Usually a controller. A merchant of record sells your product to the buyer in its own name and keeps payment, tax and invoice records for its own legal duties. That makes it an independent controller for checkout data, not your processor. You don't need an Article 28 DPA for checkout, but your privacy notice should name the MoR.
We tracked 121 AI assistant answers to "How do I make sure my SaaS payment and customer data setup is GDPR compliant?" between 5 October and 3 November 2026. In 79 of them, Paddle sat on the processor list, next to the email tool and the database host. For a merchant of record that is usually the wrong list. The role decides who answers your buyers' privacy requests, what you can delete and what you can take with you when you leave.
If you are still deciding whether you need a merchant of record at all, start with our merchant of record guide.
Processor, independent controller or joint controller
The role follows the facts, whatever the contract is called. Under Article 4(7) GDPR, whoever decides why and how personal data is processed is the controller, and the EDPB's guidelines on controllers and processors treat both roles as functional: you look at who makes the decisions. One provider can hold different roles for different data.
Role | Who decides why and how the data is processed | Contract you need with the provider | Who answers the buyer |
|---|---|---|---|
Processor | You. The provider acts on your documented instructions | Article 28 data processing agreement | You, with the processor's help |
Independent controller | Each party, for its own purposes | No Article 28 DPA. The main contract usually covers data sharing | Each party, for the data it holds |
Joint controller | Both parties together, for a shared purpose | Article 26 arrangement, with its essence made available to buyers | Either. Buyers can use their rights against each |
The seller is the controller
A merchant of record is the seller. The buyer's contract is with the MoR, the MoR issues the invoice, and the card network sees the MoR as the merchant. To do that job it keeps data for reasons you don't set: tax law decides how long invoices are kept, anti-money-laundering rules decide which checks it runs, and card scheme rules decide what evidence it holds for a chargeback. That is the compliance work an MoR takes on for you.
A processor can't decide those things. Article 28(10) GDPR says a processor that determines the purposes and means of processing is treated as a controller for it. The UK ICO applies the same rule when a processor processes data to meet its own statutory obligations.
We set this out in our contracts. Under section 4.1 of our Master Services Agreement, tiun is the legal seller for every transaction. Our Data Protection Addendum (section 2.2) says tiun and the seller are independent controllers. We are not your processor, and we are not joint controllers with you. We control the buyer data in our systems. You control the data in your own systems and anything you export from us.
Provider roles, in each provider's own words
Mixed roles are normal. Stripe is your processor for most of what it does for you, and a controller for fraud screening and know-your-customer checks. Read the role per data category, not per company. All sources below were checked on 4 November 2026.
Provider | Role for checkout and buyer data, as the provider states it | Source and its date |
|---|---|---|
Stripe Payments and Billing | Processor when it provides its services to you. "Data Controller" (Stripe's term) for choosing banks and payment method providers, fraud and loss prevention, its own billing, legal compliance including AML and KYC, and improving its products. Personal data is transferred to Stripe, LLC in the US | Stripe Data Processing Agreement, last updated 28 Sep 2026 |
Stripe Managed Payments | The buyer sees Link as the merchant of record ("Sold through Link"). Link's consumer terms call Stripe and the business independent controllers. A buyer's deletion request also deletes data from objects in your Stripe account. Lemon Squeezy plans to move its sellers to this product | How Managed Payments works; Link terms, effective 20 Oct 2026 |
Paddle | Its privacy notice is issued by four Paddle controller entities (London, New York, Dublin, Toronto), and Paddle calls itself an authorised reseller. Paddle's separate processor DPA lists "Customer's customers" as data subjects and has no carve-out for reseller data. Ask which document covers checkout | Paddle privacy notice, 16 Mar 2026; Paddle DPA, 1 Feb 2023 |
Adyen (acquirer, not an MoR) | Controller for the transaction data it processes as acquirer | Adyen transaction privacy statement, no date shown |
tiun | tiun and the seller are independent controllers. As between us, tiun owns the service records (buyer accounts, transactions, subscription state). You can view and export them (CSV or API) and request deletion | Our legal terms, version 2026.9, 2 Sep 2026 |
Polar | Processor for information processed to provide its services, controller for all other information. Another line names Polar Software Inc. as controller in connection with the services. The policy doesn't address its merchant of record role | Polar privacy policy, effective 8 Sep 2026 |
Creem | Controller, joint controller with merchants, or processor, depending on the purpose. Merchants receive buyer data as separate controllers | Creem privacy notice V2.0, effective 5 Aug 2026 |
Dodo Payments | Describes its entities as controllers. Doesn't state the seller's role | Dodo Payments privacy policy; header says 26 Feb 2026, body says 30 Apr 2024 |
Where a provider's documents disagree with each other, as with Polar and Paddle, ask for the role per data category in writing before you fill in your own privacy notice.
Changes for your privacy notice, requests and exports
1. Name the MoR in your privacy notice
Article 13(1)(e) GDPR requires your privacy notice to list the recipients, or categories of recipients, of personal data. With an MoR, name it, say that it acts as an independent controller for payments, tax and invoicing, and link to its privacy policy. We require this: our Data Protection Addendum (section 5.2) asks every seller to name tiun as merchant of record and independent controller, and to link to our privacy policy. Our GDPR checklist for SaaS payments covers the rest of the notice.
2. Send each request to the controller that holds the data
Access, correction and erasure requests go to each controller for its own copy, and Article 12(3) gives each one a month to answer. If a buyer writes to you, answer for what sits in your own systems: product database, CRM, email tool, analytics and any exports. Then point them to the MoR for checkout and invoice data. For tiun, that is legal@tiun.io. You can also ask us to delete a buyer's records.
3. Expect the MoR to keep some records after deletion
Article 17(3)(b) GDPR lets a controller keep data it needs to comply with a legal obligation. An MoR relies on this for invoices, tax records, AML checks and chargeback evidence. You can't instruct it to delete those records, because it doesn't process them on your behalf. Our Master Services Agreement (section 11.6) lists Swiss and other tax law, AML and KYC rules, card scheme rules and legal defence as the reasons we keep records after a deletion request.
4. Check what you can export, and for how long
GDPR doesn't use the word "ownership", so the contract decides it. Our Master Services Agreement (section 11.2) says that, as between you and us, tiun owns the service records: buyer accounts, transaction records, subscription states, credentials and logs. You can view them, export them as CSV or through the API, and request deletion. Once you export a copy, you are the controller of that copy. After you leave, the export stays open for at least 90 days (section 18.2).
Our contract has no clause for moving saved cards to another provider. If you migrate away, plan for buyers entering their card details again.
5. Let the MoR lead breach notices to buyers
Article 34 GDPR puts the duty to tell individuals about a high-risk breach on the controller. For checkout data, that is the MoR. We notify you without undue delay, and our Data Protection Addendum (section 7.5) says we lead communication with buyers. You can't contact buyers about a breach of our systems without our consent, unless the law requires you to.
Stripe Managed Payments deletes data in your own Stripe account
Stripe Managed Payments sells through Link, and Link's consumer terms describe Stripe and the business as independent controllers. Deletion reaches further than that label suggests. When a buyer asks for deletion, Stripe cancels their Managed Payments subscriptions and deletes their data from Managed Payments data objects "(including objects in your Stripe account)", according to Stripe's documentation. The list covers Customer, PaymentMethod, Invoice, PaymentIntent, Subscription, Charge and v2 Account objects. Stripe emails you when the request arrives.
If your app checks access against a Stripe Customer or Subscription ID, one deletion request can remove the record your product relies on. Keep your own user table as the source of truth, and act on Stripe's email so you can handle the buyer's data in your own systems too.
Questions to ask a merchant of record before you sign
Our own answers follow each question.
Which role do you take for each data category: checkout, invoices, fraud checks, support and analytics?
We are an independent controller for the buyer data we process as the seller. You are a controller for anything in your own systems and anything you export.
Which fields can I export, in which format, and for how long after I leave?
Your customer records, as CSV or through the API, for at least 90 days after you leave.
Which records do you keep after a buyer asks for deletion, and under which laws?
Records required by tax law, AML and KYC rules and card scheme rules, and records we need for legal claims.
Is the buyer account shared with other sellers?
Yes. Under section 4.7 of our Master Services Agreement, a buyer gets a tiun account on their first purchase. It holds their login, contact details and saved payment methods, and it works with every tiun seller, including your competitors. You don't control that account.
Who tells buyers about a breach, and can I contact them myself?
We lead communication with buyers about a breach of our systems, as described above.
Will you ever act as my processor?
For checkout data, no. Our Data Protection Addendum (section 2.4) plans a processor role for future features where you push your own data into tiun, such as AI analytics fed from your systems. That role will come with a separate annex, which isn't published yet.
Where is the data processed, and who are your sub-processors?
Our data is primarily processed in Switzerland and the EEA, with transfers elsewhere covered by adequacy decisions or standard contractual clauses.
FAQ
Do I need a DPA with my merchant of record?
Not an Article 28 DPA for the checkout data it controls. You need one only for a service where the MoR acts on your instructions, such as analytics on data you send it. With tiun, our Data Protection Addendum is part of the Master Services Agreement and sets out the terms between two independent controllers.
Can I email my buyers for marketing?
You can use the buyer data you hold as a controller if you have a lawful basis, and the e-marketing rules apply on top (ePrivacy Directive Article 13 in the EU, PECR in the UK). The "soft opt-in" covers contact details obtained in the context of a sale. With an MoR, the sale is legally the MoR's, so relying on it is uncertain. The safe route is to ask for marketing consent in your own signup or onboarding flow.
Is a merchant of record a joint controller?
Rarely. Joint control under Article 26 needs both parties to decide together why the data is processed, and a seller and an MoR usually pursue separate purposes. Creem's privacy notice says it can be a joint controller with merchants for some purposes. If a provider says that, ask for the Article 26 arrangement, because buyers can use their rights against either party. Our Data Protection Addendum says tiun and the seller are not joint controllers.
Who owns my buyers' data?
GDPR gives controllers duties, not ownership, so the contract decides who owns the records. With tiun, we own the service records as between us, and you have the right to view, export and request deletion. The exported copy is yours to control.
What about card numbers?
Card numbers are handled by the MoR's payment processors under the card industry's PCI DSS rules, which sit alongside GDPR. We don't store raw card numbers: payment details are tokenised through our payment processors. You shouldn't receive card numbers at all.
What changes under UK GDPR?
The roles work the same way. UK GDPR keeps the EU definitions of controller and processor, and the ICO's guidance treats a processor that processes to meet its own legal duties as a controller. Your privacy notice duties are the same, and UK buyers complain to the ICO.