless (UK), Meta Payment Systems (US), Moneygram (US), The Bancorp Inc. (US), Transact Payments Limited (Gibraltor), Valitor (Iceland), VFX Financial (UK), Western Union (US), Western Union Business Solutions (WUBS) (US) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions

Skandinaviska Enskilda Banken (Sweden), Adyen B.V, (Sweden), Elavon Financial Services Limited, UK Branch, Bambora AB (SE) To allow payment processing settlement services, and fraud checking. Name, address, details of user funding instruments, and details of payment transactions

Chargebee (India) To administer payment for products and/or services and the customer relationship i.e. to carry out our obligations arising from any contracts entered into between us and the merchant and to provide you with the information, products, and services that you request from us. Name, Address, Phone Number, Email Address, masked payment details

Stripe (US) To administer orders and/or purchases Name, email and card details (last four digits only, expiry and card type)

Modulr Finance Ltd (UK) To allow payment processing Name, account number, sort code

2. Credit Reference and Fraud Agencies

Please note that in addition to the stated purposes below, PayPal uses your personal information to detect, prevent, and/or remediate fraud or other illegal actions, or to detect, prevent or remediate violations of policies or applicable user agreements.

Socure, Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address, telephone number, email address, date of birth and IP address

Pipl, Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address, telephone number, email address and date of birth

White Pages, Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address, telephone number, email address, account opening date, and IP address

Full Contact, Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Email address

CRIF S.p.A (Italy), Cerved B.I (Italy), Synectics Solutions Limited (UK), GB Group plc (UK), Graydon (UK), Capita Plc (UK), UK Data Limited (UK), ICC Information Limited (UK), Payment Trust Limited (UK), 192.com (UK), 192.com Limited (UK), i-CD Publishing (UK) Limited (UK), Experian Netherlands BV (Netherlands), Experian Bureau de Credito SA (Spain), Informa D&B SA (Spain), and CRIBIS D&B S.r.l. (Italy), Ellisphere (France), La Banque de France (France), SysperTec Communication (France), LexisNexis Risk Solutions Ltd (UK) To verify identity, verify linkage between a customer and its bank account or credit/debit card, assist in making decisions concerning a customer’s credit worthiness (including without limitation, in relation to credit products offered by PayPal), carry out checks for the prevention and detection of crime including fraud and/or money laundering, assist in debt recovery, manage PayPal accounts and undertake statistical analysis.



To verify identity; automatic data extraction from images of documents, and document validation / forgery detection. .



Please note that data disclosed to these agencies may be retained by the applicable credit reference and fraud agency for audit and fraud prevention purposes. Name, address, telephone number, email address, date of birth, length of time at address, proof of identity, legal form, length of time in business, place of birth, company registration number, VAT number, unique business identifier reference, funding instrument including bank account and credit /debit card details (if appropriate) and relevant transaction information (if appropriate) and tax ID or national identity number (if appropriate).

Callcredit plc. (UK) including the SHARE database administered by Callcredit, Experian Limited (UK) including databases administered by Experian used for consumer and commercial referencing including CAPS credit searches and CAIS credit account performance data, Equifax Ltd (UK) including the Insight database administered by Equifax, Dun & Bradstreet Limited (UK), Equifax Ibérica S.L. (Spain), Transunion LLC To verify identity, verify linkage between a customer and its bank account or credit/debit card, make decisions concerning a customer’s credit worthiness (including without limitation, in relation to credit products offered by PayPal), carry out checks for the prevention and detection of crime including fraud and/or money laundering, assist in debt recovery, manage PayPal accounts and undertake statistical analysis, undertake research and testing as to appropriateness of new products and services and system checking.



To verify identity and provide ongoing due diligence of customer data (legal entities and directors, principles, authorized users and beneficial owners). Provision of business register data and information for the onboarding of new entities.

Provision of third party data for the screening and validation of new and existing entities. To carry out risk assessment on the entity - checks for the prevention and detection of crime including fraud and/or money laundering Customer name, address, telephone number, name of authorised user, email address, national identity number (if appropriate), date of birth, length of time at address, proof of identity, legal form, length of time in business, company registration number, VAT number, funding instrument including bank account and credit /debit card details (if appropriate), account number, relevant transaction information (if appropriate), account balance, all information supplied and used for your application for the UK products “Website Payments Pro”, “Virtual Terminal” and “PayPal Here” and the financial instrument used to pay for your PayPal Here- enabled device.

CIFAS (UK) and the CIFAS database For users with UK PayPal accounts only: to prevent and detect fraud (which may include checking details on job applicants and employees and on proposals and claims for all types of insurance).



Please note that data disclosed to this database may be: retained by the database for audit and fraud prevention purposes;

disclosed to other financial institutions for the purpose of fraud prevention and detection (including to prevent money laundering) for example, when checking details on applications for credit and other facilities, managing credit and credit related accounts or facilities, recovering debt, checking details on claims for insurance and checking details of job applicants or employees;

used to determine your risk profile and for cooperation with the relevant authorities in compliance with the requirements of the Luxembourg Law of 5 April 1993 on the financial sector and laws relating to the prevention of money laundering, terrorism and fraud (excluding the treatment of personal data in relation to solvency of the persons referred to in article 14(1)(d) of the Luxembourg Law of 5 April 1993 on the financial sector); and

transferred outside of the EU and on a global basis. All account details and circumstances of the conduct of the account.

DueDil Limited (UK) To receive business information for risk assessment, and compliance with anti-money laundering requirements, such as establishing the corporate structure and beneficial ownership. Company registration number, name and address of business, name, address, date of birth of directors.

Deltavista GmbH (Germany, Austria, Poland) Establish risk associated with address, identity; assist in making decisions concerning a customer’s credit worthiness; carry out checks for the prevention and detection of crime including fraud and/or money laundering.. Name, address, date of birth, email address and telephone number.

Accumio Finance Services GmbH (Germany), Creditreform Boniversum GmbH (Germany), CRIF Bürgel GmbH (Germany), Informa Solutions GmbH (Germany) To verify identity, address and telephone number and retrieve contact telephone numbers and addresses, To assist in making decisions concerning the credit worthiness of consumers. Name, address, date of birth, telephone number, email address, account status, account balance, and in case the transfer of such information is legally justified, also certain information on negative account performance of a customer, for which PayPal has requested a creditworthiness check from the respective database, web address, umsatzsteuerid/VAT ID and data vendor reference number (if relevant).

SCHUFA Holding AG (Germany), Infoscore Consumer Data GmbH (Germany)(Netherlands) To verify identity and address, carry out checks for the prevention and detection of failing direct debit payments. checks on the linkage of the customer and bank account and to determine creditworthiness. To detect criminal activity including fraud and/or money laundering, Name, address, email address, date of birth, gender, bank account details (including IBAN and BIC), information on failed direct debit payments from a bank account, information on negative account performance .

Creditreform Berlin Wolfram KG (Germany), Verband der Vereine Creditreform e.V. (Germany), Axesor (Spain), Ignios (Portugal). UC AB (Sweden), Dynamic Business Information Limited (UK), Trillium (USA), To determine creditworthiness of merchants. To carry out checks for the prevention and detection of crime including fraud and/or money laundering and for the evaluation of verification process improvements. Name, (including trading as names), address, email address, telephone number, unique business identifier reference.

World-Check (UK) To verify identity. All account information.

Global Data Corporation (USA) To verify identity, carry out checks for the prevention and detection of crime including fraud.. Name, address, date of birth, telephone number, email address.

RSA Security Inc. (USA) and RSA Security Ireland Limited (Ireland) To verify identity. All account information.

Mitek Systems B.V. (formerly ID CHECKER.NL B.V.) (Netherlands) (Ireland) To verify identity; automatic data extraction from images of documents, and document validation / forgery detection. Research and testing as to appropriateness of new products and services; training of document recognition Name, address, email address, date of birth, legal form, company registration number, VAT number, proof of identity, address, ownership of a funding instrument or other documents requested by PayPal and the data contained therein for Risk / Compliance/ Credit purposes.

Aristotle International, Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address, date of birth and telephone number.

Acxiom Ltd (UK), Acxiom Deutschland GmbH (Germany) and Acxiom France SAS (France) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address, telephone number, email address, PayPal account number, date of opening account and gender.

Creditinfo Decision (Czech Republic) and DecisionMetrics Limited (UK) To assist with PayPal’s assessment of merchant risk. All merchant account information.

ThreatMetrix Inc. (USA) To retrieve risk information regarding the IP and device from which customers are accessing PayPal. IP and hardware information about the device (device ID, User IP address and cookies). Email address and other information collected during sign up.

TeleSign Corporation (USA) To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address, phone number, email address,

AddressDoctor GmbH (Germany), To re-structure address data into normalized format. Name, address, email address.

Deutsche Post Direkt GmbH (Germany), AZ Direct GmbH (Germany), Deutsche Post Adress GmbH & Co. KG (Germany) To validate and re-structure address data into normalized format and to verify name and address. Name, address, email address.

Mitek Systems Inc. (USA) To validate images of identity documents and training of document recognition. Name, address, email address, date of birth, legal form, company registration number, VAT number, shipping information, documents proving identity and address, Tax ID (SSN), identity documents and images (if supplied) ownership of a funding instrument, or other documents requested by PayPal and the data contained therein for Risk / Compliance/ Credit purposes.

Jumio Inc (USA) To capture and validate proofs of identity and address. All data recorded on the customer’s identity and address documents.

Au10tix Limited (Cyprus), To verify identity; automatic data extraction from images of documents,and document validation / forgery detection. Name, address, email address, date of birth, legal form, company registration number, VAT number, shipping information, documents proving identity and address, Tax ID, identity documents (if supplied) proof of address images, ownership of a funding instrument, or other documents requested by PayPal and the data contained therein for Risk / Compliance/ Credit purposes.

Telovia SA (Luxembourg) Identity validation and Know Your Customer (KYC) controls conducted for anti money laundering purposes. Name, address, date of birth, proof of ID and address.

Syniverse Technologies, LLC (USA) Validate and apply data quality checks to telephone numbers. To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, email address, telephone number.

Signicat AS (Norway) To verify and authenticate identity. Name, address, date of birth and ID number.

ArkOwl LLC (USA) To verify email address. Email address.

Fraudscreen Ltd (UK) To evaluate level of fraud risk. Name and address, Customer ID, Date of Birth, Address, Postcode, E-mail address, Telephone numbers, all account details and circumstances of the conduct of the account, relevant transaction information, decisioning information and all information supplied and used for your application for UK products.

Trustev Ltd (Ireland) To establish identity through customer’s social media data, connections and credentials. Name, address, date of birth, email address and account number.

Tracesmart Ltd (UK) To identify customers and assist with fraud detection, prevention, and or remediation of fraud, or other illegal actions or to detect, prevent or remediate violations of policies or the applicable user agreements. For the evaluation of verification process improvements. Title, name, address, date of birth and telephone number.

MaxMind, Inc. (USA) To detect fraud. All account information and IP address, credit card information.

Future Route Ltd (UK) To carry out accounting data analysis of our commercial users for real time credit-risk evaluation. Name, address, email address and date of birth.

Kount, Inc. (USA) To facilitate fraud checking for payment processing globally. Name, address, device fingerprint data, details of payment instruments, and details of payment transactions.

Artefacts Solutions LLC (USA) To detect fraud and mitigate risk related to transaction processing. Truncated card number, amount of transaction, chargeback ratio, credit ratio, and decline ratio.

Experian Information Solutions, Inc. (USA) To verify identity, assist in making decisions concerning a customer’s credit worthiness, carry out checks for the prevention and detection of crime including fraud and/or money laundering. Please note that data disclosed to these agencies may be retained by the applicable credit reference and fraud agency for audit and fraud prevention purposes. Name, address, social security number, date of birth, business name, legal name of business, tax ID, business telephone number.

Trulioo Information Services, Inc. (USA), (Luxembourg) , Global Data Company (Spain), EDM BV (Netherlands) To verify identity, carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, date of birth, address, phone number, tax ID, national identity number, place of birth, identity document information and any other identity information.

Soda Software Labs Limited (UK), Aire Labs Limited (UK), , DueDil Limited (UK), Creditsafe (UK), Creditsafe Business Solutions Limited (UK), Creditsafe USA Inc. (USA), Creditsafe Deutschland GMBH (Germany), Solvabilite Enterprise (France), Creditsafe I Sverige AB (Sweden), Creditsafe Ireland Limited (Ireland), Creditsafe (SE) Safe Information Group NV (Netherlands), ,Yodlee Inc. (USA), Imagini Europe Limited (trading as VisualDNA) (UK); Bureau Van Dijk Electronic Publishing Ltd (UK), Company Watch Limited (UK), The Sage Group plc (UK), Xero (UK) Ethoca Limited (Canada Limited, Xero Inc. (USA) Ethoca Limited (Canada) To verify identity, verify linkage between a customer and its bank account or credit/debit card, to make decisions concerning a customer’s credit worthiness To verify identity and provide ongoing due diligence of customer data (legal entities and directors, principles, authorized users and beneficial owners). Provision of business register data and information for the onboarding of new entities. Provision of third party data for the screening and validation of new and existing entities. •To carry out risk assessment on the entity - checks for the prevention and detection of crime including fraud and/or money laundering Name, address, telephone number, email address, date of birth, place of birth, tax ID, passport ID, or other government issued identification number. Length of time at address, proof of identity, legal form, length of time in business, company name including “doing business as” or “trading as” names, company address, company tax or other government ID such as company registration number, company owners, controlling managers and beneficial owners. Name, address, date of birth of directors. Funding instrument including bank account and credit /debit card details (if appropriate) and relevant transaction information (if appropriate). All information supplied when applying for a product or account functionality (including information obtained from social media accounts or online reputation data).

National Credit Bureau (Russia) To receive business information for risk assessment, and compliance with anti-money laundering requirements, such as establishing the corporate structure and beneficial ownership. To assist in making decisions concerning a customer’s credit worthiness. Company registration number, name, and address of business, name, address, date of birth of directors, any 'trading as' names, list of companies that directors are involved in, date company established/registered.

Focum Solutions B.V. (Netherlands) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth, identity document number, identity document type and telephone number.

ID Scan Biometrics Ltd (UK), ID Scan Research Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi (TR) To verify identity; automatic data extraction from images of documents, and document validation, comparison and forgery detection. Name, address, email address, date of birth, legal form, company registration number, VAT number, shipping information, documents proving identity and address, Tax ID, identity documents, ownership of a funding instrument, or other documents requested by PayPal and the data contained therein for Risk / Compliance/ Credit purposes.

Paycasso Verify Limited (UK) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Photo of customer and document images supplied by customer including all information they contain. Information from document’s embedded RF chip (when applicable).

LexisNexis, LexisNexis Risk Solutions UK Limited (UK), LexisNexis Risk Solutions (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering; to assist with customer authentication. Name, address and date of birth and telephone number. Photo of customer and document images supplied by customer including all information they contain. Tax ID, national identity number, place of birth, identity document information and any other identity information requested by PayPal for Risk / Compliance/ Credit purposes

QGen Limited (Malta) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Photo of customer and document images supplied by customer including all information they contain.

SmartKYC Ltd (UK) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address and date of birth.

Dun & Bradstreet Limited (UK), Dun & Bradstreet, Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address, date of birth and telephone number.

Global Data Consortium, Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number. Tax ID, national identity number, place of birth, identity document information and any other identity information requested by PayPal for Risk / Compliance/ Credit purposes

CRIF GmbH (Austria), CRIF Ltd (Switzerland), CRIF AG (Switzerland) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address, date of birth and telephone number.

UPC BVK (Belgium) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Regulatory Data Corporation (USA), Livingston International (Canada), LSSI Europe Ltd (UK) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering; to screen for watch lists and adverse media Corporate name or individual name, address, telephone number

Soliditet AB (Sweden) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Publicis Groupe), i-Cover / Advisedata SARL, Mediapost, Zecible (France) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address and date of birth.

Blue Shape SRL (Italy) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth, telephone number, , tax ID, place of birth, identity document information and any other identity information requested by PayPal for Risk / Compliance/ Credit purposes.

PostNL (Netherlands) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Compta S.A. (Portugal) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Deyde Calidad de Datos S.L. (Spain) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Global Business Register Limited, T/A Kyckr (Ireland) To verify identity and provide ongoing due diligence of customer data. Provision of business register data and information for the onboarding of new customers. Provision of third party data for the screening and validation of new and existing customers. To carry out risk assessment on the customer. To carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, email address, date of birth, legal form, company registration number, VAT number, tax ID or other government issued identification number, proof of identity, address legal status, company name, known aliases, trading as name, telephone number, company owners, controlling managers and beneficial owners. Name, address, date of birth of directors. .

Simunix Ltd (UK) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Royal Mail Group Ltd (UK) To validate and re-structure address data into normalized format and to verify name and address. Name, address, email address, telephone numbers

Credit Kudos Limited (UK) To evaluate level of fraud risk and credit risk, verification of income and expenditure. Name and address, Customer ID, Date of Birth, Address, Postcode, E-mail address, Telephone numbers, all account details and circumstances of the conduct of the account, relevant transaction information, decisioning information and all information supplied and used for your application for UK products.

Acton International Ltd (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number. Tax ID, national identity number, place of birth, identity document information and any other identity information requested by PayPal for Risk / Compliance/ Credit purposes

Bisnode Norge AS (Norway) (Finland), Infobel (France), B&C Technologies (France), To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth, telephone number.

Bisnode Belgium NV/SA (Belgium) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Bisnode Danmark A/S (Denmark) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth, telephone number and civil registration number.

Bisnode Sverige AB (Sweden) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth, telephone number and Swedish identification number.

Bisnode Deutschland GmbH (Germany) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Deltavista International AG (Switzerland) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

KAPITOL S.A. / NV (Belgium) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address and telephone number.

Orange Espagne S.A.U To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

SDS (Holland) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Dataxcel Ltd.(Ireland) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth. Tax ID and national identity number (if appropriate)

Telefónica SA (Spain) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

‘CDDN’ - Communicatie Data Diensten Nederland (Holland) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

FrescoData LLC (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Precision Marketing Information Ltd. (Ireland) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name and address.

Opplysningen 1881 AS (Norway) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and telephone number.

Liteshell Holdings Ltd (Russia) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, date of birth and national identity number.

Infocore, Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address and date of birth.

LexisNexis Risk Solutions FL Inc. (USA) Support ID and Credit Verification of Customers and potential Customers. Name, address, date of birth, national identity number, telephone number, images of government issued ID documents: passports, national identity documents and driver licenses.

Neustar Inc. (USA) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, Address, Telephone Number, Email Address, IP Address and Document Identification Number.

Tradle Inc (USA) To receive customer information for risk assessment, and compliance with anti-money laundering requirements, such as establishing the corporate structure and beneficial ownership. To verify identity; automatic data extraction from images of documents,and document validation / forgery detection. Name, address, telephone number, email address, date of birth, length of time at address, proof of identity, legal form, length of time in business, company registration number, VAT number, unique business identifier reference, funding instrument including bank account and credit /debit card details (if appropriate) and relevant transaction information (if appropriate) and tax code (if appropriate). Documents proving identity and address, ownership of a funding instrument

BankID (SE), Zetes SA (BE), SK ID Solutions AS (Estonia), iDIN B.V. (NL), Nets DanID (DK), BankID Norge AS (Norway), D-Trust GmbH (DE), Verimi GmbH (DE), Yes.com (DE), Electronic Identification S.L. (Spain) To enable verification of identity Name, address, date of birth, ID number

Synnex-Concentrix Limited (UK) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering Name, address, email address, date of birth, legal form, company registration number, VAT number, documents proving identity and address, ownership of a funding instrument, or other documents requested by PayPal and the data contained therein for Risk and Compliance Purposes.

BBB.org (US) Provision of business data and information for the onboarding of new customers. Provision of third party data for the screening and validation of new and existing customers. To carry out risk assessment on the customer. To carry out checks for the prevention and detection of crime including fraud and/or money laundering and in compliance with anti-money laundering requirements such as establishing the corporate structure and beneficial ownership. Business name, address, telephone number email, URL and other supporting information about the business such as (without limitation) name of contact person, business category, BBB rating score

AgFe LLP (UK) Undertake statistical analysis, research and testing as to appropriateness of new products and services and system checking. Financial consulting support services in particular with regard to making decisions concerning a customer’s credit worthiness (including without limitation, in relation to credit products offered by PayPal); carrying out checks for the prevention and detection of crime including fraud and/or money laundering and assisting in debt recovery. Company name including “doing business as” or “trading as” names, company address, company tax or other government ID such as company registration number, company owners, company directors, beneficial owners. Name, address and date of birth of directors. Name, address and date of birth of PayPal account applicant. All information supplied when applying for a product or account functionality.

Orange S.A. (FR) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

Bouygues Telecom (FR) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and Phone Number.

Free Mobile (FR) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

Societe Francaise du Radiotelephone (FR) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS). Name, address, date of birth, mobile device IMEI number and phone Number.

Telefónica Germany GmbH & Co. OHG (DE) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

Orange Polska S.A. (PL) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

T-Mobile Polska S.A.(PL) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

Orange Espagne SAU (ES) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

Vodafone España, S.A.U and Vodafone Ono, S.A.U (ES) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

Swisscom (Schweiz) AG (CH) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

Telefónica UK Limited (UK) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS). Name, address, date of birth, mobile device IMEI number and phone Number.

Hutchison 3G UK Ltd (UK) To validate phone information for fraud prevention purposes as well outbound customer contact (phone and SMS) Name, address, date of birth, mobile device IMEI number and phone Number.

JT (Jersey) Limited (Jersey) To facilitate phone information validation for fraud prevention purposes as well outbound customer contact (phone and SMS) by providing a gateway to telecoms suppliers. Name, address, date of birth, mobile device IMEI number and phone Number.

Voxbone (Belgium) To enable SMS and telephony based authentication and identity verification services. To test suitability of new services. Name, address, date of birth, mobile device IMEI number and phone Number.

Vodafone (UK) To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, date of birth, address, telephone number, email address, IP Address, tax ID, national identity number, place of birth, identity document information and any other identity information requested by PayPal for Risk / Compliance/ Identity Verification purposes.

Jersey Telecom (Jersey) To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, date of birth, address, mobile device IMEI number, telephone number, email address, IP Address, tax ID, national identity number, place of birth, identity document information and any other identity information requested by PayPal for Risk / Compliance/ Identity Verification purposes.

iConectiv (USA) To validate telephone numbers, verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, date of birth, address, mobile device IMEI number, telephone number, email address, IP Address, tax ID, national identity number, place of birth, identity document information and any other identity information requested by PayPal for Risk / Compliance/ Identity Verification purposes.

DNB ID Solutions AS (Norway) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Identity document information, including electronic information held on chip enabled Passports (if supplied by customer).

IdentityMind Global, Inc. (US) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, Address, Date of Birth, Phone Number, Email Address, IP Address, Account Opening Date, Identity Document (if provided by customer).

EZMCOM, Inc (US) To verify identity; data extraction from images of documents, and document validation / forgery detection. Name, address, email address, date of birth, legal form, company registration number, VAT number, shipping information, documents proving identity and address, Tax ID, identity documents (if supplied) proof of address images, ownership of a funding instrument, or other documents requested by PayPal and the data contained therein for Risk / Compliance/ Credit purposes.

Ocrolus, Inc. (US) Evaluation of financial status and fraud prevention Images of bank statements as supplied by customers.

Scanovate Ltd (IL), OriginID (NZ), Idenfy (LT), IDnow GmbH (DE), Bluink Ltd. (CA) Acuant, Inc. (US), IDMerit (US), Cambridge Blockchain, Inc. (US), Trusona, Inc. (US) To authenticate images of identity documents;document recognition; testing of authentication features; validation of funding instruments; capture data. Name, address, date of birth, identity documents, proof of address images, Tax ID.

TransUnion International UK Limited (formerly Callcredit) including the SHARE database administered by TransUnion, Experian Limited (UK) including databases administered by Experian used for consumer and commercial referencing including CAPS credit searches and CAIS credit account performance data, Equifax Ltd (UK) including the Insight database administered by Equifax, Dun & Bradstreet Limited (UK), Equifax Ibérica S.L. (Spain), Transunion LLC, Transworld Services (CL), Fidelitas (AR), World Box (UK Limited), Assessbr Ltd, Risk Consult Limited, Cristal Credit International, Cheers Interactive, Eurocredit, To verify identity, verify linkage between a customer and its bank account or credit/debit card, make decisions concerning a customer’s credit worthiness (including without limitation, in relation to credit products offered by PayPal), carry out checks for the prevention and detection of crime including fraud and/or money laundering, assist in debt recovery, manage PayPal accounts and undertake statistical analysis, undertake research and testing as to appropriateness of new products and services and system checking. Customer name, address, telephone number, name of authorised user, email address, national identity number (if appropriate), date of birth, length of time at address, proof of identity, legal form, length of time in business, company registration number, VAT number, funding instrument including bank account and credit /debit card details (if appropriate), account number, relevant transaction information (if appropriate), account balance, all information supplied and used for your application for the UK products “Website Payments Pro”, “Virtual Terminal” and “PayPal Here” and the financial instrument used to pay for your PayPal Here- enabled device.

IDology Inc.(US), iovation Inc (US), Whitepages, Inc (US) Identity Verification, Authentication, Fraud Prevention Name, address, email address, date of birth, legal form, company registration number, IP Address, VAT number, shipping information, documents proving identity and address, and any other data for Risk / Compliance/ Credit purposes.

Capita Identity (UK) To carry out risk analysis, fraud prevention, and risk management. Name, date of birth, address, telephone number, tax ID, national identity number, place of birth, identity document information and any other identity information requested for risk and compliance purposes

DUO Security (UK) To carry out risk analysis, fraud prevention, and risk management. Name, e-mail and phone

IDM Global Inc. To carry out risk analysis, fraud prevention, and risk management. Name, date of birth, address, telephone number, tax ID, national identity number, place of birth, identity document information and any other identity information requested for risk and compliance purposes

KYC SiteScan To carry out risk analysis, fraud prevention, and risk management. Name and address

PhishMe (US) To carry out risk analysis, fraud prevention, and risk management. Name, address, email

Sift Science (US) To carry out risk analysis, fraud prevention, and risk management. Name, address, phone number, organization UUID, card holder information (card number), CNP transaction data (location, time, amount, reference)

Xero (UK) To assist with accounting administration Merchant name, email. Address

Deltavista GmbH (Germany,Austria, Poland) Establish risk associated with address, identity; assist in making decisions concerning a customer’s credit worthiness; carry out checks for the prevention and detection of crime including fraud and/or money laundering.. Name, address, date of birth, email address and telephone number.

UC (SE) Credit checks Name, trading name, address

Skatteverket SPAR (SE), Skattekontoret Folkeregiste (Norway) CPR-kontoret (Denmark), Finnish Transport and Communications Agency (Finland) To verify identity Name, address, date of birth and ID Number

Euroleads (France) eXotargets (Germany) To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. Name, address and date of birth.

3. Financial Products

Argus Information and Advisory Services (USA), FIS Avantguard LLC (US) Providing financial analysis, scoring solutions and advisory services. Name, payment amount, and check number

La Poste (France) To resolve technical issues and user claims (when PayPal is being offered by the merchant through La Poste’s payment solution). Any Account information necessary to resolve the issue or claim.

Santander UK Cards Limited (UK) To conduct joint marketing campaigns for PayPal Credit, and PayPal MasterCard, risk modelling, enforce terms and conditions for PayPal Credit and PayPal MasterCard. Name, address, email address and account information (including, without limitation, account status).

PrePay Technologies Limited (trading as PrePay Solutions) (UK) To conduct joint marketing campaigns for PayPal pre-paid card and risk and fraud modelling and to enforce terms and conditions for PayPal prepaid card. Name, address, email address, date of birth and account information.

Société Générale (France), La Banque Postale (France), BNP Paribas (France) and Crédit Mutuel (France) Billing purposes. Only for merchants using PayPal through the partner’s payment solution: merchant ID, number of PayPal transactions, transaction volume with PayPal and, as the case may be, termination of the PayPal account.

Findomestic Banca (Italy), Cetelem S.A., Cofidis (France) and Cofinoga S.A. (France) Registration of the credit card issued by the credit company on the user’s PayPal account and the processing of funding requests made by the same user. Name, email address, date of birth (as the case may be), credit card number, expiry date, three digit Card Security Code (as the case may be) and amount of the funding request and any account information necessary for fraud or dispute resolution.

Cofidis (France) To allow payment processing, fraud checking and dispute handling for transactions done with Cofidis Name, email address, delivery and billing address, telephone number, date of sign-up, the number of payments received from verified PayPal users, whether the customer has been verified to have a bank account, details of transactions and details of unsuccessful payments

Deloitte Consulting Inc. (USA) Financial consulting support services. Customer name or business name, customer or business address, tax payer identification number, email address, telephone number, account number, account balance, account create date, type of legal entity, citizenship status.

Paga más Tarde (Spain) To allow payment processing, fraud checking and dispute handling for transactions done with Paga más Tarde. Full name, date of birth, age range, email address street address, city, state, country, account status, account type, account creation date, time zone, locale, language

Oney (Italy) (France) To allow payment processing, fraud checking and dispute handling for transactions done with Oney Name, email address, delivery and billing address, phone number, date of sign-up, the number of payments received from verified PayPal user, verification and transaction information.

Fichier des Incidents de Remboursement des Crédits aux Particuliers (FICP) (France) To allow for notification of over-indebtedness Name and relevant account and credit history information.

4. Commercial Partnerships

Royal Mail Group Plc. (UK) and Pitney Bowes Inc. (USA) To provide automated label printing for sellers using PayPal and eBay to facilitate postal and delivery services, payment reconciliation services and to assess risk, or to help detect, prevent and/or remediate fraud, or other potentially illegal acts and violations of policies Name, address, telephone number, email address, postage transaction amount, account details, IP address, information on shipping label printing, sales history and purchase history

Trustwave (USA) (UK) To provide customised services and assistance to Merchants using PayPal, and to facilitate the process of becoming PCI DSS compliant. Name, email address and PayPal account number.

Stubhub Services S.à.r.l. (Luxembourg) For the purposes of its AML and KYC requirements. First and last name, date of birth, residential address, nationality, national ID/passport number.

Harrow Council (UK) Pay out funds to benefit recipients using PayPal. All Account Information.

Cloud IQ(UK) Telesales and Customer Support for Business Customers Customer name, business name, telephone numbers, contact email addresses, website, business industry, number of PayPal transactions, transaction volume with PayPal, domestic / international transaction volume split, shipping details, card details for the payment.

Borderlinx (UK) To provide customised services and assistance to business customers using PayPal. Customer name, business name, telephone numbers, contact email addresses, website, business industry, number of PayPal transactions, transaction volume with PayPal, domestic / international transaction volume split, shipping details, card details for the payment.

WebInterpret (France) Providing assistance with PayPal services to business customers. Customer name, business name, telephone numbers, contact email addresses, website, business industry, number of PayPal transactions, transaction volume with PayPal, domestic / international transaction volume split, shipping details, card details for the payment.

Apple Inc. (USA) To verify identity and carry out checks for the management of risk, prevention and detection of crime including fraud. First Name, Last Name, Email, Whether email is verified, Telephone number, Address, Account Status Account Type, When account was opened, Whether customer purchased anything using PayPal within the last 30 days (Yes or No), Whether billing information changed within the last thirty days (Yes or No),

Schenker (SE) To facilitate shipping and make it easier to ship sold / bought items on the site Name, address, e-mail address, phone number

DHL (SE) To facilitate shipping and make it easier to ship sold / bought items on the site Name, address, e-mail address, phone number

Sello (SE) To service larger sellers, enable shop items, enable bulk listing and order management Name, address, e-mail address, phone number, alias

Twilio Inc (US) To verify customer identity and establish contact via phone, SMS or alternative messaging service. First name, phone number

Sutherland Global Services Inc. (USA and Philippines) To allow telephone and email customer support and marketing services. Name, address, telephone number, email addresses, truncated and limited or full funding source information (case dependent), funding source expiration dates, type of PayPal account, proof of identity, account balance and transaction information, customer statements and reports, account correspondence, shipping information, and promotional information.

Nuance Communications Inc. (USA) To calibrate and optimise speech recognition performance for telephone customer support services. Recordings of a sample of customer support telephone calls, which may include any or all account information transmitted during the call.

ICT Group Inc. (USA) To perform and facilitate telephone customer support. Name, address, telephone number, and PayPal account number.

Lithium Technologies Inc. (USA) To provide customer services arising from customer contacts to PayPal on social media channels. Information provided by the customer via social media channels which may include name, address, telephone number, email addresses, social media user names, truncated and limited or full funding source information (case dependent), funding source expiration dates, type of PayPal account, proof of identity, account balance and transaction information, customer statements and reports, account correspondence, shipping information and promotional information.

Attensity Europe GmbH To provide customer services arising from customer contacts to PayPal on social media channels. Information provided by the customer via social media channels which may include name, address, telephone number, email addresses, social media user names, truncated and limited or full funding source information (case dependent), funding source expiration dates, type of PayPal account, proof of identity, account balance and transaction information, customer statements and reports, account correspondence, shipping information, and promotional information.

ILinc Communications, Inc. (USA) To provide webinars (online seminars) to merchants on ILinc’s platform. Name, email address of merchants.

ePerformax Contact Centers & BPO (USA), To provide customer services regarding payments globally. Name, address, telephone number, email addresses, truncated and limited or full funding source information (case dependent), funding source expiration dates, type of PayPal account, proof of identity, account balance and transaction information, customer statements and reports, account correspondence, shipping information, and promotional information.

CallPoint New Europe AD dba TELUS International Europe (Bulgaria) To operate refunded returns service. Name, email address, PayPal transaction ID, return information (returned item category, reason for return, amount of return, currency, country of return, type of return) and shipping documentation evidence.

Key Performance Group SAS, France Administration of PayPal member referral program. First name, last name, email, customer ID, transaction information related to referral rewards.

New Relic, Inc. (USA) To provide analytics allowing us to troubleshoot errors in the service globally. Log Data and Aggregated data on the service performance.

PagerDuty, Inc. (USA) To alert on-call technicians that an email has arrived globally. Subject of the Email at issue.

Sumologic, Inc. (USA) To provide analytics allowing us to troubleshoot errors in the service globally. Log Data and Aggregated data on the service performance.

IPSA International To support investigation of suspicious activities related to money laundering, terrorist financing, and/or violation of Global Sanctions and corresponding reporting to regulatory agencies. Name, aliases, address, e-mail address, telephone numbers, time zone location, passport ID, nationality, date of birth, place of birth, gender, marital status, driver’s license ID, social security number or other government ID, transactional and account activity data, funding instrument (bank account, credit card number).

CCC Leipzig (Germany) CCC GmbH (Germany) Global Ops Customer service outsourcing for the German market. Full Name, Date of Birth, Email address, Physical address, Telephone number, Financials-bank, debit, and credit, Transaction history, Business details including URLs, SSN/TIN/EIN, IP Address Counterparty details.

Telus international Europe Customer service contact centre to check reasons for inactivity and investigate any technical issues or problems Name, telephone number, user type (based on number of transactions), email address, user technical historical data.

24/7 (Phillippines) Live chat and lead generation Information provided by the customer which may include name, address, telephone number, email addresses, previous chat histories.

Teleperformance (SE) (Germany) (Malaysia) To service our customers questions through phone, chat and email all account details

Kundo (SE) To enable customer service through email name, e-mail address, ip-numbers and email content

Servit (SE) To enable customer service through email name, e-mail address, ip-numbers and email content

Livechat (PL) Live chat and lead generation Information provided by the customer which may include name, address, telephone number, email addresses, previous chat histories.

Giesecke+Devrient Mobile Security GB Ltd (UK, DE, AT, FR, ES, IT, IR); Giesecke+Devrient Mobile Security America, Inc (UK, DE, AT, FR, ES, IT, IR), Giesecke+Devrient Mobile Security Iberia S.A. (UK, DE, AT, FR, ES, IT, IR) Manufacture and Mailing of Debit Cards Name, Shipping Address, Card Number, Expiry Date of the Card, CVV Code, encrypted PIN of the Card.

Aplazame SL. (Spain) Credit services Name, email address, type of account, relevant transaction information.

Ezbob Ltd (UK) To provide underwriting services for customers applying for business finance. Merchant name, Merchant address, Company Registration Number, Directors’ Details, Business Financial Details, Business name, Telephone number, Postal code, Business Address, Email Address and PayPal ID.

Notive B.V. (Netherlands) To facilitate merchant onboarding and transactions. Name, date of birth, address, email address, IP address, telephone number, device ID.

Facebook Inc (US) To facilitate payment processing on Facebook for the joint customers of Facebook and PayPal. Customer name. email address, account and transaction history

Matrix Global Services EAD (Bulgaria), Matrix Global Services EAD (Bulgaria) To provide underwriting services for PayPal customers applying for business finance. Management, risk and R&D services, implementation services and technical support for the provision of the underwriting services. Merchant name, merchant address, company registration number, directors’ data, business financial details, business name, telephone number, postal code, email address, and PayPal ID.

Land Registry Office (UK) To provide confirmation of physical address Address

AccountScore Limited (UK) Consents Online (UK) To enable open banking solutions on the Ezbob platform Bank account transaction data and account number / sort code are stored in a separate data store.

SendGrid Inc (US) To allow for customer communication for transactional and marketing emails. Name, email address, loan reference number, company name, broker invoice, broker firm name, bank account number, sort code, commission amount, payment method and last four digits.

Interactions Inc (US) To send automated customer emails and text messages. Full name, date of birth, gender, address, phone number, company information.

Logical Glue Limited (UK) To enable model building and decision system with reject and refer criteria for financing Company reference number, first and last name, date of birth, address, monthly payment amount.

Impetus Technologies Inc (US), Parkar Consulting Services (US), Blue Ally (US), Resource augmentation for PayPal partners Account details

Mitto (Switzerland), Tyntec (UK), Infobip (UK) To enable Provision of mobile network code of the MNO associated with the MSISDN provided by Company Telephone number

5. Marketing and Public Relations

Northstar Research Partners (USA) To conduct customer service surveys. Name, email address, type of account, type and nature of the PayPal services offered or used, and relevant transaction information.

Ipsos Mori UK Limited (UK), Ipsos GmbH (Germany), Ipsos SAS (France) and FactWorks GmbH (Germany), TNS Deutschland GmbH (Germany), The Tryst Market Research Limited (UK), The Modellers LLC (USA), Hall and Partners Europe Ltd. (UK), Hall and Partners LLC (USA), Factworks LLC (USA). To conduct customer service and marketing surveys. Name, email address, telephone number, country of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Lieberman Research Worldwide LLC (USA) To conduct customer service and marketing surveys. Name, email address, telephone number, country of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Forrester Research, Inc. (USA), Forrester Switzerland GmbH/Forrester Research BV (CH) To conduct customer service and marketing surveys. Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Opinion Labs Inc. (USA), Sky Cconsulting (FR), Acuity ETS Ltd. (UK),I + E Research (Germany) To conduct customer service and marketing surveys. Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Adwise (France) and Axance (France) To conduct marketing surveys. Name, email address, telephone number, type of account, type and nature of the PayPal services offered or used, and relevant transaction information.

BD Network Limited (UK), Tullo Marshall Warren Limited (UK), and MyCash (France), Crowd Guru (DE), To develop and execute customer promotions. Name, address and email address.

Salesforce.com,Inc. (USA) To store merchant contact information as well as other supporting information about the business relationship. Name, address, telephone number and email address, business name, URL PayPal Account ID and other supporting information about the business relationship, such as (without limitation) name of contact person and contact information at merchant and/or partner through which merchant has been onboarded, description of products sold through PayPal, communication notes and onboarding information, internal decisions about the merchant, revenue calculations and other information on the merchant’s business as made available by the merchant, and information relevant for special integrations of merchants, name and address of bank.

Clue PR (Poland), Daniel J Edelman Ltd (UK), Edelman.ergo GmbH (Germany, Austria, Switzerland), Edelman Spain, S.A. (Spain), Edelman S.A. (France), Edelman S.r.l. (Italy), Edelman Public Relations Worldwide B.V. (Netherlands), Southpaw Productions, s.r.o. (Czech Republic), Clue PR (Hungary), Georgia-Niki Christoula, Public Relations Consultant (Greece) Comit Communications & Marketing Limited (Ireland), Spotlight PR AB (Sweden, Norway, Denmark) To answer media enquiries regarding customer queries and assist PayPal in social media activities. Name, address, and all customer account information relevant to customer queries.

Alchemy Worx Ltd (UK) To allow management reporting of marketing campaigns. Name, email address and details of customer campaign interaction.

Carrenza Limited (UK) To hose a marketing database Name, address, email address, business name, domain name, account status, account preferences, type and nature of the PayPal services offered or used, and relevant transaction information.

Dataprovider B.V (Netherlands) To obtain marketing and business information for sales and Marketing purposes by acquiring and enriching business information and data profiles of new and existing customers Request ID, URL, Domain, Company Name

1000Mercis SA (France) and 1000Mercis Ltd (UK) To store user data to conduct marketing campaigns on behalf of PayPal. Name, email address, telephone number, type of account, type and nature of the PayPal services offered or used, and relevant transaction information.

A McLay & Company Limited (UK), TNT Post Italia (Italy) To assist in the execution of offline direct mail and marketing campaigns. Name, address, email address, business name, domain name, account status, account preferences, type and nature of the PayPal services offered or used, and relevant transaction information.

Datacolor Dialog-Medien GmbH (Germany), MEILLERGHP GmbH (Germany) and W & J Linney Ltd (UK) To assist in the execution of offline direct mail and marketing campaigns. Name, email address, address, business name, domain name, account status, account preferences, type and nature of PayPal services offered or used.

Medallia, Inc. (USA) To conduct customer service surveys. Name, email address, type of account, type and nature of the PayPal services offered or used, and relevant transaction information.

Endlichsommer- werbung in bester gesellschaft mbh (Germany) and Crossover Communication GmbH (Germany) To assist in the execution of offline direct mail and marketing campaigns. Name, address, business name, type and nature of PayPal services offered or used.

optivo GmbH (Germany) To send emails; email marketing. Name of the merchant, name of the contact person, email address, address, status, client ID and shop system.

Rapp (France), Rapp (UK), Antics (USA), Partner Path To develop, measure and execute marketing campaigns. Name, business name, address and registration number of merchant/partner, name, job, title, email address, telephone number of merchant’s contact person, merchant website URL, PayPal account number, third party applications used by the merchant, behaviour on PayPal Services website.

DemandGen AG (Germany) To execute e-mail marketing campaigns. Name, email address, telephone number, type of account, type, and nature of PayPal Services offered or used and relevant transaction information.

Business support services - b2s, SAS (France), Foule Access SAS (France) To store merchants' contact information for marketing communications to those merchants. Name of the merchant, name of the contact person, address, email address, telephone number, merchant website URL.

Consultix (France and Spain) and Quadro Srl (Italy) To host information provided by merchants and display part of this information on the pages of the PayPal website listing websites accepting PayPal and proposing special offers to PayPal users. All information provided by merchants in connection with their use of these pages of the PayPal website (including in particular name of the merchant, name of the contact, email address, logo and information relating to the promotion(s) offered to PayPal users).

Appnexus, Inc. (USA), BlueKai, Inc. (USA), Adobe Systems Incorporated (USA), Mediamath Inc. (USA), Criteo SA (France)(Sweden), TubeMogul Inc (USA), AdaptTV To execute retargeting campaigns in order to deliver personalised advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users. Encrypted e-mail address associated with PayPal users (without indicating account relationship).

Google Inc., Google Ireland, Ltd. (Ireland), Google (SE), DoubleClick Europe Ltd (UK), DoubleClick, a division of Google, Inc, Google Asia Pacific Pte. Ltd. (SG) To execute retargeting campaigns in order to deliver personalised advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users. Advertising ID and Device ID, encrypted e-mail address, Encrypted Customer ID, Encrypted Merchant ID, Transaction Value.

Conversant Inc. (USA), Commission Junction (USA), Conversant GmbH (Germany), Conversant International Ltd. (Ireland) To execute and measure retargeting campaigns in order to identify visitors and redirect them though personalised advertising campaigns. Hashed PayPal Account ID (as appropriate) as well as ,device ID used by a specific person, content of advertisements to be delivered, and segmentation in a user group for advertisement purposes.

LinkedIn Ireland Unlimited Company (Ireland), LinkedIn Corporation (US), LinkedIn Singapore Pte. Ltd. (SG) To execute retargeting campaigns in order to deliver personalised advertising. Business Name, Encrypted e-mail address associated with PayPal users (without indicating account relationship)

StrikeAd UK Ltd. (UK), Criteo Ltd. (UK), Criteo Singapore Pte. Ltd (SP), Tapjoy Inc (USA)., Supersonic Ltd., StrikeAd Inc. (USA), Exponential Interactive Inc (USA), InMobi (USA), MoPub Inc. (USA), AdMob Inc (USA), Millenial Media Inc (USA), Tapad Inc, Drawbridge Inc, Mobkoi, (UK) Fiksu, Inc. (USA), Nanigans, Inc. (USA), Eloqua, a division of Oracle Inc.,Criteo SA (France), Rocket Fuel, To execute and measure retargeting campaigns in order to segment users for marketing campaigns. Anonymous cookie ID, Advertising ID, and/or device ID to segment user groups for marketing purposes.

Fiksu, Inc. (USA) To execute and measure retargeting campaigns in order to segment users for marketing campaigns involving PayPal mobile applications. Device ID used for Apple’s iOS operating system when a user installs an application, signs up for the PayPal Services, logs in, checks in, or sets a profile picture.

Heaven SAS (France) To execute marketing campaigns for merchants. Name of merchant, merchant website URL, description of item purchased and price of item.

Wire Stone LLC (USA) To select, notify winners and prize fulfillment for winners of survey sweepstakes. To conduct customer service and marketing surveys. Name, email address, encrypted ID, country/city of residence/business, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Sotiaf Telematiques Associes SAS (France) To store user data for marketing campaigns and to execute direct marketing campaigns. Name, email address, and telephone number.

2engage (Germany) and Quo Vadis (Germany) To conduct market surveys. Name, company name, address, telephone number, domain name, e-mail address, type and nature of use of PayPal services, market segment and generalised categorisation of company size and information on participation in earlier surveys.

Facebook, Inc (US), Facebook Ireland Limited (Ireland), Twitter, Inc. (US),(Ireland) AdRoll, Yahoo, Facebook Business Manager (SE). To execute retargeting campaigns in order to deliver personalised advertising. Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with PayPal users (without indicating account relationship), IP Address, Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata via Facebook SDK in mobile apps.

SurveyMonkey(SE), (Spain),(US) (Portugal) To assist in carrying out user surveys, risk analysis, fraud prevention and risk management. Name, email address and details of customer campaign interaction, merchant name, registration date, incorporation date, website, current & expected CPV, purpose & nature of business, merchant risk analysis, requested transaction limits .

Marketing and Planning Systems, LLC. USA (USA), Dynamic Logic, Inc. (USA), GfK Custom Research LLC (USA), GfK Polonia Sp. z o.o. (Poland), Millward Brown, Inc. (USA) and Radius Global Market Research, LLC (USA) To conduct customer service and marketing surveys. Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Oracle America Inc. (USA), Oracle Corporation UK Ltd To develop, measure and execute marketing campaigns. Name, business name, address and registration number of merchant, name, job title, email address, telephone number of merchant’s contact person, merchant website URL, PayPal account number, third party applications used by the merchant, behaviour on PayPal website.

Nanigans, Inc. (USA), Fiksu, Inc. (USA), Ad- X Limited (UK); Criteo Ltd. (UK), Criteo Singapore Pte. Ltd Help identify behaviour in the mobile app in order to guide decision about targeted marketing; to help efficiently handling and optimising mobile campaigns on social networks and elsewhere in the web. Anonymous cookie ID, Advertising ID, and Device ID used by a specific person, events in the mobile app about the use of the mobile app by a specific user (including, without limitation, login, successful completion of the transaction), but no payment and financial information details. Content of advertisements to be delivered to specific users and, as appropriate, segmentation group to which such person belongs to for advertisement purposes.

Zeuner S.p.A. (Italy), Accueil Srl (Italy) and CallCenterNet Italy s.r.l. (Italy) To store merchants' contact information for marketing communications to those merchants. Name of the merchant, name of the contact person, address, email address, telephone number, merchant website URL.

Purepromoter Ltd t/a Pure360 To send service related and (depending on opt-in settings) promotional SMS messages to PayPal users. Mobile Number, name, address, email address, business name, business contact details, domain name, account status, account type, account preferences, type and nature of the PayPal services offered or used and relevant transaction and account information.

Iris (Germany) To develop, measure and execute marketing campaigns. Name, business name, address and registration number of merchant/partner, name, job title, email address, telephone number of merchant’s contact person, merchant website URL, PayPal account number, third party applications used by the merchant, behaviour on PayPal website.

OC&C Strategy Consultants Limited (UK) To conduct market research and develop insight. Anonymized account and transaction information.

PaketPLUS Marketing GmbH (Germany) Managing marketing campaigns, distributing flyers to merchants and follow up of the campaigns. Consumer name, Location, Nature and scale of fraud on the account, Business name.

Eye square GmbH (Germany) To conduct customer service and marketing surveys. To conduct customer service and marketing surveys.

Alliance Data FHC, Inc., trading as Epsilon International and/or Epsilon Communication Solutions, S.L To execute outbound communication campaigns including, but not limited to, email and push notifications. Contact information inluding, but not limited to, name, email, telephone number. Anonymous cookie ID, Advertising ID. Content of communications to be delivered to specific users and, as appropriate, segmentation group to which such person belongs to for communication purposes.

Visual IQ, Inc (USA), Visual IQ (Canada) Cross Device / Channel Measurement. Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with PayPal users (without indicating account relationship). Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages,ads and emails delivered to users.

aklamio GmbH (Germany, UK, Spain, France) aklamio implements referral marketing and cashback program to acquire new active PayPal consumers. encrypted consumer ID, the time, when the sign-up and first transaction was made.

Rakuten (Global) To execute retargeting campaigns in order to deliver personalised advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users.

Realzeit GmbH (Germany) To execute and measure retargeting campaigns in order to segment users for marketing campaigns, deliver personalized advertising. Anonymous cookie ID, Advertising ID, and/or device ID.

Trademob GmbH (Germany) To execute and measure retargeting campaigns in order to segment users for marketing campaigns, deliver personalized advertising. Anonymous cookie ID, Advertising ID, and/or device ID.

Maple Team Limited (Israel), Unique Digital Marketing Limited (UK), Havas Media (France), Havas Media Limited, Webguerillas GmbH (Germany), Spark Foundry GmbH (Germany) Online media agencies to buy digital media to advertise PayPal services and products. Email address, Device IDs

Affiperf Conversion Tag (Havas Trading Desk) – EMEA To execute retargeting campaigns in order to deliver personalised advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users.

Pandora To execute retargeting campaigns in order to deliver personalised advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users.

Affilio To execute retargeting campaigns in order to deliver personalised advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users.

Resultados Digitais To execute retargeting campaigns in order to deliver personalised advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users.

Netfluential Ltd. (UK) To conduct customer service and marketing surveys. Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Greenberg Inc. (USA) To conduct customer service and marketing surveys. Name, email address, telephone number, type of account, type and nature of the PayPal services offered or used and relevant transaction information.

LatentView Analytics Corporation (US, UK, India) To conduct customer service and marketing surveys. Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Hall & Partners Europe Ltd. (UK) To conduct customer service and marketing surveys. Name, email address, telephone number, type of account, type and nature of the PayPal services offered or used and relevant transaction information.

Firefish Ltd. (UK) To conduct customer service and marketing surveys. Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

FocusVision Worldwide Inc. (USA), Focus Vision Inc (UK) To conduct customer service and marketing surveys. Name, email address, telephone number, country/city of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys.

Clear Score Technology Ltd. (UK) To execute targeted campaigns in order to deliver personalised advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users.

VivaKi GmbH (Germany) To collect anonymous user information to efficiently optimize marketing campaigns. Help identify behaviour on PayPal websites in order to guide decision about targeted marketing and personalized advertising. Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads, apps and emails delivered to users. Information about device, browser, visited PayPal websites.

Adjust GmbH (Germany) Help identify behaviour in the mobile app in order to guide decision about targeted marketing; to help efficiently handling and optimising mobile campaigns on social networks and elsewhere in the web. Anonymous cookie ID, Advertising ID, encrypted customer ID, and Device ID used by a specific person, events in the mobile app about the use of the mobile app by a specific user (including, without limitation, login, successful completion of the transaction), but no payment and financial information details. Content of advertisements to be delivered to specific users and, as appropriate, segmentation group to which such person belongs to for advertisement purposes.

Quiller Consultants (UK) Support UK Government Relations work. PayPal marketing materials and product overviews. Occasional merchant case study. All other data shared will be public record e.g. consultation response. No customer or merchant specific data will be shared.

iProspect Search engine optimization to support PayPal marketing teams and provide feedback on web-design and site issues. Cookie ID, Customer ID, Country, account type, IP address.

Mozoo UK LTD, LoopMe Ltd., 4th Screen Advertising Ltd To execute and measure retargeting campaigns, to segment users for marketing campaigns, to deliver personalized advertising. Anonymous cookie IDs, Advertising ID’s, Aggregated data on installs, signups, and conversions

Crispin Porter Bogusky CP+B (UK) To execute and measure advertising campaigns Transaction Value (Donate only), Merchant ID

Altares D&B (EMEA), Informa (EMEA), Cerved (EMEA), Cribis D&B (EMEA), Dun & Bradstreet (EMEA). Marketing and business information for sales purposes, acquire and enrich business info of new and existing clients. External leads (prospect business information).

Fiksu Inc (USA) To execute and measure retargeting campaigns in order to segment users for marketing campaigns involving PayPal mobile applications. Device ID used for Apple’s iOS operating system when a user installs an application, signs up for the PayPal services, logs in, checks in, or sets a profile picture.

Market Bridge (USA) To segment customers to enable improved servicing Account ID, address, post code, account history, growth data including product utilisation and all transaction data.

Select Media Ltd (UK), AdCompass Ltd (UK), Cheetah Mobile Inc. (China), Fyber GmbH (Germany) To execute and measure retargeting campaigns in order to segment users for marketing campaigns. Anonymous cookie ID, advertising ID, and/or device ID to segment user groups for marketing purposes.

Debby and Ron digital LTD (IL) LLC Havas Digital (Havas Russia) Online media agency to buy digital media to advertise PayPal services and products. These agencies often process anonymous cookie, device ID’s, targeting lists, hashed email lists to reach our consumers via media networks.

Ogury Ltd (UK), Adara, Inc (USA), RadiumOne, Inc (USA), Microsoft Online Inc, Commission Junction (USA) To execute and measure retargeting campaigns in order to segment users for marketing campaigns, deliver personalized advertising. Anonymous cookie ID generated by cookies, pixel tags or similar technologies embedded in webpages and emails delivered to users, Advertising ID, and/or device ID.

Integral Ad Science, Inc. (USA), Moat, Inc (USA) Third party ad verification services Non-PII Behavioral signals with regards to online advertising activity

Hypothesis Inc. To conduct customer service and marketing surveys. Name, email address, telephone number, country of residence/business, encrypted ID, transaction frequency, recency and volume, type of account, exposure to marketing materials, exposure to product flows, type and nature of the PayPal products/services offered or used, customer service contact, merchant/consumer classification, number of merchant transactions, number of months active, other relevant account/transaction information, and all information obtained from surveys

Borek media GmbH (Germany) To assist in the execution of offline direct mail and marketing campaigns. Name, customer ID, email address, postal address, business name, domain name, account status, account preferences, type and nature of PayPal services offered or used.

LookBookHQ (Canada) To deliver services related to LookbookHQ content experience products Customer and prospect IP address, customer email address

Purestone TFM Limited (UK) To perform customer and prospect interviews and research as input to the creation of marketing communication assets like testimonials and success stories Customer business name, contact name, contact telephone number

Snap Inc. (USA) To execute retargeting campaigns in order to deliver personalised advertising. Advertising ID and device ID used by a specific person, install and in-app data based on those IDs

Mobext (UK) To execute retargeting campaigns in order to deliver personalised advertising. Advertising ID and device ID used by a specific person

Teads SA (France) To execute retargeting campaigns in order to deliver personalised advertising. Advertising ID and device ID used by a specific person, install and in-app data based on those IDs

Spotify AB (Sweden) To execute retargeting campaigns in order to deliver personalised advertising. Advertising ID and device ID used by a specific person, install and in-app data based on those IDs
