Privacy Policy - Stripe

This Privacy Policy (“Policy”) describes the “Personal Data” that we collect about you, how we use it, how we share it, your rights and choices, ... StripeServicesAgreement StripeConnect PlatformAgreement AccountAgreement ProductsandPrograms StripeAtlas StripeClimate ClimateContributionTerms StripeCorporateCard StripeCustomerPortal StripeDataPipeline StripeFinancialConnections StripeIdentity StripeIssuing StripeTax StripePartnerProgram StripeRadar StripeRewards StripeVerifications StripeShop StripeTerminal TerminalPurchaseTerms TerminalResellerTerms TerminalDeviceEULA StripeTreasury-ConnectedAccounts StripeTreasury-Platforms FinancialServicesTerms StripePaymentsCompany WellsFargo PNCBank PaymentTerms RestrictedBusinesses Privacy PrivacyPolicy CookiesPolicy PrivacyShieldPolicy ServiceProvidersList DataProcessingAgreement StripePrivacyCenter IntellectualProperty IntellectualPropertyNotice MarksUsage StripeApps AppDeveloperAgreement AppMarketplaceAgreement Licenses Lastupdated:February3,2022ThisPrivacyPolicyincludesimportantinformationaboutyourpersonaldataandweencourageyoutoreaditcarefully. WelcomeWeprovideeconomicinfrastructurefortheinternet.Businessesofallsizesuseoursoftwareandservicestoacceptpaymentsandmanagetheirbusinessesonline.Stripecaresaboutthesecurityandprivacyofthepersonaldatathatisentrustedtous.ThisPrivacyPolicy(“Policy”)describesthe“PersonalData”thatwecollectaboutyou,howweuseit,howweshareit,yourrightsandchoices,andhowyoucancontactusaboutourprivacypractices.ThisPolicyalsooutlinesyourdatasubjectrights,includingtherighttoobjecttosomeusesofyourPersonalDatabyus.PleasevisittheStripePrivacyCenterformoreinformationaboutourprivacypractices.“Stripe”,“we”,“our”or“us”meanstheStripeentityresponsibleforthecollectionanduseofpersonaldataunderthisPrivacyPolicy.Itdiffersdependingonyourcountry.Learnmore.“PersonalData”meansanyinformationthatrelatestoanidentifiedoridentifiableindividual,andcanincludeinformationabouthowyouengagewithourServices(e.g.deviceinformation,IPaddress).“Services”meanstheproductsandservicesthatStripeindicatesarecoveredbythisPolicy,whichmayincludeStripe-provideddevicesandapps.Our“BusinessServices”areServicesprovidedbyStripetoentities(“BusinessUsers”)whodirectlyandindirectlyprovideuswith“EndCustomer”PersonalDatainconnectionwiththoseBusinessUsers’ownbusinessandactivities.Our“EndUserServices”arethoseServiceswhichStripedirectstoindividuals(ratherthanentities)sothatthoseindividualsdobusinessdirectlywithStripe.“Sites”meansStripe.comandtheotherwebsitesthatStripeindicatesarecoveredbythisPolicy.Collectively,werefertoSites,BusinessServicesandEndUserServicesas“Services”.Dependingonthecontext,“you”meansEndCustomer,EndUser,RepresentativeorVisitor:WhenyoudirectlyuseanEndUserService(suchaswhenyousignupforLink,ormakeapaymenttoStripeClimateinyourpersonalcapacity),foryourpersonaluse,werefertoyouasan“EndUser.” Whenyoudobusinesswith,orotherwisetransactwith,aBusinessUser(typicallyamerchantusingStripeCheckout,e.g.whenyoubuyapairofshoesfromamerchantthatusesStripeforpaymentprocessing)butarenotdirectlydoingbusinesswithStripe,werefertoyouasan“EndCustomer.” WhenyouareactingonbehalfofanexistingorpotentialBusinessUser(e.g.youareafounderofacompany,oradministeringanaccountforamerchantwhoisaBusinessUser),werefertoyouasa“Representative.” WhenyouvisitaSitewithoutbeingloggedintoaStripeaccountorotherwisecommunicatewithStripe,werefertoyouasa“Visitor.”(e.g.yousendStripeamessageaskingformoreinformationbecauseyouareconsideringbeingauserofourproducts). Dependingontheactivity,Stripeactsasa“datacontroller”or“dataprocessor”andformoreinformationaboutthisandontheStripeentitythatisresponsibleunderthisPolicy,seehere.1.Personaldatathatwecollectandhowweuseandshareit 2.Morewayswecollect,useandsharepersonaldata 3.Legalbasesforprocessingdata 4.Yourrightsandchoices 5.Securityandretention 6.Internationaldatatransfers 7.Updatesandnotifications 8.Jurisdiction-specificprovisions 9.Contactus 1.Personaldatathatwecollectandhowweuseandshareit1.1EndUsersWeprovideEndUserServiceswherewedonotactasaserviceprovidertoBusinessesbutinsteadprovidetheServicesdirectlytoyouforyourpersonaluse(e.g.Linkuser).Seehereforfurtherinformationonthelegalbaseswhichwerelyonforusing(processing)yourPersonalData.PersonaldatathatwecollectaboutEndUsersUsingLinkorConnectingyourBankAccount.StripeoffersyoutheopportunitytostoreyourpaymentmethodswithStripesothatyoucanconvenientlyuseitacrossmerchantswhoareourBusinessUsers–wecallthis“Link”(formerlyknownas“RememberMe”).WhenyouoptintoLink,youagreetoletusstoreyourpaymentmethodsothatyoucanmorereadilymakepurchasesthroughLinkwithBusinessUsersofourpaymentprocessingBusinessServices(e.g.name,cardnumber,cvc,andexpirationdate).WhenyouchoosetopaywithLink,wewillalsocollectyourTransactionData.LearnMore. Ifyouchoosetosharebankaccountinformation(includingforuseinLink)withus,Stripewillperiodicallycollectandprocessyourbankaccountinformation(e.g.accountownerinformation,accountbalances,accountnumberanddetails,accounttransactionsandinsomecases,credentials)untilyouaskustodisconnectyourbankaccount.LearnMore. PayingStripe.IfyouarebuyinggoodsorservicesdirectlyfromStripe,wereceiveTransactionData.Forexample,whenyoumakeapaymenttoStripeClimate,wewillcollectcontactinformation,paymentmethodinformation,informationaboutthattransactionandinsomecases,shippinginformation. OtherServices.WemayofferotherEndUserServicesdirectlytoyoufromtimetotime,includingcertainfinancialServices.LearnMoreforinformationaboutourcollectionanduseofPersonalData. More.PleaseseebelowforinformationaboutadditionaltypesofPersonalDatathatwemaycollect,includingaboutonlineactivity. HowweuseandsharepersonaldataofEndUsersServices.WeuseyourPersonalDatatoprovidetheEndUserServicetoyou,includingsecurity,delivery,support,personalizationandmessagesrelatedtotheEndUserService(e.g.communicatingPolicyupdatesandinformationaboutourServices).WealsouseyourPersonalDataforourfrauddetectionandmitigationBusinessServicesandmaysharecertainPersonalDataaspartofthoseBusinessServiceswithBusinessUsersthatyoumayseektodobusinesswith.TheuseofthisPersonalDataissubjecttotheBusinessUsers’privacypolicies. OurBusinessUsers.WhenyouchoosetoconnectyourbankaccountwithStripe,youmayalsochoosetoshareaccountinformationwithcertainBusinessUsersthatyoudobusinesswith.TheseBusinessUserswillhavetheirownprivacypolicieswhichdescribehowtheyusethatinformation. Transactions.ForpaymenttransactionswithLink,EndUserPersonalDataissharedwithotherstoenablethetransaction.Forexample,whenyouchoosetouseapaymentmethodforthetransactionwithStripeorwithLink(e.g.creditcard,debitcard,buynowpaylater,ordirectdebit),thatpaymentmethodwillreceivetransactioninformationthatincludesyourPersonalData.Pleasereviewyourpaymentmethod’sprivacypolicytolearnmore.WhenyouuseLink,themerchantyouchoosetodobusinesswithwillalsoreceiveTransactionDatathatincludesyourPersonalDataandwithyourpermission,yourbankaccountinformation.ThemerchantmaysharethatPersonalDatawithothers(seebelowregardingEndCustomers).Pleasereviewyourmerchant’sprivacypolicyforfurtherinformation. FraudDetectionServices.WeuseyourPersonalDatacollectedacrossourServices(e.g.StripeRadar)todetectandpreventfraudagainstus,ourBusinessUsersandfinancialpartners,includingtodetectunauthorizedlog-insusingyouronlineactivity.WemayprovideBusinessUsers(includingcardissuersandothersinvolvedinpaymentprocessingactivities)thathaverequestedourfraudBusinessServiceswithPersonalDataaboutyou(includingyourattemptedtransactions)sothattheycanassesstheassociatedfraudriskwithatransaction.Youcanlearnmoreabouthowwemayusetechnologytoassessthefraudriskassociatedwithanattemptedtransactionhere. Advertising.WemayuseyourPersonalDatatoassessyoureligibilityforandofferyouotherEndUserServices.Withyourpermissionorwhereallowedbylaw,weuseandshareEndUserPersonalDatawithotherssothatwemaymarketourproductsandservicestoyou,includingthroughinterest-basedadvertisingwhereallowedbyapplicablelaw,includingsubjecttoanyconsentrequirements.SeeourCookiePolicy.WedonotshareEndUserPersonalDatawiththirdpartiesfortheirmarketingoradvertisingunlessyougiveusorthethirdpartypermissiontodoso.WedonotsellthedataofEndUsers. More.PleaseseebelowforinformationaboutadditionalwaysinwhichwemayuseandshareyourPersonalData. 1.2EndCustomersStripeoffersBusinessServicestoourBusinessUsers(e.g.in-personcheckoutoronlinecheckout).WhenweareactingasaBusinessUser’sserviceprovider(ordataprocessor),wewillprocessPersonalDatainaccordancewiththetermsofouragreementwiththeBusinessUserandtheBusinessUser’slawfulinstructions.Forexample,weprocesspaymenttransactionsforaBusinessUserbecauseyouboughtaproductfromthem.BusinessUsersareresponsibleformakingsurethattheirEndCustomer’sprivacyrightsarerespected,includingensuringappropriatedisclosuresaboutdatacollectionandusethathappensinconnectionwiththeirservices.IfyouareanEndCustomer(e.g.,apurchaserofaproductatanonlineBusinessUsersite),pleaserefertotheprivacypolicyornoticeoftheBusinessUserforinformationregardingtheBusinessUser’sprivacypractices,choicesandcontrols,orcontacttheBusinessUserdirectly.Seehereforfurtherinformationonthelegalbaseswhichwerelyonforusing(processing)yourPersonalData.a.PersonaldatathatwecollectaboutEndCustomersTransactionData.IfyouareanEndCustomer,whenyoumakepaymentsto,getrefundsfrom,beginapurchase,makeadonationorotherwisetransactwithaBusinessUserthatusesustoprovidepaymentprocessingBusinessServices,wewillreceivetransactiondata.The“TransactionData”thatwecollectincludesPersonalData,andmayincludethefollowing:yourname,emailaddress,billingaddress,shippingaddress,paymentmethodinformation(suchascreditordebitcardnumber,bankaccountinformationorpaymentcardimageselectedbyyou),merchantandlocation,purchaseamount,dateofpurchase,andinsomecases,someinformationaboutwhatyouhavepurchasedandyourphonenumber.WemayalsoreceiveyourtransactionhistorywiththeBusinessUser.LearnMore.Wemaycollectinformationtypedintoacheckoutform,evenifyouchoosenottocompletetheformorpurchasewiththeBusinessUser.LearnMore. Identity/VerificationInformation.StripeprovidesaverificationandfraudServicethatallowsaBusinessUsertoverifyPersonalDataaboutyou,suchasyourage(whenpurchasingagerestrictedgoods)oryourauthorizationtouseapaymentmethod.YouwillbeaskedtosharePersonalDataandwewillcollecttheinformationthatyoushareforthispurpose,suchasyourgovernmentID,yourimage,andPersonalDatayouinputorthatisapparentfromthephysicalpaymentmethod(e.g.creditcardimage).WemaycomparethisinformationwithinformationaboutyouwecollectfromBusinessUsers,financialpartners,businesspartners,identityverificationservices,publiclyavailablesources,andthirdpartyserviceproviders.LearnMore. More.PleaseseebelowforinformationaboutadditionaltypesofPersonalDatathatwemaycollect,includingaboutonlineactivity. b.HowweuseandsharepersonaldataofEndCustomersWegenerallyuseandsharePersonalDataofEndCustomerswithBusinessUserstoprovideBusinessServicesasdescribedbelow,aswellasforStripe’sownpurposestosecure,improveandprovideourBusinessServices,asdescribedbelow.Payments.WeuseyourTransactionDatatoprovideourPaymentsrelatedBusinessServicestoBusinessUsers,includingtoprocessonlinepaymenttransactions,tocalculateapplicablesalestax,toinvoiceandbill,andtocalculatetheirrevenue.LearnMore.WemayalsousePersonalDatatoprovideandimproveourBusinessServices. Forpaymenttransactions,yourPersonalDataissharedwithanumberofpartiesinconnectionwithyourtransaction.Becauseweactasaserviceproviderorprocessor,wesharePersonalDatatoenablethetransaction.Forexample,whenyouchoosetouseapaymentmethodforthetransaction(e.g.creditcard,debitcard,buynowpaylater,ordirectdebit),yourpaymentmethodwillreceivetheTransactionDatathatincludesyourPersonalData.Pleasereviewyourpaymentmethod’sprivacypolicytolearnmoreabouthowtheyuseandsharethisinformation. ThemerchantyouchoosetodobusinesswithwillalsoreceiveTransactionDatathatincludesyourPersonalDataandthemerchantmaysharethatPersonalDatawithothers.Pleasereviewyourmerchant’sprivacypolicytolearnmore. OtherFinancialServices.SomeofourBusinessUsersuseourServicesinordertoofferfinancialservicestoyou,throughStripeoritsfinancialpartners.Forexample,theymayprovideacardproductthatenablesyoutopurchasegoodsandservices.ThesecardsmaycarrytheStripebrand,bankpartnerbrandand/orthebrandsofBusinessUsers.InadditiontoanyTransactionDatawemayproduceorreceivewhenthesecardsareusedforpurchases,wewillalsoreceiveanduseyourPersonalDatainordertoprovideandmanagetheseproducts.PleasealsoseetheprivacypoliciesoftheBusinessUserandourbankpartner,ifapplicable,associatedwiththefinancialservice(whosebrandsmaybeshownonthecard). Identity/VerificationServices.WeusePersonalDataaboutyouridentity,includinginformationprovidedbyyouandourserviceproviders,toperformverificationServicesforStripeorfortheBusinessUsersthatyouaredoingbusinesswithandtoreducefraudandenhancesecurity.Ifyouprovidea“selfie”alongwithanimageofyouridentitydocument,wewillusetechnologytocompareandcalculatewhethertheymatchandyoucanbeverified.LearnMore. FraudDetectionServices.WeuseyourPersonalDatacollectedacrossourServicestodetectandpreventfraudagainstus,ourBusinessUsersandfinancialpartners(e.g.StripeRadar),includingtodetectunauthorizedlog-insusingyouronlineactivity.WemayprovideBusinessUsers(includingcardissuersandothersinvolvedinpaymentprocessingactivities)thathaverequestedourfraudBusinessServiceswithPersonalDataaboutyou(includingyourattemptedtransactions)sothattheycanassesstheassociatedfraudriskwithatransaction.YoucanlearnmoreabouthowwemayusetechnologytoassessthefraudriskassociatedwithanattemptedtransactionandwhatinformationwemaysharewithBusinessUsersaboutsuchriskshereandhere. OurBusinessUsers(theirAuthorizedThirdParties).WesharePersonalDataofEndCustomerswiththeirrespectiveBusinessUsersandwithpartiesdirectlyauthorizedbythoseBusinessUserstoreceivePersonalData.ThisincludessharingPersonalDataofEndCustomerswithBusinessUserswhenaBusinessUserauthorizesathirdpartyapplicationprovidertoaccessitsStripeaccountusingStripeConnect.Forexample,whentheBusinessUserusesIdentityServicestoverifyanEndCustomer’sidentity,StripeshareswiththeBusinessUsertheinformation,documentsorphotosprovidedbytheEndCustomertoverifytheiridentity.TheBusinessUsersyouchoosetodobusinesswithmayfurthershareyourPersonalDatatothirdpartiestheyauthorize.Pleasereviewyourmerchant’sprivacypolicytolearnmore. AdvertisingbyBusinessUsers.Ifyouhavebegunapurchase,wesharePersonalDatawiththatBusinessUserinconnectionwithourprovisionofServicesandthatBusinessUsermayuseyourPersonalDatatomarketandadvertisetheirproductsorservices.Pleasereviewyourmerchant’sprivacypolicytolearnmore,includingyourrightstostoptheiruseofyourPersonalDataformarketingpurposes.WedonotuseorshareEndCustomerPersonalDataforourmarketingoradvertising,orformarketingandadvertisingbythirdpartieswhoarenottheBusinessUserwithwhichyouhavetransactedorattemptedtotransact.WedonotsellthedataofEndCustomers. More.PleaseseebelowforinformationaboutadditionalwaysinwhichwemayuseyourPersonalData. 1.3RepresentativesToprovideBusinessServices,wecollect,useandsharePersonalInformationfromRepresentativesofourBusinessUsers(e.g.abusinessowner).IftheRepresentativeistheonlyemployeeofaBusinessUser,pleaseseetheEndUserandEndCustomersectionstounderstandadditionalwaysinwhichwecancollectanduseyourPersonalDatawhenyouuseourServices.Seehereforfurtherinformationonthelegalbaseswhichwerelyonforusing(processing)yourPersonalData.a.PersonaldatathatwecollectaboutRepresentativesRegistrationandContactInformation.IfyouregisterforaStripeaccountforaBusinessUser(includingincorporationofaBusiness),wecollectyournameandaccountlog-incredentials.IfyouregisterforaneventthatStripeorganizesorattendsorifyousignupforStripecommunications,wecollectyourregistrationandprofileinformation.IfyouareaRepresentativeofapotentialBusinessUser,wereceiveyourPersonalDatafromthirdparties(includingdataproviders)inordertoadvertiseto,marketandcommunicatewithyouasdescribedfurtherbelowandinSection2. IdentificationInformation.IfyouareanownerofaBusinessUseroryouareexpectedtobeashareholder,officerordirectorofaBusinessUser,werequirethatyouprovideyourcontactdetails,suchasname,postaladdress,telephonenumber,andemailaddresstofulfillourfinancialpartnerandregulatoryrequirements.Wemayalsocollectfinancialandpersonalinformationaboutyou,suchasyourownershipinterestintheBusinessUser,yourdateofbirthandgovernmentidentifiersassociatedwithyouandyourBusinessUser(suchasyoursocialsecuritynumber,taxnumber,orEmployerIdentificationNumber).Youmayalsochoosetoprovidebankaccountinformation. More.PleaseseebelowforinformationaboutadditionaltypesofPersonalDatathatwemaycollect,includingaboutonlineactivity. b.HowweuseandsharepersonaldataofRepresentativesWegenerallyusePersonalDataofRepresentativestoprovidetheBusinessServicestotheassociatedBusinessUsers,aswellasforthepurposesdescribedbelow.BusinessServices.WeuseandsharePersonalDataofRepresentativeswithBusinessUserstoprovidetheServices.ForusersofourtaxBusinessServices,wemayuseyourPersonalDatatofiletaxesonbehalfofyourassociatedBusinessUser.IfyourBusinessUserusesAtlas,wemayuseyourPersonalDatatosubmitformstotheIRSonyourbehalfandtofiledocumentswithothergovernmentalauthorities(e.g.articlesofincorporationinyourstateofincorporation). WesharedatawithpartiesdirectlyauthorizedbyaBusinessUsertoreceivePersonalData(e.g.financialpartnersservicingthefinancialproduct).TheuseofPersonalDatabyaBusinessUser’sauthorizedthirdpartyissubjecttothethirdparty’sprivacypolicy.InsomecasesourBusinessServicewillrequireustosubmityourPersonalDatatoagovernmententity(e.g.incorporatingabusiness,orpayingapplicablesalestax). Advertising.Withyourpermissionorwhereallowedbyapplicablelaw,weuseandshareRepresentativePersonalDatawithotherssothatwemayadvertiseandmarketourproductsandservicestoyou,includingthroughinterest-basedadvertisingsubjecttoanyconsentrequirementsunderapplicablelaw.SeeourCookiePolicy.WedonotsellRepresentativePersonalData. More.PleaseseebelowforinformationaboutadditionalwaysinwhichwemayuseandshareyourPersonalData. 1.4Visitors(e.g.visitorstoStripesiteswhoarenotanEndUser,EndCustomerorRepresentative)Seehereforfurtherinformationonthelegalbaseswhichwerelyonforusing(processing)yourPersonalData.a.VisitorpersonaldatathatwecollectWhenyouvisitourSites,wegenerallyreceiveyourPersonalDataeitherfromyouprovidingittousorthroughouruseofcookiesandsimilartechnologies.SeeourCookiePolicy.Forms.WhenyouchoosetofillinaformontheSiteoronthirdpartywebsitesfeaturingouradvertising(e.g.LinkedInorFacebook),wewillcollecttheinformationincludedintheform,usuallyyourcontactinformationandotherinformationaboutyourquestionrelatedtoourServices. More.PleaseseebelowforinformationaboutadditionaltypesofPersonalDatathatwemaycollect,includingaboutonlineactivity. b.HowweuseandsharevisitorpersonaldataPersonalization.WeuseinformationaboutyouthatwegatherfromcookiesandsimilartechnologiestomeasureengagementwiththecontentontheSites,toimproverelevancyandnavigation,topersonalizeyourexperienceandtotailorcontentaboutStripeandourServicestoyou. Advertising.Withyourpermissionorwhereallowedbylaw,weuseandshareVisitorPersonalDatawithotherssothatwemayadvertiseandmarketourproductsandservicestoyou,includingthroughinterest-basedadvertisingwhereallowedbyapplicablelaw,includingsubjecttoanyconsentrequirements.SeeourCookiePolicy. More.PleaseseebelowforinformationaboutadditionalwaysinwhichwemayuseyourPersonalData. 2.Morewayswecollect,useandsharepersonaldataInadditiontothewayswecollect,useandsharePersonalDatathataredescribedabove,wealsoprocessyourPersonalDataasfollows.a.PersonalDataCollectionOnlineActivity.DependingontheServiceyouuseandtheBusinessUsers’implementationofourBusinessServices,wewillcollectinformationabout: DevicesandbrowsersacrossourSitesandthird-partywebsites,appsandotheronlineservices(“Third-PartySites”), Usagedataassociatedwiththosedevicesandbrowsers,includingIPaddress,plug-ins,languageused,timespentonSitesandThird-PartySites,pagesvisited,linksclicked,andthepagesthatledorreferredyoutoSitesandThird-PartySites.Forexample,activityindicators,likemouseactivityindicators,helpusdetectfraud.LearnMore.PleasealsoseeourCookiePolicy. CommunicationandEngagementInformation.Wewillcollectanyinformationyouchoosetoprovidetous,forexample,throughsupporttickets,emailsorsocialmedia.WhenyourespondtoStripeemailsorsurveys,wecollectyouremailaddress,nameandanyotherinformationyouchoosetoincludeinthebodyofyouremailorresponses.Ifyoucontactusbyphone,wewillcollectthephonenumberyouusetocallStripe,aswellasotherinformationyoumayprovideduringthecall.Wewillalsocollectyourengagementdatasuchasyourregistrationfor,attendanceof,orviewingofStripeeventsandotherinteractionwithStripepersonnel. ForumsandDiscussionGroups.WhereourSitesallowyoutopostcontent,wewillcollectPersonalDatathatyouprovideinconnectionwiththepost. b.PersonalDataUsage.InadditiontothewaysdescribedaboveinwhichweusePersonalData,weusePersonalDatainthefollowingways:ImprovingandDevelopingourServices.WeuseanalyticsonourSitestohelpusanalyzeyouruseofourSitesandServicesanddiagnosetechnicalissues.TolearnmoreaboutthecookiesthatmaybeservedthroughourSitesandhowyoucancontrolouruseofcookiesandthird-partyanalytics,pleaseseeourCookiePolicy.WealsocollectandprocessPersonalDatathroughourdifferentServices,whetheryouareanEndUser,EndCustomer,RepresentativeorVisitor,toimproveourServices,developnewServicesandsupportoureffortstomakeourServicesmorerelevantandmoreusefultoyou. Communications.WewillusethecontactinformationwehaveaboutyoutoperformtheServices,whichmayincludesendingcodesviaSMStoauthenticateyou.LearnMore.IfyouareanEndUser,RepresentativeorVisitor,wemaycommunicatewithyouusingthecontactinformationwehaveaboutyou(e.g.usingemail,phone,textmessageorvideoconference)toprovideinformationaboutourServicesandouraffiliates’services,inviteyoutoparticipateinoureventsorsurveys,orotherwisecommunicatewithyouforourmarketingpurposes,providedthatwedosoinaccordancewithapplicablelaw,includinganyconsentoropt-outrequirements.Forexample,whenyousubmityourcontactinformationtousorwhenwecollectyourbusinesscontactdetailsthroughourparticipationattradeshowsorotherevents,wemayusetheinformationtofollow-upwithyouregardinganevent,sendyouinformationthatyouhaverequestedonourproductsandservicesandincludeyouonourmarketinginformationcampaigns. SocialMediaandPromotions.IfyouchoosetosubmitPersonalDatatoustoparticipateinanoffer,programorpromotion,wewillusethePersonalDatayousubmittoadministertheoffer,programorpromotion.Basedonyourpermissionoropt-out,wewillalsousethatPersonalDataandPersonalDatayoumakeavailableonsocialmediatomarkettoyou. FraudPreventionandSecurity.WecollectandusePersonalDatatohelpustodetectandmanagetheactivityoffraudulentandotherbadactorsacrossourServices,toenableourfrauddetectionBusinessServices,andtootherwiseseektosecureourServicesandtransactionsagainstunauthorizedaccess,use,modificationormisappropriationofPersonalData,informationandfunds.Inconnectionwithfraudandsecuritymonitoring,prevention,detection,andcomplianceactivitiesforStripeanditsBusinessUsers,wereceiveinformationfromserviceproviders(includingcreditbureaus),thirdparties,andtheServicesweprovide.Wemaycollectinformationfromyou,andaboutyou,fromBusinessUsers,financialpartiesandinsomecasesthirdparties.Forexample,toprotectourServices,wemayreceiveinformationfromthirdpartiesaboutIPaddressesthatmaliciousactorshavecompromised.LearnMore.ThisPersonalData(e.g.name,address,phonenumber,country)helpsustoconfirmidentities,runcreditcheckssubjecttoapplicablelawandpreventfraud.WemayalsousetechnologytoassessthefraudriskassociatedwithanattemptedtransactionbyanEndCustomerorEndUserwithaBusinessUserorfinancialpartner. CompliancewithLegalObligations.WeusePersonalDatatomeetourcontractualandlegalobligationsrelatedtoanti-moneylaundering,Know-Your-Customer("KYC")laws,anti-terrorism,exportcontrolandprohibitionsondoingbusinesswithrestrictedpersonsorincertainbusinessareas,andotherlegalobligations.WestrivetomakeourServicessafe,secureandcompliant,andthecollectionanduseofPersonalDataiscriticaltothiseffort.Forexample,wemaymonitorpatternsofpaymenttransactionsandotheronlinesignalsandusethoseinsightstoreducetheriskoffraud,moneylaunderingandotheractivitythatisharmfultoStripe,ourEndUsersandtheirEndCustomers. Minors.TheServicesarenotdirectedtominors,includingchildrenundertheageof13,andwerequestthattheydonotprovidePersonalDatathroughtheServices.Insomecountries,wemayimposehigheragelimitsasrequiredbyapplicablelaw.WedonotsellanyPersonalDataofEndCustomers,Representatives,VisitorsorEndUsers,includingthoseagedbetween13to16. c.PersonalDataSharing.Inadditiontothewaysdescribedabove,wesharePersonalDatainthefollowingways:StripeAffiliates.WesharePersonalDatawithotherStripeaffiliatedentities.Whenwesharewiththeseentities,itisforpurposesidentifiedinthisPolicy. ServiceProvidersorProcessors.InordertoprovideServicestoourBusinessUsersandEndUsersandtocommunicate,marketandadvertisetoVisitors,RepresentativesandEndUsersregardingourServices,wewillrelyonotherstoprovideusservices.Serviceproviders(provideavarietyofcriticalservices,suchashosting(storinganddelivering),analyticstoassessthespeed,accuracyand/orsecurityofourServices,identityverification,customerservice,emailandauditing.WeauthorizesuchserviceproviderstouseordisclosethePersonalDataofourUsersthatwemakeavailabletoperformservicesonourbehalfandtocomplywithapplicablelegalrequirements.WerequiresuchserviceproviderstocontractuallycommittoprotectthesecurityandconfidentialityofPersonalDatatheyprocessonourbehalf.OurserviceprovidersarepredominantlylocatedintheEuropeanUnion,theUnitedStatesofAmericaandIndia.LearnMore. FinancialPartners.“FinancialPartners”arefinancialinstitutionsthatwepartnerwithtooffertheServices(includingpaymentmethodacquirers,banksandpayoutproviders).WesharePersonalDataofourUserswithcertainFinancialPartnerstoprovidetheServicestotheassociatedBusinessUsersandtooffercertainServicesinpartnershipwithourFinancialPartners.Forexample,wesharecertainPersonalDataofRepresentatives(e.g.loanrepaymentdataandcontactinformation)withinstitutionalinvestorswhopurchasetheCapitalloansthatwehavemadetotheassociatedBusinessUsers. OtherswithConsent.Insomecaseswemaynotprovideaservice,butinsteadreferyouto,orenableyoutoengagewith,otherstogetservices(e.g.professionalservicesfirmsthatwepartnerwithtodeliverAtlas).Inthesecases,wewilldisclosetheidentityofthethirdpartyandtheinformationthatwillbesharedwiththem,andseekyourconsenttosharetheinformation. CorporateTransactions.Intheeventthatweenterinto,orintendtoenterinto,atransactionthataltersthestructureofourbusiness,suchasareorganization,merger,sale,jointventure,assignment,transfer,changeofcontrol,orotherdispositionofalloranyportionofourbusiness,assetsorstock,wemaysharePersonalDatawiththirdpartiesinconnectionwithsuchtransaction.AnyotherentitywhichbuysusorpartofourbusinesswillhavetherighttocontinuetouseyourPersonalData,butsubjecttothetermsofthisPolicy. ComplianceandHarmPrevention.WesharePersonalDataaswebelievenecessary:(i)tocomplywithapplicablelaw,(ii)tocomplywithrulesimposedbypaymentmethodinconnectionwithuseofthatpaymentmethod(e.g.networkrulesforVisa);(iii)toenforceourcontractualrights;(iv)tosecureorprotecttheServices,rights,privacy,safetyandpropertyofStripe,youorothers,includingagainstothermaliciousorfraudulentactivityandsecurityincidents;and(v)torespondtovalidlegalprocessrequestsfromcourts,lawenforcementagencies,regulatoryagencies,andotherpublicandgovernmentauthorities,whichmayincludeauthoritiesoutsideyourcountryofresidence. 3.LegalbasesforprocessingdataForthepurposesoftheGeneralDataProtectionRegulation,werelyuponanumberoflegalbasestoenableourprocessingofyourPersonalData.Formoreinformationseehere.a.ContractualandPre-ContractualBusinessRelationships.WeprocessPersonalDataforthepurposeofenteringintobusinessrelationshipswithprospectiveBusinessUsersandEndUsersandtoperformtherespectivecontractualobligationsthatwehavewiththeseUsers.Activitiesinclude:CreationandmanagementofStripeaccountsandStripeaccountcredentials,includingtheevaluationofapplicationstocommenceorexpandtheuseofourServices; CreationandmanagementofStripeCheckoutaccounts; Accounting,auditing,andbillingactivities;and Processingofpayments,includingfrauddetectionandprevention,optimizingvalidtransactions,communicationsregardingsuchpayments,andrelatedcustomerservice. b.LegalCompliance.WeprocessPersonalDatatoverifytheidentityofourUsersinordertocomplywithfraudmonitoring,preventionanddetectionobligations,lawsassociatedwiththeidentificationandreportingofillegalandillicitactivity,suchas"Anti-MoneyLaundering("AML")andKnow-Your-Customer("KYC")"obligations,andfinancialreportingobligations.Forexample,wemayberequiredtorecordandverifyaUser’sidentityforthepurposeofcompliancewithlegislationintendedtopreventmoneylaunderingandfinancialcrimes.Theseobligationsareimposedonusbytheoperationoflaw,industrystandards,andbyourfinancialpartners,andmayrequireustoreportourcompliancetothirdparties,andtosubmittothirdpartyverificationaudits.c.LegitimateBusinessInterests.Whereallowedunderapplicablelaw,werelyonourlegitimatebusinessintereststoprocessPersonalDataaboutyou.Thefollowinglistsetsoutthebusinesspurposesforwhichwehavealegitimateinterestinprocessingyourdata:Detect,monitorandpreventfraudandunauthorizedpaymenttransactions; Mitigatefinancialloss,claims,liabilitiesorotherharmtoEndCustomers,EndUsers,BusinessUsersandStripe; DetermineeligibilityforandoffernewStripeproductsandservicesLearnMore; Respondtoenquiries,sendServicenoticesandprovidecustomersupport; Promote,analyze,modifyandimproveourServices,systems,andtools,anddevelopnewproductsandservices,includingreliabilityoftheServices; Manage,operateandimprovetheperformanceofourSitesandServicesbyunderstandingtheireffectivenessandoptimizingourdigitalassets; AnalyzeandadvertiseourServices; Conductaggregateanalysisanddevelopbusinessintelligencethatenableustooperate,protect,makeinformeddecisions,andreportontheperformanceof,ourbusiness; SharePersonalDatawiththirdpartyserviceprovidersthatprovideservicesonourbehalfandbusinesspartnerswhichhelpusoperateandimproveourbusinessLearnMore; EnablenetworkandinformationsecuritythroughoutStripeandourServices;and SharePersonalDataamongouraffiliates. d.Consent.WemayrelyonconsenttocollectandprocessPersonalDataasitrelatestohowwecommunicatewithyouandfortheprovisionofourServiceslikeLink,AtlasandIdentity.Whenweprocessdatabasedonyourconsent,youhavetherighttowithdrawyourconsentatanytimewithoutaffectingthelawfulnessofprocessingbasedonsuchconsentbeforetheconsentiswithdrawn. 4.YourrightsandchoicesYoumayhavechoicesregardingourcollection,useanddisclosureofyourPersonalData:a.OptingoutofreceivingelectroniccommunicationsfromusIfyounolongerwanttoreceivemarketing-relatedemailsfromus,youmayopt-outviatheunsubscribelinkincludedinsuchemailsorasdescribedhere.Wewilltrytocomplywithyourrequest(s)assoonasreasonablypracticable.Pleasenotethatifyouopt-outofreceivingmarketing-relatedemailsfromus,ourBusinessUsersmaystillsendyoumessagesanddirectustosendyoumessagesontheirbehalf.b.YourdataprotectionrightsDependingonyourlocationandsubjecttoapplicablelaw,youmayhavethefollowingrightsdescribedherewithregardtothePersonalDatawecontrolaboutyou:TherighttorequestconfirmationofwhetherStripeprocessesPersonalDatarelatingtoyou,andifso,torequestacopyofthatPersonalData; TherighttorequestthatStriperectifiesorupdatesyourPersonalDatathatisinaccurate,incompleteoroutdated; TherighttorequestthatStripeeraseyourPersonalDataincertaincircumstancesprovidedbylaw.Learnmore; TherighttorequestthatStriperestricttheuseofyourPersonalDataincertaincircumstances,suchaswhileStripeconsidersanotherrequestthatyouhavesubmitted(includingarequestthatStripemakeanupdatetoyourPersonalData); TherighttorequestthatweexportyourPersonalDatathatweholdtoanothercompany,wheretechnicallyfeasible; WheretheprocessingofyourPersonalDataisbasedonyourpreviouslygivenconsent,youhavetherighttowithdrawyourconsentatanytime;and/or Whereweprocessyourinformationbasedonourlegitimateinterests,youmayalsohavetherighttoobjecttotheprocessingofyourPersonalData.Unlesswehavecompellinglegitimategroundsorwhereitisneededforlegalreasons,wewillceaseprocessingyourinformationwhenyouobject. c.ProcessforexercisingyourdataprotectionrightsToexerciseyourdataprotectionrightspleasealsoseetheStripePrivacyCenterorcontactusasdescribedbelow. 5.SecurityandretentionWemakereasonableeffortstoprovidealevelofsecurityappropriatetotheriskassociatedwiththeprocessingofyourPersonalData.Wemaintainorganizational,technicalandadministrativemeasuresdesignedtoprotectPersonalDatacoveredbythisPolicyagainstunauthorizedaccess,destruction,loss,alterationormisuse.PersonalDataisonlyaccessedbyalimitednumberofpersonnelwhoneedaccesstotheinformationtoperformtheirduties.Unfortunately,nodatatransmissionorstoragesystemcanbeguaranteedtobe100%secure.Tohelpusprotectpersonaldata,weencourageyoutouseastrongpasswordandnevershareyourpasswordwithanyoneorusethesamepasswordwithothersitesoraccounts.Ifyouhavereasontobelievethatyourinteractionwithusisnolongersecure(e.g.youfeelthatthesecurityofyouraccounthasbeencompromised),pleasecontactusimmediately.LearnMore.WeretainyourPersonalDataaslongasweareprovidingtheServicestoyouorourBusinessUsers(asapplicable)orforaperiodduringwhichwereasonablyanticipateprovidingtheServices.EvenafterwestopprovidingServicesdirectlytoyouoraBusinessUserwithwhichyouaredoingbusiness,andevenifyoucloseyourStripeaccountorcompleteatransactionwithaBusinessUser,weretainyourPersonalDatainordertocomplywithourlegalandregulatoryobligations.Wemayalsoretainittoallowforfraudmonitoring,detectionandpreventionactivities.WealsokeepPersonalDatatocomplywithourtax,accounting,andfinancialreportingobligations,wherewearerequiredtoretainthedatabyourcontractualcommitmentstoourfinancialpartners,andwheredataretentionismandatedbythepaymentmethodsyouused.IncaseswherewekeepPersonalData,wedosoinaccordancewithanylimitationperiodsandrecordsretentionobligationsthatareimposedbyapplicablelaw.LearnMore. 6.InternationaldatatransfersWeareaglobalbusiness.PersonalDatamaybestoredandprocessedinanycountrywherewedobusiness,whereourserviceprovidersdobusinessorifyouuseaninternationalpaymentmethodorfinancialpartnerservice,thecountriesinwhichthatpaymentmethodorfinancialpartneroperates.WemaytransferyourPersonalDatatocountriesotherthanyourowncountry,includingtotheUnitedStates.Thesecountriesmayhavedataprotectionrulesthataredifferentfromyourcountry.Whentransferringdataacrossborders,wetakemeasurestocomplywithapplicabledataprotectionlawsrelatedtosuchtransfer.Incertainsituations,wemayberequiredtodisclosePersonalDatainresponsetolawfulrequestsfromOfficials(suchaslawenforcementorsecurityauthorities).IfyouarelocatedintheEuropeanEconomicArea(“EEA”),the"UnitedKingdom("UK")"orSwitzerland,pleaseseeStripePrivacyCenterformoreinformation.Whereapplicablelawrequiresadatatransfermechanism,weuseoneormoreofthefollowing:EUStandardContractualClauseswithadatarecipientoutsidetheEEA,SwitzerlandortheUK,verificationthattherecipienthasimplementedBindingCorporateRules,orotherlegalmethodsavailabletousunderapplicablelaw.FortransferstothirdcountrieswehaveenteredintoStandardContractualClauses,approvedbytheEuropeanCommission,toensureanadequatelevelofprotectionforthetransferofyourPersonalDatatothoseentitiesoutsidetheEEA.YoucanobtainacopyoftherelevantStandardContractualClauses.LearnMore.WhileStripeInc.remainsself-certifiedundertheE.U.-U.S.PrivacyShieldandtheSwiss-U.S.PrivacyShield,itisnotcurrentlyrelyingontheseframeworksforthetransferofpersonaldatatotheU.S.Formoreinformation,pleaseseeStripePrivacyCenter. 7.UpdatesandnotificationsWemaychangethisPolicyfromtimetotimetoreflectnewservices,changesinourprivacypracticesorrelevantlaws.The“Lastupdated”legendatthetopofthisPolicyindicateswhenthisPolicywaslastrevised.AnychangesareeffectivewhenweposttherevisedPolicyontheServices.WemayprovideyouwithdisclosuresandalertsregardingthePolicyorPersonalDatacollectedbypostingthemonourwebsiteand,ifyouareanEndUserorBusinessUser,bycontactingyouthroughyourStripeDashboard,emailaddressand/orthephysicaladdresslistedinyourStripeaccount.IfapplicablelawrequiresthatweprovidenoticeinaspecifiedmannerpriortomakinganychangestothisPolicyapplicabletoyou,wewillprovidesuchrequirednotice. 8.Jurisdiction-specificprovisionsAustralia.IfyouareanAustralianresident,andyouaredissatisfiedwithourhandlingofanycomplaintyouraiseunderthisPolicy,youmaywishtocontacttheOfficeoftheAustralianInformationCommissioner. EEAandUK.Toexerciseyourrights,youmaycontactourDPO.IfyouarearesidentoftheEEAorwehaveidentifiedStripePaymentsEuropeLimitedasyourdatacontroller,andbelieveweprocessyourinformationwithinthescopeoftheGeneralDataProtectionRegulation(GDPR),youmaydirectyourquestionsorcomplaintstotheIrishDataProtectionCommission.IfyouarearesidentoftheUK,youmaydirectyourquestionsorconcernstotheUKInformationCommissioner’sOffice.WherePersonalDataisusedforregulatedfinancialactivitiesinEurope,StripePaymentsEuropeLimitedandStripelocalregulatedentities(definedasthosewhoarelicensed,authorizedorregisteredbyaLocalRegulatoryAuthority)areconsideredjointcontrollers.LearnMore. Indonesia.AsusedinthisPolicy,“applicablelaw”includesLawNo.11of2008asamendedbyLawNo.19of2016onElectronicInformationandTransactions,GovernmentRegulationNo.71of2019ontheImplementationofElectronicSystemsandTransactions,andMinisterofCommunicationandInformaticsRegulationNo.20of2016onPersonalDataProtectioninElectronicSystemsand“PersonalData”includes“personaldata”asdefinedundersuchlaws. Malaysia.IfyouhaveanyquestionsorcomplaintsaboutthisPolicy,pleasecontactourDPO. Thailand.Thailandresidentsmayhaveadditionalrightsunderapplicablelaws.IfweprocessyourPersonalDataduetoalegalobligationorcontractualright,andyoudonotprovideuswithpersonalInformation,wemaynotbeabletolawfullyprovideyouservices. UnitedStates-California.IfyouareaconsumerlocatedinCalifornia,weprocessyourpersonalinformationinaccordancewiththeCaliforniaConsumerPrivacyAct("CCPA").Youhavearighttoreceivenoticeofourpracticesatorbeforecollectionofpersonalinformation.ThissectionprovidesadditionaldetailsaboutthepersonalinformationwecollectanduseforpurposesofCCPA. HowWeCollect,Use,andDiscloseyourPersonalInformation.ThePersonalDataWeCollectsectionfurtherdescribesthepersonalinformationwemayhavecollectedaboutyou,includingthecategoriesofsourcesofthatinformation.WecollectthisinformationforthepurposesdescribedintheHowWeUsePersonalDatasection.WesharethisinformationasdescribedintheHowWeDisclosePersonalDatasection.Forspecificdetails,pleaseseehere.Stripeusescookies,includingadvertisingcookies,asdescribedinourCookiePolicy. YourCCPARightsandChoices.AsaCaliforniaconsumerandsubjecttocertainlimitationsundertheCCPA,youhavechoicesregardingouruseanddisclosureofyourpersonalinformation(learnmore): Exercisingtherighttoknow:youmayrequestthatwedisclosetoyouthepersonalinformationwehavecollectedaboutyou.Youalsohavearighttorequestadditionalinformationaboutcategoriesoftheirpersonalinformationcollected,sold,ordisclosed;purposesforwhichthispersonalinformationwascollectedorsold;categoriesofsourcesofpersonalinformation;andcategoriesofthirdpartieswithwhomwedisclosedthispersonalinformation. Exercisingtherighttodelete:youmayrequestthatwedeletethepersonalinformationwehavecollectedfromyou,subjecttocertainlimitationsunderapplicablelaw. Exercisingtherighttoopt-outfromasale:WedonotsellPersonalDataasdefinedbytheCCPAandhavenotdonesointhepast12months. Non-discrimination:TheCCPAprovidesthatyoumaynotbediscriminatedagainstforexercisingtheserights. Tosubmitarequesttoexerciseanyoftherightsdescribedabove,pleasecontactususingthemethodsdescribedintheContactUssectionbelow.Youmaydesignate,inwritingorthroughapowerofattorney,anauthorizedagenttomakerequestsonyourbehalftoexerciseyourrightsundertheCCPA.Beforeacceptingsucharequestfromanagent,wewillrequiretheagenttoprovideproofyouhaveauthorizedittoactonyourbehalf,andwemayneedyoutoverifyyouridentitydirectlywithus. Further,toprovideordeletespecificpiecesofpersonalinformationwewillneedtoverifyyouridentitytothedegreeofcertaintyrequiredbylaw.Wewillverifyyourrequestbyaskingyoutosenditfromtheemailaddressassociatedwithyouraccountorrequiringyoutoprovideinformationnecessarytoverifyyouraccount. AnauthorizedagentmaysubmitarequestonyourbehalfbycontactingususingthemethodsdescribedintheContactUssectionbelow.Wemaystillrequireyoutodirectlyverifyyouridentityandconfirmthatyouprovidedtheauthorizedagentpermissiontosubmittherequest. 9.ContactusIfyouhaveanyquestionsorcomplaintsaboutthisPolicy,pleasecontactus.IfyouareanEndCustomer(i.e.anindividualdoingbusinessortransactingwithaBusinessUser),pleaserefertotheprivacypolicyornoticeoftheBusinessUserforinformationregardingtheBusinessUser’sprivacypractices,choicesandcontrols,orcontacttheBusinessUserdirectly.