> Paddle as a merchant of record and the GDPR: UK adequacy, EU hosting on AWS, checkout cookies and how billing data is shared with SaaS sellers. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/paddle E-commerce # Paddle Preferences · [Official website](https://paddle.com/) Paddle is a UK-based merchant of record (MoR) payment platform widely used by SaaS companies in Europe to outsource billing, EU VAT collection, fraud prevention and reporting. Primary processing happens on AWS EU regions; the UK benefits from an EU adequacy decision. Paddle hosted checkout sets only strictly necessary first-party cookies, and as merchant of record Paddle handles VAT and invoicing on behalf of the seller. [Block Paddle until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Not required - Documented cookies 3 - Third-party domains 4 - Servers European Union (Paddle.com Market Limited, London, United Kingdom; primary EU processing on AWS regions in Frankfurt and Dublin) Overview ## What does Paddle do? ## **What is Paddle?** Paddle is a UK based payment platform founded in 2012 in London, operating as a merchant of record (MoR) for software and digital products. Sellers integrate Paddle Checkout or Paddle Billing API; Paddle then handles card processing, fraud prevention, EU VAT calculation and remittance, invoicing, dunning and chargebacks on behalf of the seller. It is widely used by European SaaS companies to outsource compliance heavy billing operations. ## **Cookies and data collected** Paddle processes payment data submitted by the customer (card number, billing address, IP, country for VAT determination), order metadata sent by the seller, risk signals required for fraud prevention and SCA, and the customer email used for receipts and invoices. On the Paddle hosted checkout overlay, only strictly necessary first party cookies are set: a session cookie, a CSRF token and a small risk score cookie used for fraud prevention. No advertising or behavioural cookies are deployed. ## **GDPR and ePrivacy implications** For the cookies set on the Paddle checkout, the strict necessity exemption of Art. 5(3) ePrivacy applies. Payment data is processed under contract performance (Art. 6(1)(b) GDPR) and AML, EU VAT and tax record keeping under legal obligation (Art. 6(1)(c)). Because Paddle is the merchant of record, it acts as the controller for parts of the transaction (notably tax compliance and chargebacks) and as a processor for other parts. Update your privacy notice accordingly. ## **Data transfers and hosting** Paddle.com Market Limited is incorporated in the United Kingdom, which benefits from a European Commission adequacy decision. Primary processing happens on AWS EU regions in Frankfurt and Dublin, with replication to the UK and limited US sub processors used for fraud prevention and observability. Standard Contractual Clauses are included in the Paddle DPA for any non adequate transfer. ## **Practical compliance steps** Sign the Paddle DPA from your dashboard. Mention Paddle as a merchant of record and processor in your privacy notice with the UK adequacy and the EU AWS hosting. Use the hosted Paddle Checkout to limit your PCI DSS scope. Configure SCA and risk rules to comply with PSD2. Define a retention period for transaction metadata aligned with your AML, EU VAT and tax obligations. Document the merchant of record split of responsibilities (taxes, chargebacks, refunds). Compliance ## Paddle and the GDPR - Legal basis Contract performance (Art. 6(1)(b) GDPR) for processing payment data necessary to complete a transaction the customer has initiated. Legal obligation (Art. 6(1)(c)) for AML, EU VAT and tax record keeping (Paddle acts as merchant of record). Cookies on the Paddle hosted checkout are strictly necessary and exempt from consent under Art. 5(3) ePrivacy. - Risk level low - Applicable regulations GDPR, UK GDPR, ePrivacy Directive 2002/58/EC, PSD2, EU VAT Directive (Council Directive 2006/112/EC), AMLD5, PCI DSS ### Impact assessment (DPIA) A DPIA is generally not required for standard SaaS subscription billing through Paddle. It may become relevant when combined with extensive customer profiling, cross border product flows or special category data tied to subscription tiers. ### Sample text for your banner > Payments and invoicing on this site are handled by Paddle (Paddle.com Market Limited, United Kingdom), our merchant of record. Paddle processes your payment data and EU VAT under the contract and legal obligations on EU AWS infrastructure. See our privacy policy for details. Cookies and trackers ## What Paddle sets and contacts - Tracking method merchant of record SaaS payment platform; hosted Paddle Checkout overlay or Paddle Billing API with first party session and risk cookies on the Paddle hosted pages - Server location European Union (Paddle.com Market Limited, London, United Kingdom; primary EU processing on AWS regions in Frankfurt and Dublin) - Cookieless mode available Yes - Data transferred outside the EU Paddle.com Market Limited is a UK company. The UK benefits from a European Commission adequacy decision under the GDPR. EU customer data is processed primarily on AWS EU regions (Frankfurt, Dublin) with replication to the UK and limited US sub processors for fraud prevention. Standard Contractual Clauses are included in the Paddle DPA for any transfer outside the EEA or the UK. ### Cookies set (3) | Name | Type | Duration | Purpose | | --------------- | ------------ | ---------- | ------------------------------------------------------------------------------------------------------------------------------------- | | paddle\_session | first\_party | Session | Strictly necessary session cookie used to maintain the customer session on the Paddle hosted checkout while a payment is in progress. | | paddle\_csrf | first\_party | Session | CSRF protection token used to validate the payment form submission on the Paddle hosted checkout. | | paddle\_risk | first\_party | 30 minutes | Strictly necessary risk score cookie used by Paddle for fraud prevention during the transaction. | ### Third-party domains contacted (4) - `paddle.com` - `checkout.paddle.com` - `cdn.paddle.com` - `buy.paddle.com` Questions ## Frequently asked questions about Paddle Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Paddle set? On the Paddle hosted checkout overlay only strictly necessary first party cookies are set: a session cookie (paddle\_session), a CSRF protection token (paddle\_csrf) and a small risk score cookie (paddle\_risk) used for fraud prevention during the transaction. Paddle does not set advertising or behavioural cookies. ### Do I need consent to use Paddle on my website? No banner is required to display the Paddle hosted checkout because the cookies in question are strictly necessary under Art. 5(3) ePrivacy. Consent only becomes relevant if you embed optional Paddle marketing components on your own pages, which Paddle does not require by default. ### What is the legal basis for processing payment data through Paddle? Contract performance (Art. 6(1)(b) GDPR) for processing payment data necessary to complete the transaction. Legal obligation (Art. 6(1)(c)) for AML, EU VAT and tax record keeping (Paddle is the merchant of record for those obligations). Strictly necessary cookies on the Paddle checkout rely on Art. 5(3) ePrivacy. ### Does Paddle transfer data to third countries? Paddle.com Market Limited is incorporated in the United Kingdom, which benefits from a European Commission adequacy decision. Primary processing happens on AWS EU regions in Frankfurt and Dublin, with replication to the UK and limited US sub processors used for fraud prevention and observability. Standard Contractual Clauses are included in the Paddle DPA for any non adequate transfer. ### Do I need a DPIA for Paddle? Standard SaaS subscription billing through Paddle does not normally require a DPIA. A DPIA may become relevant when combined with extensive customer profiling, cross border product flows or special category data tied to subscription tiers. ### How do I implement Paddle compliantly? Sign the Paddle DPA from your dashboard. Mention Paddle as a merchant of record and processor in your privacy notice with the UK adequacy and the EU AWS hosting. Use the hosted Paddle Checkout to limit your PCI DSS scope. Configure SCA and risk rules to comply with PSD2. Define a retention period for transaction metadata aligned with your AML, EU VAT and tax obligations. ### Are there alternatives to Paddle for SaaS billing in the EU? Other merchant of record platforms include Lemon Squeezy (US), FastSpring (US) and the EU based ConsentMagic / 2Checkout. For non MoR EU options, Stripe Billing, Mollie subscriptions and Adyen subscriptions can handle recurring payments while leaving EU VAT compliance with the seller. ### How should I update my cookie policy for Paddle? For most setups no update to the banner is needed because the Paddle hosted checkout sets only strictly necessary cookies under Art. 5(3) ePrivacy. Update your privacy notice to mention Paddle as a merchant of record and processor, the UK adequacy, the EU AWS hosting and the legal basis for each step (payments, VAT, fraud prevention). Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Salonist](https://www.flowconsent.com/en/services/ecommerce/salonist) [Salonist is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Salonist supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Salonist ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/salonist) [Preferences](https://www.flowconsent.com/en/services/ecommerce/salonist) · ### [Shoper](https://www.flowconsent.com/en/services/ecommerce/shoper) [Shoper is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Shoper integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Shoper helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/shoper) [Preferences](https://www.flowconsent.com/en/services/ecommerce/shoper) · ### [Visa](https://www.flowconsent.com/en/services/ecommerce/visa) [Visa is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Visa integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Visa helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/visa) [Preferences](https://www.flowconsent.com/en/services/ecommerce/visa) · ### [Zeleris](https://www.flowconsent.com/en/services/ecommerce/zeleris) [Zeleris is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Zeleris supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Zeleris ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/zeleris) [Preferences](https://www.flowconsent.com/en/services/ecommerce/zeleris) · ### [Starboard Suite](https://www.flowconsent.com/en/services/ecommerce/starboard-suite) [Starboard Suite is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Starboard Suite enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Starboard Suite empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/ecommerce/starboard-suite) [Preferences](https://www.flowconsent.com/en/services/ecommerce/starboard-suite) · ### [RedCart](https://www.flowconsent.com/en/services/ecommerce/redcart) [RedCart is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. RedCart supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, RedCart ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/redcart) [Preferences](https://www.flowconsent.com/en/services/ecommerce/redcart) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)