Data Processing Agreement

Добавлено

• Добавлено: This Data Processing Agreement (“DPA”) is between the Stripe entity specified in the Agreement (and its Affiliate(s), collectively “Stripe”) and the User specified in the Agreement, and is subject to and incorporated by reference into the Agreement. This DPA governs Stripe’s and its Affiliates’ Processing of Personal Data.
• Добавлено: 3.3 United States Specific Data Protection Obligations.
• Добавлено: To the extent that US State DP Law applies and Stripe is acting as a Data Processor, Stripe certifies that it understands and will comply with its obligations under US State Privacy Law to:
• Добавлено: (a) not sell or share (as defined under the CCPA) Personal Data;

• Добавлено: (b) only Process Personal Data for the purposes set out in this DPA, the Agreement or otherwise permitted by Law;
• Добавлено: (c) not retain, use or disclose Personal Data outside of its direct business relationship with User other than to provide Stripe’s products and services and as required to comply with Law; and
• Добавлено: (d) not combine Personal Data received from or through User with Personal Data received from or on behalf of an individual or collected from Stripe's own interactions with the individual, unless permitted by US State DP Law or at the individual's direction.
• Добавлено: (e) provide no less than the level of protection to Personal Data as required by US State DP Law; and
• Добавлено: (f) inform User if it determines that it can no longer meet its obligations under the US State DP Law and will grant User the right to take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.
• Добавлено: “US State DP Law” means DP Law applicable in the United States, which may include, among others, the CCPA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act.
• Добавлено: **Encryption at rest. **To protect data at rest, Stripe encrypts all production data stored in server infrastructure using encryption algorithms and key lengths that meet or exceed NIST recommendations for symmetric encryption.

Изменено

• Изменено: Было Last updated: November 18 , 2025 Стало Last updated: September 28 , 2026
• Изменено: Было **1. Structure .** Стало **1. Scope .**
• Изменено: Было may engage a Stripe Affiliate to act as (a) a Joint Controller to provide Authorized Services; and ( b ) a Data Processor to provide services other than Authorized Services. Стало may engage a Stripe Affiliate to act as (a) a Joint Controller to provide products and services, including Authorized Services; (b) an independent Data Controller to provide Authorized Services; and ( c ) a Data Processor to provide services other than Authorized Services.
• Изменено: Было If applicable, Stripe may Process Payment Method Account Details, bank account details, billing/shipping address, name, order description (including date, time, amount, product or service description), device ID, email address, IP address/location, order ID, payment card details, tax ID/status, unique customer identifier , identity information including government issued documents (e.g., national IDs, driver’s licenses and passports ). Стало If applicable, Stripe may Process Payment Method Account Details, bank account details, billing/shipping address, name, order description (including date, time, amount, product or service description), device ID, email address, IP address/location, order ID, payment card details, tax ID/status, unique customer identifier , identity information including government issued documents (e.g., national IDs, driver’s licenses and passports ), cryptocurrency wallet address.

• Изменено: Было (c) inform User of each request Stripe receives from Data Subjects (including "verifiable consumer requests" as defined under the CCPA) exercising their rights under DP Law to (i) access (e.g., right to know under the CCPA) their Personal Data; (ii) have their Personal Data corrected or erased; (iii) restrict or object to Stripe’s Processing; or (iv) data portability (collectively “**Data Subject Request**”). Other than to request further information, identify the Data Subject, and, if applicable, direct the Data Subject to User as Data Controller, Stripe will not respond to these requests unless User instruct Stripe in writing to do so. Taking into account the nature of the Processing, Stripe will assist User by appropriate technical and organizational measures, insofar as this is possible, to enable User to meet its obligation to respond to a Data Subject Request; Стало (c) inform User of each request Stripe receives from Data Subjects (including "verifiable consumer requests" as defined under the CCPA) exercising their rights under DP Law to (i) access (e.g., right to know under the CCPA) their Personal Data; (ii) have their Personal Data corrected or erased; (iii) restrict or object to Stripe’s Processing; or (iv) data portability (collectively “**Data Subject Request**”). Other than to request further information, identify the Data Subject, and, if applicable, direct the Data Subject to User as Data Controller, Stripe will not respond to these requests unless User instructs Stripe in writing to do so. Taking into account the nature of the Processing, Stripe will assist User by appropriate technical and organizational measures, insofar as this is possible, to enable User to meet its obligation to respond to a Data Subject Request;
• Изменено: Было “** EEA SCCs **” means Module 1 (Transfer: Controller to Controller) and Module 2 (Transfer: Controller to Processor) of the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries according to the GDPR. Стало **“ EEA SCCs ” ** means Module 1 (Transfer: Controller to Controller ), Module 2 (Transfer: Controller to Processor ) and , as applicable, Module 3 (Transfer: Processor to Processor) of the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries according to the GDPR.
• Изменено: Было **Encryption in transit .** To protect data in transit, Stripe requires all inbound and outbound data connections to be encrypted using the TLS 1.2 protocol . For data traversing Stripe’s internal production networks, Stripe uses mTLS to encrypt connections between production systems. Стало **Encryption in transit . ** To protect data in transit, Stripe requires all inbound and outbound data connections to be encrypted using cryptographic protocols, cipher suites, and key exchange mechanisms approved under current NIST guidelines . For data traversing Stripe’s internal production networks, Stripe uses mutual authentication and encryption ( mTLS ) to secure connections between production systems.
• Изменено: Было **Payment Card and Banking Account Data Tokenization .** Payment card and bank numbers are separately encrypted using industry standard encryption (AES-256) at the data level and stored in a separate data vault that is highly restricted . Decryption keys are stored on separate machines. Tokens are generated to support Stripe data processing. Стало **Payment Card and Banking Account Data Tokenization . ** Payment card and bank numbers are stored in a separate, highly restricted data vault and are separately encrypted at the data level using NIST-approved symmetric encryption algorithms and key lengths . Decryption keys are stored on separate machines. Tokens are generated to support Stripe data processing.

Удалено

• Удалено: This Data Processing Agreement (“DPA”) is subject to and forms part of the Agreement and governs Stripe’s and its Affiliates’ Processing of Personal Data.
• Удалено: If User's Stripe Account is located in North America or South America, User enters this DPA with Stripe, LLC. If User's Stripe Account is located elsewhere, User enters this DPA with Stripe Payments Europe, Limited (“SPEL”). Accordingly, references in this DPA to “Stripe” mean Stripe, LLC or SPEL, as applicable.
• Удалено: 3.3 CCPA.
• Удалено: To the extent the CCPA applies and Stripe is acting as a Data Processor, Stripe will not (except to provide Stripe's services as permitted by Law): (a) sell or share (as defined under the CCPA) Personal Data; (b) retain, use or disclose Personal Data outside of its direct business relationship with User other than to provide Stripe’s products and services and as required to comply with Law; and (c) combine Personal Data received from or through User with Personal Data received from or on behalf of an individual or collected from Stripe's own interactions with the individual. Stripe certifies that it understands and will comply with the requirements in this DPA relating to the CCPA and will provide the same level of privacy protection to Personal Data as required by the CCPA. Stripe will inform User if it determines that it can no longer meet its obligations under the CCPA and will take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.

• Удалено: **Encryption at rest. **To protect data at rest, Stripe uses industry standard encryption (AES-256) to encrypt all production data stored in server infrastructure.