Moneris Payment Gateway

What Moneris is

Moneris is a major Canadian payment gateway and processor used by merchants to accept card payments online and in store. It offers hosted tokenization, which keeps payment details on Moneris systems while the customer stays on the merchant website. By handling the sensitive card data itself, Moneris helps merchants reduce their own exposure to cardholder information. It operates under the strict requirements of the Payment Card Industry Data Security Standard.

What data and cookies it collects

During checkout Moneris processes cardholder data such as the card number, expiry and security code, along with transaction amounts and identifiers. Its hosted payment pages and scripts may set cookies and use pixel tags, including a cookie that links a browser to tokenized card numbers, and in some deployments the Offlinx cookie. This information is personal data under the GDPR and includes financial details that are particularly sensitive. The card number itself is also regulated cardholder data under PCI DSS.

GDPR and ePrivacy implications

Processing payment data to fulfil an order generally rests on the performance of a contract under the GDPR, so consent is not required for the payment itself. However, any cookies that are not strictly necessary, such as marketing or analytics cookies set at checkout, still require prior consent under Art. 5(3) of the ePrivacy Directive. The merchant and Moneris must clarify their respective controller and processor roles and put an appropriate agreement in place. Transparency about the financial processing and the parties involved is essential.

Consent requirements

The payment processing does not need consent because it is necessary to perform the contract with the customer. Strictly necessary checkout cookies that simply make the payment work are also exempt from the consent rule. Any additional cookies used for marketing, fraud profiling beyond what is necessary, or analytics must be gated behind a consent banner. Where the Offlinx cookie or similar advertising features are present, they must remain off until the visitor opts in.

International data transfers

Moneris processes data in Canada, which benefits from a partial EU adequacy decision covering commercial activity under PIPEDA, so transfers from the EU to Canada require no additional safeguards. This is an important nuance that distinguishes Moneris from United States based providers. However, Moneris states it may transfer personal data onward to the United States and the Philippines, and those onward transfers need Standard Contractual Clauses, a transfer impact assessment and supplementary measures. The merchant should confirm where data actually flows and document the safeguards accordingly.

Practical compliance steps

Confirm the controller and processor roles with Moneris and conclude a data processing agreement that addresses cardholder data and onward transfers. Rely on hosted tokenization to keep card data out of your own systems and stay within PCI DSS scope. Gate any non essential checkout cookies behind a consent banner and disclose Moneris clearly in the privacy and cookie policies. Map the data flows to Canada, the United States and the Philippines, and document the adequacy decision and the clauses used.