{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"ab33f12c-223c-4045-89ac-0ea091eb21c3","screeningDate":"2026-07-10T01:47:41.631Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"dc8f08a1-4c7e-4b31-a1cd-c3f8597c965a","name":"User Agreement","type":"terms","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.661Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"3e217da9e7ae7a1db9b349adc236cadeadd301a3ed9218ab56117447e2280894","capturedAt":"2026-07-07T02:34:58.017Z"},"current":{"version":3,"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","capturedAt":"2026-07-10T01:47:41.622Z"}},"assessment":{"summary":"This PayPal User Agreement outlines terms for Luxembourg residents, detailing account types, payment services, and user responsibilities, with standard financial service clauses.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"472a92ae-24a8-4d9c-a47b-66f043669f57","overallRisk":"Medium","overallScore":5,"screeningDate":"2026-07-07T02:34:58.026Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"warning","textEn":"Account data and e-money can be held indefinitely post-closure for risk protection.","textIt":"Dati account e moneta elettronica possono essere conservati indefinitamente dopo la chiusura.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Users are liable for actions of third parties they authorize to access their account.","textIt":"Gli utenti sono responsabili delle azioni di terzi autorizzati ad accedere al loro account.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"PayPal may automatically update linked card information without explicit user action.","textIt":"PayPal può aggiornare automaticamente le informazioni della carta collegata senza azione utente.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Personal and business accounts have different uses and fees, requiring careful selection based on your primary activity.","textIt":"Tipi di account personali e aziendali con usi e commissioni diversi, da scegliere in base all'attività principale.","sentiment":"neutral"},{"textEn":"Granting third parties access makes you liable for their actions, so exercise caution and review permissions.","textIt":"Concedere accesso a terzi ti rende responsabile delle loro azioni; procedi con cautela e rivedi i permessi.","sentiment":"negative"},{"textEn":"PayPal retains account data and electronic money post-closure for legal and risk management purposes.","textIt":"PayPal conserva dati e moneta elettronica dopo la chiusura per obblighi legali e gestione del rischio.","sentiment":"negative"},{"textEn":"EU consumers benefit from a 14-day withdrawal right and two months' notice for policy changes.","textIt":"I consumatori UE hanno un diritto di recesso di 14 giorni e un preavviso di due mesi per le modifiche.","sentiment":"positive"},{"textEn":"PayPal is a regulated bank in Luxembourg, supervised by the CSSF, ensuring a level of financial oversight.","textIt":"PayPal è una banca regolamentata in Lussemburgo, supervisionata dalla CSSF, garantendo controllo finanziario.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Businesses must ensure their use of PayPal, especially with third-party integrations, complies with DORA and PSD2. The policy's focus on Luxembourg regulation provides a clear framework for EEA operations.","complianceNoteEn":"DORA, PSD2"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy provides strong consumer protections, including a 14-day withdrawal right, aligning with EU consumer law. Data retention clauses, however, should be reviewed against GDPR's storage limitation principles.","complianceNoteEn":"GDPR, PSD2"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must navigate a complex web of international financial regulations and AML laws. While PayPal is a regulated entity, businesses need to ensure their operations align with all applicable local and international standards.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Global users should be aware that this specific agreement applies only to Luxembourg residents. Their local PayPal User Agreement will govern their services, which may have different terms and protections.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US businesses using PayPal must ensure compliance with federal and state financial regulations, which may vary significantly from EU standards. This policy serves as a general reference, not a direct guide.","complianceNoteEn":null},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"This policy is tailored for Luxembourg residents, so US users should consult their specific PayPal User Agreement. Rights under CCPA/CPRA or other state privacy laws may differ from those explicitly stated here.","complianceNoteEn":null}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":2,"mappedFieldCount":4,"evidence":[{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":2,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original User Agreement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/ab33f12c-223c-4045-89ac-0ea091eb21c3","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"7d083ca0b2ad77ca7ea1d7ebedf0742e35dc65525a6fcb5c94a6cbb552e6700b"}