Privacy Statement

Last updated 27/07/2026

Our privacy statement has been translated into multiple languages. You can find the languages available below. In case of a discrepancy, the English version prevails.

German
⁠Spanish
⁠French

1. Introduction

This privacy statement ("Privacy Statement") describes how Mangopay processes your Personal Data and outlines your rights under applicable data protection laws, including Regulation (EU) 2016/679 of April 27, 2016, also known as the General Data Protection Regulation ("GDPR") and the UK Data Protection Act 2018. "Personal Data" refers to any information related to an identified or identifiable individual, in line with applicable data protection laws.

This Privacy Statement is issued on behalf of our entities that process your Personal Data, i.e., either Mangopay S.A. or Mangopay UK Ltd. These entities act as separate data controllers and are each responsible for their own processing activities carried out for the provisions of their services, unless in cases identified in this Privacy Statement where the entities act as joint controllers. Consequently, any references to "Mangopay," "we," or "our" pertain to the specific entity responsible for processing your Personal Data, as detailed in the "Country specific information" section.

2. Does this Privacy Statement apply to you?

This Privacy Statement applies to you if you engage with Mangopay’s payment and electronic money services through online platforms (websites or mobile applications) (“Platforms”) operated by our partners (“Partners”). These Partners manage Platforms for various purposes, such as online sales, marketplaces, or participative funding (e.g., donation or crowdfunding). They have integrated Mangopay's payment solution to process transactions on their Platforms. Mangopay and the Partners operate as separate data controllers regarding the processing of Personal Data taking place to provide Mangopay’s services.

When you register on these Platforms, you may be required to also register for Mangopay’s services, enabling you to transfer funds or receive payments related to transactions conducted on the Platforms. To deliver these payment or e-money services, Mangopay needs to process your Personal Data.

In this Privacy Statement, "you" refers to natural persons who interact with Mangopay in one or more categories listed in Section 3 below. This Privacy Statement does not apply to you if you are a job applicant, or a current or former employee of one of our entities. In these contexts, you are provided with a specific privacy statement, either during the job application process or in the course of your employment with Mangopay.

3. What Personal Data is processed by Mangopay?

When you interact with Mangopay and/or use our services, we process your Personal Data as described in this table.

Your Category	Categories of Personal Data	Purpose of Processing	Legal Bases	Additional information
Users who registered for Mangopay’s services via a Partner’s platform	Minimum registration data we collect is names, date of birth, nationality, country of residence and email address. In addition, we also collect: For our anti-money laundering and counter financing of terrorism (AML/CFT): supporting documents such as a copy of an official identity document (e.g., ID card, passport or driver’s licence) and any other information or document necessary to meet AML/CFT obligations. A selfie or video for liveness check. For strong customer authentication (SCA): email address, phone number and technical information about the SCA session (i.e., data about your device, browser and network) For U.S. tax payers: Taxpayer Identification Number (TIN) Data processed to provide payment & e-money services: transaction data (e.g., amounts transferred, transaction information, recipients); bank account information, credit card information.	Open your account with Mangopay and enabling payment and e-money services for you Conduct fraud detection and prevention, including through profiling techniques, and security checks Meet our AML/CFT obligations Prepare aggregated statistical data	Performance of a contract: to initiate and provide you payment and e-money services based on our Terms & Conditions Comply with our legal obligations: to verify your identity, including through the analysis of a copy of your identity document and through a liveness check, in accordance with applicable laws for AML/CFT and payment services regulations (e.g., the Payment Services Directive (EU) 2015/2366 and its subsequent updates). These legal obligations are critical for Mangopay’s responsibilities as a licensed institution for payments and e-money services. Our legitimate interest: to detect and prevent fraud and ensure the security of transactions and our services in general and to improve the quality of our services through aggregated statistical data analysis, as well as to defend ourselves against legal claims and manage legal disputes.	As part of our AML/CFT due diligence, we perform a liveness check which requires you to provide a real-time selfie or video of yourself. This mandatory identity verification may take place either directly when you register via the Partner’s platform or later upon your first transaction. If you do not provide the necessary Personal Data, we will not be able to provide you with our services as this would go against our obligations as a licensed institution. For fraud prevention and AML/CFT purposes, we use profiling to automatically process your Personal Data. Decisions based on profiling may or may not involve human intervention depending on the circumstances, and may result in temporarily blocking a payment, delaying a payout, or limiting access to your account if we detect suspicious activity. These decisions may produce legal effects or similarly affect you significantly, but they are necessary to ensure the security of transactions and our services, to prevent fraud, money laundering and terrorism financing. It is a critical part of the services we provide to keep payments secure. Your Personal Data is collected directly through Mangopay’s API on the Partner’s Platform, which serves as the technical infrastructure for processing payments. Providing your Personal Data is mandatory for registering for our services. The specific categories of Personal Data required is clearly indicated on the registration forms available on the Partner’s Platform. If you choose not to provide the necessary Personal Data, it may result in the refusal or suspension of Mangopay’s services.
	Data used for our customer support services: identification data such as names, email address, internal technical identifiers (e.g. user ID) and phone number, data about the use of our services, content of your communication with our support team, phone call recordings (for training and quality control only)	Process and answer your support request as well as to maintain the quality and continuity of our regulated and customer care services	Performance of a contract: to ensure the high quality of our services. Our legitimate interest: to process your queries, to improve the quality of our customer service experience and to defend ourselves against legal claims and manage legal disputes.	Providing this data is mandatory to allow us to respond to your requests and communicate with you effectively. Failure to provide the necessary Personal Data may prevent Mangopay from addressing your queries and assisting with troubleshooting. If you do not wish to be recorded on the phone, you may object to the recording by informing the agent you are speaking on the phone with.
Users who make payments on a Partner’s platform without registering for Mangopay’s services	Data used to make a payment with a card or other payment methods: payment details (card number, CVV, expiry date, and other types of card data depending on the payment method you selected), transaction data, and technical data (IP address, device ID, and electronic identifiers).	Execute payment orders Ensure security, including fraud detection and prevention	Our legitimate interest: to execute the payment, to resolve any issue relating to the payment, to improve the quality of our services, to ensure security and prevent fraud on our services, and to defend ourselves against legal claims and manage legal disputes.	Your Personal Data is collected directly from you. Providing this data is necessary, if you fail to provide the required information, we will be unable to process your payment.
	Data used for identity verification: copy of identity documents or any data	Ensure security, including fraud detection and prevention	Our legitimate interest: to detect and prevent fraud and financial crime activities	We may collect your Personal Data either directly from you or through the Partner you registered with and made a payment without registering to Mangopay’s services
Partners’ Legal Representatives, Beneficial Owners, and Business Contacts & Partners who are Sole Traders	Data collected to conclude a contract with Mangopay: identification and supporting documents (e.g., names, tax identification details, address, countries of residence, copies of identity documents), professional details (e.g., job position), contact information (email addresses, phone numbers).	Conclude the contract between Mangopay and the Partner for our services Verify the identity of the contracting entity Disclose information following the termination of the contract with card schemes in accordance with direct acquiring card schemes obligations imposed on Mangopay	Comply with our legal obligation: to verify your identity and provide appropriate AML/CFT training (for Partners acting as Mangopay’s agents) in line with our AML/CFT obligations Performance of a contract: to provide Mangopay’s services and register you to our services Our legitimate interest: prevent fraud and defend ourselves against legal claims and manage legal disputes; and to comply with card schemes conditions imposed on Mangopay	The exact list of required documents and Personal Data may vary depending on individual circumstances. The provision of Personal Data is mandatory to enable the delivery of our services. Failure to provide the required Personal Data may prevent us from concluding a contract with you and, consequently, from providing Mangopay’s services to the Partner. If Mangopay’s Partner has been appointed as an agent: your contact details may be relied on to contact you for mandatory AML/CFT training purposes.
	Data collected through Mangopay’s technical interfaces (HUB and dashboard): identification data (names, email address), job position, technical logs for interface access and session recordings.	Ensure the security and access management of the interfaces and improve user experience	Our legitimate interest: to ensure the delivery of high-quality services to the Partner and monitor transactions, to solve any technical issues detected on Mangopay’s technical interfaces, to prevent fraud and secure our interfaces and services, and defend ourselves against legal claims and manage legal disputes.	Provision of Personal Data is mandatory in order to access our HUB and Dashboard. Refusal to provide the required Personal Data will prevent access to the interfaces.
	Customer support data: identification data (e.g., names); contact information (phone number and email address); content of communications with the support team	Process and answer the Partner’s support request and maintain the quality and continuity of our services	Our legitimate interest: to handle customer support requests and other inquiries, to improve the quality of our services and our customer service experience, and defend ourselves against legal claims and manage legal disputes. Consent: to record your meetings with our strategic account managers (SAM) team.	When addressing your request, you may be interacting with an Artificial Intelligence (“AI”) technology which may provide you with an output to help answer your request. The reliance on an AI will be clearly indicated in the chatbot and you will always have the possibility of choosing to interact with one of Mangopay agents instead. Except for the recording of your meeting with your CSM which requires your consent, providing your Personal Data is mandatory in order to enable responding to your queries and contacting you. Refusal to provide the required Personal Data may result in Mangopay’s inability to respond to your queries and help with troubleshooting. If you do not wish to be recorded, you may object to the recording by informing the agent you are speaking on the phone with. If you provide your consent, the Partner’s CSM also has the possibility of recording your meetings (i.e., voice and/or image).
	Data for marketing activities: contact information, job position. Voice and image if you consent to the recording of meetings.	Market our services to you.	Our legitimate interest: upsell our services and enhance the quality of our services and the customer service experience Consent: to record meetings with our strategic account managers team.	Your Personal Data is collected directly from you, on a voluntary basis.
Mangopay’s business contacts	Data for direct marketing: name, job position and employer name, corporate contact information, information available on LinkedIn and CV; information obtained via professional databases or obtained during events to which Mangopay participates.	Business development outreach	Our legitimate interest: direct marketing for our services	Mangopay S.A. and Mangopay UK act as joint controllers for this activity. In that context, Mangopay S.A. is the entity responsible for (i) collecting any legally required consent, (ii) complying with transparency obligations, data transfer restrictions and concluding data processing agreements with vendors acting as processors (e.g., for hosting purposes). All other obligations remain with each individual entity as a controller.
	Data to respond to a contact request: names, job position and employer, corporate contract information and any personal data you may include in your queries.	Handle your query received through online forms or directly with our business development team	Our legitimate interest: upsell our services. Consent: to record meetings with our business development teams.	Provision of your Personal Data is voluntary, but if you don’t provide us with your basic contact details (name, surname and either phone number or email address), we will not be able to respond to your query. The information above regarding Mangopay S.A. and Mangopay UK as joint controllers applies here.
	Data obtained through a marketplace solution provider: names, job position and employer, corporate contract information.	Evaluate Mangopay’s services suitability based on your integration with the marketplace software solution provider we partner with.	Our legitimate interest: promote our services tailored for your integration with the marketplace software solution provider.	The information above regarding Mangopay S.A. and Mangopay UK as joint controllers applies here.

4. How long do we keep your Personal Data?

We keep your Personal Data for as long as necessary to fulfill the purpose(s) for which it is processed. We rely on legally required data retention periods when they apply, such as in the following contexts:

AML/CFT compliance: Personal Data provided for AML/CFT purposes, including identification documents and transaction details, are retained from five (5) to ten (10) years, starting from the end of the contractual relationship with Mangopay.
Disputes and support communications: Personal Data needed to manage disputes and communications with our support team will be retained for five (5) years.
Phone calls and meetings recordings: Phone calls recordings made for training and quality control purposes are kept for six (6) months. Recordings of meetings with our sales and business development teams are kept for one (1) year.
Marketing purposes: Personal Data used for marketing purposes, based on our legitimate interest, will be processed throughout our relationship with the Partner and for up to three (3) years after the last contact with the Partner.
Log data: Personal Data stored in logs will be kept for six (6) months.
Accounting data: Personal Data necessary for accounting will be retained for ten (10) years from the end of the relevant accounting period.

5. Where is your Personal Data stored?

We store your Personal Data on cloud servers located in Ireland (Dublin) and Germany (Frankfurt). Sometimes, we may need to transfer your Personal Data to companies outside the EU/EEA to help us provide our services. When we do this, we make sure your Personal Data is protected by using valid safeguards such as the European Commission’s adequacy decisions or Standard Contractual Clauses, and we follow the guidelines of competent authorities about international data transfers.

6. Is Your Personal Data shared with third parties?

As part of our services, your Personal Data may be shared with:

⁠⁠⁠6.1. Affiliates

We share your Personal Data with Mangopay’s affiliated companies to fulfill the purposes outlined in this Privacy Statement.

⁠6.2 Competent authorities

We may need to disclose your Personal Data to legal authorities, such as courts, privacy regulators and financial regulators. Before sharing, our legal team reviews each request to ensure it is legitimate.

⁠6.3 Processors

We work with selected service providers to deliver part of our services. These providers are bound by strict contractual obligations to only process your Personal Data as instructed by Mangopay. For instance, Mangopay uses service providers specialized in AML/CFT and KYC verifications, such as Entrust and Trulioo.

⁠6.4 Payment partners

We collaborate with payment partners to process transactions and protect your funds. These partners act independently and only receive the data necessary to complete the transaction. The legal basis for sharing your Personal Data with these partners is either the performance of our contract with you or our legitimate interest in ensuring proper payment processing or complying with the payment partners’ rules. For instance, we may share your personal data with card scheme companies such as Mastercard and Visa. Data is shared as part of our activities to detect and prevent fraud events. For more information about how these recipients process your personal data, please read their privacy statements.

As part of our partnership with American Express as a payment facilitator, your personal data may be processed by American Express for the following purposes:

To manage its regulatory and reputational risks and to comply with applicable laws, including AML/CFT laws.
To manage its business risks such as fraud, credit, operational, and reputational and security risks to prevent fraud or any other unlawful activities.

For additional information on American Express’ processing activities, please consult their online privacy statement:

6.5. Mangopay’s Partners

If you are acting as a Mangopay user (whether you have registered for our services or simply made a payment on a Partner’s platform), your Personal Data may be shared with our Partners under certain circumstances, such as for answering a customer support request, investigating a fraudulent transaction, for the Partner’s audit purposes, or helping the Partner with a refund request.

7. What are your rights regarding your Personal Data?

7.1 Right of access

You have the right to know what Personal Data we hold about you and how it is being processed. We’ll provide this information electronically unless you request a different format, which we’ll try to accommodate.

⁠7.2 Right of rectification

If your Personal Data is incorrect or incomplete, you can ask us to correct or update it.

7.3 Right to erasure (“Right to be forgotten”)

You can ask us to delete your Personal Data if:⁠

It is no longer needed for the purposes for which it was collected;
It was processed illegally;
You withdraw your consent (if consent was the legal basis for the processing);
You object to the processing based on your specific situation, and there are no overriding interest for Mangopay to continue the processing;
You object to its use for direct marketing;
We are legally required to erase it.

However, your request may be denied if we need to keep your Personal Data to exercise our right to freedom of expression and information, defend legal claims, or comply with legal obligations, such as for AML/CFT purposes.
⁠

⁠7.4 Right to restrict processing

You can ask us to limit how your Personal Data is processed if:

You contest its accuracy;
The processing is unlawful but you prefer restriction over deletion;
We no longer need your Personal Data but you need it to establish or defend legal claims;
You objected to our processing based on our legitimate interest and we are still reviewing your request.

In case restriction is implemented, we’ll inform you before it is lifted.
⁠

7.5 Right to object to processing

You can object to our processing of your Personal Data if it is based on our legitimate interests, unless we can demonstrate compelling reasons to continue the processing. You can also object to the use of your Personal Data for direct marketing at any time.

⁠7.6 Right to data portability

If our processing is based on your consent or a contract, and is done via automated means, you have the right to receive your Personal Data in a machine-readable format and request its transfer to another controller, if technically possible.

7.7 Right to withdraw your consent

If our processing is carried out on the basis of your consent, you have the right to withdraw it at any time. Withdrawal will not affect the legality of prior processing.

⁠7.8 How to exercise your rights?

Please consult the “Country specific information” section of this Privacy Statement to learn how to exercise your rights with Mangopay.

8. How is your Personal Data secured?

We use various security measures, including encryption and pseudonymization, to protect your Personal Data from unauthorized access, loss or alteration.

9. Country-specific information

9.1 European Union/European Economic Area (EU/EEA)

If you are using the services of one of our EU/EEA-based Partners, the following additional information applies:

Mangopay S.A. is the data controller responsible for processing your Personal Data in connection with its payment or e-money services. Mangopay S.A. is a company registered in Luxembourg, with its registered office at 4 rue du Fort Wallis, L-2714 Luxembourg.

Personal Data collected and processed under Mangopay S.A.'s AML/CFT obligations will be retained for ten (10) years, starting from the end of your contractual relationship with Mangopay S.A.

To exercise your data rights, you can contact Mangopay S.A. directly at: dpo.mangopay@mangopay.com.

If you believe your rights have been violated in relation to the processing of your Personal Data, you have the right to file a complaint with the Commission Nationale pour la Protection des Données (CNPD) at any time. You can submit a complaint form here. You can also contact any other national data protection authority in your country.

9.2 United Kingdom (UK)

If you are using the services of one of our UK-based Partners, the following additional information applies:

Mangopay UK Limited is the data controller responsible for processing your Personal Data in connection with its payment or e-money services. Mangopay UK Limited is registered in the UK, with its registered office at 32-34 Great Marlborough Street, London, England, W1F 7JB, United Kingdom. It is also registered with the Information Commissioner’s Office (ICO) under registration number ZB710243.

Personal Data collected and processed under Mangopay UK Limited’s AML/CFT obligations will be retained for five (5) years, starting from the end of your contractual relationship with Mangopay UK Limited.

To exercise your data rights, you can contact us directly at: uk.dpo.mangopay@mangopay.com.

If you believe your rights have been violated in relation to the processing of your Personal Data, you have the right to file a complaint with the Information Commissioner’s Office (ICO). You can submit a complaint form here.

10. Changes to this Privacy Statement

This Privacy Statement may be updated to reflect changes in our practices, business model or legal requirements. The latest version will always be available on our website, with the date of the last update clearly indicated.