TBD Privacy Notice

Effective Date: May 18, 2022

This Privacy Notice describes how Block, Inc. (formerly known as "Square, Inc.") and our affiliates (collectively, “TBD,” “we,” and “us”) collect, use, disclose, transfer, store, retain or otherwise process your information when you (“you,” “your”) use our services available on our website (“Services”).

This Privacy Notice applies to your use of our Services, and covers only information collected in connection with your access to and use of our Services. Please read this Privacy Notice carefully. By continuing to interact with our Services, you are consenting to the practices described in this Privacy Notice.

Our Privacy Notice explains:

• Information we collect about you

• Sources of Information We Collect About You

• How we use your information

• When and with whom we share your information

• Cookies and Other Similar Automated Technologies

• Third-Party Analytics Services

• How Long We Keep Your information

• Your Choices

• Rights of California Residents

• Security

• Storage and Processing

• Changes to this Privacy Notice

• How to Contact Us

We need to collect information about you to provide you with the Services or the support you request. Specifically, we collect (and/or have collected during at least the 12-month period preceding the effective date of this Privacy Notice) the categories of personal information described below. Additionally, you can choose to voluntarily provide information to us.

Information You Provide to Access our Services

We collect information you provide when you go through any account creation or verification process, communicate with us, answer our surveys, or otherwise use our Services.

Information You Provide to Enhance Your Experience

You can choose to provide us with additional information to improve your user experience when using our Services:

• Other Information You Provide. We collect information that you voluntarily provide to us, including your photograph, if you choose to upload a picture to the Services; survey responses; participation in contests, or other prospective marketing forms or devices; suggestions for improvements; or any other actions you perform on the Services.

Information We Collect From Your Use of our Services

We collect information about you and the devices you use to access the Services, such as your computer, mobile phone, or tablet. The information that we collect includes:

• Geolocation Information. The location of your device, including your IP address, device language, and location of your network provider. For more information and to learn how to disable collection of location information from your mobile device, please see below.

• Device Information. Information about your device, including your hardware model, operating system and version, device name, unique device identifier, mobile network information, and information about the device’s interaction with our Services.

• Internet or other electronic network activity information. Information about how you use and interact with our Services, including your access time, information, browser type and language, country and language setting on your device, IP address, the domain name of your internet service provider, other attributes about your browser, mobile device and operating system, any specific page you visit on our platform, content you view, features you use, the date and time of your use of the Services, your search terms, and the website you visited before you visited or used the Services.

• Inferences drawn from any of the information we collect to create a profile about you that may reflect, for example, your preferences, characteristics, and behavior, including for account security purposes or to enhance our Services to you.

SOURCES OF INFORMATION WE COLLECT ABOUT YOU

We collect (and/or have collected during at least the 12-month period preceding the effective date of this Privacy Notice) information about you from the following categories of sources:

• You directly, when you submit information to us or allow us to access information

• Your devices and how you interact with our Services

• Our group companies or affiliates

• Other sources, including:

  • Identity Verification. Information from third-party verification services (e.g., identity verification agencies and companies which provide third party analytics (see “Third-Party Analytics” below)), and publicly available sources. In some circumstances, where lawful, this information can include your government-issued identification number.

  • Credit, Compliance, and Fraud. Information about you from third parties for any credit investigation, credit eligibility, identity or account verification process, fraud detection process, or collection procedure, or as may otherwise be required by applicable law. This includes, without limitation, the receipt and exchange of account or credit-related information with any credit reporting agency or credit bureau, where lawful, and any person or corporation with whom you have had, currently have, or may have a financial relationship, including without limitation past, present, and future places of employment, financial institutions, and personal reporting agencies.

We may collect, use and share (or have collected, used or shared during at least the 12-month period preceding the effective date of this Privacy Notice), information about you for the following reasons:

Providing, Improving, and Developing our Services

• Determining whether the Services are available in your country;

• Connecting you with people you already know;

• Providing, maintaining and improving our Services;

• Developing new products and services;

• Delivering the information and support you request through the use of our Services;

• Improving, personalizing and facilitating your use of our Services, content and applications;

• Measuring, tracking and analyzing trends and usage in connection with your use or the performance of our Services; and

• Otherwise providing you with the products and features you choose to use.

Communicating with You About our Services

• Sending you surveys and getting your feedback about our Services; and

• Sending you information we think you may find useful or which you have requested from us about our products and services.

Protecting our Services and Maintaining a Trusted Environment

• Conducting investigations, complying with and enforcing any applicable laws, regulations, legal requirements, and industry standards, and responding to lawful requests for information from the government or to valid legal process;

• Contacting you to resolve disputes, collect fees and help you with our Services;

• Debugging to identify and fix errors that impair how our Services function;

• Making sure you follow our TBD’s Terms of Service or other applicable agreements or policies;

• Investigating, detecting, preventing, recovering from, or reporting fraud, misrepresentations, security breaches or incidents, other potentially prohibited, malicious, or illegal activities, or to otherwise help protect your account, including to dispute chargebacks on your behalf;

• Protecting your, our, or our other customers’ rights or property, or the security or integrity of our Services;

• Verifying or maintaining the quality and safety of our Services; and

• Verifying your identity (e.g., through government-issued identification numbers).

Advertising and Marketing

• Marketing our Services to you; and

• Communicating with you about opportunities, products, services, contests, promotions, discounts, incentives, surveys, and rewards offered by us and select partners.

If we send you marketing emails, each email will have instructions on how you can “opt out” of getting future marketing from us.

Other Uses

• For any other reason we may tell you about from time to time.

We may share the information described in the “Information We Collect About You” section with the following categories of service providers and third parties:

With Other Users of our Services

• With other users of our Services. For example, we may share information with the person(s) with whom you interact with while using our Services. If you choose, we may also allow you to share additional information about you and your use of our Services with other TBD customers.

With our Affiliates and Group Companies

• With our group companies and corporate affiliates, for the reasons outlined above. For example, we may share your information internally to provide you with enhanced services from TBD and other Block company products you use, to understand how you engage with Block company products to help make our Services better for you and for everyone, and to help us build Services tailored to your preferences.

With our Service Providers

• With service providers who help us provide, maintain, and improve our Services (e.g., vendors who help us with fraud prevention, identity verification, and fee collection services), as well as financial institutions, payment networks, payment card associations, credit bureaus, carrying brokers, and other entities in connection with your payment, money transfer process, investing activity, or otherwise to help us provide the Services;

• With service providers that help us run our advertising campaigns, contests, special offers, or other events or activities.

Business Transfers and Corporate Changes

• To a subsequent owner, co-owner, or operator of one or more of the Services; or

• If we do or try to do a corporate merger, consolidation, or restructuring (including during due diligence and negotiation of these); the sale of substantially all of our stock and/or assets; the financing, acquisition, divestiture, or dissolution of all or a portion of our business; or other corporate change.

Safety and Compliance with Law

• If we believe that disclosure is reasonably necessary (i) to comply with any applicable law, regulation, legal process or governmental request (e.g., from creditors, tax authorities, law enforcement agencies, in response to a garnishment, levy, or lien notice, etc.); (ii) to establish, exercise or defend our legal rights; (iii) to enforce or comply with our Terms of Service or other applicable agreements or policies; (iv) to protect our or our customers’ rights or property, or the security or integrity of our Services; (v) for an investigation of suspected or actual illegal activity; or (vi) to protect us, users of our Services or the public from harm, fraud, or potentially prohibited or illegal activities.

With Your Consent

• With your consent. For example:

  • At your direction or as described at the time you agree to share;

  • When you authorize a third party application or website to access your information.

With Others

• With other companies who deliver services on our behalf, including via the use of cookies and similar automated technologies, and third party analytics.

Aggregated and Anonymized Information

• We also may share (within our group of companies or affiliates, or with service providers or other third parties) aggregated and/or anonymized information that does not specifically identify you or any individual user of our Services.

When you interact with our online services, or open emails we send you, we obtain certain information using automated technologies, such as cookies, web server logs, web beacons, and other technologies. A “cookie” is a text file that websites send to a visitor’s computer or other internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon,” also known as an internet tag, pixel tag, or clear GIF, is a tiny graphic image that may be used in our websites or emails.

We use these automated technologies to collect your device information, internet activity information, and inferences as described above. These technologies help us to:

• Remember your information so you do not have to re-enter it;

• Track and understand how you use and interact with our online services and emails;

• Tailor our online services to your preferences;

• Measure how useful and effective our services and communications are to you; and

• Otherwise manage and enhance our products and services.

We set some of these automated technologies ourselves, but others are set by third parties who deliver services on our behalf. For example, we may use other companies’ web analytics services (described in the “Third-Party Analytics Services” section), which use automated technologies to help us evaluate how customers use our websites.

Your browser can alert you when cookies are placed on your device, and how you can stop or disable them via your browser settings. Please note, however, that without cookies all of the features of our online services may not work properly. If you use a mobile device, you can manage how your device and browser share certain device data by changing the privacy and security settings on your mobile device. You can learn more about cookies and how to manage your preferences by visiting http://www.allaboutcookies.org.

We generally keep your information as long as reasonably necessary to provide you the Services or to comply with applicable law. However, even after you deactivate your account, we can retain copies of information about you and any transactions or Services in which you may have participated for a period of time that is consistent with applicable law, applicable statute of limitations or as we believe is reasonably necessary to comply with applicable law, regulation, legal process, or governmental request, to detect or prevent fraud, to collect fees owed, to resolve disputes, to address problems with our Services, to assist with investigations, to enforce our Terms of Service or other applicable agreements or policies, or to take any other actions consistent with applicable law.

Personal Information

You can access, change, or correct information that you have provided to TBD by making a request to us using the contact details below. We will need to verify your identity before granting access or otherwise changing or correcting your information.

Location Information

In order to provide certain Services, we may require access to location information, including precise geolocation information collected from your device. If you do not consent to collection of this information, certain Services will not function properly and you will not be able to use those Services. You can stop our collection of location information at any time by changing the preferences on your mobile device.

Do Not Track

Certain web browsers allow you to instruct your browser to respond to Do Not Track (“DNT”) signals to website you visit, informing those sites that you do not want your online activities to be tracked. At this time, our websites are not designed to respond to DNT signals or similar mechanisms from browsers.

Promotional Communications

You can opt out of receiving in-app push notifications containing promotional messages from us by following the instructions on screen or by following the instructions in those messages. If you decide to opt out, we may still send you non-promotional communications in-app, or via email and text, such as transaction receipts and messages about your account, or our processing of your information in accordance with the provision of our Services.

RIGHTS OF CALIFORNIA RESIDENTS

If you live in California, the following additional rights apply to you.

Right to Know

You may have the right to request, up to twice in a 12-month period, to see the following information about the personal information we have collected about you during the past 12 months:

• The categories and specific pieces of personal information we have collected about you;

• The categories of sources from which we collected the personal information;

• The business or commercial purpose for which we collected the personal information;

• The categories of third parties with whom we shared the personal information; and

• The categories of personal information about you that we disclosed for a business purpose, and the categories of third parties to whom we disclosed that information for a business purpose.

To request the specific pieces of personal information we have collected about you, see “How to exercise your rights” below. You may find all of the other information listed above in this Privacy Notice.

California law gives you the right to ask if we disclose your personal information to third parties for their direct marketing purposes (we do not disclose your personal information for others’ direct marketing purposes). It also gives you the right to ask if we sell your personal information to third parties (we do not sell your personal information and have not done so in the past), and if we did (which we don’t), you’d have the right to opt out of such sales.

Right of Deletion

You have the right to ask us to delete the personal information we have collected from you (subject to exceptions the law provides). Please note that you may no longer be able to use our Services if you delete your personal information.

Right of Non-Discrimination

You have the right to not be discriminated against if you exercise these privacy rights. We will not discriminate against you, deny, charge different prices for, or provide a different quality of goods or services if you choose to exercise these rights.

How to Exercise Your Rights

If you live in California and would like to send us a request to exercise one of your above rights, you may do so by contacting us as indicated in the “How to Contact Us” section below.

To help protect your privacy and maintain security, we take steps to verify your identity before granting you access to your personal information or complying with your request.

You may designate an authorized agent to make a request on your behalf as permitted under law, though before we process that request, we will require that you provide the authorized agent written permission to do so and verify your identity directly with us.

To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

Exceptions to These Rights

California law provides for certain exceptions to the rights described above. We reserve the right to avail ourselves of these exceptions where applicable.

Our Services are general audience services not directed at children under the age of 13. If we learn that any information we collect has been provided by a child under the age of 13, we will promptly delete that information.

We take reasonable measures, including administrative, technical, and physical safeguards, to protect your information from loss, theft, and misuse, and unauthorized access, disclosure, alteration, and destruction. Nevertheless, the internet is not a 100% secure environment, and we cannot guarantee absolute security of the transmission or storage of your information. We hold information about you both at our own premises and with the assistance of third-party service providers.

We may, and we may use third-party service providers to process and store your information in the United States, Canada, Japan, the European Union, and other countries.

We may amend this Privacy Notice from time to time by posting a revised version and updating the “Effective Date” above. The revised version will be effective on the “Effective Date” listed. We will provide you with reasonable prior notice of material changes in how we use your information, which may include notification through our website, or by email, if you have provided one. If you disagree with these changes, you may cancel your account at any time. If you keep using our Services, you consent to any amendment of this Privacy Notice.

Please contact our privacy team with any questions or concerns regarding this Privacy Notice: Block, Inc. 1455 Market Street, Suite 600, San Francisco, CA 94103, U.S.A. privacy@squareup.com.

If you have any questions or concerns regarding our privacy notice, or if you believe our privacy notice or applicable laws relating to the protection of your personal information have not been respected, you may file a complaint with our privacy team listed above. We will respond to let you know when you can expect a further response. We may request additional details from you regarding your concerns and may need to engage or consult with other parties in order to investigate and address your issue. We may keep records of your request and any resolution.