United States
A. California
Supplemental Privacy Notice for California Residents
Effective: May 27, 2025
1. Introduction
This supplemental notice is intended for residents of California that qualify as a “consumer” as required by the California Consumer Privacy Act of 2018 (including as amended)(“CCPA”). This Notice describes how we collect, process and manage personal information (as defined by the CCPA) within the scope of the CCPA. Defined terms shall refer to terms defined under the CCPA or as defined in the generally applicable section of the Notice found above.
2. CCPA Personal Information Summary
The information table below summarizes (a) the categories of personal information collected by Marqeta in the past 12 months, (b) the sources of that information, (c) how we use that information and (d) disclosures made for business purposes (including to third parties) in the past 12 months.
Category of personal data | Collected? | Examples of personal data collected* | Categories of sources | Commercial or business purpose | How we disclose your personal data |
Identifiers | Yes | Name, email, IP address | Provided directly to Marqeta Collected automatically Provided by our service providers and partners | To provide, maintain and improve our Services For internal operational purposes To personalize your experience To advertise and market to you To communicate with you For legal, compliance and security purposes | With our service providers With our partners With legal or other regulatory authorities |
California Customer Records (Cal. Civ. Code § 1798.80(e)) | Yes | Name, email, country of location (US, UK) | Provided directly to Marqeta Collected automatically Provided by our service providers and partners | To provide, maintain and improve our Services For internal operational purposes To advertise and market to you To communicate with you For legal, compliance and security purposes | With our service providers With our partners With legal or other regulatory authorities |
Protected Classification Characteristics | No | n/a | n/a | n/a | n/a |
Commercial Information | Yes | Business or company name and records of purchased services | Provided directly to Marqeta Provided by our service providers and partners | To provide, maintain and improve our Services For internal operational purposes To advertise and market to you | With our service providers With legal or other regulatory authorities |
Biometric Information | No | n/a | n/a | n/a | n/a |
Internet/Network Information | Yes | Website browsing activity and interactions | Provided directly to Marqeta Collected automatically Provided by our service providers and partners | Website visibility | With our service providers |
Geolocation Data | Yes | IP Address, country of location (US, UK) | Provided directly to Marqeta Collected automatically | To provide, maintain and improve our Services To personalize your experience To advertise and market to you For legal, compliance and security purposes | With our service providers |
Sensory Information | No | n/a | n/a | n/a | n/a |
Profession/Employment Information | No | n/a | n/a | n/a | n/a |
Non-Public Education Information (20 U.S.C. § 1232g, 34 C.F.R. Part 99) | No | n/a | n/a | n/a | n/a |
Inferences | Yes | Preferences and behaviors as part of the website services | Provided directly to Marqeta Collected automatically | To provide, maintain and improve our Services For internal operational purposes To personalize your experience To advertise and market to you | With our service providers |
Note that additional detail on our personal information practices can also be found in the generally applicable sections of the Notice above.
3. Categories of Personal Information Sold or Shared
Marqeta may disclose personal information obtained from an individual's interactions with our websites to our social media, advertising and analytics providers for the purposes of displaying advertisements and delivering targeted advertising on our websites and potentially across other businesses or third party websites, for data, analytics and for content personalization features. These disclosures may qualify as “sales” or “sharing” of personal information for valuable consideration or cross-context behavioral advertising.
The categories of personal information we may disclose for these purposes include:
Marqeta does not disclose personal information of individuals we know to be under the age of 16 to businesses or third parties for monetary or other valuable consideration as a “sale” of personal information or for cross-context behavioral advertising.
For information on how to exercise your right to opt out of the “sale” or “sharing” of personal information, please see Section 4 of this California Notice below.
4. Rights available to consumers and how to invoke those rights
Available rights
Residents of California have the right to exercise the rights described below.
The right to know what personal information we have collected about you as well as how it is used and shared
The right to delete personal information we have collected from you
The right to opt out of the sale or sharing of personal information
The right to correct inaccurate personal information held by us
The right to non-discrimination for the exercise of any of the rights above
All rights above are subject to any conditions, exceptions or limitations provided under and available to us under the CCPA. Accordingly, we may refuse to act or impose limitations on your invocation of any of the available rights. The exercise of the rights above may also limit our ability to provide you with the Services under this Notice.
How to invoke your rights
You can invoke your rights by contacting us through any of the channels below.
Post:
Marqeta, Inc.
Attention: Assistant General Counsel, Privacy
Grand Ave., 6th Floor, Oakland, CA 94612, USA
Phone: (877) 323-4376
Once a request has been submitted, we may ask for additional information, including your email or phone number, to verify your identity as well as information needed to process or understand your request. This information will only be used to fulfill your request and for compliance-related tracking purposes. These requests can also be submitted to us via an authorized agent in accordance with the requirements under the CCPA. In these cases, we will take steps to verify that the agent is authorized to act on your behalf. Typically, we require a valid power of attorney or a signed letter with your information that includes a statement of authorization for the request. We may still reach out to you in order to verify the agent’s authority to act as well as for identification purposes.
Opting out of the Sale or Sharing of Personal Information
Marqeta provides individuals with the ability to opt out of the sale or sharing of their personal information in a frictionless manner in accordance with the CCPA. If we receive and are able to process a signal from your device indicating your preference to opt out from sales or sharing of personal information, as defined by law, then we will apply that preference to personal information we collect from that device, provided that we may not be able to associate the signal to the same device if:
you use a different web browser or other tool to interact with us,
you make changes to your browser (e.g., uninstall and reinstall or certain types of upgrades) that impact our ability to associate the device with the signal your device originally sent, or
you clear cookies or browsing data from your browser or device in a way that impacts our ability to associate the device with the signal your device originally sent.
Our websites currently recognize opt out preference signals that comply with the Global Privacy Control specification. For more information about the Global Privacy Control, you can visit
https://globalprivacycontrol.org.
5. Sensitive Personal Information
In limited cases, we may also process “sensitive personal information” as defined under the CCPA as part of the Services. A summary of this collection and whether the sensitive personal information is sold or shared (both as interpreted under the CCPA) has been provided below.
Category of sensitive personal information | How the sensitive personal information is used | Is the sensitive personal information sold? | Is the sensitive personal information shared? |
Account login details + password/credentials | Developer (and related) accounts that individuals elect to create to access services on the websites. | No | No |
We do not presently use or disclose the above categories of sensitive personal information to infer characteristics about consumers.
6. Accessibility
If you are a user with a disability or are having difficulty with accessing or navigating aspects of this Notice, please contact us at
privacy@marqeta.com for support.
7. Retention
We retain each category of personal information as described in the “Information Retention” section above.
8. De-identified Information
As part of our processing, we may use personal information to create de-identified information that can no longer reasonably be used to infer information about, or otherwise be linked to an individual or household. Any applicable de-identified information will remain in a de-identified form and we will not attempt to re-identify the individual or household unless required or permitted by applicable law.
9. Updates
We will update this Notice from time to time to reflect changes to our information handling practices or as required by the CCPA by posting an updated version on our website. If the changes we make are material, we will provide you with prior notice and/or obtain consent (where required by applicable law) regarding such changes.
California “Shine the Light” disclosure
If you are a California resident that has an established relationship with us, you have a right to know how your information is disclosed to third parties for their direct marketing practices under California’s “Shine the Light” law (Civ. Code § 1798.83). You can contact us via the “Contact Us” section in the main body of the Notice to invoke these rights.
B. Other US States
Supplemental Privacy Notice for Residents of Other U.S. States
Effective Date: May 27, 2025
1. Introduction
This supplemental notice is intended for applicable U.S. residents that reside in states where a state-specific privacy law has been enacted (i.e., CO, CT, DE, IN, IA, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA) outside of California.
2. Individual Rights
Depending on your state of residence and the nature of your relationship with us, you may have a number of individual rights. These include a:
Right of access and the ability to request copies of the personal data that we hold about you and details on how your information is used
Right of deletion and the ability to direct that we (or any parties with whom we have shared your information) delete the personal data that we hold about you
Right to opt-out of processing, including in cases where (i) targeted advertising is occurring, (ii) where there is a sale of personal data and (iii) where certain instances of profiling (e.g., profiling in furtherance of decisions that produce legal or similarly significant effects) are occurring
Right of portability and the right to obtain and reuse your personal data for your own purposes or across different services, including so that you can provide or “port” that information to another provider
Right of correction and the ability to require us to correct any inaccurate or incomplete personal data
Right to request a list of third parties to which we have disclosed your personal data
How to invoke your rights
You can invoke your rights by contacting us through any of the channels below.
Post:
Marqeta, Inc.
Attention: Assistant General Counsel, Privacy
180 Grand Ave., 6th Floor, Oakland, CA 94612, USA
Phone: (877) 323-4376
Once a request has been submitted, we may ask for additional information, including your email and phone number, to verify your identity as well as information needed to process or understand your request. This information will only be used to fulfill your request and for compliance-related tracking purposes. These requests can also be submitted to us via an authorized agent as applicable under the various US state legislation. In these cases, we will take steps to verify that the agent is authorized to act on your behalf. Typically, we require a valid power of attorney or a signed letter with your information that includes a statement of authorization for the request. We may still reach out to you in order to verify the agent’s authority to act as well as for identification purposes.
In certain states, you may have a right to appeal a decision where we refuse to act or impose limitations on your rights. In such cases, we will notify you within 45 days of receipt of the original request with an explanation and an overview of how you may appeal that decision. All appeal requests should be submitted to privacy@marqeta.com with the subject line, “Privacy Request Appeal”.
3. Opting out of sales of personal data and targeted advertising
Where we carry out practices that qualify as a “sale” of personal data or "targeted advertising” under applicable state laws, individuals can opt out of these practices by visiting
the Digital Advertising Alliance website or
the Network Advertising Initiative website or by selecting the Cookie Settings link and disabling cookies. We will also process opt-out requests submitted by an individual’s opt-out preference signal as required by applicable law. Our websites currently recognize opt out preference signals that comply with the Global Privacy Control specification. Please note that a Global Privacy Control-compliant signal will be specific to the device and browser you use when you opt out. For more information about Global Privacy Control signals, please visit
https://globalprivacycontrol.org.
European Economic Area (“EEA”) and the United Kingdom (“UK”)
Supplemental Privacy Notice for the EEA and UK
Effective: May 27, 2025
1. Introduction
The provisions below supplement the generally applicable sections of the Notice above and apply where the General Data Protection Regulation (the “GDPR”), the UK’s GDPR and UK Data Protection Act 2018 (referred to generally as the “UK Data Protection Law”) and other local implementing legislation apply to the processing of personal data within the EEA and UK.
2. Basis for Processing Personal Data
When we process your personal data as a data controller part of the Services, we do so in line with the purposes and legal bases below.
Purposes of processing | Legal basis |
Providing the Services, including account creation and management and customer support services | If you are a customer, this is necessary for the performance of the agreement If you do not have a contract with us, we have a legitimate interest to manage our business |
Improving our websites and related technologies to better understand our visitors | If consent is required (e.g., as a result of cookies and tracking technologies), with your consent Otherwise, we have a legitimate interest to manage our business and pursue commercial interests |
Communicating with you, including responding to inquiries, obtaining feedback or otherwise. | If you are a customer, this is necessary for the performance of the agreement If you do not have a contract with us, we have a legitimate interest to manage our business |
For contests, sweepstakes and other promotional activities | Where required, with your consent and, alternatively, pursuant to our legitimate interests (commercial interests) |
Marketing and advertising our Payments Services, including sending you marketing and promotions | Where required, with your consent and alternatively, pursuant to our legitimate interests (commercial interests) |
Enhancing our system and providing updates in relation to our Payments Services, new products, upgrades and services. | Pursuant to our legitimate interests (commercial interests) where we have an interest in enhancing our business and Services |
For compliance, legal and security-related purposes, including verifying your identity, securing our websites and Services as well as managing our compliance and legal obligations associated with our policies, the applicable law and contractual terms (including protecting our legal interests as deemed appropriate). | Processing is necessary in order for us to manage compliance with applicable laws, regulations and other obligations. Where processing is not pursuant to a legal or compliance requirement, such processing is a result of a legitimate interest to protect and manage our business operations and interests. |
Note that where we rely on a legitimate interest basis, we undertake a balancing test to ensure that our legitimate interests are not outweighed by your interests and fundamental rights. When we rely on consent as the basis for our processing, you can request to withdraw or partially revoke your consent any time by contacting us at
privacy@marqeta.com or by following the instructions for revoking your consent contained within communications we send you. We honor such requests as required by applicable laws.
Note that when we collect and process personal data on behalf of our customers or other parties to provide Payments Services, we are typically acting as a data processor and rely on our customer’s legal basis for processing.
If you have questions about or need further information concerning the legal basis we rely on to process your personal information, please contact us via email at
privacy@marqeta.com.
3. International Transfers
See the “International Transfer” section in the generally applicable portion of this Notice.
4. Individual Rights
As a resident of the EEA or the UK, you have additional rights in relation to how your personal data is processed. These include:
A right of erasure to remove your data
A right of access and the ability to obtain a copy of your personal data
A right of correction/rectification where your personal data is inaccurate or outdated
A right of portability and the ability to request a transfer of your personal data to another entity in a structured, commonly used and machine-readable format
Rights of restriction and objection around how your personal data is processed, including the right to object to direct marketing.
Where the legal basis for the processing is based on your consent, you also have a right of withdrawal and can revoke your consent at any time. Note that this will not impact any processing that has already occurred.
All rights above are subject to the limitations under the applicable law. You may exercise these rights by submitting your request to
privacy@marqeta.com or by contacting us through the channels in the “Contact us” section in the main body of the Notice. Note that in certain cases, we may refuse to act or limit the processing as permitted by the applicable law. Although such requests are free of charge, to the extent requests are found to be excessive or repetitive, we may impose a reasonable fee or refuse to act on the request.
5. Data Controllers
For the purposes of the Services and this supplemental notice, joint data controllers include:
Marqeta UK Ltd (Marqeta UK)
Marqeta, Inc. (Marqeta US)
Marqeta sp. z.o.o.(Marqeta Poland)
In most instances, for the Services within the Notice, Marqeta US will be the primary controller although your personal data may also be processed by Marqeta UK and Marqeta Poland for the purposes of the Services (e.g., for lead generation purposes in the UK and the EEA respectively). Marqeta Poland and Marqeta UK each act as a controller under the respective EEA and UK laws.
Marqeta US is primarily responsible for ensuring that Marqeta is compliant with applicable legislation and our internal policies in the EEA and UK. Marqeta US is also entrusted with managing individual rights requests.
Marqeta may use various processors in order to provide the Services (as detailed in the “Information Sharing and Disclosure” section above).
6. Contact Information
If you have a question or concerns around the processing of your personal data, we can be reached via the “Contact Us” section in the main body of the Notice.
7. Retention
See the “Information Retention” section in the generally applicable portion of this Notice.
8. Cookies and related tracking technologies
Please see the “Cookies and related Technologies” section in the generally applicable section of this Notice.
9. Children
See the “Children” section in the generally applicable portion of this Notice.
10. Complaints
You have the right to raise a complaint with the relevant data protection authority. Please see additional details below: