{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"f14dc990-fe46-4292-9702-48471a26ad97","screeningDate":"2026-08-02T12:50:57.183Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"dc8f08a1-4c7e-4b31-a1cd-c3f8597c965a","name":"User Agreement","type":"terms","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.661Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":5,"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","capturedAt":"2026-08-02T11:30:57.018Z"},"current":{"version":6,"sha256":"3e217da9e7ae7a1db9b349adc236cadeadd301a3ed9218ab56117447e2280894","capturedAt":"2026-08-02T12:50:57.172Z"}},"assessment":{"summary":"No changes were found between the old and new versions of PayPal's User Agreement, maintaining existing terms for Luxembourg residents.","overallRisk":"Medium","overallScore":4,"previousPublicChange":{"id":"decc553e-ece4-43de-8d6e-4f4fedbf3a9a","overallRisk":"Medium","overallScore":5,"screeningDate":"2026-08-02T11:30:57.027Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"info","textEn":"Data retention after account closure for legal and risk management purposes.","textIt":"Conservazione dei dati dopo la chiusura dell'account per scopi legali e di gestione del rischio.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataRetention","anchorStatus":"not-recorded"},{"icon":"info","textEn":"Automatic updates to linked funding source information without explicit user action.","textIt":"Aggiornamenti automatici delle informazioni sulle fonti di finanziamento collegate senza azione esplicita dell'utente.","deltaScore":0,"evidenceQuote":"If this information changes, we may update it using information and third-party sources available to us without any action on your part.","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"info","textEn":"Users are liable for actions taken by third parties granted account permissions.","textIt":"Gli utenti sono responsabili per le azioni intraprese da terze parti con permessi sull'account.","deltaScore":0,"evidenceQuote":"You are liable to us for the actions that you authorise the third parties to carry out. You will not hold us responsible for, and you will indemnify us from, any liability arising from the actions or inactions of such third parties in conne","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"}],"keyPoints":[{"textEn":"The policy remains unchanged, covering account types, funding, and closure for Luxembourg residents.","textIt":"La politica rimane invariata, coprendo tipi di account, finanziamenti e chiusura per i residenti in Lussemburgo.","sentiment":"neutral"},{"textEn":"PayPal is a Luxembourg-licensed bank, supervised by the CSSF, ensuring regulatory compliance.","textIt":"PayPal è una banca con licenza lussemburghese, supervisionata dalla CSSF, garantendo la conformità normativa.","sentiment":"positive"},{"textEn":"Users grant continuous permission to charge linked funding sources for payments and top-ups.","textIt":"Gli utenti concedono un'autorizzazione continua per addebitare le fonti di finanziamento collegate per pagamenti e ricariche.","sentiment":"neutral"},{"textEn":"Account closure allows withdrawal of undisputed funds, but data retention for legal reasons is stated.","textIt":"La chiusura dell'account consente il prelievo di fondi non contestati, ma è prevista la conservazione dei dati per motivi legali.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Businesses registered in Luxembourg using PayPal are subject to these terms, including specific conditions for commercial entity status. Compliance with financial regulations (PSD2) and CSSF oversight is central.","complianceNoteEn":"PSD2, CSSF Oversight"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"This policy directly applies to individuals residing in Luxembourg within the EEA. While it outlines consumer rights like withdrawal, data retention clauses for legal obligations may limit full GDPR deletion rights.","complianceNoteEn":"GDPR Art. 17, PSD2"},{"region":"Global","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Global enterprises must adhere to the PayPal user agreement specific to their operational jurisdiction. This Luxembourg-focused policy does not set a global standard for all business accounts.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"Globally, individuals outside Luxembourg/EEA are not covered by this policy. PayPal operates with localized user agreements, so users should refer to the terms applicable to their country of residence.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"US businesses are not directly impacted by this Luxembourg-specific agreement. They operate under distinct PayPal business agreements tailored to US regulations and market practices.","complianceNoteEn":null},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"This specific policy does not apply to US residents, who are governed by separate PayPal user agreements. US users should consult their region-specific terms for applicable rights and obligations.","complianceNoteEn":null}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":2,"mappedFieldCount":4,"evidence":[{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":2,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original User Agreement source still match the recorded public snapshot version 6?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/f14dc990-fe46-4292-9702-48471a26ad97","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"842f1151580dec8be74dfd563182c7af856e8f3b7e7df71893e92761960a1d0f"}