For the purpose of this Global Privacy Notice, “Personal Information” means any information relating to an identified or identifiable individual. Examples of Personal Information include: name, email address, IP address, personal account number and phone number. We may obtain different types of Personal Information relating to you in the situations described below.

Personal Information We Receive from Financial Institutions, Merchants, and Other Partners in Connection with Mastercard’s Products or Services

As a processor of payment transactions and provider of related services, we obtain a limited amount of information in connection with your payment transactions such as the personal account number, the merchant’s name and location, the date and the total amount of transaction. Importantly, we generally do not need or collect the cardholder’s name or other contact information to process payment transactions.

In addition, for certain products and services, your financial institutions, the merchants where you make a transaction or other partners may provide us with more information about you, or we may collect it directly from you to provide you with those products and services on their behalf, support their business or perform processing activities on their behalf.

In the above situations, we act on behalf of and under the instructions of financial institutions, merchants and other partners which act as data controllers. Unless otherwise authorised by law, we will process your Personal Information to process payment transactions or for the purposes agreed between Mastercard and the financial institutions, merchants and other partners. Please refer to their respective privacy policy for more information regarding the processing of your Personal Information.

Personal Information We Collect when Providing Mastercard’s Products and Services Directly to You

Mastercard may provide you directly with products and services such as marketing programmes, rewards programmes, eWallets, prepaid services, location alert programmes, and biometric authentication tools. To benefit from one or more of these products and services, you can submit information to us directly via various means including: (i) on our websites and digital assets, (ii) in response to marketing or other communications, (iii) by signing up for a Mastercard product or service, or (iv) through your participation in an offer, programme or promotion. We may also obtain Personal Information about you through your use of our products or services, from companies that use or facilitate our products or services, from publicly available sources, or from third party partners. Your Personal Information may also be passed on to us by your financial institution, merchant or other business partners.

Below is an overview of the types of Personal Information we may collect in relation to programmes we offer directly to you. Each programme differs, so where applicable, please refer to the relevant programme-specific privacy notice for more information on the use of your Personal Information for that specific programme.

• Registration and payment information: We may collect your contact information (such as name, email address, phone number, billing or shipping address), username and password, age, date of birth, gender and family status, language preferences, personal account number, merchant’s name and location, date and total amount of the transactions, card expiration date and card verification code.
• Information we process to provide you with the programme: We may collect different types of Personal Information depending on the programme. For example, programmes designed to offer you location-based services will typically require the collection of your address or location. Similarly, programmes designed to allow you to authenticate for example, via facial or fingerprint recognition may require the processing of your photograph and/or biometric data. All these programmes are voluntary, and your Personal Information is only collected if you subscribe to such programmes.
• Other information you choose to provide: You may choose to provide other information, such as different types of content (e.g., photographs, articles, comments), contact information of friends or other people you would like us to contact, content you make available through social media accounts or memberships with third parties, or any other information you want to share with us.

In addition, we may collect or use Personal Information for fraud prevention and monitoring, risk management, dispute resolution and other related purposes. Such information may include the personal account number, merchant’s name and location, date and total amount of the transactions, IP address, fraud score, location data, merchant details, items purchased and information about the dispute. For more information, please click here.

Personal Information We Obtain from Your Interaction with Mastercard’s Ads, Websites, Apps or Other Digital Assets

We, our service providers and partners may collect certain information about you via automated means such as cookies and web beacons when you interact with our ads, mobile apps, or visit our websites, pages or other digital assets. The information we collect in this manner may include: IP address, browser type, operating system, mobile device identifier, geographical area, referring URLs and information on actions taken or interaction with our digital assets. A “cookie” is a text file placed on a computer’s hard drive by a web server. A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, is a technology that helps us identify when content has been accessed or visited.

We use this information to improve our online products and services by assessing how many users access or use our online products and services, which content, products and features of our online products and services most interest our visitors, what types of offers our customers like to see and how our online products and services perform from a technical point of view. For instance, we may use third-party web analytics services on our websites and mobile apps, such as those of Adobe Omniture. The analytics providers that administer these services use technologies such as cookies and web beacons to help us analyse how visitors use our websites and apps.

We, our service providers and partners may also collect information about you in connection with our marketing activities, including offers, sweepstakes, contests and promotions. The information collected for these purposes may include your contact information (e.g., name, postal address, email address, phone number), electronic identification data (e.g., username, password, security questions, IP address), and data collected in the context of online marketing programmes (e.g., personal characteristics, life habits, consumption habits, interests, location data, and voice and image recordings).

We, our service providers and partners may also collect information about you to provide you with content and advertising tailored to your individual interests. The information collected for these purposes may include details about things like the particular pages or ads you view on our websites and apps and the actions you take on our websites and apps.

In addition, some of our online products and services include advanced fraud prevention technology using behavioural-based data, such as keystroke timing, device accelerometer, scroll position and mouse-location.

Where required under applicable law, we obtain your consent prior to using the above automated means, and prior to sending you marketing communications, tailored content and advertisings.

Please see the “Your Rights And Choices” section of this Global Privacy Notice to learn about your choices.

Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, Mastercard does not respond to web browser-based DNT signals at this time. To learn more about browser tracking signals and DNT, visit http://www.allaboutdnt.com.

Personal Information We Obtain when You Apply for a Job with Us

If you are applying for a job at Mastercard, we may collect certain Personal Information from your job applications on our Career website, such as your contact information (including name, postal address, email address and phone number), job history, curriculum vitae, contact details of your referees and any other Personal Information you choose to submit along with your application.

Personal Information We Collect in the Context of Our Business Relationship with Financial Institution, Merchant or other Entity Partnering with Mastercard

We may collect Personal Information from individuals working for one of our business partners (including financial institutions, merchants, customers, suppliers, vendors and other partners), including name, job title, department and name of organisation, business email and postal addresses, business telephone number, answers to security questions, security passwords and other credentials. We may use this information to provide products and services directly to financial institutions, corporate clients, merchants, customers and partners, to manage our business relationships and financial reporting, for franchise development and integrity, for marketing and to comply with applicable law, as well as for accounting, auditing and billing purposes.

We may use the Personal Information we obtain about you to:

• Process your payment transactions (including authorisation, clearing, chargebacks and other related dispute resolution activities).
• Protect against and prevent fraud, unauthorised transactions, claims and other liabilities, and manage risk exposure and franchise quality with respect to the integrity and security of our payments network.
• Create and manage any accounts you may have with us, verify your identity, provide our services, and respond to your inquiries.
• Provide, administer and communicate with you about products, services, offers, programmes and promotions of Mastercard, financial institutions, merchants and partners (including contests, sweepstakes and any other marketing activities). If you provide your phone number, we may contact you using an automatic telephone dialing system to the extent permitted by applicable law.
• Create and publish business directories (which may include business contact information).
• Operate, evaluate and improve our business (including developing new products and services, such as new programmes designed to make it easier for cardholders to make payments with a Mastercard card based on information indicating what features would appeal to you and our customers, or products designed to improve the security of payment transactions; managing our communications; determining the effectiveness of and optimising our advertising; analysing our products, services, websites, mobile apps and any other digital assets in order to facilitate their functionality; and performing due diligence reviews, accounting, auditing, billing, reconciliation and collection activities).
• Provide you with personalised services and recommendations. For example, we may use your Personal Information such as your email address and your interaction with our website to analyse your preferences, interests and behaviour in order to decide to provide you with tailored content and the most relevant offers, recommendations and email communications about a specific product from Mastercard, financial institutions, merchants and partners.
• Anonymise Personal Information and prepare and furnish aggregated data reports showing anonymised information (including compilations, analyses, analytical and predictive models and rules, and other aggregated reports) for the purpose of advising our financial institutions, merchants and other customers and partners regarding past and potential future patterns of spending, fraud, and other insights that may be extracted from this data.
• Evaluate your interest in employment and contact you regarding possible employment with Mastercard.
• Enforce our Terms of Use or as necessary to establish, exercise and defend legal rights.
• As may be required by applicable laws and regulations, including for compliance with Know Your Customers, Anti-Money Laundering, anti-corruption and sanctions screening requirements, or as requested by any judicial process, law enforcement or governmental agency having or claiming jurisdiction over Mastercard or Mastercard’s affiliates.
• Comply with industry standards and our policies.
• For other purposes for which we provide specific notice at the time of collection.

If you are located in the European Economic Area (“EEA”) or Switzerland, we will only process your Personal Information for the above purposes when we have a valid legal ground for the processing, including if:

• You consented to the use of your Personal Information. For example, we may seek to obtain your consent for our uses of cookies or similar technologies, to send you marketing communications or personalise our offerings, or to process Personal Information deemed sensitive under applicable law.
• We need your Personal Information to provide you with products and services, or to respond to your inquiries.
• The processing is necessary for compliance with a legal obligation or other regulatory obligations such as to prevent and monitor fraud in payment transactions.
• We, or a third party, have a legitimate interest in using your Personal Information, such as to ensure and improve the safety, security, and performance of our products and services, to protect against and prevent fraud and to anonymise Personal Information and carry out data analyses.

We will not subject you to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, unless you explicitly consented to the processing, the processing is necessary for entering into, or performance of a contract between you and Mastercard, or when we are legally required to use your Personal Information in this way, for example to prevent fraud.

If you provide us with any information or material relating to another individual, you must make sure that the sharing with us and our further use as described to you from time to time is in line with applicable laws, so for example you should duly inform that individual about the processing of her/his Personal Information and obtain her/his consent, as may be necessary under applicable laws.

We do not sell or otherwise disclose Personal Information we collect about you, except as described in this Global Privacy Notice, as disclosed to you at the time of data collection or as described in our programme-specific privacy notice.

We transfer Personal Information globally within the Mastercard group of affiliated companies consistent with the terms of this Global Privacy Notice or as we otherwise disclose at the time the data is collected. If you are located in the EEA or Switzerland, we will transfer your Personal Information in accordance with the Mastercard Binding Corporate Rules available here.

We may also share your Personal Information:

• With financial institutions and other entities that issue payment cards or merchants to process payment transactions and perform other activities that you request.
• With entities that partner with Mastercard or assist Mastercard in providing its products and services, including for fraud prevention and monitoring and third-party identification services, to ensure the security of transactions and our payment processing system.
• When we act as a service provider for third parties and provide them with Personal Information that we process on their behalf.
• With our service providers who perform services on our behalf for the purposes described in this Global Privacy Notice (or in the applicable programme-specific privacy notice). We require these service providers by contract to only process Personal Information in accordance with our instructions and as necessary to perform services on our behalf or in compliance with applicable law. We also require them to safeguard the security and confidentiality of the Personal Information they process on our behalf by implementing appropriate technical and organisational security measures and confidentiality obligations binding employees accessing Personal Information.
• With third parties whose features you use in connection with our products and services, including social networks.
• With other third parties with your consent.
• As required under applicable law or legal process, or when we believe disclosure is necessary to protect individuals’ vital interests, to enforce our terms and conditions, prevent Mastercard against harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.
• In the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use Personal Information you have provided to us in a manner that is consistent with our Global Privacy Notice. Following such a sale or transfer, you may contact the entity to which we transferred your Personal Information with any inquiries concerning the processing of that information.

You have certain rights regarding the Personal Information we maintain about you and certain choices about what Personal Information we collect from you, how we use it, and how we communicate with you.

You can choose:

• Not to provide Personal Information to Mastercard by refraining from conducting payment transactions or from submitting Personal Information directly to us. When we collect Personal Information from you, we indicate whether and why it is necessary to provide it to us, as well as the consequences of failing to do so. If you do not provide Personal Information, you may not be able to benefit from the full range of Mastercard products and services, and we may not be able to provide you with the Mastercard products or services if that information is necessary to provide you with them, or if we are legally required to collect it in relation to the provision of such product or service.
• To opt out of the collection and use of certain information, which we collect about you by automated means, when you visit our websites or use our apps. In certain jurisdictions, you can exercise your choice regarding the use of cookies and similar technologies via the Cookie Consent tool displayed in the bottom right corner of Mastercard websites. Your browser may tell you how to be notified of and opt out of having certain types of cookies placed on your device. Note that without certain cookies you may not be able to use all of the features of our websites, apps or online services.
• To opt out of certain uses of information, which we collect about you by automated means when you visit third-party websites and interact with our ads. We may use service providers to serve ads on those third-party websites. These ads may be customised and served based on the use of data we and our partners have collected on our websites and apps. In addition, some of our service providers and partners may collect information about your online activities over time and across third-party websites to customise and serve these ads. Mastercard ads are sometimes delivered with icons that help consumers (i) learn more about how their data is being used and (ii) exercise choices they may have regarding the use of their data. Please click here or, where applicable, on the icon in our targeted ads to learn about your ability to opt out or limit the use of your browsing behaviour for advertising purposes.
• To tell us not to send you marketing emails by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us as indicated below. You also may opt out of receiving marketing emails from Mastercard by clicking here.
• To opt out of the anonymisation of your Personal Information to perform data analyses by clicking here.

In certain jurisdictions, in particular if you are located in the EEA or Switzerland, you may have the right to:

• Request access to and receive information about the Personal Information we maintain about you, to update and correct inaccuracies in your Personal Information, to restrict or to object to the processing of your Personal Information, to have the information anonymised or deleted, as appropriate, or to exercise your right to data portability to easily transfer your Personal Information to another company. In addition, you may also have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work or where an incident took place
• Withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.

You may opt out from certain processing of your Personal Information, e.g. via our opt-out webpage.

Those rights may be limited in some circumstances by local law requirements.

If we fall short of your expectations in processing your Personal Information or you wish to make a complaint about our privacy practices, please tell us because it gives us an opportunity to fix the problem. To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time and as required under applicable law.

To update your preferences, ask us to remove your information from our mailing lists or submit a request to exercise your rights under applicable law, contact us as specified in the "How To Contact Us" section below. If you are located in the EEA or Switzerland, we have developed Mastercard’s “My Data Center” portal to facilitate the exercise of your rights.

Mastercard is a global business. We may transfer the Personal Information we collect about you to recipients in countries other than your country, including the United States, where we are headquartered. These countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your Personal Information to other countries, we will protect that information as described in this Global Privacy Notice, as disclosed to you at the time of data collection or as described in our programme-specific privacy notice.

We comply with applicable legal requirements providing adequate safeguards for the transfer of Personal Information to countries other than the country where you are located. In particular, we have established and implemented a set of Binding Corporate Rules (“BCRs”) that have been recognised by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally. A copy of our BCRs is available here. We may also transfer Personal Information to countries for which adequacy decisions have been issued, use contractual protections for the transfer of Personal Information to third parties, such as the European Commission’s Standard Contractual Clauses or their equivalent under applicable law, or rely on third parties’ certification to the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks where applicable. You may contact us as specified in the “How to Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of the EEA.

The security of your Personal Information is important to Mastercard. We are committed to protecting the information we collect. We maintain administrative, technical and physical safeguards designed to protect the Personal Information you provide or we collect against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use. We use SSL encryption on a number of our websites from which we transfer certain Personal Information.

We also take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

Our websites may provide links to other websites for your convenience and information. We may also allow you to choose to use certain features for which we partner with other entities. These websites and features, which may include social networking and geo-location tools, operate independently from Mastercard, and are clearly identified as such. They may have their own privacy notices or policies, which we strongly suggest you review. To the extent any linked websites or features you visit or use are not owned or controlled by Mastercard, we are not responsible for their content, any use of the websites, or the privacy practices of the websites.

Mastercard offers you the possibility to share, link to, or mention things on social media about Mastercard’s products and services. For example, you may “like” an offer via your Facebook account, or “tweet” an offer using Twitter. You may also choose to use certain features on our websites that can be accessed through, or for which we partner with, other entities that are not otherwise affiliated with Mastercard. These features, including geo-location tools, are operated by third parties and are clearly identified as such. Social media providers such as Facebook and Twitter, and these other third parties, are independent from Mastercard and do not necessarily share the same policy as Mastercard regarding the protection of privacy. Please verify their privacy notices if you decide to use their services. Mastercard cannot be held liable for any of these social media tools’ and third parties’ websites’ and apps’ content, use or privacy practices.

This Global Privacy Notice may be updated periodically to reflect changes in our Personal Information practices. We will post a prominent notice on relevant websites to notify you of any significant changes to our Global Privacy Notice and indicate at the top of the Notice when it was most recently updated. If we update our Global Privacy Notice, in certain circumstances, we may seek your consent.

If you have any questions, comments or complaints about this Global Privacy Notice and our privacy practices, or would like to update your privacy preferences, please email us at: privacyanddataprotection@mastercard.com or write to us at:

Global Privacy Office
Mastercard International Incorporated
2000 Purchase Street
Purchase, New York 10577
USA

If you are located in the EEA or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information on Mastercard’s “My Data Center” portal, or email us at: privacyanddataprotection@mastercard.com, or write to us at:

Data Protection Officer
Mastercard Europe SA
Chaussée de Tervuren 198A
B-1410 Waterloo
Belgium

For enquiries about your Mastercard card and your purchase, you should contact your financial institution or merchant. More information about how to contact them can be found on their respective websites.