Requirements for Your Privacy Policy. If you receive access to any Verification Data as part of the Stripe Identity Services, your Privacy Policy must, at a minimum:
(a) state that you and Stripe are each independent controllers of Verification Data, and that Stripe will process Verification Data in accordance with Stripe’s Privacy Policy and these Stripe Identity Terms, in addition to acting as a service provider to you;
(b) state the process through which Verifiable Individuals can submit data subject requests (including data deletion and data access) to you, and provide your contact information for this purpose;
(c) state the ways in which you will use Verification Data, including, if Law requires, whether you will sell or disclose Verification Data (including as the term “sell” is defined in the CCPA, as applicable);
(d) if Law requires, (i) state the alternative verification methods that you make available to individuals who do not consent to be verified by the Stripe Identity Services; (ii) state that using the Stripe Identity Services may include transmitting Verification Data outside of your jurisdiction, including to the United States; and (iii) state that Verification Data may be submitted to third-party service providers, including Governmental Authorities, for the purpose of verifying the identity of the Verifiable Individual; and
(e) include all other information Law requires you to include.
