Glossary
GDPR
The GDPR, Regulation (EU) 2016/679, governs the processing of personal data of people in the EU and the EEA: it requires a lawful basis, purpose limitation, data minimisation, limited retention, security, records of processing and respect for data subjects' rights, with notification of breaches to the authority within 72 hours. In payments almost every record is personal data: the payer's name, card and account details, IP address and e-mail, and the merchant's directors and beneficial owners.
Controller and processor
The licensed payment business that decides why and how payer and merchant data is processed is the controller; the software vendor or cloud provider that processes it on the business’s instructions is a processor, bound by a data processing agreement with the duties of article 28. Each merchant is itself a controller for its customers. A platform must make the roles clear in its contracts and keep its processing within them.
What it changes in a platform
Retention periods that are justified, such as the record-keeping obligations of payment and anti-money-laundering law for journals; masking and access control so that card and personal data are seen only by people who need them; export and deletion mechanisms for data subject requests where the law does not require retention; and a known location of the data, since transfers outside the EEA need safeguards.
On the platform
Tranzify processes merchant and payer data on its clients’ instructions under a data processing agreement; deployment in the client’s own cloud account keeps the data in the client’s region and under its keys, personal data is masked outside the roles that need it, and the journal and log retention follow the record-keeping periods of the client’s regulation.
Updated: 2026-11-08