Tracking IP address for SAAS companies is important for defending chargeback claims.
For e.g when a customer demands a chargeback through their bank, Stripe notes down the IP address of every transaction. It is important to note this IP address and check if the user created an account using the same IP address. How are SAAS companies to provide sufficient usage proof when it comes to defend chargebacks?
You would be allowed to track IP addresses to prevent fraud. This is from Recital 47 of the GDPR:
"The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned."
"Legitimate interest" is one of the legal bases for processing personal data under the new regulation.
For e.g when a customer demands a chargeback through their bank, Stripe notes down the IP address of every transaction. It is important to note this IP address and check if the user created an account using the same IP address. How are SAAS companies to provide sufficient usage proof when it comes to defend chargebacks?