Scalapay

What Scalapay Is and How It Works

Scalapay is an Italian Buy Now Pay Later (BNPL) fintech that enables consumers to split purchases into three or four interest-free installments. Founded in 2019 and headquartered in Milan, it focuses on fashion, beauty and lifestyle e-commerce across Italy, France, Spain, Portugal, Germany and Australia. Merchants embed the Scalapay checkout widget via a JavaScript snippet loaded from cdn.scalapay.com or widget.scalapay.com, which displays installment previews on product pages and handles the payment flow at checkout. The service is regulated as a consumer credit provider, meaning its data processing obligations extend beyond general GDPR requirements to include sector-specific rules under the EU Consumer Credit Directive and PSD2.

Data Collected, Cookies and Tracking Pixels

Scalapay collects consumer identity data (name, email, phone, address), order data (items, amounts, merchant ID) and payment schedule data. During eligibility assessment it performs a soft credit check, consulting credit bureau data that does not leave a visible mark on the consumer's credit file but still constitutes processing of financial personal data. The Scalapay marketing pixel (loaded from widget.scalapay.com) collects page-view and conversion events, enabling Scalapay to measure its contribution to sales and retarget customers across partner sites. Cookies include a payment session identifier, a fraud-prevention device token and marketing measurement cookies. The payment session cookie is essential for the checkout to function; all others require consent.

GDPR Legal Basis and Italian Codice Privacy

Core payment processing relies on contractual necessity (Art. 6(1)(b) GDPR), as it is necessary to execute the installment agreement. Soft-credit checks can be justified under legitimate interests (Art. 6(1)(f)) where the controller demonstrates a proportionate need for creditworthiness verification, but many practitioners use consent to be safe. Marketing pixel processing and retargeting require consent under both Art. 6(1)(a) GDPR and the ePrivacy Directive. Italian merchants must also comply with the Garante per la protezione dei dati personali's cookie guidelines, which follow EDPB guidance but impose additional notification and record-keeping obligations. The Italian Codice Privacy (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018) applies in parallel with GDPR for Italian data subjects.

Consumer Credit Directive and PSD2 Obligations

Because Scalapay offers deferred payment plans, merchants integrating it as a payment option may take on co-disclosure obligations under the EU Consumer Credit Directive (2008/48/EC) and its successor (2023/2225/EU). These require pre-contractual information to be provided to consumers, including the APR (even if 0%), total credit amount and repayment schedule, before the consumer commits. The forthcoming Consumer Credit Directive II increases transparency requirements for BNPL. Under PSD2, Scalapay itself holds the necessary payment institution or e-money institution authorisation; merchants simply integrate the widget. However, merchants must ensure their checkout flow does not obscure the credit nature of the transaction.

Consent Requirements and CMP Implementation

The checkout widget itself may load without consent if it is limited to rendering installment pricing information using only essential session cookies. However, the marketing pixel on widget.scalapay.com and any retargeting or analytics cookies must be gated behind prior consent. In practice, many merchants load the full widget script conditionally after consent, which is the safest approach. The CMP consent layer must categorise Scalapay under both 'Payments' (essential, no consent needed for core checkout) and 'Marketing' or 'Analytics' (consent required for the pixel). Consent records must be stored with timestamps, and withdrawal must be honoured by blocking subsequent pixel requests.

Practical Compliance Steps for Merchants

Merchants should: (1) separate the Scalapay installment preview widget (can be treated as functional) from the marketing pixel (requires consent) and load them independently; (2) include Scalapay in the privacy notice with a description of soft-credit processing, legal basis and data sharing with credit bureaus; (3) sign and keep current the Scalapay DPA and review its sub-processor list; (4) display the required EU Consumer Credit pre-contractual information (SECCI form equivalent) before the consumer finalises payment; (5) offer clear information about the soft credit check in the checkout flow; (6) conduct a DPIA if operating at scale or processing financial data that could reveal consumer vulnerability; and (7) update cookie policy tables to list Scalapay cookies separately with their purpose, duration and legal basis.