GDPR Data processing modelRisk assessment and prevention of website payment fraud

Function: Legal and complianceOrganisation: PrivateFunction: Finance and accounting

This processing is intended for risk assessment and prevention of website payment fraud, in the marketing sector

Purposes (3)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Potential fraud refers to the illegitimate use of payment cards or the data attached to them, or of cheques where such use is likely to have harmful consequences. A manual check on a case-by-case basis is recommended after registration in the file

Legitimate interest

Use a real-time payment risk assessment tool

Allows data relating to detected fraud attempts to be stored for in-depth analysis of subsequent transactions displaying one or more of these characteristics.

Legitimate interest

Remove the possibility for the prospect/customer to pay for his order by cash on delivery

If payment on delivery is possible

Legitimate interest

Data categories (3)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Login information

Data details

Timestamp informationrequired

IP addressrequired

Data conservation rules

Active base:

If an order is cancelled for suspected fraud, the record of the order and of the exchanges with the card issuer is kept for as long as needed to handle any chargeback or dispute. Data on confirmed fraud attempts are kept for a maximum of 3 years. All other data are deleted at the end of the verification procedure; copies of supporting documents are kept for a maximum of 6 months. No statutory period; the controller should set these periods based on chargeback and dispute timeframes and the time needed to detect repeat fraud.

Destruction

Payer identification data

Data details

Country of residencerequired

Civilityrequired

Product orderedrequired

Emailrequired

Telephone numberrequired

Department of residencerequired

Delivery terms and addressrequired

Postal Addressrequired

Name and surnamerequired

Data conservation rules

Active base:

Destruction

Economic and financial information

Data details

Partenaire monétiquerequired

Payment statusrequired

Payment methodrequired

Data conservation rules

Destruction

Data subject (1)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Customers

Created at:07/08/2023

Updated on:10/05/2026

Nb using:0