Banking and commerce
GDPR Qonto
In an indie stack, Qonto is used for Business account and payments. Entity cited: Qonto SA. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Qonto
not disclosed
Stated role
not disclosed
Personal data
The security documentation cites, among the data handled by the application, the password, the IP address, the beneficiary IBAN, the balance, transactions, and attachments. Categories described in a public privacy policy readable on the day of the check: not disclosed.
Sub-processors of Qonto
not disclosed
Public URL of a list: not disclosed on this sheet.
Transfers outside the EU
Hosting / location
The security documentation states that the application runs in three AWS data centers in the Paris region, and that customer data is backed up in AWS S3.
EU–United States Data Privacy Framework
Official search for “Qonto” on the active and inactive lists: no participant. Not registered.
Cookies
Cookies set by Qonto are generally used to identify the user and to open the user's account. Third-party cookies are used for advertising or for analysis of the platform. Strictly necessary cookies are used for operation, for the services requested, and for security.
Typical use, written by StackLégal and not by the vendor: Business account and payments.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Qonto a processor within the meaning of the GDPR?
not disclosed
What DPA does Qonto publish?
not disclosed
Which further sub-processors does Qonto publish?
not disclosed
Where does Qonto state that it processes data, including outside the EU?
The security documentation states that the application runs in three AWS data centers in the Paris region, and that customer data is backed up in AWS S3.
Is Qonto registered under the EU–United States Data Privacy Framework?
Official search for “Qonto” on the active and inactive lists: no participant. Not registered.
Which personal data does Qonto mention?
The security documentation cites, among the data handled by the application, the password, the IP address, the beneficiary IBAN, the balance, transactions, and attachments. Categories described in a public privacy policy readable on the day of the check: not disclosed.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.