Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
SumUp is a German fintech headquartered in Berlin that provides payment processing, online checkout pages and an embeddable card payment widget. Its checkout sets strictly necessary cookies to operate the payment and prevent fraud, and where enabled it adds performance, analytics and advertising cookies that require consent. Core payment data is processed within the European Union, though some fraud prevention and analytics partners may sit outside the EU. Because it handles card payments, it is governed by both GDPR and PSD2.
SumUp is a German fintech company headquartered in Berlin that provides payment acceptance for businesses of all sizes. For websites it offers hosted checkout pages and an embeddable card payment widget that collects card details and processes the transaction. Because card data is captured inside SumUp controlled fields, the merchant generally stays out of scope for handling raw card numbers, which simplifies card industry compliance. SumUp operates under EU financial regulation and is subject to the revised Payment Services Directive known as PSD2. The widget loads from SumUp domains and sets cookies needed to run the payment and to detect fraud. Understanding which cookies are strictly necessary and which require consent is the key to compliant deployment.
SumUp sets strictly necessary cookies that allow access to the checkout, identify irregular site behaviour, prevent fraudulent activity and improve security, and these cannot be refused without breaking the payment. Where enabled it also uses performance and analytics cookies to understand how visitors use the service and to measure page speed, and it can set advertising cookies for marketing. The data collected at checkout includes payment details, transaction amounts, contact information and technical metadata such as IP address and device information used for fraud prevention. The strictly necessary and fraud related cookies do not need consent, but the analytics and advertising cookies do. It is important to keep this distinction clear in your cookie banner and policy. Always confirm the live cookie set, as it can vary by region and configuration.
Under the GDPR the legal basis for processing a payment is contract performance, because the customer asks you to take the payment, while fraud prevention and securing the transaction rest on legitimate interest. Under the ePrivacy Directive the strictly necessary payment and fraud cookies are exempt from consent, but any analytics or advertising cookies require prior opt in. SumUp acts as a processor or in some respects an independent controller for payment data, so you need the appropriate agreement and a clear understanding of the roles. PSD2 adds obligations such as strong customer authentication, which interacts with the data you collect at checkout. You remain responsible for informing customers about the processing in your privacy notice. Keeping necessary and optional cookies clearly separated is central to compliance.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You do not need consent for the strictly necessary checkout and fraud cookies, so the payment widget itself can load to let customers pay. You do need prior consent for the analytics and advertising cookies, which should be wired into your consent management platform and blocked until the visitor accepts the relevant category. A good pattern is to let the payment function work while gating only the optional tracking. Your consent banner should explain that some cookies are essential to complete and secure the payment, and that others are optional. Make sure declining the optional categories genuinely prevents those cookies from being set. Document the consent choices so you can demonstrate compliance to a supervisory authority.
SumUp is a German company and processes core payment data within the European Union, which is favourable for data residency. However, it relies on service providers including fraud prevention, identity verification and analytics partners, some of which may be located outside the EU. Where personal data flows to such providers in a third country, the transfer must be covered by an appropriate safeguard such as the EU US Data Privacy Framework or Standard Contractual Clauses, supported by a transfer impact assessment. Optional analytics and advertising tools can also involve third country transfers and these are tied to consent. Review the SumUp documentation and subprocessor list to confirm where data goes. Record the safeguards in your processing records and privacy notice.
Start by putting the right data processing terms in place with SumUp and reviewing its subprocessor list and transfer safeguards. Configure your consent management platform so the strictly necessary payment and fraud cookies run while analytics and advertising cookies are blocked until consent. Update your privacy notice and cookie policy to explain the payment processing, the legal bases of contract and legitimate interest, and the consent based optional cookies. Set retention periods for transaction data that respect financial record keeping rules and apply data minimisation elsewhere. Implement strong customer authentication as required by PSD2 and make sure your checkout flow supports it. Complete a transfer impact assessment for any non EU providers and, where the risk is significant, a Data Protection Impact Assessment. Finally, keep your documentation aligned with the live configuration.
Websites using SumUp must obtain user consent under GDPR regulations.
DPIA considerations
Payment processing involves financial data and fraud detection, so a careful assessment is warranted, especially for high transaction volumes or where payment behaviour is profiled. A Data Protection Impact Assessment should document the categories of data collected at checkout, the strictly necessary versus consent based cookies, the fraud prevention processing under legitimate interest, and any transfers to service providers outside the EU. Record the PSD2 obligations such as strong customer authentication and how they interact with data minimisation. Note retention periods for transaction records, which may be set by financial regulation.
Sample consent text
This website uses SumUp to process payments securely. Cookies that are strictly necessary to complete your payment and to prevent fraud are always active. With your consent, we also set analytics and advertising cookies; you can accept or decline these at any time.
Third-party domains contacted
sumup.comapi.sumup.compay.sumup.comgateway.sumup.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| Checkout session | strictly_necessary | session | Operates the checkout and maintains the secure payment session so the customer can complete the transaction. |
| Fraud prevention | strictly_necessary | session to persistent | Identifies irregular site behaviour, detects unusual transaction patterns and prevents fraudulent activity to secure the payment. |
| Performance and analytics | analytics | up to 2 years | Measures how visitors use the service and metrics such as page speed. Not strictly necessary and requires consent. |
| Advertising | marketing | up to 1 year | Used for advertising and marketing purposes. Not strictly necessary and requires consent. |
SumUp uses cookies for user preferences — inform visitors with a consent banner.
SumUp sets strictly necessary cookies that operate the checkout, identify irregular site behaviour and prevent fraud, which cannot be refused without breaking the payment. Where enabled it also sets performance and analytics cookies and advertising cookies, which are not strictly necessary and require consent. Always confirm the live cookie set, as it can vary by region and configuration.
Consent is not required for the strictly necessary payment and fraud prevention cookies, so the checkout can function. Consent is required for the optional analytics and advertising cookies, which must be blocked until the visitor accepts the relevant category through your consent banner.
The legal basis is contract performance under GDPR Article 6(1)(b) for processing the payment the customer requested, plus legitimate interest under Article 6(1)(f) for fraud prevention and securing the transaction. Any analytics or advertising cookies need consent under Article 6(1)(a).
Core payment processing is performed within the EU by a German company. However, SumUp uses service providers including fraud prevention, verification and analytics partners, some of which may be outside the EU, so a transfer can occur. Such transfers must be covered by a safeguard such as the EU US Data Privacy Framework or Standard Contractual Clauses.
A Data Protection Impact Assessment is advisable because payment processing involves financial data and fraud detection, particularly for high transaction volumes or where payment behaviour is profiled. The DPIA should cover the data collected at checkout, the cookie categories, the fraud prevention processing and any transfers to non EU providers.
Put the right data processing terms in place, review the subprocessor list, and configure your consent management platform so necessary payment and fraud cookies run while analytics and advertising cookies are blocked until consent. Update your privacy and cookie policies, set retention for transaction data, and implement strong customer authentication required by PSD2.
Other payment providers include Stripe, Mollie, Adyen and Worldpay, each with its own cookie and data processing profile. For the strongest EU data residency, prefer a provider that processes payment data in the EU and keeps optional analytics and advertising cookies clearly separated and consent based, as SumUp does.
List the strictly necessary payment and fraud cookies separately from the optional analytics and advertising cookies, with their purpose and approximate duration. State that SumUp is the payment processor, that core data is handled in the EU, and disclose any non EU service providers and the safeguard relied on. Review the entry whenever the configuration changes.