Payment providers headquartered in the EU include Adyen and Mollie (Netherlands), Worldline (France), Nexi (Italy) and Klarna (Sweden). Mollie completed its takeover of GoCardless on 1 September 2026, and Klarna's listed parent is a UK company. Checkout.com, GoCardless and Paddle are based in the UK, so they are European but outside the EU. Cleverbridge is a German merchant of record. Datatrans, Payrexx and tiun are Swiss.
Headquarters is not data location. For each provider, the table below shows the entity you sign with and who owns it. It also shows where the provider's own documents say your data is stored, and whether any of it goes to a US entity. We are tiun, a Swiss merchant of record, and our own row uses the same columns as everyone else's.
Headquarters, data residency and data sovereignty
These three terms answer different questions, and many provider lists only answer the first.
Headquarters is where the company is run from. Together with where it is incorporated and licensed, it decides which regulators supervise the provider and which courts hear a dispute.
Data residency is where your data is stored and processed. A provider headquartered in Amsterdam can store data in Frankfurt and still send some of it to a support team or cloud region elsewhere.
Data sovereignty is about which governments can compel the provider to hand data over. Under the US CLOUD Act of 2018, US providers of communication and cloud services can be required to hand over data they hold or control. That applies even when the data is stored outside the United States. EU concerns about transfers to the US, including the Schrems II ruling, centre on US surveillance law such as FISA section 702.
A European headquarters is a good start. It doesn't tell you where the data sits, or whether a US order can reach a US parent or a US cloud provider.
For the current state of EU-US transfers, see Is the EU-US Data Privacy Framework still valid?
European payment providers compared
Last updated: 4 November 2026. Cells come from the provider's own terms, privacy notice, DPA, sub-processor list or filings; cells marked "press" or "reports" come from news coverage. "Not stated" means we could not find it in those documents. The table is not exhaustive: PayPal, Payone, Trustly and wallee are among the providers it leaves out.
Provider | Type | Home | Entity an EU seller signs with | Parent / ownership | Data location (provider's own docs) | Data to a US entity? |
|---|---|---|---|---|---|---|
Processor and acquirer, bank licence | EU (Netherlands) | Adyen N.V., Amsterdam | Listed on Euronext Amsterdam | Payments stored in Europe and an isolated India environment, in its own data centres | Yes: group companies outside the EEA, incl. a San Francisco branch; AWS, Google, Microsoft and Oracle added for cloud services from 1 Sep 2026 | |
Processor, e-money institution | EU (Netherlands) | Mollie B.V., Amsterdam | Private; owns GoCardless since 1 Sep 2026 | Not stated for payments; Google Cloud in the EU for add-on services | Transfers under SCCs, no countries named; sub-processor list includes Rapyd (US/EEA) for disputes | |
Processor and acquirer | EU (France) | Varies by country (e.g. Worldline NV/SA, Belgium) | Listed on Euronext Paris; sold several units in 2026 | Not stated | Not stated; group transfers under Binding Corporate Rules approved by the CNIL in 2025 | |
Processor and acquirer | EU (Italy) | Local entity, e.g. Nexi Payments S.p.A. (Italy) or Nets Denmark A/S | Listed on Euronext Milan | Within the EEA (Nexi Payments notice); not stated by Nets | US not named; Nets cites SCCs and the EU-US Data Privacy Framework | |
Processor and acquirer, bank licence | EU (Greece) | Viva Bank, Maroussi (Athens) | Private; JPMorgan holds 48.5% (2025 reports) | Not stated; built on Microsoft Azure | Not stated; transfers under SCCs | |
Processor, payment institution | EU (Germany) | Unzer E-Com GmbH (Heidelberg) or Unzer Luxembourg S.A. | KKR agreed in 2023 to hand majority control to lenders (press reports) | Not stated | Yes: business-customer notice says data may be processed on US servers of US providers | |
Marketplace payments, e-money institution | EU (Luxembourg) | Mangopay S.A., Luxembourg | Advent International (majority since 2022); its terms describe its parent as US-based | Cloud servers in Dublin and Frankfurt | Yes: payment terms say some service providers, incl. hosting and security, are in the US, UK and Canada; most are in the EU | |
Buy now, pay later; bank licence | EU (Sweden) | Klarna Bank AB (publ), Stockholm | Klarna Group plc (England and Wales), NYSE-listed since 10 Sep 2025 | Not stated | Yes: transfers outside the EEA within the group or to suppliers (SCCs, BCRs, EU-US DPF); AWS is its primary cloud (2025 annual report) | |
Processor and acquirer | UK | e.g. Checkout SAS, Paris | Private | Not stated | Not stated; transfers under SCCs; AWS and Snowflake named for biometric data | |
Payment gateway, part of Planet | Switzerland | Datatrans AG, Zurich | Planet (bought Nov 2021, then owned by Advent and Eurazeo) | Not stated for Datatrans; Planet's group list names AWS EMEA (Luxembourg) | Planet's group list includes US providers such as Cloudflare and Google | |
Payment platform, technical provider for partner institutions | Switzerland | Payrexx AG, Thun | Private | Primarily Switzerland and the EU; servers on AWS in Frankfurt (DPA) | Possible, "in particular the USA" (privacy policy, Dec 2025); DPA lists US email providers | |
Processor | US | Stripe Payments Europe, Limited, Dublin | US parent company, per Stripe's privacy centre | Hosted by AWS and Microsoft Azure, both listed as US entities (provider list); regions not stated | Yes: DPA transfers data to Stripe, LLC (US); DPF-certified | |
Merchant of record | EU (Estonia) | Armitage Labs OÜ, Tallinn | Private, venture-backed | AWS servers in Germany; database (Supabase) listed as USA | Yes: DPA lists US sub-processors incl. Supabase, Vercel, Sentry, PostHog | |
Merchant of record | EU (Germany) | Cleverbridge GmbH, Cologne | Private; EMH Partners took a 65% stake in 2021 (press) | Not stated; privacy policy says data may be stored globally | Yes: privacy policy names transfers to affiliates, in particular the USA | |
Merchant of record | UK | Paddle.com Market Ltd, London | Private, venture-backed | Not stated; no public sub-processor list found | Yes: privacy notice says data moves between Paddle entities, incl. Paddle.com Inc. (US) | |
Merchant of record, plus login and customer database | Switzerland | tiun AG, Zurich | Private | Primarily Switzerland and the EEA; hosting by Microsoft Ireland (EEA/Global) | Yes: 7 of 12 sub-processors list US locations, incl. Stytch (login codes), OpenAI and Statsig; Stripe and PayPal for backup and clearing | |
Merchant of record | US entity; team in Europe | Polar Software, Inc. (US; Delaware law) | Private, venture-backed | Sub-processors in the US, incl. Render, AWS and Stripe | Yes | |
Merchant of record | US entity; HQ in Bengaluru | Dodo Payments Inc. (Delaware) and affiliates | Private, venture-backed | Cardholder data environment on AWS Mumbai (ap-south-1) | Yes: the DPA counterparty is Dodo Payments Inc., a Delaware corporation | |
Merchant of record | US | Sold through Link, LLC (formerly Lemon Squeezy LLC) | Stripe (Lemon Squeezy acquired Jul 2024) | Not stated by country | Yes: Link privacy policy (Jan 2026) names transfers incl. to the US and India | |
Nuvei (often listed as European) | Processor and acquirer | Canada | EU licences in the Netherlands, Cyprus and Lithuania | Private since Nov 2024 (Advent-led) | EU B.V. notice: servers in the EU/EEA; group notice: worldwide | Group notice allows worldwide transfers; US affiliate Nuvei Technologies Inc. |
Our row is based on our Data Protection Addendum and Privacy Policy at legal.tiun.io (version 2026.9, 2 September 2026) and our sub-processor list, last updated the same day. Seven of our 12 sub-processors list US locations.
Payment processors and merchants of record
A payment processor moves the money and leaves you as the seller. You register for VAT, file the returns, issue the invoices and answer for the sale. Adyen, Mollie, Stripe and the other processors in the table work this way.
A merchant of record (MoR) buys your product and resells it to the buyer. The MoR is the seller on the invoice, collects and remits VAT where it is registered, and holds the contract with your customer. Paddle, Creem, Cleverbridge, Polar, Dodo Payments, Stripe Managed Payments and tiun work this way.
That changes which column of the table matters most. With a processor, your company stays the main controller of your customers' data, and the processor's location is one link in your chain. Processors such as Stripe and Mollie say they act as controllers for their own fraud-prevention and anti-money-laundering processing. A merchant of record usually acts as a controller of the buyer's data, though not always an independent one. Paddle describes itself as a controller; Creem says it may be a controller, a joint controller with the seller, or a processor. The buyer's contract usually names the MoR's law, though consumers keep their home country's mandatory protections. We explain the controller question in Is your merchant of record a GDPR processor or a controller?
Catches the directories miss
Owners change, and the brand stays the same
Mollie announced its takeover of GoCardless in December 2025 and completed it on 1 September 2026. GoCardless now trades as "GoCardless, a Mollie company". Datatrans was bought in November 2021 by Planet, then owned by Advent International and Eurazeo. Lemon Squeezy has been Stripe's since July 2024, and its terms now name "Sold through Link, LLC f/k/a Lemon Squeezy LLC" as the reseller. Mangopay is a Luxembourg e-money institution, but its own terms describe it as a subsidiary of a US-based company. Read the entity name in the current terms, not the logo on the checkout.
A European company can run on a US cloud
Creem is an Estonian company. Its DPA lists AWS servers in Germany, but its database (Supabase), Vercel, Sentry and PostHog are listed as processing data in the USA. Unzer Luxembourg's April 2026 privacy notice for business customers says data may be processed on US servers of US providers. Mangopay keeps data on cloud servers in Dublin and Frankfurt, but its payment terms put some service providers in the US, the UK and Canada. Adyen says it uses no public cloud for payment processing and stores payments in its own data centres. From 1 September 2026, its sub-processor list also includes AWS, Google, Microsoft and Oracle for cloud services.
We are in the same position. Our hosting provider is Microsoft Ireland, and seven of the 12 companies on our sub-processor list name US locations. One of them is Stytch, which sends our login codes. A Frankfurt or Dublin region keeps the data in the EU, but the cloud is still owned by a US company.
The UK is not in the EU
Checkout.com, GoCardless and Paddle are based in the UK. Personal data can still flow from the EU to the UK without additional safeguards such as standard contractual clauses. On 19 December 2025 the European Commission renewed its UK adequacy decisions until 27 December 2031. The difference shows up in law and supervision. Paddle's seller terms run under English law, and a UK entity answers to UK regulators, not EU ones.
Switzerland is not in the EU either
Swiss providers are easy to miss in lists of European alternatives, because Switzerland is not in the EU. For data, the EU has treated Switzerland as adequate since Decision 2000/518/EC, and the Commission confirmed it on 15 January 2024. Data can move from the EU to a Swiss provider without standard contractual clauses. We are one of those Swiss providers. Our contracts with sellers and buyers run under Swiss law, and buyers keep the mandatory consumer rights of their own country.
European payment sovereignty in 2026
International card schemes accounted for about 61% of euro-area card transactions in 2022. That figure comes from the ECB's report on card schemes and processors, published in February 2025. The largest international schemes are Visa and Mastercard, both headquartered in the US. The concern is who owns and controls the schemes. We found no credible source saying that card payments between two EU countries are routed through the US.
Banks and wallets are building an alternative. On 30 September 2026, Bancomat, Bizum, EPI Company (Wero), SIBS (MB WAY) and Vipps MobilePay announced the European Network for Payments. It will be a Madrid-based company they own in equal shares, and its members reach about 130 million users in 13 countries. It starts with cross-border payments between people; online and in-store payments come in later phases, with no dates yet.
Wero itself is moving faster. It began rolling out for online payments in the Netherlands on 26 October 2026. The Dutch market aims to complete the switch from iDEAL by the end of 2027. For a SaaS company the effect is still small. Most subscriptions are charged to cards or by direct debit, and Stripe and Adyen don't yet support recurring Wero payments. EPI plans subscription features from the second quarter of 2027.
Choosing a provider
If you need data kept in the EU, ask every provider, including us, for its sub-processor list and cloud regions before you sign. Nexi Payments (Italy) says it processes data within the EEA. Adyen and Mangopay name European storage but also use providers outside the EEA, including in the US.
If you sell to Swiss buyers, you should offer TWINT. Datatrans, Payrexx and Adyen support it, including recurring payments on some setups. Stripe offers TWINT only for consumer sales priced in CHF, including recurring. Mangopay supports one-time TWINT only. Where the seller's setup and location allow, we offer TWINT at checkout through Payrexx, one of our sub-processors.
If you don't want to register for VAT in every country, you need a merchant of record, not a processor. European options include Creem (Estonia), Cleverbridge (Germany), Paddle (UK) and tiun (Switzerland). 2Checkout (Verifone) and FastSpring are US groups that also contract through Dutch subsidiaries. Polar, Dodo Payments and Stripe Managed Payments contract through US entities. We compare the options in the best merchant of record for EU SaaS.
If you need SEPA Direct Debit, use a processor such as Mollie, GoCardless, Adyen or Stripe. Paddle's payment methods don't include SEPA Direct Debit, and we don't offer it today either.
If you sell to US businesses, keep that revenue on your own billing or use another provider for it. Annex C.1 of our End Customer Terms of Sale says we do not currently serve businesses in the United States.
FAQ
Is Stripe a European company?
No. Stripe's privacy centre describes its parent as a US company operating under US law. Sellers in the EEA sign with Stripe Payments Europe, Limited in Ireland, under Irish law. Stripe's DPA says personal data is transferred to Stripe, LLC in the United States, and Stripe, LLC is certified under the EU-US Data Privacy Framework.
Is Paddle an EU company?
No, it is British. Paddle's terms make Paddle.com Market Ltd in London the seller in most cases, and Paddle.com Inc. (US) the seller to buyers in the US. Paddle Payments Ltd in Ireland is the seller only for UK and Isle of Man sellers' sales outside the US.
Is Klarna still European after its IPO?
The bank is. Klarna names Stockholm as its headquarters, and Klarna Bank AB is a Swedish bank supervised by Finansinspektionen. Its parent, Klarna Group plc, is incorporated in England and Wales with its registered office in London. It has been listed on the New York Stock Exchange since 10 September 2025.
Do card payments between EU countries go through the US?
We found no credible source that says so. Visa's 2017 annual report (Form 10-K) said European transactions ran on separate platforms in the United Kingdom. Its recent filings don't say where they are processed. The sovereignty question is about US ownership of the card schemes, not the route a payment takes.
Is Nuvei European?
No. Nuvei is a Montreal-based Canadian company, privately owned by an Advent-led group since November 2024. It holds EU licences in the Netherlands, Cyprus and Lithuania, which is why some lists include it.