Effective Date: December 1, 2023

This Privacy Notice describes how your Square entity as indicated below (“Square,” “we” and “us”) collects, uses, discloses, transfers, stores, retains or otherwise processes your information when you (whether you are a person acting as a sole proprietor or on behalf of another business entity) visit our website (www.squareup.com) or apply or sign up for a Square account (collectively, “Services”).

If you are a consumer shopping at a business that uses Square, please refer instead to the Privacy Notice available here. If you are a consumer shopping at a business that uses Square and you provide information to Square in order to receive a digital receipt and email marketing messages, and/or you have signed up to use Square Pay, please refer to the Privacy Notice available here.

• If your Country of Residence is the United States, your Square entity is Block, Inc., 1455 Market Street, Suite 600, San Francisco, CA 94103, United States.

• If your Country of Residence is Canada, your Square entity is Square Canada, Inc. or Square Technologies, Inc.

• If your Country of Residence is Japan, your Square entity is Square KK.

• If your Country of Residence is Australia, your Square entity is Square AU PTY, Ltd.

• If your Country of Residence is within the European Union, your Square entity is Squareup International Ltd.

• If your Country of Residence is the United Kingdom, your Square entity is Squareup Europe Ltd.

The full contact details for each of these entities are available at the end of this Privacy Notice.

Our Privacy Notice explains:

• INFORMATION WE COLLECT ABOUT YOU
• INFORMATION WE COLLECT ABOUT YOUR CUSTOMERS
• WHEN AND WITH WHOM WE SHARE YOUR INFORMATION
• SECURITY
• COOKIES & OTHER SIMILAR TECHNOLOGIES
• HOW LONG WE RETAIN YOUR INFORMATION
• YOUR CHOICES
• CHILDREN’S PERSONAL INFORMATION
• ADDITIONAL COUNTRY DISCLOSURES
  - EU/UK
  - AUSTRALIA
  - JAPAN
  - UNITED STATES
• CHANGES TO THIS PRIVACY NOTICE
• HOW TO CONTACT US

INFORMATION WE COLLECT ABOUT YOU

We collect information about you in three ways: (i) when you provide it to us directly; (ii) when we gather information while you are using the Services; and (iii) when we collect information from other sources. We explain below what types of data are involved in each case, how and why we process (use) it and the lawful basis that applies to our use of the relevant information.

Information You Provide (“Square Account Data”)

Below is a description of the types of information that we may receive directly from you which we refer to as “Square Account Data”:

Here is an explanation of what we do with the Square Account Data described above, i.e. how we use it and for what purposes, along with an explanation of the lawful basis that supports this use.

Information We Collect From Your Use of the Services

We also get data from the devices you use when you interact with our systems, like your location or information about the device you’re using. We refer to this as Usage Data.

We need this Usage Data to do things like provide services to you that you have requested, fulfill our legal obligations (such as checking if payments are being made or received by you and that they are legally compliant), and help protect your account from hackers and prevent fraud. We also need this Usage Data to make our products and services better for you and others, as well as to develop new products and services. For example, if more transactions are occurring on a specific hardware device we will build out more product and service availability on that device.

Information We Collect from Other Sources

We also need to check that you are eligible for the services you want to use, are using our services legally, and to protect your data and our services from potential fraudulent activity which may put you and your money at risk. To do this, we may collect data about you from companies that help us verify your identity, do a credit check, prevent fraud or assess risk.

INFORMATION WE COLLECT ABOUT YOUR CUSTOMERS

We also obtain information about your customers on your behalf as your service provider when they transact with you or otherwise when you request that we do so. We call this information Your Customers’ Data. We collect Your Customers’ Data when they interact with you through your use of Square’s products, for instance when they make a payment at your establishment, or schedule an appointment, or receive an invoice from you. The particular Customer Data we collect will vary depending on your location, which products and services you use and how you use them. Your Customers’ Data may include:

We use Your Customers’ Data as part of our contractual obligation to provide the Services you request to you and, in the United States, as disclosed in the Privacy Notice for Users Who Do Not Apply or Sign Up for a Square Account or Other Services, or as instructed by your customers.


It is your responsibility to obtain any necessary permission for us to use Your Customers’ Data in the manner envisaged in this Privacy Notice so that we can provide you with the Services requested by you.

WHEN AND WITH WHOM WE SHARE YOUR INFORMATION

We may share the personal information described in the “Information We Collect About You” section with the following categories of service providers and third parties:

Although we disclose your personal information to third parties as described above, we do not sell your personal information. We do, however, share your information for purposes of interest-based advertising or “targeted advertising” as discussed in the chart above, as well as below in the “Cookies, Other Similar Technologies, and Advertising” section. You can find more information on how to opt-out of targeted advertising in that section as well as the “Your Choices” section below.

SECURITY

We do a lot to keep your data safe. While we think we have strong defenses in place, no one can ever guarantee that hackers won’t be able to break into our sites or steal your data while it is stored or flowing from you to us or vice versa.

We take reasonable measures, including administrative, technical, and physical safeguards, to protect your information from loss, theft, and misuse, and unauthorized access, disclosure, alteration, and destruction. Nevertheless, the internet is not a 100% secure environment, and we cannot guarantee absolute security of the transmission or storage of your information. We hold information about you both at our own premises and with the assistance of third-party service providers. Your personal information will be accessible by our employees, contractors and service providers who require access for the purposes described in this Privacy Notice.

For more information about our security practices, please visit https://squareup.com/us/en/security.

COOKIES, OTHER SIMILAR TECHNOLOGIES, AND ADVERTISING

If you are reading this Privacy Notice in a country where we have a separate Cookies Policy, you will see the Cookie Banner that applies to you each time you visit the site.

The following additional information applies across all of our websites and apps.

Digital cookies and similar technologies help us make our services better to use by doing things like recognizing when you’ve signed in, analyzing how you use our services so we can make them more useful to you, giving you a more personalized experience.

When you interact with our online services, or open emails we send you, we obtain certain information using automated technologies, such as cookies, web server logs, web beacons and other technologies. A “cookie” is a text file that websites send to a visitor’s computer or other internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon,” also known as an internet tag, pixel tag, or clear GIF, is a tiny graphic image that may be used in our websites or emails.

We use these automated technologies to collect your device information, internet activity information, and inferences as described above. These technologies help us to:

• Remember your information so you do not have to re-enter it;
• Track and understand how you use and interact with our online services and emails;
• Tailor our online services to your preferences;
• Measure how useful and effective our services and communications are to you; and
• Otherwise manage and enhance our products and services.

We set some of these automated technologies ourselves, but others are set by third parties who deliver services on our behalf. For example, we may use other companies’ web analytics services (described in the “Third-Party Analytics Services” section above), which use automated technologies to help us evaluate how customers use our websites. Some of these technologies may also be set by third parties that help us advertise our products and services to you as informed by your interests, based on information collected from your activity on the web, including but not limited to, browsing or purchasing products on or through our websites or on third party websites or your activity on mobile sites and applications. This advertising approach is called interest-based advertising or “targeted advertising.”

Your browser can alert you when cookies are placed on your device, and how you can stop or disable them via your browser settings. More information on how to manage these settings on common browsers and devices are below.

• Manage cookie settings in Chrome and Chrome Android and Chrome iOS
• Manage cookie settings in Firefox
• Manage cookie settings in Internet Explorer
• Manage cookie settings in Microsoft Edge
• Manage cookie settings in Safari and Safari iOS

Please note, however, that without cookies all of the features of our online services may not work properly. If you use a mobile device, you can manage how your device and browser share certain device data by changing the privacy and security settings on your mobile device.

Within mobile applications, you may also go to your device settings and select “Limit Ad Tracking” (for iOS devices), or “Opt out of Interest-Based Ads” (for Android devices), which will allow you to limit our use of information collected from or about your mobile device (such as precise location data) for the purposes of serving online behavioral advertising to you.

You can also opt out of receiving interest-based ads from third party advertisers who are members of the Network Advertising Initiative (NAI) or who follow the Digital Advertising Alliance’s (DAA) Self-Regulatory Principles for Online Behavioral Advertising by visiting the opt out pages on the NAI website and DAA website.

Please also see the “Your Choices” section for other ways to opt-out of interest-based or targeted advertising.

HOW LONG WE RETAIN YOUR INFORMATION

We store your information for as long as is necessary for the purposes identified in this Privacy Notice, including to provide our Services, to comply with legal obligations, to enforce and prevent violations of our Terms, to protect against fraudulent activity, and to defend our legal rights, property and users.

The retention periods for your information are determined on a case-by-case basis that depends on the following factors:

• The nature of the information and why it is collected and processed. The length of time we will keep your information will generally be determined by how long we need that information to provide you with our Services, including any optional features you use and to provide customer support. For example:
  - As set out in this Privacy Notice, we require Square Account Data to deliver our Services. We need to keep it for the duration your Square account exists so that we can maintain your account.
  - Similarly, we will also keep your Usage Data for the lifetime of your account.

• Legal reasons. In certain cases, we are obliged to keep your information for legal reasons, which may include after your account has been deactivated. We will keep your information where it necessary for us:
  - To respond to a legal request or to comply with applicable law. We must keep your information where we have a legal obligation to do so, for example, if we receive a valid legal request, such as a preservation order or search warrant, related to your account, we preserve your information after you delete your account.
  - To deal with and resolve requests, disputes or complaints.
  - For litigation or regulatory matters. For example, we preserve your information related to a legal claim or complaint, such as where we are subject to a regulatory investigation or we need to defend ourselves in legal proceedings about a claim related to your information or respond to a regulator in relation to a legal or regulatory complaint made by you or someone else.
  - Issues relating to the safety, security and integrity of our Services and to protect rights, property and users. For example, we keep information where it is necessary to investigate misuse of our Services, such as fraud.

YOUR CHOICES

As described further below, you may be entitled to certain rights with respect to your personal information. You can also see, change or fix information you gave us, ask us to deactivate your account, control your location information, or opt out of receiving promotional messages from us.

Your Personal Information Rights

Depending on the jurisdiction in which you reside, you may be entitled under applicable law to request:

• Access to your personal information in a portable format, including: (1) the categories of personal information described above that we have collected about you and the categories of sources from which we collected such personal information; (2) the business or commercial purposes for collecting or sharing such personal information; (3) the categories of personal information about you that we have disclosed to third parties for a business purpose; (4) the categories of third parties to whom we have disclosed such personal information; and (5) the specific pieces of personal information we have collected about you.
• Deletion of the personal information we have collected from you;
• Correction of the personal information we have collected about you;
• To opt-out of the sharing of your personal information for purposes of targeted advertising.

You may submit an access, deletion, or correction request by emailing us at privacy@squareup.com or by calling us at 1.844.213.7377. Once we receive your request, we will verify it by requesting that you confirm certain personal information associated with your account. You may also be entitled to submit a request through an authorized agent. You may also email us privacy@squareup.com to appeal our denial of any of your access, deletion, or correction requests.

You can exercise your right to opt-out of targeted advertising by clicking the “Opt Out of Interest-Based Advertising” link in the footer of any page on our browser site.

Although some of the information we collect and process about you may be considered sensitive personal information, we only process such information for purposes authorized by law, such as to provide services you request from us or to verify your information.

Deactivating Your Account

If you wish to deactivate your account, you can do so by logging into your Square account or by emailing us using the contact details provided below.

Location Information

In order to provide certain Services, we may request access to location information, including precise geolocation information collected from your device. If you do not consent to the collection of this information, certain Services will not function properly and you will not be able to use those Services. You can stop our collection of location information at any time by changing the preferences on your mobile device. If you do so, some of our mobile applications will no longer function. You also may stop our collection of location information via mobile application by following the standard uninstall process to remove all Square mobile applications from your device.

Promotional Communications

You can opt out of receiving promotional messages from Square by following the instructions in those messages, by informing the caller that you would not like to receive future promotional calls, or by changing your notification settings by logging into your Square account. You may only opt out of text messages from Square by replying STOP. Opting out of receiving communications may impact your use of the Services. If you decide to opt out, we will still send you non-promotional communications which are required for the running of your account, such as digital receipts and messages about your account or our ongoing business relations.

CHILDREN’S PERSONAL INFORMATION

Our Services are general audience services not directed at children under the age of 18. We do not knowingly collect, share, or sell any information from children under the age of 18. If we learn that any information we collect has been provided by a child under the age of 18, we will promptly delete that information.

ADDITIONAL JURISDICTIONAL DISCLOSURES

EU/UK

Personal Information

If you reside in the EU or the UK, you have the right under certain circumstances:

• to be provided with access to your personal data held by us;
• to request the rectification or erasure of your personal data held by us;
• to request that we cease processing your data;
• to request that we restrict the processing of your personal data (while we verify or investigate your concerns with this information, for example);
• to object to profiling activities based on our own legitimate interests;
• to object to solely automated processing producing legal or similar effects;
• to request that your data be transferred to a third party (data portability);
• to withdraw your consent to our processing of your data (where such processing is based on consent); and
• to lodge a complaint with the data protection authority in your jurisdiction.

In order to exercise any of these rights (including the right to withdraw your consent), please email privacy-eu@squareup.com. We may need to verify your identity before granting access or otherwise changing or correcting your information.

International Data Transfers

We operate in many countries, and we (or our service providers) may move your data and process it outside the country where you live. We use third-party service providers to process and store your information in the United States, Japan, the EU, and other countries. When we transfer your personal data to our affiliates outside the EU, we make use of standard contractual clauses (which have been approved by the European Commission) to help ensure your information is afforded a high standard of protection, and that your privacy rights can be vindicated. For a list of the countries in which we operate, please see https://squareup.com/gb/about.

If you wish to obtain further details regarding the contractual arrangements we enter into to protect your personal data when it is transferred outside the EU, you may do so by emailing us via privacy-eu@squareup.com. You can also access the standard contractual clauses approved by the European Commission at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

AUSTRALIA

Square complies with the Privacy Act 1988 (Cth)(Privacy Act) and with the 13 Australian Privacy Principles (APPs) in the Privacy Act, as well as with this Privacy Policy.

We may share your information with Cuscal Limited, an Authorised Deposit-Taking Institution (ADI) supervised by the Australian Prudential Regulation Authority (APRA). Cuscal supports our provision of the Services through its banking and payments services and may not be able to provide its services without information about you. Cuscal’s privacy policy is available via www.cuscal.com.au/privacy-policy and sets out details about Cuscal’s collection, use and disclosure of information about you, as well as information about your rights to access your personal information.

JAPAN

We may share your information with a third party outside of Japan, including, but not limited to, the United States, Canada, the EU, and in other countries. We may use some cloud service providers located in the United States and Japan. We are unable to specify all possible jurisdictions Personal Data of users of Square services in Japan would be transferred or stored, as service providers use multiple servers located in multiple jurisdictions and do not disclose all of these locations for security reasons.

You may contact our privacy team with any requests of disclosure, correction, or deletion of your personal information. You may also request suspension of use or suspension of sharing of your personal information with certain third parties. Please contact our privacy team at the address listed below under “Contact.” We may request to verify your identity before processing your request.

UNITED STATES

California

Privacy laws that apply in certain places, like California, treat “businesses” and “service providers” differently. Under those laws, a business is the company that decides why and how to process personal information. A service provider processes personal information on behalf of a business in order to provide services. When Square processes Your Customers’ Data, we generally act as your service provider. In select cases, however, we may act as a business when we process Your Customers’ Data. For example, we act as a business when we use Your Customers’ Data to send your customers digital receipts directly from Square, or when we allow you to use Customer Directory or Square Marketing to contact your buyer using a masked email address (for example, j*****@gmail.com) that gets routed to them via Square. Your customers can visit the Privacy Notice for Square Buyer Features for more information on how Square processes their data when it is acting as a business.

Even though you use our services while acting as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietor of a business, nonprofit, or government agency, if you live in California, California law gives you the right to ask if we disclose your personal information to third parties for their direct marketing purposes (we do not disclose your personal information for others’ direct marketing purposes).

CHANGES TO THIS PRIVACY NOTICE

We reserve the right to change this Privacy Notice from time to time, as may be required. We will provide you with reasonable prior notice of any material changes in how we use your information, including by email if you have provided one. If you disagree with these changes, you may cancel your account at any time. Any amendments will be published by posting a revised version of the Privacy Notice and updating the “Effective Date” above. The revised version will be effective on the “Effective Date” listed.

CONTACT

If you have any questions or concerns regarding this Privacy Notice, please reach out to us by contacting your country specific privacy contact below: