At Vinted Pay, safeguarding your privacy is our top priority. Make and receive transactions securely, with full confidence that your data is well protected.
What is our role in your privacy?
“We” are Vinted Pay, UAB, a European company that provides an electronic payments solution, simply known as “Vinted Pay”. We operate under the Electronic Money Institution Licence issued by the Bank of Lithuania. You can find our full contact details below.
Whenever you use Vinted Pay to process your payment, we act as your “data controller”. This means we take responsibility for keeping your data safe and using it in accordance with strict legal requirements, such as the General Data Protection Regulation (“GDPR”).
To help you understand how we handle your data, we’ve gathered essential information on what data we collect, how we use it, who we share it with, and how we keep it safe. We encourage you to review this information to stay informed about your choices and rights regarding your data.
What type of data do we collect about you?
We begin collecting your data from the moment you start using Vinted Pay.
By “your data” we mean personal data – any information that can identify or be linked to you as an individual.
The amount of data we collect depends on your interactions with us. Note that we collect most of your data directly from you but we may also receive it from other sources, like Vinted, UAB; other payment service providers, our AML Screening & Monitoring Service providers, your representatives, government authorities, or companies we acquire or are acquired by.
Based on this, we may collect the following categories of data:
- Identification data, like your full name, copy of your passport or ID card, a photo of your facial image.
- Account data, like account (wallet) ID, account creation data.
- Contact data, like your email, phone number, home address.
- Communication data, like emails, and other forms of communication with us, along with the accompanying information like the date and time, sender and recipients, attachments.
- Commercial data, like the name of your workplace, your position.
- Demographic data, like date of birth, nationality.
- Financial data, like your IBAN, bank account name; e-wallet balance.
- Transactional data, like your payment ID, payment status, transaction amount and currency, purchase and sale history, invoices, receipts.
- Location data, like your home address, country.
- Security data, like proof of address, bank statements, Know Your Customer status, Politically Exposed Person checks data (such as whether you, your family member, or a close associate is such a person, and related details (like name, organisation, position)), or if you are subject to national or international sanctions, user blocking details.
- Biometric data, data derived from the technical analysis of your facial features to verify your identity, such as comparing a live facial scan with the photo on your ID document.
- Audio-visual data, like photos, video recordings, taken during remote identity verification.
- Feedback data, like Vinted user reviews.
- Listing data, like sold item title, description, photos, pricing.
- Shipping data, like shipment status.
- Activity data, like actions performed on Vinted Pay webpage, services usage info.
- Device and technical data, like your IP address, device ID, browser type.
What do we use your data for?
To ensure that Vinted Pay operates smoothly and securely
So you can use our services
Purpose. We use your data to enable you to access Vinted Pay and use our services, like creating an e-wallet. We collect this data either directly from you or, when you are switching providers, from your previous payment service provider.
Data categories. Identification data, account data, demographic data, contact data, device and technical data, location data.
Legal basis.
- Your contract with us Terms & Conditions.
- Vinted Pay’s legitimate interest in managing the contractual relationship with our business clients, in case we need to handle the data of their employees or representatives.
Data retention. For the duration of your relationship with Vinted Pay.
So you can carry out transactions
Purpose. We use your data to allow you to complete transactions on Vinted Pay. This includes making and receiving payments, getting refunds, and issuing payouts.
Data categories. Identification data, financial data, transactional data.
Legal basis.
- Your contract with us Terms & Conditions.
- Legitimate interest for a transfer of withdrawal account details from your previous payment service provider to Vinted Pay, provided the payment provider has it. To make your experience smoother, we rely on our legitimate interest to avoid asking you to provide the same information repeatedly.
Data retention. Until the completion of a transaction.
So we can analyse and improve our services
Purpose. We use your data to better understand how you’re using our services and improve them.
Data categories. Activity data, financial data, transactional data, communications data, location data, security data, device and technical data.
Legal basis. Vinted Pay’s legitimate interest in continuously improving its services, optimising operations, enhancing reliability, and improving user experience.
Data retention. For the duration of your relationship with Vinted Pay.
So that we can off-board you
Purpose. We use your data so that we can off-board you as a client as and when needed. This may happen of your own accord (for example, if you no longer wish to use Vinted Pay services) or due to our decision (say, if you become subject to national or international sanctions).
Data categories. Identification data, contact data, financial data.
Legal basis. Your contract with us Terms & Conditions.
Data retention. For the duration of off-boarding.
So you can reach out to us for help
Purpose. We use your data to investigate and respond to your queries, requests, or complaints.
Data categories. Identification data, account data, contact data, communication data, demographic data, financial data, transactional data, listing data, location data, security data.
Legal basis.
- Legal obligation (Republic of Lithuania Law on Payments), in case you submit a complaint or a request relating to our payment services.
- Your contract with us Terms & Conditions, in case you reach out to us about other service-related matters.
Data retention. 5 years following the resolution of a query, request, or complaint.
To help prevent fraud, money laundering, and terrorist financing
So we can verify your identity remotely and securely
Purpose. We use your data to make sure that we know who you are so we’re compliant with the law. In some cases (for example, if you reach a certain sales threshold), we’ll need to verify your identity by way of:
- Remote identity verification: we may ask you to provide a photo of your face and a copy of your national ID, passport or your driver’s licence to confirm that the document belongs to you. Automated tools may be used to compare your facial image with the photo on your identity document in order to verify your identity. During this process biometric data is processed to perform the verification but it is not recorded or stored.
In some cases, depending on the verification provider, the outcome of the identity verification may initially be determined solely by automated means. If the verification is unsuccessful, you may be unable to continue using our services. You have the right to request human review and to contest the outcome by contacting us at dataprotection@vintedpay.lt.
Data categories. Identification data, contact data, location data, demographic data, security data, biometric data, audio-visual data, device and technical data.
Legal basis.
- Your consent for biometric data.
- Legal obligation (Republic of Lithuania Law on the Prevention of Money Laundering and Terrorist Financing) for the remaining types of data.
- Legitimate interest for a transfer of a copy of your national ID, passport or driver’s licence from your previous payment service provider to Vinted Pay, provided your identity has already been verified. Relying on your legitimate interest in a smoother user experience allows us to avoid requiring you to repeat the identity verification process.
Data retention. 8 years from the end of your relationship with Vinted Pay, with the exception of biometric data, which is deleted immediately after your identity is verified.
So we can carry out necessary due diligence
Purpose. We use your data to carry out the Know Your Customer (KYC) checks, which are essential for complying with the regulations aimed at preventing fraud, money laundering, and other financial crimes. This also includes Politically Exposed Person checks, sanctions match checks and reporting, as well as adverse media checks.
Data categories. Identification data, account data, contact data, commercial data, communication data, demographic data, financial data, transactional data, listing data, location data, device and technical data, security data.
Legal basis.
- Legal obligation (Republic of Lithuania Law on the Prevention of Money Laundering and Terrorist Financing).
- Legitimate interest to better fulfil our AML/CTF legal obligations when performing KYC checks in the scope of your Vinted account data, some of the security data, transactional data and aggregated listing data.
Data retention. 8 years from the end of your relationship with Vinted Pay.
So we can monitor suspicious users and activities
Purpose. We use your data to monitor transactions on Vinted Pay and report suspicious financial activities, so that we comply with our anti-money laundering and counter-terrorist financing (“AML/CTF”) obligations.
Data categories. Identification data, account data, activity data, contact data, demographic data, device and technical data, financial data, feedback data, communication data, location data, listing data, security data, shipping data, transactional data.
Legal basis.
- Legal obligation (Republic of Lithuania Law on the Prevention of Money Laundering and Terrorist Financing) for identification data, contact data, demographic data, device and technical data, financial data, communication data, location data.
- Legitimate interest to better fulfil our AML/CTF obligations when processing listing data, shipping data, feedback data and some of the security data.
Data retention. 8 years from the end of your relationship with Vinted Pay, with the exception of communications data, which is kept for 5 years.
To meet our broader legal obligations and for other legal purposes
So we can comply with our regulatory obligations, including strong customer authentication (SCA), regulatory reporting, and safeguarding requirements, and provide information to law enforcement and other state institutions
Purpose. We use your data to meet our broader legal obligations, like those relating to accounting, tax, AML/CFT and client funds safeguarding, strong customer authentication (SCA), and regulatory reporting to the Bank of Lithuania. We may also share certain information with law enforcement and other state institutions upon their request or when required by law.
Data categories. Identification data, account data, contact data, financial data, transactional data, location data, security data, device and technical data, other data as needed in a specific situation.
Legal basis. Legal obligation (Republic of Lithuania Law on the Prevention of Money Laundering and Terrorist Financing; Republic of Lithuania Law on Payments; General Index of Document Retention Periods; Law on Documents and Archives of the Republic of Lithuania No. I-1115; Law on Accounting of the Republic of Lithuania No. IX-574; and other applicable laws).
Data retention.
- For as long as necessary to prepare the required reports, in the case of regulatory reporting to the Bank of Lithuania, accounting and financial reporting, and safeguarding client’s funds.
- Data used for tax reporting is kept for 3 years from the end of the calendar year of the date of the relevant payment.
- Data used for AML/CTF reporting to the Financial Crime Investigation Service, as well as for SCA is kept for 8 years from the end of your relationship with Vinted Pay.
- Accounting-related data is kept for 10 years after the issuance of an invoice.
| Good to know |
|---|
| We carefully review each request from state institutions and won’t share your data if the request is unfounded or unlawful. |
So you can exercise your rights
Purpose. We use your data to help you exercise your contractual, privacy, or other legal rights. For example, if you request to access all the data we have on you, we use it to create a copy and share it with you. We also retain some information as proof that we’ve properly addressed your rights.
Data categories. Identification data, account data, contact data, communication data, demographic data, financial data, location data, security data, device and technical data.
Legal basis.
- Legal obligation when you’re exercising your statutory rights.
Data retention. 3 years from the date we respond to your rights request.
| Good to know |
|---|
| We care about your privacy, so sometimes we might request additional information to confirm it’s really you or your authorised representative making a request to exercise certain rights. |
So we can defend our rights and legitimate interests
Purpose. We use your data to handle complaints or disputes, to enforce our Terms & Conditions, or to protect our rights and legitimate interests. This includes cases where we need to establish, exercise, or defend against legal claims, whether in court, administrative settings, or out-of-court processes.
Data categories. Identification data, account data, activity data, contact data, communication data, demographic data, financial data, transactional data, location data, security data, and other data as needed in a specific situation.
Legal basis. Vinted Pay’s legitimate interest in the establishment, exercise, or defence of legal claims.
Data retention. 10 years after the end of your relationship with Vinted Pay, or as long as the dispute lasts.
Who do we share your data with?
Sometimes we need to share your data with third parties. Who we share it with depends on how you use Vinted Pay and interact with us. When permitted by law and necessary for the purposes mentioned above, we may share your data with:
Service providers and partners
To keep Vinted Pay running smoothly, we may share your data with external service providers who offer services such as cloud storage, IT security, maintenance, technical support, communication, and customer support services. We have contracts in place to ensure that they use your data only as instructed by us.
We may also share your data with our AML Screening & Monitoring Service providers, payment partners, attorneys, notaries, auditors, accountants, translators, insurers, consultants, and other vendors who assist us in different aspects of our operations.
Most of our service providers are based in countries within the European Economic Area (“EEA”). That said, if a service provider is located outside the EEA, we take additional steps to ensure the security and lawful transfer of your data, as required by the GDPR.
More specifically, for data transfers to the UK and other countries, we make sure your data is protected by way of valid safeguards, such as the adequacy decisions or standard contractual clauses approved by the European Commission in our contracts with data recipients.
| Good to know |
|---|
| If you want to know the specific recipients or categories of recipients with whom your personal data have been or will be shared, you can exercise your right of access. Read the section Your rights below to find out more. |
Vinted Pay Affiliates and Investors
We may share your data with companies in the Vinted group to which Vinted Pay belongs, and any entities to be incorporated or acquired in the future.
If an entity is based outside the EEA, we rely on standard contractual clauses included within our Intra-Group Data Processing and Transfer Agreement to ensure that your data is secure and transferred lawfully.
Also, if we’re seeking investments or are involved in mergers and acquisitions, we may share your data with potential investors or companies that may acquire or merge with Vinted Pay.
Government agencies, public authorities, and parties involved in legal proceedings with us
When required by law, we may share your information with law enforcement agencies, courts, government bodies (including tax and financial authorities), and intergovernmental bodies. We may also share data with other third parties bringing legal claims against us.
However, we only do so when required by law, if we suspect that you are involved in illegal activities, in case we need to protect Vinted Pay’s rights and interests, or in other exceptional cases.
What choices and rights do you have over your data?
Your choices
You have control over your data. You can choose not to share certain information with us or withhold consent for specific purposes.
Your choice to share data and its implications
Providing your data is sometimes necessary and sometimes optional, with varying impacts:
- When sharing your data is required by law (such as for tax reporting) or necessary for a contract (like processing a payment), not providing it may prevent you from using Vinted Pay’s services. You can find more details in our Terms and Conditions.
- In other cases, while data provision is optional, choosing not to share it could limit certain features. For example, if you don’t provide your bank account information, you won’t be able to receive a payout.
You have the option to withhold consent for certain uses of your data
When we ask for your consent to use your data for certain purposes, you always have the option to say yes or no.
You can also change your mind and withdraw your consent at any time. Please note that withdrawing consent does not affect the legality of any data use that occurred before the withdrawal.
Your rights
You have the right to access the data we hold about you
You can ask us to confirm if we have any of your data and get a copy of it, so long as it does not negatively impact the rights and freedoms of others. We’ll also provide additional information, like how we use your data and who we share it with.
You have the right to have us correct any inaccurate data we hold about you
You can ask us to update any outdated, inaccurate, or incomplete data we have about you. Note that in some cases, we may ask you to go through our due diligence procedure so that we comply with our AML/CTF obligations.
You have the right to be ‘forgotten’ by us
You can ask us to delete your data but keep in mind this right doesn’t apply in all cases.
We’ll delete your data if:
- We no longer need it;
- We handled your data unlawfully;
- You withdraw your consent (when we rely on this legal basis to use your data);
- You object to us using your data and we don't have overriding legitimate grounds; or
- Other grounds specified in the GDPR apply in your specific situation.
Once we receive your request, we’ll carefully review your situation to see if any of these grounds and their exceptions apply. You don’t need to specify a particular ground in your request, but it can help us process your request faster. If we find that your situation doesn’t fit any of these grounds, or if there are other legal exceptions, we’ll let you know.
| Good to know |
|---|
Some laws (such as those relating to AML/CTF) require us to retain some of your data for a certain period of time, which could be several years. Yet we don’t keep your data forever. Even if you don’t ask, we make it anonymous or delete it as soon as its retention period is over. |
You have the right to restrict how your data is used
You have the right to request limitations on how your data is used in specific situations.
You have the right to export your data
We will give you a copy of your data so that you can provide it to another service. If you ask us and it is technically possible, we will directly transfer the data to the other service for you. However, we will not do so to the extent that this involves sharing data about other people.
You have the right to object to us using your data
You can object to the use of your data when it’s based on our legitimate interest.
If you object, we will stop using your data unless it’s necessary for legal purposes or we can show a compelling reason that outweighs your rights.
You have the right to challenge fully automated decisions
You have the right not to be subject to decisions made solely by automated processing of your data, including profiling, if these decisions have legal or other significant effects on you. But there are exceptions: if it’s necessary for a contract, allowed by law with safeguards, or if you’ve agreed to it. In those cases, we’ll ensure your rights are protected, including letting you have a say and contesting the decision.
You have the right to lodge a complaint
If you’re worried about how we handle your personal information, you can talk to us first so that we can address your concerns properly. You may also take your complaint to the data protection authority in the country where you live, work, or where you think the problem occurred.
Cookies
Cookies are small text files that we store on your device when you access Vinted Pay. In particular, we use strictly necessary cookies to ensure that all the essential features function properly. Note that these cookies cannot be turned off; otherwise, Vinted Pay would become practically unusable. We may also use performance cookies if you provide your consent.
How do we protect your data?
As a European company, Vinted Pay is subject to high data protection standards (like GDPR) and regulatory oversight. We’ve put in place and continuously improve our technical and organisational measures to ensure data security and compliance.
Technical means
We use advanced technical and electronic measures, as well as strong physical safeguards to protect your data. For example, we employ encrypted communication, firewall protection, access controls, and regular security audits.
Organisational means
We have specialised teams for information security, privacy, and compliance, led by experts in these fields. Our employees are bound by confidentiality obligations, and we maintain effective internal policies and procedures to ensure the security of your data.
Your role
We work hard to protect your data, but even the best security measures can’t always prevent cyberattacks or guarantee that unauthorised parties won’t access or tamper with your data. So, please be mindful of what data you share. Remember to keep your personal information secure. If you have any concerns about your data or notice anything unusual, contact us right away.
How can you contact us?
For any questions about your data collection, use, and your rights, please contact us at dataprotection@vintedpay.lt. You can also reach out to us at the following address:
Vinted Pay, UAB
Švitrigailos st. 13
LT-03228 Vilnius
Republic of Lithuania
Updates
This page was last updated on 27-08-2026.
Please don’t make this the last time you read it, as we will post any changes on this page. Significant changes will also be notified by email and/or other means.