I hate that the world is going this way, I am resisting it in any way I can, but I know it's a losing battle. Until then, unless I can pay in cash you do not get my custom.
To try and answer your question "We will not share personal data with third parties for them to use for their own marketing purposes without ensuring that there is a lawful ground to do so.'
But, 'We process personal data obtained from selected third parties such as credit bureaus, fraud detection agencies, other financial institutions and other information providers, and from publicly available sources (such as population registers and registers held by tax authorities, company registration offices, enforcement authorities etc). Third parties from which we obtain personal data can also be e.g. social networks or similar that you have linked your Zettle account with. In connection with payments we collect information from e.g. banks, payment service providers and others.'
And 'PayPal Group. We may share personal information with members of the PayPal Group for the purposes set out in this Privacy Policy.'
Ianal, it seems like they don't share or sell, except when it benefits them. Whether they can send the data back to the States, seems murky. If you were linking to a US based Visa/ Bank they would obviously have to, which may then let them use a data loophole. They also say their pos system contains analytics, so they know you are clogging your arteries, and how often. And if you're using Bluetooth/ WiFi there they know for how long, and even if you walk by the shop.
https://web.archive.org/web/20230908034734/https://www.zettle.com/gb/legal/privacy-policy
Also, this is the UK policy in English, which may differ from the policy you were subjected to.