MonoBill

MonoBill writes only strictly necessary first party cookies on the checkout and customer portal pages: a session cookie, a CSRF token, the cart contents, the currency choice and the signed in customer reference. No advertising or analytics cookies are set by the platform itself. localStorage is used for the cart and the currency selection. Anything beyond that, such as Google Ads conversion tags, Meta Pixel or Klaviyo events, comes from the operator and remains under its own consent regime.

No. The cookies and storage entries set by MonoBill are strictly necessary to deliver a service explicitly requested by the user (the contractual transaction). They fall under the second limb of Article 5(3) of the ePrivacy Directive and the equivalent national rules and do not require opt in consent. They must still be described in the cookie policy. Marketing pixels added on top of MonoBill keep their normal consent obligation.

The primary lawful basis is Article 6(1)(b) GDPR, performance of the sale contract. Article 6(1)(c) GDPR covers invoicing and the legal obligation to retain accounting records (typically 6 to 10 years in EU Member States). Article 6(1)(f) GDPR can support strictly scoped anti fraud controls. Choose the basis that fits the operation rather than relying on consent, which is inappropriate for billing.

In the default SaaS configuration MonoBill is hosted in the European Union and does not transfer billing data outside the EEA. If the operator connects MonoBill to a non EU payment service provider, tax engine or accounting tool, those downstream transfers become the operators responsibility. They must be backed by Article 46 GDPR safeguards (typically Standard Contractual Clauses plus a transfer impact assessment) and documented in the record of processing.

A DPIA is generally not required for routine billing performed under contract performance and legal obligation. Trigger a DPIA when MonoBill feeds large scale automated decisions, customer profiling or anti fraud scoring with significant effects, or when the platform is integrated with sensitive flows (health, children, vulnerable users). Document the assessment outcome even if you decide that no full DPIA is required.

Sign a Data Processing Agreement with MonoBill and list it in your record of processing as a processor. Update the privacy notice with the EU hosting location, the categories of data processed, the legal retention period and any downstream payment providers. Display the strictly necessary cookies in the cookie table. Restrict access to the MonoBill back office via SSO and per role permissions and enable two factor authentication for finance and admin users.

EU based alternatives include Paddle MoR, Lemon Squeezy EU entity, Chargebee EU residency, Recurly EU, Mollie Subscriptions and self hosted options such as Lago or Killbill on EU infrastructure. The choice depends on whether you want a Merchant of Record handling sales tax, whether you need pure subscription management or a full checkout, and the level of automation around accounting and dunning.

Add a section for MonoBill in the cookie policy listing each strictly necessary cookie (name, purpose, retention) even though no consent is required. Mention the lawful basis (contract performance and legal obligation), the EU hosting location and the downstream payment providers used. Update the record of processing activities and the privacy notice in parallel and notify any downstream tools that scan the site for tracker changes.