·Last updated: September 27, 2026

·To support Stripe in delivering its Services, Stripe engages service providers, Sub-Processors and affiliates to assist Stripe with its data processing activities on behalf of Stripe Business Users as defined in our Stripe Services Agreement.

·Summary of Changes

·We've updated this page because we strive to be clear about our use of Personal Data and the third party service providers we engage. The below outlines a few highlights of the changes we made, so please review this page carefully. If you have questions or queries, please contact us.

·You will see that in our List of Affiliates we have:

• ·removed all references to Stripe, Inc., as this entity no longer exists
• ·removed Stripe Payments Europe, Limited - Italian Branch, and added our new Italian Affiliate, Stripe Italy S.r.l.
• ·added Metronome Technologies, Inc., a company Stripe acquired
• ·updated the name of LemonSqueezy, LLC to its new name Sold Through Link, LLC
• ·added Microsoft Corporation and Snowflake, Inc. as cloud service providers
• ·added a new dedicated section for Data Pipeline and added five Cloud service providers for Stripe Data Pipeline: Amazon Web Services, Inc., Databricks, Inc., Google LLC, Microsoft Corporation, and Snowflake Inc.
• ·updated the purpose of processing description for Adish Co., Ltd. by removing "in Japanese"
• ·moved Inscribe AI, Inc. from the Identity subsection to the general list of Sub-processors since we also use this party for other Capital and Financial Connections
• ·added a new subsection for Consumer Issuing and added two Sub-processors to this category: LoanPro Software, LLC and January Technologies, Inc.
• ·removed Mitek Systems, Inc.
• ·added direct links to acquired Affiliate's own sub-processors list for Bridge, TaxJar, and Privy
• ·updated the list of Service Providers for Terminal with new fulfillment and distribution partners

·What is a Sub-processor?

·When Stripe engages third party service providers in our capacity as a data processor for our Business Users' personal data, the General Data Protection Regulation ("GDPR") and a number of other global privacy frameworks call these third-party service providers sub-processors. Sub-processors are service providers who have or potentially will have access to or process personal data that Stripe processes for, and on behalf of, Stripe's Business Users.

·This page outlines the types of service providers, Sub-processors, and affiliates we utilize, where they are located, and a description of the work they carry out.

·Due Diligence

·Before engaging any service provider (including Sub-processors), we perform due diligence, including a vendor security assessment. Our service providers are subject to contract terms designed to ensure that these service providers process personal data only for the purposes of providing services to Stripe and in accordance with our commitments to Business Users and applicable data protection laws.

·List of Sub-processors

·List of Service Providers

·The below list of service providers are some key third parties Stripe works with across our products and services. You will also find some service providers that Stripe works with for a specific Stripe product or service.

·List of Affiliates

·Other Stripe Entities Involved in Offering the Services

·Stripe may need to rely on Stripe affiliates to help provide the Services to our Business Users, their Customers and our End Users. Stripe affiliates are other entities delivering elements of the Services to our Business Users and End Users. The Stripe affiliates involved in the processing of personal data will depend on the location of our Business Users, their End Customers and our End User, and the nature of the services Stripe is providing.

·Updates to this Page

·Due to the nature of our global business and the volume of Business Users, our business needs and services providers may change from time to time. For example, we may deprecate a service provider to consolidate and minimize our use of service providers. Similarly, we may add a service provider if we believe that doing so will enhance our ability to deliver our Services.

·We will periodically update this page to reflect additions and removals to our list of service providers, Sub-processors and Affiliates. If you are a Business User, you may subscribe to receive email notifications of updates to our list of Sub-processors on this page here.

·Under the terms of our Data Processing Agreement (DPA), a Business User may reasonably object in writing to the processing of its personal data by a new Sub-processor within 30 days following the update of this page. If a Business User does not object during the 30 day time period, the appointment of the new Sub-processor shall be deemed accepted by the Business User. If you are a Business User and want to know more about our DPA, please contact us.

·For more information on Stripe's privacy practices, please visit our Privacy Policy. If you have any questions regarding this page, please contact us.

11. Scope.

·This Data Processing Agreement ("DPA") is between the Stripe entity specified in the Agreement (and its Affiliate(s), collectively "Stripe") and the User specified in the Agreement, and is subject to and incorporated by reference into the Agreement. This DPA governs Stripe's and its Affiliates' Processing of Personal Data.

22. Stripe as Data Processor and Data Controller

33. Stripe Obligations when Acting as a Data Processor.

3.13.1 Obligations.

·When Stripe is acting as a Data Processor for User, Stripe will, to the extent required by DP Law:

·(a) Process Personal Data on User's behalf and according to User's Instructions. Stripe will inform User if, in its opinion, Instructions violate or infringe DP Law;

·(b) ensure that all persons Stripe authorises to Process Personal Data are granted access to Personal Data on a need-to-know basis and are committed to respecting the confidentiality of that Personal Data;

·(c) inform User of each request Stripe receives from Data Subjects (including "verifiable consumer requests" as defined under the CCPA) exercising their rights under DP Law to (i) access (e.g., right to know under the CCPA) their Personal Data; (ii) have their Personal Data corrected or erased; (iii) restrict or object to Stripe's Processing; or (iv) data portability (collectively "Data Subject Request"). Other than to request further information, identify the Data Subject and, if applicable, direct the Data Subject to User as Data Controller, Stripe will not respond to these requests unless User instructs Stripe in writing to do so. Taking into account the nature of the Processing, Stripe will assist User by appropriate technical and organisational measures, insofar as this is possible, to enable User to meet its obligation to respond to a Data Subject Request;

·(d) inform User of each law enforcement request Stripe receives from a Governmental Authority requiring Stripe to disclose Personal Data or participate in an investigation requiring Stripe to disclose Personal Data, unless prohibited by Law;

·(e) provide User with reasonable assistance, following User's written request, to help User comply with its obligations under DP Law and, taking into account the nature of the Processing and the information available to Stripe, Stripe will provide reasonable information to help User conduct a data protection impact assessment or consult with a Supervisory Authority. If User requests assistance from Stripe that goes beyond Stripe's obligations under DP Law or this Agreement, Stripe may charge User a reasonable fee;

·(f) if Stripe experiences a Data Incident, notify User without undue delay, which for Data Incidents affecting Personal Data subject to the GDPR or UK GDPR will be no later than 48 hours, in each case after becoming aware of the Data Incident. To the extent known to Stripe, Stripe's notification to User will describe in reasonable detail (i) the type of Personal Data that was the subject of the Data Incident, (ii) the categories and potential number of individuals or records affected (including their countries) and (iii) the status of Stripe's investigation and current or planned remediation. Following the notification, Stripe will provide relevant updates to assist User in complying with its obligations under DP Law;

·(g) following User's written request, contribute to audits or inspections by making audit reports available to User. Following this request, and no more frequently than once annually, Stripe will promptly provide documentation or complete a written data security questionnaire of reasonable scope and duration regarding Stripe's and its Affiliates' Processing of Personal Data. All reports and documentation provided, including any response to a security questionnaire, are Stripe's confidential information; and

·(h) at User's choice, delete or return to User all Personal Data Processed in connection with the Services, and delete existing copies, following termination of the Agreement, except that Stripe will not be required to delete or return that Personal Data, or delete existing copies, to the extent that Stripe's storage of that Personal Data or those copies is (i) required by Stripe to exercise its rights and perform its obligations under this Agreement; or (ii) required or authorised by DP Law for a longer period.

3.23.2 Sub-processors.

·(a) Stripe engages Sub-processors, which may include its Affiliates, as necessary to perform the Services. User consents to Stripe's use of its existing Sub-processors, as set out on the Stripe Sub-processors List, and grants Stripe a general written authorisation to engage Sub-processors as necessary to perform the Services. If User subscribes to email notifications at the Stripe Sub-processors List, then Stripe will notify User via email if Stripe intends to add one or more Sub-processors to that list at least 30 days before the changes take effect. User may reasonably object to a change on legitimate grounds within 30 days after User receives notice of the change. User acknowledges that Stripe's Sub-processors are essential to provide the Services and that if User objects to Stripe's use of a Sub-processor, then notwithstanding anything to the contrary in the Agreement (including this DPA), Stripe will not be obliged to provide User the Services for which Stripe uses that Sub-processor.

·(b) Stripe will enter into a written agreement with each Sub-processor that imposes on that Sub-processor obligations comparable to those imposed on Stripe under this DPA, including the obligation to implement appropriate Data Security Measures. If a Sub-processor fails to fulfil its data protection obligations under that agreement, Stripe will remain liable to User for the acts and omissions of its Sub-processor to the same extent Stripe would be liable if performing the relevant Services directly under this DPA.

3.33.3 United States Specific Data Protection Obligations.

·To the extent that US State DP Law applies and Stripe is acting as a Data Processor, Stripe certifies that it understands and will comply with its obligations under US State Privacy Law to:

·(a) not sell or share (as defined under the CCPA) Personal Data;

·(b) only Process Personal Data for the purposes set out in this DPA, the Agreement or otherwise permitted by Law;

·(c) not retain, use or disclose Personal Data outside of its direct business relationship with User other than to provide Stripe's products and services and as required to comply with Law; and

·(d) not combine Personal Data received from or through User with Personal Data received from or on behalf of an individual or collected from Stripe's own interactions with the individual, unless permitted by US State DP Law or at the individual's direction.

·(e) provide no less than the level of protection to Personal Data as required by US State DP Law; and

·(f) inform User if it determines that it can no longer meet its obligations under the US State DP Law and will grant User the right to take reasonable and appropriate steps to remediate any unauthorised Processing of Personal Data.

3.43.4 Disclaimer of Liability.

·Notwithstanding anything to the contrary in the Agreement, including this DPA, Stripe and its Affiliates will not be liable for any claim made by a Data Subject arising from or related to Stripe's or any of its Affiliates' acts or omissions, to the extent that Stripe was acting in accordance with User's Instructions.

44. User's obligations when acting as a Data Controller.

4.14.1 Instructions.

·User must only provide Instructions to Stripe that are lawful;

4.24.2 Compliance with DP Law.

·User must comply with and perform User's obligations under DP Law, including with regard to Data Subject rights, data security and confidentiality and ensure User has an appropriate legal basis for the Processing of Personal Data as described in the Agreement, including this DPA; and

4.34.3 Disclosures.

·User must provide all necessary notices (including by making available a Privacy Policy) to, and obtain all necessary rights, permissions and consents from, Data Subjects (including Customers), to enable Stripe to lawfully Process any Personal Data provided by User as described in the Agreement, including this DPA. User is solely responsible for the content of notices it provides to its Customers.

55. Stripe's obligations when acting as a Data Controller.

·Stripe must comply with and perform its obligations under DP Law when Processing Personal Data, including making available a Privacy Policy that explains how and for what purposes Stripe collects, uses, retains, discloses and safeguards Personal Data.

66. Data transfers.

6.16.1 Cross-border Data Transfers by User.

·User acknowledges that in order for Stripe to provide the Services, User transfers Personal Data to Stripe, LLC in the United States. If the transfer comprises Personal Data that requires a Data Transfer Mechanism, the Data Transfers Addendum, which is incorporated into this DPA, will apply.

6.26.2 Cross-border Data Transfers by Stripe.

·Stripe and its Affiliates may transfer Personal Data on a global basis as necessary to provide the Services. In particular, Personal Data may be transferred to Stripe, LLC in the United States and to Stripe's Affiliates and Sub-processors in other jurisdictions.

77. Conflict.

·To the extent of any conflict between the provisions of this DPA and any provision of the:

·(a) Agreement regarding Personal Data Processing, the provisions of this DPA will prevail; and

·(b) Data Transfers Addendum, the provisions of the Data Transfers Addendum will prevail.

88. Definitions.

·Capitalised terms not defined in this DPA have the meanings given to them in the Agreement.

·"Agreement" has the meaning given in the Stripe services agreement between User and Stripe located at www.stripe.com/legal/ssa, or as otherwise agreed by the parties.

·"Authorised Services" means Services that a Governmental Authority licenses, authorises or regulates.

·"CCPA" means California Consumer Privacy Act of 2018, Cal. Civ. Code Sections 1798.100-1798.199, and its implementing regulations.

·"Data Controller" means the entity which, alone or jointly with others, determines the purposes and means of Processing Personal Data, which may include, as applicable, a "Business" as defined under the CCPA.

·"Data Incident" means an unauthorised or unlawful Processing, use, access, loss, disclosure, destruction or alteration of Personal Data in a party's or its Affiliate's, or a party's or its Affiliate's subcontractor's, agent's or representative's, possession or control.

·"Data Privacy Framework" means, as applicable, the EU-US, Swiss-US or UK-US Data Privacy Framework self-certification programme operated by the US Department of Commerce.

·"Data Processor" means the entity that Processes Personal Data on behalf of the Data Controller, which may include, as applicable, a "Service Provider" as defined under the CCPA.

·"Data Security Measures" means technical and organisational measures that are intended to secure Personal Data to a level of security appropriate for the risk of the Processing.

·"data subject" means an identified or identifiable natural person to which Personal Data relates.

·"Data transfer Mechanism" means a transfer mechanism that enables the lawful cross-border transfer of Personal Data under DP Law, which includes transfer mechanisms that are required under DP Law in the EEA, Switzerland and the UK, such as the Data Privacy Framework, the EEA SCCs, the UK International Data Transfer Addendum and any data transfer mechanism available under DP Law that is incorporated into this DPA.

·"Data Transfers Addendum" means the data transfers addendum located at www.stripe.com/legal/dta, as updated from time to time.

·"DP Law" means Law that applies to Personal Data Processing under the Agreement and this DPA, including international, federal, state, provincial and local Law relating in any way to privacy, Data protection or data security.

·"EEA" means the European Economic Area (EEA).

·"EEA SCCs" means Module 1 (Transfer: Controller to Controller), Module 2 (Transfer: Controller to Processor) and, as applicable, Module 3 (Transfer: Processor to Processor) of the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries according to the GDPR.

·"GDPR" means General Data Protection Regulation (EU) 2016/679.

·"Instructions" means any communication or documentation, including that which may be provided through a Stripe API, or Stripe Dashboard, or written agreements between User and Stripe through which the Data Controller instructs a Data Processor to perform specific Processing of Personal Data for that Data Controller.

·"Joint Controller" means a Data Controller that jointly determines the purposes and means of Processing Personal Data with one or more Data Controllers.

·"Personal Data" means any information relating to an identifiable natural person that is Processed in connection with the Services, and includes "personal data" as defined under the GDPR and "personal information" as defined under the CCPA.

·"Privacy Policy" means any or all of a publicly posted Privacy Policy, privacy notice, data policy, cookies policy, cookies notice or other similar public policy or public notice that addresses a party's Personal Data practices and commitments.

·"Process" means to perform any operation or set of operations on Personal Data or sets of Personal Data, such as collecting, recording, organising, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying, as described under DP Law. "Processed" and "Processing" have corresponding meanings.

·"Sensitive Data" means, to the extent this data is treated distinctly as a special category of Personal Data under DP Law: (a) Personal Data that is genetic data, biometric data, data concerning health, a natural person's sex life or sexual orientation; (b) data about racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; (c) geolocation data; or (d) sensitive personal information as defined under the CCPA.

·"sub-processor" means an entity a Data Processor engages to Process Personal Data on that Data Processor's behalf in connection with the Services.

·"Stripe Sub-processors List" means the list of Stripe's Sub-processors and Affiliates located at www. stripe.com/legal/service-providers, as updated from time to time.

·"Supervisory Authority" means an independent public authority which is (i) established by a European Union member state pursuant to Article 51 of the GDPR; or (ii) the public authority governing data protection that has supervisory authority and jurisdiction over User.

·"UK GDPR" means the GDPR, as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

·"UK International Data Transfer Addendum" means the international data transfer addendum to the EEA SCCs issued by the United Kingdom's Information Commissioner's Office.

·"US State DP Law" means DP Law applicable in the United States, which may include, among others, the CCPA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act and the Utah Consumer Privacy Act.

ExhibitEXHIBIT: STRIPE DATA SECURITY

·Download the DPA

·Click here to download the Stripe DPA