Manage information collection and CCPA privacy rights for customers
About information collection and CCPA privacy rights for customers
The California Consumer Privacy Act of 2018 (CCPA) is a law that provides California residents with certain rights regarding their personal information, and went into effect on January 1, 2020. California residents and customers of Square sellers may have the right to make a data request from that business.
When making purchases from some Square sellers, some of your personal or contact information may be collected. Under the CCPA, California residents and customers of Square sellers may have the right to make a data request from that business.
A Square profile helps customers manage their information when interacting with Square sellers, while also providing important privacy protections, including those required by the California Consumer Privacy Act (CCPA).
Before you begin
Ensure you’ve reviewed the Square profile - Privacy Notice for Buyer Features and Square Pay and the Privacy Notice for Square Sellers and Website Visitors to understand what types of information is collected.
Square acts primarily as a service provider with respect to the personal information we process about the customers who transact with Square sellers. For example, when a customer makes a purchase with a Square seller, we process the transaction as a service provider on the seller’s behalf. Square also offers certain features directly to customers who transact with Square sellers called “Buyer Features.”
Not all Square sellers may be subject to the CCPA.
The CCPA does not apply to data about businesses, including sole proprietorships, or other legal entities, but it does apply to data that businesses or legal entities collect or maintain about individuals who are California residents.
The California Attorney General is responsible for enforcing businesses’ compliance with the CCPA. If you are a California resident, you can visit the Attorney General’s website to find more information about your privacy rights.
Personal information collection
Personal information under CCPA means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. This is a very broad definition. It can include a California resident’s name, phone number, email address or postal address. It also can include records of products or services purchased, purchasing or consuming histories or tendencies, or information a business obtains about an individual’s online activity, such as an IP address or browsing history.
When using Square’s buyer features, personal information is collected in the following ways:
- Contact information: When you shop with a Square seller and choose to receive a digital receipt and other communications from the seller, we ask for you to fill in certain contact information, such as your email address or phone number.
- Square profile: When you use Square profile, Square passively collects certain information about your device and how you browse or use our portal, such as your IP address, device characteristics, the web pages you click on, and the dates and times of your visits.
At a high level, the CCPA grants individuals who live in California certain rights over their personal information, such as:
- The right to access their personal information.
- The right to delete their personal information.
- The right to opt-out of the “sale” of their personal information.
In addition to honoring and fulfilling these rights, the CCPA also imposes certain other requirements on businesses. For example, the CCPA requires businesses to:
- Disclose specified content in their privacy policies.
- Contractually restrict the activities of “service providers” that process personal information on their behalf.
- Train relevant personnel responsible for CCPA compliance.
Businesses may not discriminate against California residents for exercising their rights under the CCPA. Businesses may offer financial incentives for the collection, sale or deletion of individuals’ personal information only if they obtain opt-in consent.
Square collects and uses your personal information to provide you with the buyer features and improve and develop Square products and services. Your information may also be used for other reasons, including:
- Communicating with you about our buyer features.
- Showing your masked information in the directory of your sellers.
- Advertising and marketing from Square or on behalf of Square sellers.
- Conducting internal analytics to understand how customers engage with Square’s different products.
- Email marketing and other communications from your sellers.
- Manage, develop, and improve Square products and services.
- Protect Square services and maintain a trusted environment, such as to detect and prevent fraud and to ensure Square services are not used unlawfully.
Your personal information is shared with the following:
- With Square sellers after you fill in your contact information to receive a digital receipt and other communications from the seller. Square shares your “masked” contact information with subsequent sellers you visit so they can send you digital receipts and marketing communications. For example, if your email address is johnsmith@gmail.com, a subsequent seller will only see a masked version, such as jo@gm in their customer directory. If your phone number is 415-555-0190, a seller will see –0190. Once you’ve provided this information to your seller, subsequent sellers can send digital receipts to you and contact you through Square, but they will not see your full phone number or email address unless you first entered that contact information at their store.
- Vendors that help run Square services.
- Individuals whose information you or your seller provides to Square when you use your card to make a payment. For example, if you or your seller enters the email address for your family member when you make a payment, that family member may receive future automatic receipts and email marketing communications from your sellers. If you share a card account with a family member, the family member whose contact information was entered may also receive digital receipts linked to the card.
At a high level, the CCPA grants individuals who live in California certain rights over their personal information, such as:
- The right to access their personal information.
- The right to delete their personal information.
- The right to opt-out of the “sale” of their personal information.
In addition to honoring and fulfilling these rights, the CCPA also imposes certain other requirements on businesses. For example, the CCPA requires businesses to:
- Disclose specified content in their privacy policies.
- Contractually restrict the activities of “service providers” that process personal information on their behalf.
- Train relevant personnel responsible for CCPA compliance.
Businesses may not discriminate against California residents for exercising their rights under the CCPA. Businesses may offer financial incentives for the collection, sale or deletion of individuals’ personal information only if they obtain opt-in consent.
Manage CCPA information requests
If you’re a California resident, under the CCPA you may request the following details from a Square seller from the preceding 12 months:
- The categories of personal information the seller collected about you.
- The specific pieces of personal information the seller collected about you.
- The categories of sources from which the seller collected your personal information.
- The business or commercial purposes for collecting or “selling” your personal information.
- The categories of your personal information that the seller shared with third parties.
- The categories of your personal information that the seller “sold” to third parties, and the third parties to whom they “sold” it to.
- The categories of your personal information that the seller disclosed for a “business purpose”, and the third parties to whom they disclosed it to.
The CCPA also grants you the right to:
- Request that the seller delete the personal information the seller collected from you, subject to certain exceptions.
- If the business “sells” your personal information, opt out of the “sale” of your personal information to third parties.
If you have questions about the personal information that a Square seller has about you, ask that Square seller whether they have obligations under CCPA. If so, you can ask that seller to supply you with the information you need by visiting the seller’s website or store, or calling the seller at their listed phone number.
If you elect to use certain Square buyer features, you can exercise your CCPA rights and make requests about the data Square uses for the buyer features by going to your Square profile. These buyer features are offered directly to you, the consumer. Square has independent obligations with respect to these features, and will provide you with your rights under CCPA accordingly.
Information request exemptions
Under the CCPA, businesses are not required to delete personal information if the following applies:
The data is necessary to provide goods or services to a customer.
The data complies with legal obligations.
The data is used to discover and resolve issues related to security or functionality.
If the data has solely internal uses that a consumer would expect.