{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"fefcf0ae-a694-4042-a97f-a8abe7cd08bd","screeningDate":"2026-10-18T07:38:49.133Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"c28fb784-5012-4696-8c70-505d4185972a","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-10-22T11:43:49.097Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":10,"sha256":"1883abf1abba82e38280f0f2c62ab83be76a12e93e2c85b319f9c069b557a364","capturedAt":"2026-10-09T02:46:51.964Z"},"current":{"version":11,"sha256":"8323bbee96911722b84e4bbaf21d6828ba0d8902511b66918a5cd0fca153b5dd","capturedAt":"2026-10-18T07:38:49.111Z"}},"analysisLineage":{"status":"verified","requestSha256":"0183babcaca448da6ac1d7a427ce6857a7adfaecf59c3c0b02f936141f1563de","responseSha256":"324f174e87ef8823affd5b4de0b91cfc4a4f2c4f844fd5c0910172573c954a53","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"1883abf1abba82e38280f0f2c62ab83be76a12e93e2c85b319f9c069b557a364","charLength":132431,"byteLength":132591,"rangeUnit":"utf16-code-unit","includedRanges":[[0,132431]],"excludedRanges":[]},"new":{"sha256":"8323bbee96911722b84e4bbaf21d6828ba0d8902511b66918a5cd0fca153b5dd","charLength":132444,"byteLength":132604,"rangeUnit":"utf16-code-unit","includedRanges":[[0,132444]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-09T02:46:51.964Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full","requestedUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full","finalUrl":"https://www.paypal.com/lu/legalhub/paypal/privacy-full","capturedAt":"2026-10-18T07:38:49.111Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"This PayPal Privacy Statement update is administrative, changing only the effective date and UK office address, with no impact on user data or rights.","overallRisk":"Medium","overallScore":5,"previousPublicChange":{"id":"f21e62b7-844f-464b-8f11-871c42b3c506","overallRisk":"High","overallScore":7,"screeningDate":"2026-10-09T02:46:51.974Z"},"scoreDelta":-2,"direction":"lower","reasons":[{"icon":"info","textEn":"Policy update is administrative, changing only the effective date.","textIt":"L'aggiornamento della politica è amministrativo, cambia solo la data di efficacia.","deltaScore":0,"evidenceQuote":"Last updated on 28 September 2026","evidenceSide":"old","relatedKpi":null,"anchorStatus":"verified"},{"icon":"info","textEn":"UK registered office address updated, no impact on data processing.","textIt":"Indirizzo della sede legale nel Regno Unito aggiornato, nessun impatto sul trattamento dei dati.","deltaScore":0,"evidenceQuote":"PayPal UK Ltd5 Fleet PlaceLondon, UK EC4M 7RD","evidenceSide":"old","relatedKpi":null,"anchorStatus":"verified"},{"icon":"info","textEn":"No changes to data collection, sharing, or user rights were identified.","textIt":"Non sono state identificate modifiche a raccolta dati, condivisione o diritti utente.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"The policy's effective date was updated from September 28, 2026, to October 12, 2026.","textIt":"La data di entrata in vigore della politica è stata aggiornata dal 28 settembre 2026 al 12 ottobre 2026.","sentiment":"neutral"},{"textEn":"PayPal UK's registered office address has been changed, an administrative update.","textIt":"L'indirizzo della sede legale di PayPal UK è stato modificato, un aggiornamento amministrativo.","sentiment":"neutral"},{"textEn":"No substantive changes to how personal data is collected, used, or shared were identified.","textIt":"Non sono state identificate modifiche sostanziali al modo in cui i dati personali vengono raccolti, utilizzati o condivisi.","sentiment":"neutral"},{"textEn":"User data protection rights and AI governance clauses remain unchanged in this version.","textIt":"I diritti di protezione dei dati degli utenti e le clausole di governance dell'IA rimangono invariati in questa versione.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"The policy changes are administrative and do not introduce new compliance burdens for enterprises under GDPR or DORA. Existing obligations remain unchanged.","complianceNoteEn":null},{"region":"EU","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"This update is administrative, changing only the effective date and a UK office address. It has no direct impact on individual privacy rights under GDPR or the upcoming AI Act.","complianceNoteEn":null},{"region":"Global","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"The administrative nature of this update means no new global compliance challenges or operational adjustments for enterprises. Business operations are unaffected.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"This update is purely administrative, affecting only the policy date and a UK address. Global individual privacy rights and data handling practices are unaffected.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Administrative changes do not alter compliance requirements for businesses under CCPA or other US regulations. Operational impacts are minimal.","complianceNoteEn":null},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"The update is administrative, with no changes to data collection, sharing, or consumer rights under CCPA or other US state privacy laws. User protections remain consistent.","complianceNoteEn":null}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 11?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/fefcf0ae-a694-4042-a97f-a8abe7cd08bd","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"19417088ac608528bdf3c6a37dc51c673c77c7403374e3caf856d9ce47bb355c"}