Nuvei

Overview

Nuvei is a global payment technology company that provides payment processing infrastructure for online merchants, marketplaces, and platforms. The company supports over 700 alternative payment methods across nearly 200 markets, making it one of the more comprehensive payment gateway options for businesses operating internationally. When Nuvei's scripts appear on a merchant's website, they power the checkout experience — securely collecting payment credentials and routing transactions through the appropriate payment networks.

As a payment processor, Nuvei occupies a position of significant trust in the e-commerce transaction chain. Its scripts handle the most sensitive data a website processes: credit card numbers, bank account details, and authentication credentials. This necessitates strict security standards (PCI DSS compliance) and places Nuvei's scripts firmly in the essential category — they are the mechanism through which the website generates revenue.

What This Script Does

Nuvei's scripts provide secure payment processing functionality on merchant websites:

• Hosted Payment Fields: Renders PCI-compliant input fields for collecting card numbers, expiration dates, CVVs, and cardholder names. These fields are served from Nuvei's secure infrastructure via iframes, ensuring sensitive payment data never touches the merchant's servers or DOM.
• Alternative Payment Methods: Presents and manages checkout flows for non-card payment options including digital wallets (Apple Pay, Google Pay), bank transfers, buy-now-pay-later services, and region-specific payment methods based on the customer's location and the merchant's configuration.
• 3D Secure Authentication: Handles the 3DS verification flow required by card networks and regulations like PSD2 Strong Customer Authentication. This involves redirects or embedded challenge frames where the cardholder verifies their identity with their issuing bank.
• Transaction Routing: Manages the communication between the checkout interface and Nuvei's payment processing infrastructure, handling authorization requests, decline responses, retry logic, and transaction confirmation callbacks.
• Fraud Prevention: Integrates device fingerprinting and behavioral analysis as part of Nuvei's fraud detection capabilities, collecting device and session data to assess transaction risk in real time.
• Tokenization: Securely stores payment credentials as tokens for returning customers, enabling one-click checkout experiences without re-entering payment details.

Consent & Compliance

Nuvei's payment processing scripts operate under a clear legal basis across all major privacy frameworks. Under GDPR Article 6(1)(b), payment processing is necessary for the performance of the purchase contract — the customer has decided to buy something and payment collection is an integral step in that transaction.

The ePrivacy Directive's cookie exemption for strictly necessary functionality applies to all cookies and device storage used by Nuvei's payment scripts, including session tokens, payment form state, and fraud detection mechanisms. These are all essential to completing the transaction the customer has initiated.

The fraud prevention component deserves specific attention. Nuvei's device fingerprinting and behavioral analysis for fraud detection process additional data points beyond the payment credentials themselves. However, this processing is generally considered necessary for the legitimate interest of preventing fraudulent transactions (GDPR Article 6(1)(f)) and is typically covered by the security exemptions in privacy regulations.

Nuvei maintains PCI DSS Level 1 compliance, the highest level of payment security certification. Merchants using Nuvei's hosted payment fields benefit from reduced PCI compliance scope since sensitive card data is handled entirely within Nuvei's certified environment.

Should You Block This Without Consent?

Nuvei's scripts are essential payment infrastructure. Blocking them would prevent customers from completing purchases, directly undermining the core commercial function of the website. Payment processing is strictly necessary for the service requested by the customer, and all data collection is limited to what is required for secure transaction completion and fraud prevention.

No.