Data Sharing with Affiliates and Service Providers

What it is

Square shares your personal data with its related companies and outside vendors who help it run its business, including for payment processing, marketing, and fraud detection.

Why it matters (compliance & governance perspective)

Data sharing with affiliates and a broad range of service providers means your personal information moves beyond Square to a potentially large ecosystem of companies, each with their own data handling practices.

Consumer impact (what this means for users)

Your personal data is shared with Square's affiliated companies and various third-party vendors involved in marketing, analytics, fraud prevention, and payment processing, meaning multiple organizations may hold copies of your information under different contractual terms.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Under GDPR Article 28, sharing personal data with service providers acting as processors requires written data processing agreements specifying the scope and nature of processing. CCPA/CPRA distinguishes between service providers (who receive data under contractual restrictions) and third parties (to whom data is sold or shared); the policy's categorization of recipients affects which opt-out rights apply. GLBA Safeguards Rule requires financial institutions to oversee service provider arrangements involving customer financial data. GOVERNANCE EXPOSURE: Medium. The breadth of affiliate and service provider sharing is standard for a large fintech company but requires robust contractual controls and ongoing vendor management. The lack of a comprehensive list of affiliate entities or service provider categories in the public-facing policy creates some opacity about the actual scope of data flows. JURISDICTION FLAGS: GDPR requires that international transfers to service providers outside the EEA be covered by Standard Contractual Clauses or equivalent mechanisms. CPRA requires that service provider contracts prohibit use of personal information for purposes beyond the service agreement. State-level financial privacy laws in California (CCFIPA) may impose additional notice requirements for sharing with affiliates. CONTRACT AND VENDOR IMPLICATIONS: Institutional customers should request Square's sub-processor list and data processing agreements to assess the scope of downstream data sharing. Any B2B contract with Square should clarify the customer's status as a business versus a consumer and the applicable data handling obligations that flow from that classification. COMPLIANCE CONSIDERATIONS: Compliance teams should map all affiliate and service provider relationships in Square's ecosystem and assess whether contractual controls meet GDPR Article 28, CPRA service provider requirements, and GLBA vendor management standards. Periodic vendor assessments and audit rights should be confirmed in applicable agreements.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Collection of Payment and Financial Data high
• Sharing Data with Advertising and Analytics Partners high
• Identity Verification and Biometric-Adjacent Data Collection high
• California Consumer Privacy Rights (CCPA/CPRA) medium
• GDPR Rights for EEA and UK Users medium
• Automatic Collection of Device and Behavioral Data medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.