Περιγραφή Δραστηριοτήτων Επεξεργασίας
Effective per 12 October 2026
This page forms Annex A to the Data Processing Agreement (“DPA”) between Controller and Mollie B.V. and Mollie UK Ltd. (“Processor”), and is incorporated therein by reference. It describes, per product or service where Mollie acts as a processor according to the DPA, the purpose of the Processing, the categories of Data Subjects, and the types of Personal Data processed.
Controller's enrolment in, or use of, a given product or service constitutes Controller's documented instruction to Processor, within the meaning of Article B.2 of the DPA, to Process Personal Data for that product or service as described below.
Processor may update this page from time to time to reflect Processing carried out under new, amended, or additional products or services taken up by Controller. Such updates do not reduce Controller's rights, or Processor's obligations, under the DPA.
Products and Services for which Mollie acts as a Processor on your behalf
Invoicing Service
Purpose of the Processing
Facilitating the sending of invoices to Controller's Customers via Mollie's products and services.
Categories of Data Subjects
Customers of Controller (i.e. the payer – consumers, business customers) who receive invoices.
Authorised Representatives / Staff: personnel of Controller whose names, contact details, or login credentials are used to access and manage the Mollie dashboard for invoicing purposes.
Types of Personal Data
Basic contact details (full name, (office) phone number, (business) email address, residential/company address).
Invoice details (as included by Controller).
Special Categories of Personal Data
No special categories of Personal Data (as defined by Article 9 GDPR) are Processed by Processor in connection with the Invoicing Service.
Disputes Service
Purpose of the Processing
Providing Controller with the necessary tools and information to respond to dispute claims, such as chargebacks or payment inquiries.
Categories of Data Subjects
Customers of Controller (i.e. the payer - consumers, business customers).
Third-Party Recipients: individuals identified in delivery records or transaction evidence who may not be the payer (e.g. a person receiving a gift at a shipping address).
Authorised Representatives / Staff: personnel of Controller whose names, contact details, or signatures may appear in dispute evidence, communication logs, or support tickets.
Third-Party Service Providers: individuals whose data may be contained in evidence provided by sub-processors or partners (e.g. a delivery driver's name on a proof-of-delivery signature).
Types of Personal Data
Reflecting the categories of data that flow through the sub-processors engaged for this service (see Annex B), the Disputes Service involves the following types of Personal Data:
Identity and contact data of the buyer/payer and, where applicable, the seller (e.g. name, address, phone number, email address).
Transaction metadata (e.g. payment and transaction identifiers, amounts, dates, order references).
Fulfilment and logistics data (e.g. delivery/shipping address, tracking information, proof-of-delivery records, including the name of a recipient who may not be the payer).
Dispute evidence: files and documents submitted by Controller or a Data Subject to substantiate or contest a dispute (which may itself contain any of the categories above), together with related technical/platform identifiers.
Special Categories of Personal Data
No special categories of Personal Data (as defined by Article 9 GDPR) are intentionally Processed by Processor in connection with the Disputes Service. As dispute evidence consists of files submitted by Controller or a Data Subject, Controller should ensure that such submissions do not include special category data unless strictly necessary and legally permissible.
Receipt Capture
Purpose of the Processing
Enabling cardholders and other users of Controller to capture, attach, and store receipts (photo or PDF) and accompanying free-text notes in relation to outgoing transactions made through a Mollie Business Account, including transactions made with a Mollie card; verifying, through automated optical character recognition ("OCR"), whether an attached receipt matches the underlying transaction (amount, merchant, and date); and, where Controller has enabled this at the organisation level, enforcing a policy requiring a receipt to be attached to card transactions. This Processing enables Controller to monitor and reconcile its business expenses. It is not intended, and should not be relied upon, to support Controller's compliance with its own statutory tax, bookkeeping, or record-retention obligations, responsibility for which rests with Controller under its own applicable law.
Categories of Data Subjects
Cardholders of Controller (current and former): employees or business owners of Controller who capture, view, or historically captured receipts and notes in relation to their own outgoing transactions.
Authorised Representatives / Staff: personnel of Controller with administrative or read-only access rights (organisation admins/account owners, and other staff granted view-only access) who can view, and where applicable download, replace, or delete receipts and notes across the organisation's transactions, and who configure the organisation-level "Require receipt" policy (admins only).
Third parties incidentally identifiable from receipt content: individuals whose personal data may incidentally appear within an uploaded receipt image or PDF (for example, a merchant employee's name printed on a receipt), independent of any structured data field.
Types of Personal Data
Identity and account data of the cardholder (name and other identifiers linked to the relevant Mollie card or account and the underlying transaction).
Transaction data used to verify a receipt match (transaction amount, timestamp, and merchant name/location).
Receipt file content: the photo (PNG) or PDF file of the receipt as uploaded by the cardholder, which may incidentally contain further personal data depicted in the document itself (for example, itemised purchases or other identifying details).
Transaction notes: free-text notes entered by the cardholder or an organisation admin in relation to a transaction.
OCR match outcome and confidence score generated by Processor's OCR service (matched / mismatch / low confidence, and an associated confidence score), processed internally by Processor and not visible to Controller or the cardholder.
Special Categories of Personal Data
No special categories of Personal Data (as defined by Article 9 GDPR) are intentionally Processed by Processor in connection with Receipt Capture. As receipt files consist of images or documents submitted by the cardholder, they may incidentally contain special category data (for example, where the purchase itself reveals health-related, religious, or other sensitive information). Controller should ensure that cardholders do not use Receipt Capture to submit such data unless strictly necessary and legally permissible.
