Privacy Notice

Please find attached the Privacy Policy for Merchant Agreements of GP Payments Acquiring International GmbH here.

At Commerz Globalpay GmbH, we respect your concerns about privacy. Except where otherwise indicated, this Privacy Notice (“Notice”) relates to the collection of personal information from users of our websites, mobile applications (“Apps”), email, branded social media sites or pages and other online or mobile services that link to or expressly reference this Notice (collectively the “Sites”).

For the purpose of this Notice, “Commerz Globalpay”, “we” and “us” refer to Commerz Globalpay GmbH as the context requires. Our privacy practices vary depending on the services we provide and the country-specific requirements for the countries in which we operate. For some products and services, where required, we will provide additional privacy notices before collecting your personal information. Please read this Notice carefully. If you have any questions, you may contact us at [email protected] or by the methods provided in the “Contact Us” section below. Commerz Globalpay maintains specific privacy notices for job applicants, employees, and contractors. If you are a job applicant, employee, or contractor and need a copy of the applicable privacy notice, please contact us at [email protected].

Commerz Globalpay provides payment products and services for commercial and non-commercial enterprises (our “Customers”). In the delivery of our services, we routinely collect and retain personal information about our Customers and the individuals with whom our Customers do business. For our Customers, additional disclosures are set out in the documentation provided to them at or before onboarding. This Notice should be viewed as a supplement to any other notices or contractual terms provided to Customers.

Commerz Globalpay collects personal information from users of our Sites and Apps who might be our Customers, prospective Customers, and Customer end users (“End Users”) who engage with our Sites as part of the Services we provide to our Customers.

Because our relationship with End Users is indirect, we process such personal information relating to End Users only for the purposes of providing the Services to our Customers and in accordance with our Customer’s instructions. Under applicable privacy laws, in this context, Commerz Globalpay would be considered a processor or service provider. If you are an End User who has a relationship with one of our Customers and you have a question about how personal information about you is collected, used, or disclosed, or would like to exercise any rights you may have with respect to such personal information, please contact the Customer directly.

Select one of the links below to jump to the relevant section:

Personal Information We Collect

“Personal information” is information that identifies you as an individual or relates to an identifiable individual. Subject to your consent if required by law, we may collect the following categories of personal information:

  • Basic Identifying Information, including your full name, postal address, e-mail address, phone number, username, or other similar identifiers.

  • Government-Issued Identifiers, including your personal identification number, tax identification number, or other similar government identifiers.

  • Demographic Data, including age, gender, race, ethnicity, citizenship, and primary language.

  • Device Information and Other Unique Identifiers, including device identifier, internet protocol (IP) address, cookies, beacons, pixel tags, or similar unique identifiers.

  • Internet or Other Network Activity, including browsing or search history and information regarding your interactions with our Sites and Apps.

  • Geolocation Data, including information that permits us to determine your precise location, such as if you manually provide precise location information or enable your device to send us precise location information.

  • Payment Information, including credit or debit card numbers or other financial account information.

  • Commercial Information, including information about your business, your commercial transactions with us, and your preferences regarding products and related services which are of interest to you (see “Managing Your Preferences” below).

  • Professional and Employment-Related Information, including your role or status with the organization with which you are affiliated.

  • Education Information.

  • Health/Medical Information.

  • Biometric Identifiers, including voiceprints, fingerprints, or facial scans.

  • Information You Provide, including your communications with us and any other content you provide (such as if you report a problem with our Sites and Apps).

  • Audio and Visual Information, including photographs, images, videos, and recordings of your voice (such as when we record calls or videos for quality assurance or other business activities).

  • Inferences drawn from or created based on any of the information identified above.

Data Anonymization and Aggregation: Subject to your consent if required by law, we may anonymize or aggregate personal information about you so that you are not identified or identifiable from it, in order to use the anonymized or aggregated data, for example, for statistical analysis including analysis of trends, to carry out actuarial work, to tailor products and services and to conduct risk assessments and analysis of costs and charges in relation to our products and services. We may disclose anonymized or aggregated data to our global affiliates and with other third parties. This Notice does not restrict Commerz Globalpay's use or disclosure of any anonymized or aggregated information.

Where we maintain or use de-identified information, we will continue to maintain and use the de-identified information only in a de-identified fashion and will not attempt to re-identify the information.

Sources of Personal Information

Information that you provide to us: We collect personal information that you provide to us when you set up an account with us, use our services, or communicate with us. For example, if you register for an online account with us, we may request your name, contact information, and business information. Providing us with personal information is voluntary, and you can always choose not to provide certain information, but then you may not be able to take advantage of or participate in some of the services.

Information collected from third parties: We may collect information about you from third parties in the course of providing our services. For example, we may collect Identifiers and Commercial information from a referral partner or other third party in order to contact you about the services we provide. We may also receive business-related information about you from third-party companies that supplement our business customer records with, for example, professional information.

Information collected through technology: When you visit our Sites or Apps or interact with an email we send to you, we may collect certain information automatically such as your account or device identifier, and usage information such as pages that you visit, information about links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our services. You have the ability to express your preference regarding some of the ways we collect information through technology in some of our services (see “Cookies and Other Tracking Technologies” for more information). When you download and use our Apps, we and our service providers may track and collect App usage data, such as the date and time the App on your device accesses our servers and what information and files have been downloaded to the App based on your device number. Subject to your consent where required by law, we may collect geolocation in the Sites or Apps for the purpose of enabling location-based services.

How We Use the Personal Information We Collect

Subject to your consent if required by law, we may use your personal information for the following business and commercial purposes:

  • To provide our Services to you;

  • To contact you regarding any inquiry you make or to fulfill a request, such as, for example, a request for information about our products and services or to provide customer support;

  • To contact you if you have signed up for e-newsletters or any other updates, communications or publications;

  • To verify or maintain the quality and safety of our products and services and to repair, improve, upgrade, or enhance our services;

  • To conduct our operations and for other general business purposes;

  • To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute individuals responsible for that activity;

  • To conduct audits and enable internal record keeping and administration of records;

  • To personalize your experience when you use our Sites and Apps;

  • To track information about our interactions with you, including, but not limited to, counting advertising impressions to unique visitors and verifying positioning and quality of advertising impressions;

  • To send you direct marketing, subject to your consent if required by applicable law (see “Managing Your Preferences” below); and

  • To comply with applicable laws and regulations.

Our Legal Basis for Collecting and Using Personal Information

Our legal basis for collecting, using and storing personal information may depend on the specific service with which you are engaging. In most cases, when we process personal information on behalf of our Customer, our legal basis is the performance of a contract. In some contexts, such as when we engage in direct marketing, our legal basis for processing personal information is consent. When we rely on legitimate interest as the legal basis for our processing of personal information, we have procedures in place to ensure that we are balancing our interests and rights against the impact to the individual and their applicable statutory or fundamental rights.

How we Disclose the Personal Information We Collect

Commerz Globalpay GmbH is a joint venture between Global Payments and Commerzbank headquartered in Germany, with affiliates in countries around the world. We may disclose personal information to recipients located outside of your country, including to our global affiliates (see “Our Relationship with Affiliate Companies” below) as described in this Notice.

For each category of personal information we collect, we may disclose such information in the manner and for the purposes described below:

  • With companies engaged to help us run our business, subject to your consent if required by law. These types of companies may include our affiliate companies, distributors of our products and services, service providers retained to perform functions on our behalf or to provide services to us, including (without limitation) legal, accounting, audit, consulting and other professional service providers, and providers of other services related to our business. Portions of our Services may be provided by organizations with which Commerz Globalpay has a contractual relationship, including subcontractors, and, accordingly, your personal information may be disclosed to them;

  • With third parties with whom you have a relationship, such as a financial institution or independent sales organization who referred you to Commerz Globalpay for services;

  • With logistics service providers to enable the delivery of packages to individuals;

  • With other third parties to whom you direct us to disclose personal information;

  • With regulators including state and federal agencies, card brands, financial networks, issuing banks and other parties required to enable compliance with laws, regulations and industry standards related to transaction processing and in order to obtain commercial and credit information to establish, maintain or renew a customer’s contract(s), as may be required to provide any of the services for which a Customer has subscribed, or to comply with the rules and regulations of any credit or debit card payment network or otherwise in accordance with this Notice;

  • In response to a court order or a request for cooperation from a regulatory, law enforcement or other government agency; to establish or exercise our legal rights; to defend legal claims; or as otherwise required or permitted by applicable laws and/or regulations;

  • When we believe that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; to protect and defend the rights, property or safety of Commerz Globalpay, its customers, staff, suppliers or others; and

  • To third parties in connection with any proposed or actual reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our assets or stock (including in connection with any bankruptcy or similar proceedings).

Cookies and Other Tracking Technologies

Cookies and similar tracking technologies are used to help us retain information about your use of our Sites and Apps. Using cookies, we collect information like country location, language preference and other settings. Cookies can also help us to operate our services more efficiently and securely, remember you for future visits and enhance your user experience by providing real-time tools including user guides and chatbots. We also gather statistical information about the use of our services in order to continually improve their design and functionality, understand how they are used, and assist us with resolving questions regarding them.

The cookies and tracking technologies that we may use fall into the following categories:

Strictly Necessary. These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions taken by you such as logging in or filling in forms. You can set your browser to block or alert you to these cookies but blocking them may impede the functionality of the Sites and Apps.

Performance. These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated. If you do not allow these cookies we will not know when you have visited our site and will not be able to monitor its performance.

Functional. These cookies enable the Sites and Apps to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies, then some of these services may not function properly.

Targeting. These cookies may be set through our Sites and Apps by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant advertisements on other sites. They are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

How to Delete or Block Cookies and Other Tracking Technologies: We do not currently respond to browser Do-Not-Track signals. If you do not want information collected through the use of cookies, you can use the Cookie Settings banner or icon on the Site to make selections about the use of cookies. Additionally, most browsers allow you to automatically decline cookies or be given the choice of declining or accepting a particular cookie (or cookies) from a particular website. You may also refer to our cookie banner for information on what cookies we use and how to manage your cookie choices. If, however, you do not accept cookies, you may experience some inconvenience in your use of our services. You also may not receive advertising from us that is relevant to your interests and needs.

External Links

Commerz Globalpay may provide links on our Sites and Apps to third-party websites or services that are not under our control. We do not endorse or make any warranty of any type regarding the content contained on such third-party websites or services or the products and services they offer. We make no representation regarding your use of such websites or services. Please be aware that we are not responsible for the privacy practices of the operators of other websites or services. We encourage our users to be aware when they leave our Sites and Apps. You should read any other applicable privacy and cookies notices carefully before accessing and using third-party websites and services.

Our Relationship with Affiliate Companies (Including Disclosures and Cross-Border Transfers)

Subject to your consent if required by applicable law, we may appoint an affiliate company to process personal information in a service provider role. We will typically remain responsible for that company’s processing of personal information pursuant to applicable data privacy laws.

Because our affiliate companies are located around the globe, personal information may be transferred to and stored in the United States or in another country outside of the country in which you reside, which may be subject to different standards of data protection than your country of residence.

We take appropriate steps to transfer personal information in accordance with applicable law, such as transferring personal information to countries that are recognized as providing an adequate level of legal protection or where alternative adequate arrangements are in place to protect your privacy rights.

Data Security and Data Retention

We maintain administrative, technical and physical safeguards designed to protect the personal information you provide via the Sites and Apps against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.

Any suspected attempt to breach our policies and procedures, or to engage in any type of unauthorized action involving our information systems, is regarded as potential criminal activity. Suspected computer mischief may be reported to the appropriate authorities.

Please remember that communications over the internet such as emails are not secure. We seek to keep secure personal information submitted to us through the Sites and Apps in accordance with our obligations under applicable laws and regulations. However, like all website operators, we cannot guarantee the security of any data transmitted through the Sites and Apps.

We retain the personal information we collect for different periods of time depending on what it is and how we use it. In some contexts, we will provide additional information about retention as you use the services. When we collect personal information, we will retain it only for as long as is necessary to complete the legitimate business or legal purposes for which we collected it. The criteria used to determine our retention periods include:

  • The length of time we have an ongoing relationship with you and provide services to you, for example, for as long as you have an account with us or continue to use our services, and the length of time thereafter during which we may have a legitimate need to reference personal information to address issues that may arise;

  • Whether there is a contractual obligation to which we are subject, for example, our contracts with our Customers may specify a certain period of time during which we are required to maintain the information on behalf of our Customers;

  • Whether there is a legal obligation to which we are subject, for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them; and

  • Whether retention is advisable in light of our legal position, such as in regard to applicable statutes of limitations, litigation or regulatory investigations.

Login Details and Your Responsibility

Subject to your consent if required by law, we will collect and process personal information as necessary to set up and administer your sign up to, and use of, the log in facility available on our Sites and Apps. We will use cookies to “remember” the machine or other device you use to access our Sites and Apps (see “Cookies and Other Tracking Technologies”). Please remember that if we contact you, we will never ask you for your password in an unsolicited email, message or phone call. If you choose to use the log in facility available on our Sites and Apps, you are required to adhere to the security procedures we establish in the documentation we provide you with as part of the services.

Managing Your Preferences

Subject to your consent if required by applicable law, we may use personal information to provide you with direct marketing information about our products and services as well as those of our global affiliates and third parties. Our direct marketing may occur through email, telephone, post or SMS or such other method(s) as may become relevant.

We will take steps to ensure that any direct marketing from us will provide a simple means for you to stop further communications, in accordance with applicable law. For example, in email, we may provide you with an “unsubscribe” link, or an email address to which you can send an opt-out request. In addition, if we need your consent for direct marketing communications under applicable law, and if you provide your consent, you will be able to change your mind at any time. Please note that if you opt out of receiving marketing-related communications from us, we may still send you administrative, transactional, or information messages, from which you cannot opt out.

Your Legal Rights

If you are an End User who interacts with our Sites or Apps for the purpose of engaging with our Customers and have questions about legal rights you may have with respect to personal information collected by our Customer, please consult the Customer with whom you have a relationship.

If you interact with our Sites and Apps for the purpose of engaging in a direct relationship with us, subject to certain exceptions, and in some cases dependent upon the processing activity we are undertaking, you may have the right to:

  • Know whether we process personal information about you;
  • Know how the personal information is used;
  • Access, request and receive the personal information we have collected in a portable manner;
  • Opt out of having personal information sold, “shared,” or used for certain profiling activities;
  • Request that we correct inaccuracies in personal information about you; and
  • Request that we delete personal information about you.

You may contact us using the information in the “Contact Us” section of this Notice for additional information about how to exercise your rights. In addition, if you are a resident of the European Union, please see the “Information for European Union and United Kingdom Residents” section below for further details on how to exercise your privacy rights.


Our Sites and Apps are not directed to children or intended for use by children. We do not solicit or knowingly accept any personal information from persons under the age of 18. Please do not use the Sites or Apps if you are under the age of 18.

Changes and Updates

We reserve the right, in our sole discretion, to modify, update, or otherwise change this Notice. The “Last Updated” legend at the top of this Notice indicates when this Notice was last revised. Any changes will become effective when we post the revised Notice on our services, including our Sites and Apps.

Contact Us

If you have questions about this Notice, or if you want to exercise your rights as described in this Notice, you can submit a request by completing this form or you may contact us as follows:

Commerz Globalpay GmbH
EVO Payments International GmbH
Elsa-Brändström-Str. 10-12
50668 Köln

Email: [email protected]

If you make a request to exercise a privacy right, we will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request. We may decline to honor your request where an exception applies. In order to honor any access, deletion, or similar request, we will require you to provide enough information for us to verify your identity. For example, we may ask you for information associated with your account, including your contact information or other identifying information. If you would like your agent to make a request on your behalf, if permitted under applicable law, the agent may exercise those rights as noted above. We will process the agent’s request consistent with applicable law. As part of our verification process, we may request that the agent provide, as applicable, proof concerning their status as an authorized agent. In addition, we may require that you verify your identity as described in this section or confirm that you provided the agent permission to submit the request.

Information for European Union and United Kingdom Residents

To the extent that the Sites or Apps with which you are interacting are directed at United Kingdom or European Union residents, this section of the Notice applies to you.

You have specific rights with regard to the processing of your personal data. When Commerz Globalpay acts as a business for the purpose of processing your personal data you can contact us using the information provided in the “Contact Us” section of this Notice with regard to the following rights. You may also contact our Data Protection Officer at [email protected].

Your Rights

What does this mean?

Right to be informed

You have the right to be provided with clear and easy-to-understand information about how we use your personal information. This is why we are providing you this Notice and we may provide other forms of notice, as appropriate or required by law, in the services.

Right to access personal information

You have the right to access and receive a copy of personal information we hold about you.

Right to data portability

In some circumstances, you have the right to receive the personal information you request from us in a format that is user-friendly and enables you to transfer it to another provider.

Right to rectification

You have the right to correct or update your personal information if it is outdated, incorrect or incomplete.

Right of erasure ("right to be forgotten")

In some circumstances, you have the right to have your personal information erased or deleted.

Right to restrict/suspend processing of personal information

You may object to processing of personal information that is based on legitimate interest. You may withdraw consent for processing that is based on consent (this includes the right to opt out of direct marketing).

Right to information about information transfers

You have the right to obtain a copy of documents related to the safeguards under which your personal information is transferred outside the EU.

Right to complain to a supervisory authority

You have the right to contact the data protection authority in your country to complain about our data protection and privacy practices.