Square Privacy Notice

This document is Square's global Privacy Notice, governing the collection, use, storage, and disclosure of personal information across Square's payment processing, point-of-sale, financial services, and related products, with legal basis grounded in contractual necessity, legitimate interests, legal obligation, and consent depending on jurisdiction. The policy states that Square collects identifiers, financial account details, transaction data, device and location information, biometric-adjacent identity verification data, and inferred characteristics, and the terms authorize sharing this data with affiliates, service providers, financial partners, and third parties for advertising and analytics purposes. The breadth of data collection extending to device signals, browsing behavior on third-party sites via cookies, and inferred consumer attributes, combined with a stated right to share data with advertising partners, is operationally significant; however, the policy also documents opt-out mechanisms for certain sharing categories, and applicable law may constrain the broadest assertions, particularly for California residents and EU/EEA users. The policy explicitly engages CCPA/CPRA for California residents, GDPR and UK GDPR for EEA and UK users, and intersects with GLBA and PCI DSS given Square's role as a payment processor and financial services provider; compliance obligations under these frameworks vary materially by jurisdiction and user category. Compliance teams should note that Square's dual role as both a data controller for its own purposes and a data processor on behalf of merchant customers creates layered obligations that may require separate evaluation under applicable law.