Data Processing

Last updated: September 9, 2026

Status of this page

This page explains how Pleezpay handles personal data on behalf of its customers and what its Data Processing Agreement (DPA) contains. The DPA itself is available on request to customers and to prospective customers evaluating Pleezpay. It is signed together with the customer agreement. Once signed, the DPA prevails over this page and over the Privacy Notice for the processing it covers. This page is a plain explanation, not the agreement, and it does not create or modify a contractual obligation.

1. Controller and processor roles

Pleezpay provides payment orchestration software and payments advisory. For the personal data of its own website visitors, prospects, partners and customer account holders, Pleezpay decides why and how that data is used and acts as the controller. That processing is described in the Privacy Notice.

When Pleezpay processes transaction and shopper data on behalf of a merchant customer, the customer determines the purposes and means of the processing and is the controller. Pleezpay acts as its processor, or as its service provider under California law, and processes that data only under the customer agreement and the DPA.

Customer data in this context means the personal data Pleezpay handles for a customer through the platform: payment sessions, transaction metadata, shopper contact and billing details submitted at checkout, order references, webhook records and dispute records. It also includes configuration and support information that a customer or its authorized users provide so that Pleezpay can operate the service for them.

Card data entered on the hosted payment page is transmitted to the connected payment provider that processes the payment. That provider handles it under its own terms, regulatory permissions and card scheme obligations. The DPA describes this boundary; it does not make Pleezpay an acquirer, payment institution or card scheme member.

2. What the DPA covers

The DPA contains the terms that data protection law requires between a controller and a processor. In plain terms:

  • Subject matter and duration: the processing needed to provide the subscribed services, for as long as the customer agreement runs plus the return or deletion period at the end.
  • Nature and purpose: creating and operating payment sessions, routing payments to connected providers, normalizing payment status, delivering webhooks, reconciling outcomes, supporting refunds and disputes, reporting and customer support. Pleezpay does not process customer data for any other purpose without a documented instruction.
  • Categories of data and data subjects: an annex lists the personal data involved (such as name, email address, billing address, phone number, order and payment references, payment method type and status, device and network details captured at checkout, and dispute correspondence) and the people concerned (shoppers and payers, the customer’s staff and authorized users, and other people named in an order).
  • Documented instructions: Pleezpay processes customer data only on the customer’s documented instructions, which are the agreement, the DPA and the configuration the customer makes through the dashboard or API. Pleezpay tells the customer if it believes an instruction breaches data protection law, and informs the customer before processing that a law requires, unless that law prohibits the notice.
  • Confidentiality of personnel: people authorized to process customer data are bound by confidentiality obligations, and access is limited to what their role requires.
  • Security measures: technical and organizational measures appropriate to the risk of the processing. The DPA’s security annex refers to the control set published on the Security & Trust page, which states what is in place and what is not claimed. Pleezpay makes no PCI DSS, SOC 2 or ISO certification claims.
  • Subprocessors: the customer gives general written authorization for the subprocessors listed on the Subprocessors page. Pleezpay gives advance notice of an intended addition or replacement within the notice period stated in the DPA, the customer may object on reasonable data protection grounds, and if no solution is found the customer may terminate the affected service as the DPA sets out. Pleezpay passes equivalent obligations on to each subprocessor and remains responsible to the customer for their performance.
  • Assistance: Pleezpay helps the customer respond to data subject requests for access, correction, deletion, restriction, objection and portability that concern customer data, and helps with data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to Pleezpay. A request that reaches Pleezpay directly is passed to the customer.
  • Personal data breach: Pleezpay notifies the customer of a personal data breach affecting customer data without undue delay and within the period stated in the DPA, provides the information reasonably needed for the customer’s own notifications, and cooperates on containment and remediation. Notification is not an admission of fault.
  • Deletion or return at end of service: at the customer’s choice, Pleezpay returns or deletes customer data after the service ends, within the window stated in the DPA, and deletes remaining copies. Data that legal, tax, dispute or accounting duties require Pleezpay to keep is retained only for that purpose, stays protected under the DPA and is deleted when the duty ends.
  • Audit and information rights: Pleezpay makes available the information reasonably needed to demonstrate compliance with the DPA, answers security questionnaires, and allows audits, including inspections, by the customer or an independent auditor the customer mandates, under the frequency, notice, confidentiality and scope conditions set out in the DPA.
  • Liability: liability under the DPA follows the caps, exclusions and remedies in the customer agreement, except where data protection law does not allow it.

3. International transfers

Pleezpay is US based and processes customer data in the United States and in the countries where its subprocessors operate. Where customer data originates in the European Economic Area, the United Kingdom or Switzerland, the DPA incorporates the European Commission’s standard contractual clauses of 2021: module two where the customer is a controller and module three where the customer is itself a processor. For UK data the clauses are supplemented by the International Data Transfer Addendum issued by the Information Commissioner’s Office. For Swiss data they are adjusted as the Federal Data Protection and Information Commissioner requires, so that references to the GDPR are read as references to the Federal Act on Data Protection, the FDPIC is the competent authority and Swiss data subjects are covered. Where an adequacy decision or another recognized mechanism applies, Pleezpay may rely on it instead.

On request, Pleezpay provides a transfer impact assessment describing the laws and practices of the destination country, the safeguards in place and the supplementary measures relied on, so that the customer can complete its own assessment.

4. California and other US state privacy laws

For personal information covered by the California Consumer Privacy Act, as amended, and similar US state privacy laws, the DPA contains the terms those laws require of a service provider, contractor or processor. Pleezpay processes customer data only for the specific business purposes described in the agreement; does not sell or share it; does not retain, use or disclose it outside the direct business relationship with the customer or for any other commercial purpose; does not combine it with personal information received from other sources except as those laws permit; provides the same level of privacy protection the law requires of the customer; notifies the customer if it determines that it can no longer meet these obligations; allows the customer to take reasonable steps to verify compliance and to stop and remediate unauthorized use; and assists the customer in responding to consumer requests to know, delete, correct and limit. Pleezpay passes the same requirements on to its subprocessors.

5. Payment providers and independent controllers

The DPA covers the processing Pleezpay performs for the customer. Connected payment providers process transaction and card data under their own terms, regulatory permissions and merchant onboarding decisions. For fraud prevention, sanctions screening, financial crime controls and regulatory reporting, a provider may act as an independent controller and decide for itself how it uses the data it receives. Each provider that receives customer data through the platform, and the role it plays, is listed on the Subprocessors page, and each provider’s own privacy notice describes its processing. Pleezpay is not responsible for processing a provider carries out as a controller, and provider terms apply independently of the DPA.

6. How to request the DPA

Email [email protected] with “DPA request” in the subject and include:

  • the legal entity name, registered address and jurisdiction of the contracting customer;
  • the name and role of the person who will sign;
  • whether personal data from the European Economic Area, the United Kingdom, Switzerland or California is in scope, so that the right transfer clauses and state law terms are attached; and
  • the product or agreement the DPA relates to, such as a platform order form, hosted checkout, a plugin integration or an advisory engagement.

Pleezpay replies with the current DPA and its annexes (processing description, security measures, subprocessor list and transfer clauses) for signature alongside the customer agreement. Prospective customers evaluating Pleezpay may request the DPA before signing so that their legal and compliance teams can review it. Where a customer’s own regulatory position requires its own DPA template, Pleezpay can review it, subject to agreement between the parties on scope, timing and any differences from the standard terms.

7. Related documents

Back to home