At Vinted Pay, safeguarding your privacy is our core commitment. We employ robust security measures to protect your data, so you can make and receive payments with peace of mind.
What is our role in your privacy?
"We" are Vinted Pay Limited, a UK company that provides an electronic payments solution, simply known as "Vinted Pay". We operate under the Electronic Money Institution Licence issued by the UK Financial Conduct Authority. You can find our full contact details below.
Whenever you use Vinted Pay to process your payment, we act as your "data controller". This means we take responsibility for keeping your data safe and using it in accordance with the strict requirements set out in data protection laws.
To help you understand how we handle your data, we've gathered essential information on what data we collect, how we use it, who we share it with, and how we keep it safe. We encourage you to review this information to stay informed about your choices and rights regarding your data.
What type of data do we collect about you?
We begin collecting your data from the moment you start using Vinted Pay.
By "your data" we mean personal data – any information that can identify or be linked to you as an individual.
The amount of data we collect depends on how you use our services. Note that we collect most of your data directly from you but we may also receive it from other sources, like Vinted Platform Limited or Vinted UAB, and their service providers; other payment service providers, our third-party providers (like AML Screening & Monitoring Service providers), your representatives, government authorities, or companies we acquire or are acquired by.
Based on this, we may collect the following categories of data:
- Identification data, like your full name, copy of your passport or ID card, a photo of your facial image.
- Account data, like account (wallet) ID, account creation data.
- Contact data, like your email, phone number, mailing address.
- Communication data, like emails, and other forms of communication with us, along with the accompanying information like the date and time, sender and recipients, attachments.
- Commercial data, like the name of your workplace, your position.
- Demographic data, like date of birth, nationality.
- Financial data, like your IBAN, bank account name; e-wallet balance.
- Transactional data, like your payment ID, payment status, transaction amount and currency, purchase and sale history, invoices, receipts.
- Location data, like your home address, country.
- Security data, like proof of address, bank statements, Know Your Customer status, Politically Exposed Person checks data (such as whether you, your family member, or a close associate is such a person, and related details (like name, organisation, position)), or if you are subject to national or international sanctions, user blocking details.
- Biometric data, data derived from the technical analysis of your facial features to verify your identity, such as comparing a live facial scan with the photo on your ID document.
- Audio-visual data, like photos, video recordings, taken during remote identity verification.
- Feedback data, like Vinted user reviews.
- Listing data, like sold item title, description, photos, pricing.
- Shipping data, like shipment status.
- Device and technical data, like your IP address, device ID, browser type.
- Activity data, like actions performed on Vinted Pay webpage, services usage info.
What do we use your data for?
To ensure that Vinted Pay operates smoothly and securely
So you can use our services
Purpose. We use your data to enable you to access Vinted Pay and use our services, like creating an e-wallet. We collect this data either directly from you or, when you are switching providers, from your previous payment service provider.
Data categories. Identification data, account data, demographic data, contact data, device and technical data, location data.
Legal basis.
- Your contract with us Terms & Conditions.
- Vinted Pay's legitimate interest in managing the contractual relationship with our business clients, in case we need to handle the data of their employees or representatives.
Data retention. For the duration of your relationship with Vinted Pay.
So you can carry out transactions
Purpose. We use your data to allow you to complete transactions on Vinted Pay. This includes making and receiving payments, getting refunds, and issuing payouts.
Data categories. Identification data, financial data, transactional data.
Legal basis.
- Your contract with us Terms & Conditions.
Data retention. Until the completion of a transaction.
So we can analyse and improve our services
Purpose. We use your data to better understand how you're using our services and improve them.
Data categories. Activity data, financial data, transactional data, communications data, location data, security data, device and technical data.
Legal basis. Vinted Pay's legitimate interest in continuously improving its services, optimising operations, enhancing reliability, and improving user experience.
Data retention. For the duration of your relationship with Vinted Pay.
So that we can off-board you
Purpose. We use your data so that we can off-board you as a client as and when needed. This may happen of your own accord (for example, if you no longer wish to use Vinted Pay services) or due to our decision (say, if you become subject to national or international sanctions).
Data categories. Identification data, contact data, financial data.
Legal basis. Your contract with us Terms & Conditions.
Data retention. For the duration of off-boarding.
So you can reach out to us for help
Purpose. We use your data to investigate and respond to your queries, requests, or complaints. To do that we use the help of Vinted UAB providing us with the service of Customer Support.
Data categories. Identification data, account data, contact data, communication data, demographic data, financial data, transactional data, listing data, location data, security data.
Legal basis.
- Legal obligation (UK Payment Services Regulations 2017), in case you submit a complaint or a request relating to our payment services.
- Your contract with us Terms & Conditions, in case you reach out to us about other matters.
Data retention. 3 years following the resolution of a query, request, or complaint.
To help prevent fraud, money laundering, and terrorist financing
So we can verify your identity
Purpose. We use your data to make sure that we know who you are so we're compliant with the law. When you open your wallet or reach an internal trigger such as a certain sales threshold, we'll need to verify your identity by way of:
- Identity verification against trusted sources: a verification of your identity details against independent or authoritative data sources. This can include checks that confirm your identity and address information or that verify that the name you provide corresponds with the name associated with your bank account.
- Biometric identity verification: we may ask you to provide a photo of your face and a copy of your national ID, passport or your driver's licence to confirm that the document belongs to you. Automated tools may be used to compare your facial image with the photo on your identity document in order to verify your identity. During this process biometric data is processed to perform the verification but it is not recorded or stored.
- In some cases, depending on the verification provider, the outcome of the identity verification may initially be determined solely by automated means. If the verification is unsuccessful, you may be unable to continue using our services. You have the right to request human review and to contest the outcome by contacting us at dataprotection@vintedpay.com.
Data categories. Identification data, contact data, location data, demographic data, security data, biometric data, audio-visual data, device and technical data.
Legal basis.
- Your consent for biometric data.
- Legal obligation (UK's Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017) for the remaining types of data.
- Legitimate interest for a transfer of a copy of your national ID, passport or driver's licence from your previous payment service provider to Vinted Pay, provided your identity has already been verified. Relying on your legitimate interest in a smoother user experience allows us to avoid requiring you to repeat the identity verification process.
Data retention. 5 years from the end of your relationship with Vinted Pay, with the exception of biometric data, which is deleted immediately after your identity is verified.
So we can carry out necessary due diligence
Purpose. We use your data to carry out the Know Your Customer (KYC) checks, which are essential for complying with the regulations aimed at preventing fraud, money laundering, and other financial crimes. This also includes Politically Exposed Person checks, sanctions match checks and reporting to state authorities, as well as adverse media checks.
Data categories. Identification data, account data, contact data, commercial data, communication data, demographic data, financial data, transactional data, listing data, location data, device and technical data, security data.
Legal basis.
- Legal obligation (UK's Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017).
- Legitimate interest to better fulfil our AML/CTF legal obligations when performing KYC checks in the scope of your Vinted account data, some of the security data, transactional data and aggregated listing data.
Data retention. 5 years from the end of your relationship with Vinted Pay.
So we can monitor suspicious users and activities
Purpose. We use your data to monitor transactions on Vinted Pay and report suspicious financial activities, so that we comply with our anti-money laundering and counter-terrorist financing ("AML/CTF") obligations.
Data categories. Identification data, account data, activity data, contact data, demographic data, device and technical data, financial data, feedback data, communication data, location data, listing data, security data, shipping data, transactional data.
Legal basis.
- Legal obligation (UK's Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017) for identification data, contact data, demographic data, device and technical data, financial data, communication data, location data.
- Legitimate interest to better fulfil our AML/CTF obligations when processing listing data, shipping data, feedback data and some of the security data.
Data retention. 5 years from the end of your relationship with Vinted Pay.
To meet our broader legal obligations and for other legal purposes
So we can comply with our regulatory reporting, and safeguarding obligations, and provide information to law enforcement and other state institutions
Purpose. We use your data to meet our broader legal obligation, like those related to accounting, tax, client funds safeguarding, and regulatory reporting to the UK Financial Conduct Authority (FCA). We may also share certain information with law enforcement and other state institutions upon their request.
Data categories. Identification data, account data, contact data, financial data, transactional data, location data, security data, other data as needed in a specific situation.
Legal basis. Legal obligation (like, UK Payment Services Regulations 2017; Electronic Money Regulations 2011; Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017; Value Added Tax Act 1994, Client Assets Sourcebook (CASS) of the FCA Handbook, and other applicable regulations).
Data retention.
- For as long as necessary to prepare the required reports, in the case of regulatory reporting to the FCA, accounting and financial reporting, and safeguarding client's funds.
- Data used for tax reporting is kept for 6 years from the end of the calendar year of the date of the relevant payment.
- Accounting-related data is kept for 6 years after the end of the last financial year the issuance of an invoice is related to.
| Good to know |
|---|
| We carefully review each request from state institutions and won't share your data if the request is unfounded or unlawful. |
So you can exercise your rights
Purpose. We use your data to help you exercise your contractual, privacy, or other legal rights. For example, if you request to access all the data we have on you, we use it to create a copy and share it with you. We also retain some information as proof that we've properly addressed your rights.
Data categories. Identification data, account data, contact data, communication data, demographic data, financial data, location data, security data, device and technical data.
Legal basis.
- Legal obligation when you're exercising your statutory rights.
Data retention. 3 years from the date we respond to your rights request.
| Good to know |
|---|
| We care about your privacy, so sometimes we might request additional information to confirm it's really you or your authorised representative making a request to exercise certain rights. |
So we can defend our rights and legitimate interests
Purpose. We use your data to handle complaints or disputes, to enforce our Terms & Conditions, or to protect our rights and legitimate interests. This includes cases where we need to establish, exercise, or defend against legal claims, whether in court, administrative settings, or out-of-court processes.
Data categories. Identification data, account data, activity data, contact data, communication data, demographic data, financial data, transactional data, location data, security data, and other data as needed in a specific situation.
Legal basis. Vinted Pay's legitimate interest in the establishment, exercise, or defence of legal claims.
Data retention. 6 years after the end of your relationship with Vinted Pay or as long as the dispute lasts.
Who do we share your data with?
Sometimes we need to share your data with third parties. Who we share it with depends on how you use Vinted Pay and interact with us. When necessary for the purposes mentioned above, we may share your data with:
Service providers and partners
To keep Vinted Pay running smoothly, we share your data with external service providers who offer services such as cloud storage, IT security, maintenance, technical support, communication, and customer support services. We have contracts in place to ensure that they use your data only as instructed by us.
We may also share your data with our AML Screening & Monitoring Service providers, payment partners, attorneys, notaries, auditors, accountants, translators, insurers, consultants, and other vendors who assist us in different aspects of our operations.
Most of our service providers are based within the UK. That said, if a service provider is located outside the UK, we take additional steps to ensure the security and lawful transfer of your data, as required by applicable data protection laws.
More specifically, for data transfers to the EEA, we make sure your data is protected by way of valid safeguards, such as the UK adequacy regulations. For transfers of personal data to the US and other countries, we ensure appropriate safeguards are in place, such as the International Data Transfer Agreement or the UK Addendum to Standard Contractual Clauses, agreed in our contracts with data recipients.
| Good to know |
|---|
| If you want to know the categories of recipients with whom your personal data have been or will be shared, you can exercise your right of access. Read the section Your rights below to find out more. |
Vinted Pay Affiliates and Investors
We may share your data with companies in the Vinted group to which Vinted Pay belongs, and any entities to be incorporated or acquired in the future.
If an entity is based outside the UK, we rely on the UK adequacy regulations to ensure that your data is secure and transferred lawfully.
Also, if we're seeking investments or are involved in mergers and acquisitions, we may share your data with potential investors or companies that may acquire or merge with Vinted Pay.
Government agencies, public authorities, and parties involved in legal proceedings with us
When required by law, we may share your information with law enforcement agencies, courts, government bodies (including tax and financial authorities), and intergovernmental bodies. We may also share data with other third parties bringing legal claims against us.
However, we only do so when required by law, if we suspect that you are involved in illegal activities, in case we need to protect Vinted Pay's rights and interests, or in other exceptional cases.
What choices and rights do you have over your data?
Your choices
You have control over your data. In some cases, you can choose not to share certain information with us or withhold consent for specific purposes.
Your choice to share data and its implications
Providing your data is sometimes necessary and sometimes optional, with varying impacts:
- When sharing your data is required by law (such as for tax reporting) or necessary for a contract (like processing a payment), not providing it may prevent you from using Vinted Pay's services. You can find more details in our Terms & Conditions.
- In other cases, while data provision is optional, choosing not to share it could limit certain features. For example, if you don't provide your bank account information, you won't be able to receive a payout.
You have the option to withhold consent for certain uses of your data
When we ask for your consent to use your data for certain purposes, you always have the option to say yes or no.
You can also change your mind and withdraw your consent at any time. Please note that withdrawing consent does not affect the legality of any data use that occurred before the withdrawal.
Your rights
You have the right to access the data we hold about you
You can ask us to confirm if we have any of your data and get a copy of it, so long as it does not negatively impact the rights and freedoms of others. We'll also provide additional information, like how we use your data and who we share it with.
You have the right to have us correct any inaccurate data we hold about you
You can ask us to update any outdated, inaccurate, or incomplete data we have about you. Note that in some cases, we may ask you to go through our due diligence procedure so that we comply with our AML/CTF obligations.
You have the right to be 'forgotten' by us
You can ask us to delete your data but keep in mind this right doesn't apply in all cases.
We'll delete your data if:
- We no longer need it;
- We handled your data unlawfully;
- You withdraw your consent (when we rely on this legal basis to use your data);
- You object to us using your data and we don't have overriding legitimate grounds; or
- Other grounds specified in the data protection laws apply in your specific situation.
Once we receive your request, we'll carefully review your situation to see if any of these grounds and their exceptions apply. You don't need to specify a particular ground in your request, but it can help us process your request faster. If we find that your situation doesn't fit any of these grounds, or if there are other legal exceptions, we'll let you know.
| Good to know |
|---|
Some laws (such as those relating to AML/CTF) require us to retain some of your data for a certain period of time, which could be several years. Yet we don't keep your data forever. Even if you don't ask, we make it anonymous or delete it as soon as its retention period is over. |
You have the right to restrict how your data is used
You have the right to request limitations on how your data is used in specific situations.
You have the right to export your data
We will give you a copy of your data so that you can provide it to another service. If you ask us and it is technically possible, we will directly transfer the data to the other service for you. However, we will not do so to the extent that this involves sharing data about other people.
You have the right to object to us using your data
You can object to the use of your data when it's based on our legitimate interest.
If you object, we will stop using your data unless it's necessary for legal purposes or we can show a compelling reason that outweighs your rights.
You have the right to challenge fully automated decisions
You have the right not to be subject to decisions made solely by automated processing of your data, including profiling, if these decisions have legal or other significant effects on you. But there are exceptions: if it's necessary for a contract, allowed by law with safeguards, or if you've agreed to it. In those cases, we'll ensure your rights are protected, including letting you have a say and contesting the decision.
You have the right to lodge a complaint
If you're worried about how we handle your personal information, you can talk to us first so that we can address your concerns properly. You may also take your complaint to the data protection authority (the UK Information Commissioner's Office (ICO)).
Cookies
Cookies are small text files that we store on your device when you access Vinted Pay. In particular, we use strictly necessary cookies to ensure that all the essential features function properly. Note that these cookies cannot be turned off; otherwise, Vinted Pay would become practically unusable. We may also use performance cookies if you provide your consent.
How do we protect your data?
As a UK company, Vinted Pay is subject to high data protection standards (like UK GDPR) and regulatory oversight. We've put in place and continuously improve our technical and organisational measures to ensure data security and compliance.
Technical means
We use advanced technical and electronic measures, as well as strong physical safeguards to protect your data. For example, we employ encrypted communication, firewall protection, access controls, and regular security audits.
Organisational means
We have specialised teams for information security, privacy, and compliance, led by experts in these fields. Our employees are bound by confidentiality obligations, and we maintain effective internal policies and procedures to ensure the security of your data.
Your role
We work hard to protect your data, but even the best security measures can't always prevent cyberattacks or guarantee that unauthorised parties won't access or tamper with your data. So, please be careful with the data you share. Remember to keep your personal information secure. If you have any concerns about your data or notice anything unusual, contact us right away.
How can you contact us?
For any questions about your data collection, use, and your rights, please contact us at dataprotection@vintedpay.com. You can also reach out to us at the following address:
Vinted Pay Limited
25 Worship Street
London EC2A 2DX
UK
Updates
This page was last updated on 17-03-2026.
Please don't make this the last time you read it, as we will post any changes on this page. Significant changes will also be notified by email and/or other means.