Braintree is a payment-processing platform, founded in 2007 and acquired by PayPal (then under eBay) in 2013 for approximately $800 million, that now operates under PayPal's privacy statement rather than a wholly separate policy. The Braintree Privacy Statement, published on PayPal's legal hub, discloses that PayPal entities act as data controller, describes use of cookies and other tracking technologies, states that personal data is not sold but may be shared across the 'PayPal corporate family' and with third-party service providers, and is accompanied by a documented 2018 FTC settlement involving PayPal's Venmo service over privacy and security disclosure practices. Corporate ownership is disclosed relatively clearly in public filings and the privacy statement itself, though the statement names different controlling PayPal legal entities depending on region, adding some complexity for consumers trying to trace responsibility.
TRACK RECORD
1 ENFORCEMENT ACTION
[2018-05-24]
On May 24, 2018, the Federal Trade Commission granted final approval to a settlement with PayPal, Inc. resolving allegations that PayPal's Venmo peer-to-peer service — part of the same corporate family later folded into the Braintree/PayPal structure — misrepresented its security practices and privacy controls and violated the Gramm-Leach-Bliley Act's Safeguards and Privacy Rules.
The Braintree Privacy Statement defines 'personal data' broadly to include a user's identity, financial information, contact information, and online behavior, collected when visiting Braintree websites or using Braintree services.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow you to permanently delete your personal data? — No.
The Braintree Privacy Statement discloses that different PayPal legal entities act as data controller depending on region: PayPal Pte. Ltd. for some markets, and PayPal (Europe) S.à r.l. et Cie, S.C.A. for users in the EEA/UK, with a named Data Protection Officer address in Luxembourg.
Braintree, founded in 2007, was acquired by eBay's PayPal unit in an all-cash transaction valued at approximately $800 million, announced on September 26, 2013, after which Braintree continued to operate as a service within PayPal.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
The Braintree Privacy Statement states that Braintree does not sell personal data, but discloses that data may be shared across PayPal's services and with other members of the 'PayPal corporate family,' as well as with third parties to provide services, address fraud and risk, and market products.
An earlier version of the Braintree Privacy Policy discloses that personal data may also be shared with 'businesses and members of the public, when data is aggregated and does not personally identify you,' and used to send promotional materials on behalf of PayPal's affiliates and business partners.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes.
Braintree's published Data Protection Addendum for card-processing products states that PayPal's processes and products are certified against industry security standards including ISO 27001 and PCI DSS, and undergo AICPA SOC-1 and SOC-2 audits, as part of its ongoing data-protection assurance program.
On May 24, 2018, the Federal Trade Commission granted final approval to a settlement with PayPal, Inc. resolving allegations that PayPal's Venmo peer-to-peer service — part of the same corporate family later folded into the Braintree/PayPal structure — misrepresented its security practices and privacy controls and violated the Gramm-Leach-Bliley Act's Safeguards and Privacy Rules.
The Braintree Privacy Statement discloses that Braintree and 'certain business partners and vendors' use cookies and other tracking technologies to recognize visitors, customize online experiences and advertising, measure promotion effectiveness, and mitigate fraud risk, and warns that disabling these technologies may limit use of the services.