EU Data Act Notice
1. Purpose of this notice
The EU Data Act gives users of connected products the right to access, and to share with third parties, the data that those products and their related services generate. This notice is provided to you before you purchase, rent, lease or otherwise begin using a SumUp connected device, so that you can make an informed decision. It explains, in a clear and comprehensible manner, the type, format and volume of data the device generates, how that data can be accessed, and your rights in relation to it.
This notice is issued by SumUp in its capacity as the manufacturer / data holder of the products listed in Section 3.
2. Who we are
The SumUp Group is made up of different companies. The SumUp company that provides the relevant product or Service to you is the data holder responsible for the product data described in this notice. That entity, together with its registered address and company registration number, is available on the Terms and Conditions page of this SumUp website.
Contact point for data access and data-sharing requests under the EU Data Act: [email protected]. Requests will be handled at the earliest opportunity.
3. Products covered by this notice
This notice applies to the following SumUp connected card readers and point-of-sale devices, together with their associated related services (mobile apps, firmware and backend processing):
SumUp Solo
SumUp Air
SumUp Solo Lite
SumUp Tap to Pay (Tap to Pay on compatible mobile devices)
SumUp Android Terminal
Where a related app runs on your own mobile or host device, certain data about that device is also generated (see Section 4).
4. Data generated by the product
The table below describes the categories of data generated by the products and related services, the data points within each category, where that data is stored, and how long it remains available. Data is generated continuously and in real time as transactions are performed on the device. Data is held primarily in a structured (tabular) format; diagnostic logs are held in a log/text format.
Data category | Data generated by the product | Source / storage location | Availability / retention |
|---|---|---|---|
Merchant attributes | Merchant code; merchant registration details (country, city, address, business name, business category, bank account details, etc.) | Transactions databases | All time |
Transaction attributes | Timestamp; amount and currency; tip amount; VAT amount; transaction code; transaction result (successful / failed) | Transactions databases | All time |
Payment card attributes | Card scheme, issuing bank and card funding type (data relating to the payment instrument presented by the cardholder) | Transactions databases | All time |
Card reader attributes | Reader name; serial number; battery level at time of transaction; firmware version; internet connection type; card entry mode; cardholder verification method | Transactions databases | All time |
Mobile / host device attributes | Device brand and model; operating system version; SumUp app version | Transactions databases | All time |
Transaction speed metrics | Time to initiate the transaction; time for customer to present the card; time for SumUp to process payment; time to submit PIN (if applicable); total transaction completion time | Firebase | 180 days |
Event & diagnostic logs | Log-format records covering all of the above data points and related device/transaction events | Grafana / Honeycomb | 90 days |
Note on personal data: Some of the data above may relate to identified or identifiable individuals (for example cardholders or your staff). Where it does, our processing is also governed by the EU General Data Protection Regulation (GDPR) and our Privacy Policy, and your separate data-protection rights continue to apply alongside your rights under the EU Data Act.
5. Nature, volume and format of the data
Nature: transaction records, device telemetry (battery, firmware, connectivity), performance/speed metrics and diagnostic logs.
Format: structured records exportable in commonly used, machine-readable formats; logs in text/log format.
Volume and frequency: generated continuously, with one or more records produced per transaction.
Retention / availability: as stated in the table — transaction data for the lifetime of the account, speed metrics for 180 days, and logs for 90 days.
6. How you can access your data
As the user, you can obtain the readily available product data generated by your device, free of charge, without undue delay and where applicable in a continuous and real-time manner.
To request access, contact us at [email protected]. Please specify the device(s), the account / merchant code and the period concerned so we can locate your data. Requests will be handled at the earliest opportunity post successful verification procedures.
7. Sharing your data with third parties
Under the EU Data Act you may instruct SumUp to make your product data available to a third party of your choice (for example an accounting provider, analytics tool or another service provider). On your verified instruction, we will make the relevant readily available data available to that third party without undue delay, under fair, reasonable and non-discriminatory terms and in a secure manner. We will only act on requests we can reasonably verify as coming from you.
8. Use of the data by SumUp
SumUp may use non-personal product data generated by the device on the basis of, and in accordance with, our contract with you. SumUp will not use such data to derive insights about your economic situation, assets or production methods in a way that could undermine your commercial position, and will not make the data available to a third party for such purposes, except as permitted by law or with your agreement.
9. Your rights
Access the product data your device generates, free of charge.
Receive that data in a structured, commonly used and machine-readable format where feasible.
Direct SumUp to share your data with a third party of your choice.
Receive clear pre-contractual information (this notice) before you commit.
Exercise your separate rights under the GDPR where the data is personal data.
10. Changes to this notice
We may update this notice to reflect changes to our products, data practices or legal requirements. The applicable version and effective date are shown at the top of this document. Material changes will be communicated to users in line with our contractual terms.
11. Questions and complaints
If you have questions about this notice or wish to exercise your rights, contact [email protected]. You also have the right to lodge a complaint with the competent authority designated under the EU Data Act in your Member State, and with your data protection authority where personal data is concerned.