Marqeta Data Privacy Framework Policy
Policy Effective Date: April 2024
This Data Privacy Framework Policy (“DPF Policy”) applies to Marqeta, Inc. and its global
affiliates, including Marqeta UK LTD, Marqeta Australia Pty Ltd, and Marqeta Singapore Pte.
Ltd., (collectively, “Marqeta”, “we”, “our”, or “us”), when information related to an identified or
identifiable person (“Personal Data”) is received from or about individuals in the European
Economic Area (EEA), United Kingdom (UK), or Switzerland in any format including
electronic, paper or verbal. Marqeta respects the relationships we have with our customers andrespects the privacy of all individuals whose Personal Data may be processed by Marqeta in theperformance of our services and our business operations.
Marqeta is committed to protecting your Personal Data and privacy rights and that is why wecomply with the EU-U.S. Data Privacy Framework (“EU-US DPF”), the UK Extension to the
EU-U.S. DPF (“UK Extension”), and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S.
DPF”) as set forth by the U.S. Department of Commerce. Marqeta has certified to the U.S.
Department of Commerce that it adheres to the Data Privacy Framework Principles (“DPFPrinciples”) with regard to the processing of Personal Data received pursuant to the EU-US DPF,
UK Extension, and Swiss-U.S. DPF. To learn more about the Data Privacy Framework (“DPF”)
program, and to view our certification, please visit DPF website.
This Policy supplements Marqeta’s General Privacy Notice and Services Privacy Notice(collectively, Marqeta’s “Privacy Policies”).
Processing of Personal Data
Below we describe the categories of Personal Data Marqeta may collect depending on thecontext of our interaction(s) with you. These categories include information you provide directly
to us, information created or collected during your use of the Services, inferences we make about
you when you communicate with us or use the Services, and information we obtain from othersources, such as third-party service providers and public databases.
Categories of Personal Data We Collect● Claim or Dispute Information: Information you provide when you correspond with us
about a claim or dispute, such as your contact information or transactional information.
● Communications Information: Information you provide when you communicate with us,
including by phone, virtual chat, email, “contact us” forms, or social media. This may
include your contact information, feedback, photographs or recordings, and language
preference.
● Contact Information: Personal and business contact information, such as your name,telephone number, job title, email address, and office or home address.
● Credit and Debit Card Information: Information associated with your credit or debit card,such as your primary account number, cardholder name, expiration date and service code,
as well as information pertaining to the transactions you make using the credit or debitcard.

● Device Information: Information collected automatically about your computer or device
through your web browser and other technologies, including cookies, web beacons, orother tracking/recording tools, such as your IP address, device type, unique device
identification numbers, or browser type.
● Identity Verification Information: Information about you and your business, including
Personal Data about your business’ control persons and beneficial owners, such as name,job title, birthdate, gender, nationality, and government identifiers or other information
used to verify such individuals’ identification.
● Inferences: Information about your preferences and interests that we infer from your
Personal Data and use of our Services, such as the topics you would like to learn more
about and card usage habits.
● Location Information: Information about your geographic location (typically country orcity-level), which may be inferred from your Device Information (e.g., from your IP
address).
● Publicly Available Information: Information obtained from public sources and databases,
such as your current place of employment.
● User credentials: Information you provide to us when you create a user log-in or profile
in connection with the use of our Services, such as a user ID, email address, name,password, authentication information, and profile information.
● Employment and HR Information: Information regarding current, former and prospective
partners, principals, employees and contractors of members of the Marqeta network forthe purposes of operating and managing the Marqeta network, performing humanresource administration and maintaining contact with individuals.
In some situations above, we may process Personal Data that is regulated as sensitive data or a
special category of Personal Data under applicable data protection laws.
We may collect some of the Personal Data described above from third parties, including ourcustomers, identity verification providers, social media services, data brokers and aggregators,
and other sources, as permitted by the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF
and the Swiss-U.S. DPF. We may also obtain information from companies with whom we offer
co-branded services or engage in joint marketing activities.
How We Use Personal Data. We use the Personal Data we collect for the purposes described inthis DPF Policy and in our Privacy Policies. In particular, we may use any of the above
categories of information to:● Provide the Services, including to issue credit and debit cards, facilitate payments
transactions, provide risk monitoring services, and manage compliance with card network
rules and applicable regulations● Verify your identity● Identify and protect against fraudulent transactions● Maintain, improve, and enhance our Services● Analyze and better understand the use of our Services, including consumer spending
patterns and trends● Respond to correspondence and inquiries● Provide cardholder support and customer service● Perform human resource administration and other employer functions

● Perform recruitment administration and other hiring functions● Monitor and enforce compliance with our policies, applicable laws and regulations, andcontractual terms.
Please also note that when Marqeta processes your information solely on behalf of and at thedirection of other companies to whom we provide our Services (e.g., when we act as a ‘dataprocessor’), your Personal Data will be handled in accordance with our agreements with suchother companies. In some cases, agreements with our customers may place additional limits onwhat we can or cannot do with the Personal Data we collect or receive when we provide Services
to them, and we may not be permitted to use and share information in all of the ways describedin this Privacy Policy. Marqeta is not responsible for its customers’ data handling practices.
To Whom We Disclose Personal Data. We may disclose your Personal Data to the following
categories of recipients and for the following purposes:● Customers: We may provide your Personal Data to our customers in order to provide our
Services and fulfill transactions or requests you initiate.
● Affiliates: We may provide your Personal Data to our global affiliates. We share
information with our affiliates so they can help us deliver our Services.
● Third-Party Service Providers: We may provide your Personal Data to our third-party
service providers (such as IT service providers, communications providers, customer
support providers, and identity verification providers) who perform certain functions for
us in connection with the Services and process Personal Data on our behalf or inconnection with our role as employer.
● Parties in a Corporate Transaction or Proceeding: We may share Personal Data withactual or prospective parties to an actual or potential corporate transaction or proceeding,including their representatives and other relevant participants in or during negotiations ofany sale, merger, acquisition, restructuring, bankruptcy, dissolution, or a change incontrol, divestiture, or sale involving all or a portion of Marqeta’s business or assets.
Notice and Choice
We collect and process Personal Data from certain individuals and for the purposes described inthis DPF Policy. Personal Data covered by this Policy is collected and processed only as
permitted by the DPF Principles. This includes employee information collected in Marqeta’s role
as a controller of data from individuals in the EEA, UK, or Switzerland and Personal Data
processed in Marqeta’s role as processor to its customers.
Where Marqeta collects Personal Data directly from individuals, we will explain the purposes forwhich it collects and uses Personal Data about the individuals, the types of third parties to which
Marqeta discloses that information, and the choices and means, if any, Marqeta offers individuals
for limiting the use and disclosure of Personal Data about them. Notice will be provided in clear
and conspicuous language. This explanation will be provided as soon as practicable before
Marqeta discloses the Personal Data or uses such information for a purpose materially different
than that for which it was originally collected or processed.

Where Marqeta receives Personal Data from its customers or affiliates when acting as a service
provider processing Personal Data under the direction of a customer, Marqeta’s customers oraffiliates are responsible for providing appropriate notice to the individuals whose Personal Data
are transferred to the United States and obtaining any requisite consent (unless this function has
been delegated to Marqeta pursuant to a data processing agreement). We will use suchinformation in accordance with the notices provided by such entities and the choices made by theindividuals to whom such Personal Data relates.
You have the right to request that Marqeta stop processing your Personal Data or that we restrict
processing of your Personal Data in certain circumstances. Where practical and appropriate, you
may choose whether your Personal Data is (a) to be disclosed to a non‐agent third party, or (b) to
be used for a purpose materially different from the purpose for which it was originally collectedor subsequently authorized by the individual. For example, if you receive marketing emailcommunications from us, you can update your preferences by using the “Unsubscribe” linkfound in those emails.
Accountability for Onward Transfers
Consistent with DPF Principles, transfers to third parties are covered by the provisions in thisPolicy regarding notice and choice. We do not disclose your Personal Data except as described inthis DPF Policy or our Privacy Policies.
Marqeta maintains written contracts with these third parties, including data processing
agreements with vendors and customers. Those contracts include requirements to provide at least
the same level of privacy protection and security as required by the DPF Principles. Where
Marqeta knows that any third party to whom it has provided Personal Data is using or disclosingthat information in a manner inconsistent with this DPF Policy and/or the DPF Principles,
Marqeta will take reasonable steps to prevent or stop the use or disclosure. With respect to suchonward transfers to agents, Marqeta shall remain liable should its agents process Personal Data
in a manner contrary to the DPF Principles and this Policy, unless Marqeta proves that it is not
responsible for the matter giving rise to the damage.
Security
Marqeta will endeavor to take reasonable and appropriate technical, administrative, and physicalprecautions to protect Personal Data in its possession from loss, misuse, and unauthorized access,disclosure, alteration, and destruction. These measures take into account the nature of the
Personal Data and the risks involved in its processing, as well as best practices in the industry forsecurity and data protection.
AccessIn compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S.
DPF, you have certain rights of access for any data Personal Data Marqeta holds and is able tomodify with reasonable effort (except where the burden or expense of providing access would be
disproportionate to the risks to the individual’s privacy, where the rights of persons other than theindividual would be violated, or where doing so is otherwise consistent with DPF Principles).
These rights include:● Right of access: You have the right to request copies of the Personal Data that we holdabout you and to receive additional information from us about how your information isused.
● Right to correction: You have the right to require us to correct any inaccurate or
incomplete Personal Data.
● Right of erasure: You have the right to require us (or any parties with whom we haveshared your information) to delete the Personal Data that we hold about you (forexample, if it is no longer necessary for the purposes for which it was originally collectedor to comply with applicable law).
If you would like to correct, amend or delete the Personal Data if it is inaccurate or has beenprocessed in violation of the DPF Principles, please send us an email at: privacy@marqeta.com.
Unless prohibited by applicable law, Marqeta reserves the right to charge a reasonable fee tocover costs for providing copies of Personal Data requested by individuals.
Data Integrity and Purpose Limitation
Purpose Limitation. Marqeta collects and processes Personal Data only to the extent that it iscompatible with the purposes for which it was collected or subsequently authorized by the data
subject. We do not retain Personal Data after it no longer serves the purposes for which it wascollected or subsequently authorized, and we take reasonable steps to ensure that Personal Datais accurate, complete, current, and reliable for its intended use for as long as we retain possessionof the information.
When acting as a processor or subprocessor at the direction of customers using our Services, thecollection and purposes of that data processing is controlled and handled by those customers. In
these situations, Marqeta endeavors only to process Personal Data that is relevant to the services
it provides and any processing agreement with the customer, only for purposes compatible withthose for which the Personal Data was collected.
Exceptions for Unauthorized Disclosure. In addition to the above purposes, we may also use,transfer, disclose, or preserve Personal Data when we believe that doing so is necessary to:● Comply with applicable law or respond to valid legal process, including from law
enforcement, supervisory or regulatory authorities, or other government agencies.
● Protect our customers and others, for example to prevent attempts to commit fraud or tohelp prevent the loss of life or serious injury to anyone.
● Operate and maintain the security of our Services, including to prevent or stop an attackon our computer systems or networks.
● Protect our and others’ rights and property, including by enforcing our agreements, termsof service, and policies.
In each case, we will take reasonable steps to ensure that your Personal Data is used andprotected as described in this DPF Policy.

Recourse, Enforcement, and Liability
Internal Complaints Mechanism. In accordance with the DPF Principles, Marqeta commits toresolve complaints about the collection or use of your Personal Data. Any individuals withinquiries or complaints regarding this Policy or the use or disclosure of Personal Data inaccordance with the DPF Principles should first contact Marqeta using the contact information
given below. We will investigate and attempt to resolve complaints and disputes regarding theuse and disclosure of Personal Data in accordance with the DPF Principles outlined in thisPolicy.
If you do not receive timely acknowledgement of your complaint from us, or if we have notaddressed your complaint to your satisfaction, please contact your DPA for more information or
to file a complaint. The services of DPAs (including the Swiss Federal Data Protection andInformation Commissioner (FDPIC) and the UK’s Information Commissioner’s Office (ICO))
are provided at no cost to individuals.
Independent Recourse Mechanism. Marqeta has agreed to cooperate with JAMS Mediation
Services (“JAMS”) with respect to complaints of individuals who are not personnel of theCompany and with the local data protection authorities with respect to personnel and humanresources-related information. For more information and to submit a complaint to JAMS, visit
https://https/www.jamsadr.com/DPF-Dispute-Resolution.
Such independent dispute resolution mechanisms are available to individuals free of charge.
Under certain limited conditions, if your complaint is not resolved through these channels, it may
be possible for individuals to invoke binding arbitration before the Panel to be created by the
U.S. Department of Commerce and the European Commission. For additional information,please visit
https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2.
Employee Information. In addition, Marqeta has further committed to cooperate with the panel
established by the EU data protection authorities (“DPAs”) and comply with the advice given by
the panel with respect to unresolved DPF complaints related to employee data transferred fromthe EEA in the context of the employment relationship. Marqeta also commits to cooperate with
the UK’s Information Commissioner’s Office (ICO) and to comply with the advice given by such
authorities with regard to employee data transferred from the UK in the context of theemployment relationship.
Commitments as a Processor. In circumstances where Marqeta obtains or maintains Personal
Data as a processor to customers, individuals may submit complaints concerning the processingof their Personal Data to the relevant customer, in accordance with the customer’s dispute
resolution process. Marqeta will participate in this process at the request of the client or theindividual. Marqeta will take steps to remedy any issues arising out of potential failure to comply
with the DPF Principles.

The Federal Trade Commission. The Federal Trade Commission has jurisdiction over Marqeta’s
compliance with the DPF Principles.
Contact Information.
If you have any inquiries about our collection, use, or storage of your Personal Data, would liketo exercise any of your rights in relation to your Personal Data, or contact Marqeta’s Data
Protection Officer, please send us an email at: privacy@marqeta.com.
Inquiries can also be sent to us by regular mail at:
Marqeta, ATTN: Legal - Privacy, 180 Grand Ave, Oakland, CA 94612, USA
If you are in the European Union, you may address privacy-related inquiries to our EU
representative pursuant to Article 27 GDPR:
EU: EU-REP.Global GmbH, Attn: Marqeta, Hopfenstr. 1d, 24114 Kiel, Germany
marqeta@eu-rep.global
www.eu-rep.global
Changes to the DPF Policy
Changes to this DPF Policy may be made periodically to reflect changes to our information
handling practices or relevant laws. If the changes we make are material, we will provide youwith prior notice and/or obtain consent regarding such changes in accordance with applicablelaws. If the changes we make are not material, this DPF Policy will be updated by posting an
updated version on our website. You can tell when this DPF Policy was last updated by looking
at the date at the top of the Policy.