1. Introduction 

Stripe takes data privacy seriously. We ensure the highest level of protection and diligence around collecting, using and retaining the Personal Data of all applicants applying for a position at Stripe. Bottom line: we care about your Personal Data and want you to be informed about how it’s collected, used and retained. 

This EU Applicant Personal Information Notice (“Notice”) applies to the Personal Data (as defined below) collected about prospective applicants and applicants who apply to work for a Stripe company in the European Economic Area (EEA), the United Kingdom and Switzerland, which includes Stripe Payments Europe Limited. and any affiliates (collectively, “Stripe”). Stripe Payments Europe, Limited (“SPEL”) is the data controller for any Personal Data processed in connection with this Notice along with the local Stripe employing entity.

This Notice describes the Personal Data we collect, what we do with it, with whom we share it, how we secure it, how long we store it for and what rights and obligations you as an applicant or prospective applicants (“you” or “applicant”) have. 

2. What Personal Data is collected?

Personal Data is any information that relates to an identified or identifiable individual. Subject to applicable law, the Personal Data we collect from you or from a variety of third-party sources may include:

• Contact information (such as name, address, email address, and phone number);
• Government-issued identifiers (such as passport information, driver’s licence information, social security information;
• Demographic information (such as age, date of birth, gender);
• Online activity information such as devices and browsers across our websites and other online services and usage data associated with those devices and browsers; including IP address, browser types, language used and pages visited. Please see our Cookie Policy for more information;
• Professional or employment-related information including:
• Professional and background information (such as education, skills, work experience and/or CVs, photograph, references, employee records and appraisals);
• Work permit status (such as immigration, residency, and related information);
• Education information such as education background and qualifications, trainings, or certifications
• Background screening information and results;
• Social media public profiles or other publicly available data; 
• Travel itinerary and booking information if applicable as part of the recruitment process;
• Content and communications such as interview records, assessment responses, recordings (if applicable) and results including for psychometric and ability tests (if applicable); communications or documents in relation to recruitment activities; and
• Other information necessary for making a recruitment decision or otherwise voluntarily provided by you.

To the extent permitted by applicable law, we also may collect the following sensitive and special categories of Personal Data:

• Physical or mental health data: such as information you disclose regarding an accommodation request or in countries where pre- employment medical checks are required by law;
• Other special categories of Personal Data: such as racial or ethnic origin; religious or similar beliefs; membership of a trade union where we have a legal obligation (e.g. equal opportunities monitoring), or where we have your consent to do so (e.g. surveys); 
• Criminal data: such as the commission or alleged commission by you of any offence; and any proceedings for any offence committed or alleged to have been committed by you, the disposal of those proceedings or the sentence of any court in those proceedings (e.g., background screening and results). 

Special categories of Personal Data will only be collected and used in so far as such is necessary for the purposes of carrying out an obligation under applicable law, establishing exercising or defending legal rights, obtaining legal advice or when the use is permitted by European Union or Member State law. 

Stripe may occasionally process Personal Data relating to criminal convictions where required or permitted by applicable laws. This data will only be collected and used as necessary to comply with legal or regulatory requirements, prevent and detect unlawful acts (including fraud), obtain legal advice or establish, exercise or defend legal claims.

3. How and why is my Personal Data used?

Stripe collects and uses Personal Data for reasons related to your application, and in accordance with applicable data protection laws. Specifically, we collect and use Personal Data:

1. to take steps to assess your suitability for the vacancy prior to entering into an employment contract ;
2. to comply with a legal obligation;
3. to serve Stripe’s legitimate interests (or the interests of a third party) if your interests and fundamental rights don’t override those interests, i.e., Stripe's interests include hiring qualified and appropriate people, finding the right candidate for future vacancies and securing, defending and developing its business.

In certain narrow circumstances, Stripe processes Personal Data with your freely given and explicit consent (e.g. surveys).

This chart gives some more detail:

The Personal Data requested in the application process is required by Stripe to assess your application for employment. If you do not provide some or all of this Personal Data, it may affect our ability to process your application and therefore to enter into an employment agreement with you.

4. Does Stripe retain my Personal Data?

Yes, but only as long as permitted or required by applicable law to satisfy the purpose for which it was collected and used, unless a longer period is needed because of legal or regulatory obligations or for the establishment, exercise or defence of a legal claim. 

If you accept employment with Stripe, your Personal Data will be held on the basis set out in our European Employee Personal Information Notice. 

5. What security is in place to protect my Personal Data? 

Stripe takes technical, physical, and organisational measures to ensure that your Personal Data is properly secured against unauthorised or unlawful use, alteration, unauthorised access or disclosure, accidental or wrongful destruction, and loss.

Stripe also takes steps to limit access to your Personal Data to those persons who need to fulfil the purposes listed in the chart above. And, we require service providers to contractually commit to protect the security and confidentiality of Personal Data they process on our behalf.

6. How is my Personal Data disclosed and transferred? 

Stripe shares Personal Data for the purposes described in this Notice, and with individuals in roles requiring access to this information. Stripe may also disclose Personal Data with the following categories of recipients, for the purposes described in this Notice:

• Our affiliates for purposes identified in this Notice; 
• Service providers that process personal information on Stripe’s behalf, including recruiting, HR tools, screening or background checks, and hosting.
• Parties to a corporate transaction, as part of a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets;
• Government regulators, law enforcement, court officials and others, in connection with audits, investigations, or other legal or regulatory purposes; and
• Professional advisors, including lawyers, immigration advisors, and other professional advisors.

We may also access, transfer, disclose, and retain Personal Data when we believe that doing so is necessary to:

• Administer your recruitment process
• comply with legal and regulatory obligations;
• comply with applicable law or respond to valid legal process, including from law enforcement, courts or other public authorities;
• operate and maintain the security of Stripe’s systems, including to prevent or stop an attack on our computer systems or networks; 
• protect Stripe and the rights or property of ourselves or others, including enforcing our agreements, terms, and policies; or
• act in urgent circumstances such as protecting the health or personal safety of persons.

Some of the Stripe Affiliates and third parties we may share your Personal Data with may be located outside of Europe. Stripe takes measures to ensure that your Personal Data is shared and treated securely, in accordance with this Notice and applicable laws. Where we transfer data outside of the European Economic Area, the United Kingdom or Switzerland, we will use one or more of the following:

• Transfers to certain countries or recipients that are recognised as having an adequate level of protection for Personal Data under applicable law. 
• EU Standard Contractual Clauses approved by the European Commission and/or the UK International Data Transfer Addendum issued by the Information Commissioner’s Office.
• or other legal methods available to us under applicable law. 

Stripe, Inc. complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce (as applicable). You can learn more here. 

You can request a copy of the relevant data transfer mechanism at applicant-privacy@stripe.com.

7. What are my rights? 

As a data subject, you have a number of rights in relation to your Personal Data. These rights are not absolute and are subject to various legal conditions under applicable data protection laws: 

• Right to access, correct and delete your Personal Data. Stripe will ensure that all Personal Data is correct, but we can only do so if you give us correct information. So, it’s your responsibility to notify Stripe of any changes in personal circumstances (for example, change of contact details) as soon as possible. You may request access to your Personal Data and request correction of any inaccurate or incomplete Personal Data. You may also request deletion of your Personal Data.
• Right to withdraw consent. If your Personal Data is processed on the basis of your consent, you may withdraw consent at any time. This will not affect the lawfulness of processing that was based on consent before its withdrawal.
• Data portability. To the extent Stripe uses your Personal Data for the preparation of or performance of the employment/engagement contract or on the basis of your consent, and that Personal Data is processed by automatic means, you have the right to receive it in a structured, commonly used and machine-readable format. You can also request for it to be transmitted to another data controller.
• Right to restrict Personal Data use. You may have the right to restrict Stripe’s use of your Personal Data. 
• Right to object. To the extent that Stripe is relying on its legitimate interests to use your Personal Data, you may object to the use, and Stripe will stop processing unless Stripe demonstrates either compelling legitimate grounds for the use that override your interests, rights and freedoms or where Stripe needs to process the Personal Data for the establishment, exercise or defence of legal claims.
• Digital Legacy. If you are an applicant in France, you also may have the right to give instructions relating to the disposition of your Personal Data after your death. 
• Lodge a complaint. You have the right to lodge a complaint with the Irish Data Protection Commission (SPEL’s lead supervisory authority) or with the supervisory authority in your country of residence.

8. Who should I contact with questions?

For further information regarding your rights or have questions about this Notice, please contact applicant-privacy@stripe.com. 

If you wish to reach Stripe’s Data Protection Officer, you can contact us at dpo@stripe.com.

9. Updates to this Notice

We may occasionally update this Notice from time to time to reflect changes required by law or our practices or procedures. The “effective date” at the top of this Notice indicates when this Notice was last revised. Any changes are effective when we post the revised policy on the website or otherwise provide notice of the update as required by law.