Privacy built into the transaction path
Payment orchestration depends on moving the right information to the right authorized provider at the right moment. OpenPath’s privacy program is designed around purpose limitation, data minimization, access control, security, retention discipline, transparency, and accountability.
OpenPath, Inc. is a Maryland corporation operating as OpenPath Payments in California. We support privacy obligations under the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, when those laws apply to the processing at issue.
Privacy law and payment security overlap, but they are not interchangeable. GDPR and CCPA govern rights and responsibilities for personal information. PCI DSS establishes security requirements for payment account data in the cardholder data environment.
GDPR
The GDPR may apply when personal data is processed in connection with an establishment in the European Economic Area or when an organization outside the EEA offers goods or services to, or monitors the behavior of, people in the EEA.
Core principles
Our GDPR program is aligned to the principles of lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.
Legal bases
Depending on the processing, OpenPath relies on performance of a contract, compliance with law, legitimate interests such as providing and securing business payment services, protection of legal rights, and consent where consent is legally required. A merchant or platform that controls end-customer data is responsible for establishing its own lawful basis.
Individual rights
Where the GDPR applies, individuals may have rights to information, access, correction, erasure, restriction, portability, objection, withdrawal of consent, and protection concerning certain solely automated decisions. Individuals may also complain to the data-protection authority where they live, work, or believe a violation occurred. Rights are subject to the conditions and exceptions in the GDPR.
CCPA
The CCPA gives California residents rights over personal information held by covered businesses. Those rights may include knowing the categories and specific pieces of personal information collected, accessing that information, requesting deletion or correction, opting out of sale or sharing, limiting certain uses of sensitive personal information, and receiving non-discriminatory treatment for exercising a right.
OpenPath does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising as those terms are defined by the CCPA. We recognize applicable opt-out preference signals where legally required. If our practices change, we will provide the disclosures and choice mechanisms required before beginning the covered activity.
When OpenPath processes personal information for a merchant or platform as a service provider or contractor, we process that information for the contracted business purposes and under applicable restrictions. The merchant or platform remains the primary contact for requests about its end customers, and OpenPath assists as required by contract and law.
Payment data and PCI DSS
OpenPath operates as a PCI DSS Level 1 service provider for its in-scope cardholder data environment. Our security program uses controls designed to protect the confidentiality and integrity of payment account data and the systems that can affect its security.
PCI DSS validation does not mean every system, merchant, or integration automatically becomes compliant, and it is not a guarantee that an incident can never occur. Each merchant, processor, platform, and provider remains responsible for its own PCI DSS scope and obligations. OpenPath uses tokenized references and purpose-specific transaction information where appropriate to reduce unnecessary exposure of payment account data.
The PCI Security Standards Council describes PCI DSS as a baseline of technical and operational requirements for entities that store, process, transmit, or can affect the security of payment account data.
Who controls the data?
OpenPath as controller
OpenPath generally acts as controller for its website, direct business contacts, accounts, billing, compliance, security, and its own business operations. Our Privacy Policy explains these practices.
OpenPath as processor or service provider
For transaction and end-customer information submitted through a merchant, platform, or partner, OpenPath often acts under that customer’s documented instructions as a processor, service provider, or contractor. Contractual measures may include a data processing addendum, confidentiality terms, security commitments, subprocessor controls, transfer safeguards, deletion or return terms, and assistance with individual requests.
Rules, risk signals, and automated decisions
OpenPath can apply merchant-configured rules, routing logic, risk signals, processor state, and transaction context to make or support real-time payment decisions. These tools may route, retry, approve for submission, flag, or block a transaction according to the configured workflow.
The business that determines how these tools are used is responsible for assessing whether its processing involves a solely automated decision that produces legal or similarly significant effects and for providing any required notice, lawful basis, human review, or contest mechanism. When OpenPath acts as its processor, we provide reasonable assistance required by contract and applicable law.
International data transfers
Our operations and service providers span multiple countries. When personal data protected by the GDPR or similar law is transferred internationally, OpenPath uses safeguards appropriate to the transfer. These may include an adequacy decision, Standard Contractual Clauses, contractual and organizational safeguards, and transfer-risk review.
Access is limited based on role and business need, and recipients are subject to confidentiality and security requirements appropriate to their responsibilities.
Exercise your rights
Email support@openpath.io with the subject “Privacy Request” or call 844-728-4247. Tell us the right you want to exercise, your relationship with OpenPath, and enough information to locate the relevant records.
We may verify identity and authority before completing a request. If OpenPath holds the information only for a merchant or platform, we may direct the request to that controller or coordinate with it. We respond within the period required by applicable law and explain any permitted extension or denial.
Authorized agents may submit requests where allowed. OpenPath may request proof of authorization and direct verification from the individual. We do not discriminate against individuals for exercising privacy rights.
Official resources
These government and standards-body resources explain the frameworks summarized above:
- Official text of the GDPR — EUR-Lex
- GDPR rights for individuals — European Commission
- California Consumer Privacy Act — California Attorney General
- CCPA regulations — California Privacy Protection Agency
- PCI Data Security Standard — PCI Security Standards Council
This page is a plain-language overview. The applicable law, customer contract, and Privacy Policy control if there is a conflict.