When Visa acts on behalf of its clients, it uses personal information only as the client's contract authorizes
Visa describes itself as a global payments technology company that fills many roles. Where it acts on behalf of its Visa clients, it says it collects, uses and shares Personal Information only as authorized by its contracts with those clients. For questions about how those companies handle your information, or to exercise your rights, the notice tells you to contact them directly. Its example: for questions about your Visa card transactions, contact the institution that issued your card.
Details not recorded for this card
Supporting quotations
When we act on behalf of our Visa clients, we only collect, use, and share Personal Information as authorized by our contracts with our clients.
If you have questions about how these companies handle your Personal Information, or wish to exercise your rights, please contact them directly. For example, if you have questions about your Visa card transactions, please contact the institution that issued your card for more information.
Not stated here
The client contracts that set what Visa may do are not part of this notice, and the passage does not list which Visa activities are done on behalf of clients.
Visa uses personal information to run its payment networks, prevent fraud and develop fraud and security features
The purposes table lists three purposes together in one row: (1) operating Visa's electronic payments networks, including authorization, clearing, settlement and tokenization, enabling your payment transactions, and related purposes such as authentication and dispute resolution; (2) safeguarding against fraud and cyber incidents, strengthening the cyber resilience of Visa's operations and network and managing risk exposure; and (3) developing and offering enhanced identity verification, fraud and security features, such as fraud scores and rules-based or artificial-intelligence-based systems that can identify fraud patterns. The categories listed for this row are Contact Information, Transaction and Financial Information, Relationship Information, Interaction Information, Biometric Identifiers, Business Customer Data, Inferred and Derived Information, Online and Technical Information, Audio and Visual Information, Government Issued Identification Numbers, Geolocation Information and Compliance Data.
Details not recorded for this card
Supporting quotations
Operate Visa’s electronic payments networks (including authorization, clearing, and settlement of transactions and tokenization), enable your payment transactions, and for related purposes, such as authentication and dispute resolution.
To safeguard against fraud and cyber incidents, enhance the cyber resilience of our operations and network and effectively manage risk exposure.
To develop and offer enhanced identity verification, fraud and security features such as fraud scores and rules based or artificial intelligence based systems that can identify fraud patterns
Contact Information
Transaction and Financial Information
Relationship Information
Interaction Information
Biometric Identifiers
Business Customer Data
Inferred and Derived Information
Online and Technical Information
Audio and Visual Information
Government Issued Identification Numbers
Geolocation Information
Compliance Data
Qualifications & exceptions
Every category in the notice's list is shown for this row except Professional and Employment Information.
Not stated here
The row lists the categories together; it does not say which category is used for which of the three purposes or to what extent.
Visa uses personal information to provide the products, services, programs, offers or information you request
One listed purpose is providing you with the products, services, programs, offers or information you request from Visa, and related purposes such as determining eligibility and customer service. The categories listed for this purpose are Contact Information, Transaction and Financial Information, Relationship Information, Interaction Information, Biometric Identifiers, Business Customer Data, Inferred and Derived Information, Online and Technical Information, Audio and Visual Information, Government Issued Identification Numbers, Geolocation Information and Compliance Data.
Details not recorded for this card
Supporting quotations
Provide you with the products, services, programs, offers, or information you request from Visa, and for related purposes such as determining eligibility and customer service
Contact Information
Transaction and Financial Information
Relationship Information
Interaction Information
Biometric Identifiers
Business Customer Data
Inferred and Derived Information
Online and Technical Information
Audio and Visual Information
Government Issued Identification Numbers
Geolocation Information
Compliance Data
Qualifications & exceptions
Every category in the notice's list is shown for this purpose except Professional and Employment Information.
Not stated here
The table does not say which categories are used for which parts of this purpose.
Visa processes data to provide services to its clients, such as calculating loyalty rewards and delivering client offers
One listed purpose is providing services to Visa's clients. The example given: if you enroll in a card issuer or merchant loyalty program, Visa will process 'Card Transaction Data' to calculate your rewards and provide targeted offers to you from the client. The row lists these categories: Contact Information, Transaction and Financial Information, Relationship Information, Interaction Information, Biometric Identifiers, Business Customer Data, Inferred and Derived Information, Online and Technical Information, Audio and Visual Information, Government Issued Identification Numbers, Geolocation Information and Compliance Data. Its legal bases are contract (as described above), compliance with laws and regulations, and legitimate interests (as described above).
Details not recorded for this card
Supporting quotations
Provide services to our clients. For example, if you enroll in a card issuer or merchant loyalty program, we will process Card Transaction Data to calculate your rewards and provide targeted offers to you from the client
Contact Information
Transaction and Financial Information
Relationship Information
Interaction Information
Biometric Identifiers
Business Customer Data
Inferred and Derived Information
Online and Technical Information
Audio and Visual Information
Government Issued Identification Numbers
Geolocation Information
Compliance Data
To fulfill a contract to which you are a party, as described above
To comply with the laws and regulations that are applicable to us around the world
For the purposes of our own legitimate interests or for the legitimate interests of others, as described above
Qualifications & exceptions
Every category in the notice's list is shown for this row except Professional and Employment Information.
Not stated here
'Card Transaction Data' is not defined in this notice, so it is unclear which of the listed categories it covers.
Only the loyalty-program case is given as an example; other client services are not described in this row.
Use & Processing · Company practice
Visa uses personal information to run Click to Pay: enrollment, staying signed in, checkout and digital wallet links
One listed purpose is operating Visa solutions such as Click to Pay: enrolling you (directly with Visa or with your issuing bank), enabling you to check out, managing your profile, participating in programs related to your use, and, if you have chosen, keeping you signed in on your device and integrating with other digital wallets. It may include moving your enrollment so the service is provided by your issuing bank. The row lists these categories: Contact Information, Transaction and Financial Information, Relationship Information, Interaction Information, Biometric Identifiers, Business Customer Data, Inferred and Derived Information, Online and Technical Information, Audio and Visual Information, Government Issued Identification Numbers, Geolocation Information and Compliance Data. Its legal bases are contract, compliance with laws and regulations, and legitimate interests (the first and last 'as described above').
Details not recorded for this card
Supporting quotations
Operate Visa solutions such as Click to Pay, including to enroll you in the solution (which may be directly with Visa, or with your issuing bank), to enable you to stay signed in on your device (if you have chosen this), to enable you to check out using the solution, to manage your profile, and to integrate with other digital wallets (if you have chosen to do this), and to participate in programs related to your use of the solution. This may include transitioning your enrollment so that the service is provided to you by your issuing bank (if and when applicable)
Contact Information
Transaction and Financial Information
Relationship Information
Interaction Information
Biometric Identifiers
Business Customer Data
Inferred and Derived Information
Online and Technical Information
Audio and Visual Information
Government Issued Identification Numbers
Geolocation Information
Compliance Data
To fulfill a contract to which you are a party, as described above
To comply with the laws and regulations that are applicable to us around the world
For the purposes of our own legitimate interests or for the legitimate interests of others, as described above
Qualifications & exceptions
Staying signed in and wallet integration apply only if you have chosen them.
Moving enrollment to your issuing bank applies only 'if and when applicable'.
Not stated here
Visa's Click to Pay terms of service and an issuing bank's own privacy notice are not part of this notice.
Use & Processing · Company practice
Visa uses personal information to administer surveys, loyalty programs, sweepstakes, contests and events
One listed purpose is administering surveys, loyalty programs, sweepstakes, contests and events. The row lists these categories: Contact Information, Transaction and Financial Information, Relationship Information, Interaction Information, Biometric Identifiers, Business Customer Data, Inferred and Derived Information, Online and Technical Information, Audio and Visual Information, Government Issued Identification Numbers, Geolocation Information and Compliance Data. Only two legal bases are listed for this row: contract (as described above) and legitimate interests (as described above). Unlike most rows, no compliance-with-law basis is shown here.
Details not recorded for this card
Supporting quotations
Administer surveys, loyalty programs, sweepstakes, contests, and events
Contact Information
Transaction and Financial Information
Relationship Information
Interaction Information
Biometric Identifiers
Business Customer Data
Inferred and Derived Information
Online and Technical Information
Audio and Visual Information
Government Issued Identification Numbers
Geolocation Information
Compliance Data
To fulfill a contract to which you are a party, as described above
For the purposes of our own legitimate interests or for the legitimate interests of others, as described above
Qualifications & exceptions
Every category in the notice's list is shown for this row except Professional and Employment Information.
Only the contract and legitimate-interests bases are listed for this row.
Use & Processing · Company practice
Based on your choices, Visa delivers marketing communications, personalized offers and interest-based ads
One listed purpose is delivering marketing communications, personalized offers and interest-based ads to you, based on your choices. The row lists these categories: Contact Information, Transaction and Financial Information, Relationship Information, Interaction Information, Biometric Identifiers, Business Customer Data, Inferred and Derived Information, Online and Technical Information, Audio and Visual Information, Geolocation Information and Compliance Data. The only legal basis listed in this row is Visa's legitimate interests, such as sending you news and offers relevant to you. Elsewhere the notice says Visa may also rely on your consent, where required by law, for marketing communications and personalized experiences offered through its partners.
Details not recorded for this card
Supporting quotations
Based on your choices, deliver marketing communications, personalized offers, and interest-based ads to you
Contact Information
Transaction and Financial Information
Relationship Information
Interaction Information
Biometric Identifiers
Business Customer Data
Inferred and Derived Information
Online and Technical Information
Audio and Visual Information
Geolocation Information
Compliance Data
For the purposes of our own legitimate interests or for the legitimate interests of others, such as to send you news and offers that are relevant to you
Where applicable, we also may process Personal Information with your consent. For example, we may rely on your consent, where required by law, to provide you with marketing communications and personalized experiences offered through our partners.
Qualifications & exceptions
Government Issued Identification Numbers and Professional and Employment Information are not listed for this row.
Consent is mentioned for this purpose where applicable and where required by law.
Not stated here
The notice does not say which marketing uses need your consent and which rest on legitimate interests.
Visa uses personal information to fulfill, develop or maintain its business relationship with you or your company
One listed purpose is fulfilling, developing or maintaining Visa's business relationship with you and/or your company. The row lists these categories: Contact Information, Transaction and Financial Information, Relationship Information, Interaction Information, Biometric Identifiers, Business Customer Data, Inferred and Derived Information, Online and Technical Information, Audio and Visual Information, Government Issued Identification Numbers, Geolocation Information and Compliance Data. Two legal bases are listed: contract (as described above) and legitimate interests (as described above); no compliance-with-law basis is shown in this row.
Details not recorded for this card
Supporting quotations
Fulfill, develop, or maintain our business relationship with you and/or your company
Contact Information
Transaction and Financial Information
Relationship Information
Interaction Information
Biometric Identifiers
Business Customer Data
Inferred and Derived Information
Online and Technical Information
Audio and Visual Information
Government Issued Identification Numbers
Geolocation Information
Compliance Data
To fulfill a contract to which you are a party, as described above
For the purposes of our own legitimate interests or for the legitimate interests of others, as described above
Qualifications & exceptions
Every category in the notice's list is shown for this row except Professional and Employment Information.
Only the contract and legitimate-interests bases are listed for this row.
Use & Processing · Company practice
Visa uses personal information to facilitate employment or contracting relationships and evaluate candidates
One listed purpose is facilitating your employment or contracting relationship with Visa or evaluating you for a position, including customary human resources purposes, risk management and compliance. The categories listed for this row are Contact Information, Relationship Information, Interaction Information, Biometric Identifiers, Online and Technical Information, Audio and Visual Information, Government Issued Identification Numbers, Professional and Employment Information and Compliance Data. Its legal bases are contract, compliance with laws and regulations, and legitimate interests; the contract and legitimate-interests entries say 'as described above', meaning the first row's descriptions of a contract and of legitimate interests such as security, business administration and improving relationships.
Details not recorded for this card
Supporting quotations
Facilitate your employment or contracting relationship with us or evaluate you for a position, including customary human resources purposes, risk management, and compliance
Contact Information
Relationship Information
Interaction Information
Biometric Identifiers
Online and Technical Information
Audio and Visual Information
Government Issued Identification Numbers
Professional and Employment Information
Compliance Data
To fulfill a contract to which you are a party, as described above
To comply with the laws and regulations that are applicable to us around the world
For the purposes of our own legitimate interests or for the legitimate interests of others, as described above
To fulfill a contract to which you are a party, such as a contract with you, or as needed to fulfill a contract between you and a merchant or between you and the financial institution or other entity that issued your card, where Visa is providing payment services or acting as a data processor
For the purposes of our own legitimate interests or for the legitimate interests of others, such as to protect you, us, or others from threats (such as security threats or fraud); to enable or administer our business, such as for quality control, compliance, consolidated reporting, and customer service; to manage corporate transactions, such as mergers or acquisitions; and to understand and improve our business or customer relationships generally
Qualifications & exceptions
Transaction and Financial Information, Business Customer Data, Inferred and Derived Information and Geolocation Information are not listed for this row.
Visa uses transaction, contact, relationship, interaction, online and location data for analytics and modeling
One listed purpose is understanding how you and others use Visa's products, for analytics, modeling, creating business intelligence and insights, and understanding economic trends. For these activities the row says Transaction and Financial Information, Contact Information, Relationship Information, Interaction Information, Online and Technical Information and Geolocation Information 'may be used'. The legal basis listed is Visa's legitimate interests (as described above).
Details not recorded for this card
Supporting quotations
Understand how you and others use our products, for analytics, modeling, and to create business intelligence and insights and to understand economic trends
Transaction and Financial Information, Contact Information, Relationship Information, Interaction Information,Online and Technical Information, and Geolocation Information may be used for these activities.
For the purposes of our own legitimate interests or for the legitimate interests of others, as described above
Qualifications & exceptions
Only the six categories named in the row are listed for these activities.
Legitimate interests is the only legal basis listed for this row.
Use & Processing · Company practice
Visa generates de-identified, anonymized or aggregated datasets for product development and consulting for clients
One listed purpose is generating de-personalized, de-identified, anonymized or aggregated datasets, which are used for product development and for delivering consulting services to clients. Transaction and Financial Information, Contact Information, Relationship Information, Interaction Information and Online and Technical Information 'may be used' to generate them. The legal basis listed is Visa's legitimate interests (as described above).
Details not recorded for this card
Supporting quotations
Generate de-personalized, de-identified, anonymized, or aggregated datasets, which are used for product development and delivery of consulting services to clients
Transaction and Financial Information, Contact Information, Relationship Information, Interaction Information, and Online and Technical Information may be used to generate these datasets.
For the purposes of our own legitimate interests or for the legitimate interests of others, as described above
Qualifications & exceptions
Only the five categories named in the row are listed for generating these datasets.
Not stated here
The notice does not describe how the datasets are de-identified or aggregated, or whether the datasets themselves, rather than consulting results, reach clients.
Use & Processing · Company practice
Visa uses personal information for 'Everyday Business Purposes' such as account management, security and analytics
One listed purpose is supporting Visa's 'Everyday Business Purposes': account management, quality control, website administration, business continuity and disaster recovery, security and fraud prevention, corporate governance, reporting and legal compliance, analytics and research, enforcement of contracts and other contract management, and the provision of requested products and services. The categories listed are Contact Information, Transaction and Financial Information, Relationship Information, Interaction Information, Business Customer Data, Inferred and Derived Information, Online and Technical Information, Audio and Visual Information, Government Issued Identification Numbers, Geolocation Information, Professional and Employment Information and 'Compliance Information'. The legal bases are contract, compliance with laws and regulations, and legitimate interests (the first and last 'as described above', as for the first row).
Details not recorded for this card
Supporting quotations
Support our Everyday Business Purposes, such as for account management, quality control, website administration, business continuity and disaster recovery, security and fraud prevention, corporate governance, reporting and legal compliance, analytics and research, enforcement of contracts and other contract management, and the provision of requested products and services*
Contact Information
Transaction and Financial Information
Relationship Information
Interaction Information
Business Customer Data
Inferred and Derived Information
Online and Technical Information
Audio and Visual Information
Government Issued Identification Numbers
Geolocation Information
Professional and Employment Information
Compliance Information
To fulfill a contract to which you are a party, as described above
To comply with the laws and regulations that are applicable to us around the world
For the purposes of our own legitimate interests or for the legitimate interests of others, as described above
Qualifications & exceptions
Biometric Identifiers are the one listed category not shown for this row.
Not stated here
The purpose text ends with an asterisk that no footnote in this notice explains.
This row names 'Compliance Information' where other rows say 'Compliance Data'; the notice does not say whether they are the same category.
Where applicable, Visa may also process personal information with your consent, for example for partner marketing
Visa says that where applicable it may also process Personal Information with your consent. Its example is relying on consent, where required by law, to provide you with marketing communications and personalized experiences offered through its partners.
Details not recorded for this card
Supporting quotations
Where applicable, we also may process Personal Information with your consent. For example, we may rely on your consent, where required by law, to provide you with marketing communications and personalized experiences offered through our partners.
Qualifications & exceptions
For the marketing and personalization example, consent is relied on where required by law.
Not stated here
Only the marketing and personalization example is given; the notice does not list other processing that relies on consent.
'Everyday Business Purposes' include requested services, identity management, security protection and fraud prevention
The notice says 'Everyday Business Purposes' encompasses the following business purposes and related purposes for which Personal Information may be used: providing the information, product or service requested or reasonably expected given the context of collection (such as customer credentialing, customer service, negotiation and contracting, personalization and preference management, product updates, bug fixes or recalls, and dispute resolution); identity and credential management, including identity verification, authentication and system and technology administration; protecting the security and integrity of systems, networks, applications and data, including detecting and resolving security threats and working with cybersecurity centers, consortia and law enforcement about imminent threats; and fraud detection and prevention.
Details not recorded for this card
Supporting quotations
Everyday Business Purposes” encompasses the following business purposes and related purposes for which Personal Information may be used:
To provide the information, product, or service requested by the individual or as reasonably expected given the context in which with the Personal Information was collected (such as customer credentialing, providing customer service, negotiation and contracting, personalization and preference management, providing product updates, bug fixes or recalls, and dispute resolution);
For identity and credential management, including identity verification and authentication, and system and technology administration;
To protect the security and integrity of systems, networks, applications, and data, including detecting, analyzing, and resolving security threats, and collaborating with cybersecurity centers, consortia, and law enforcement about imminent threats;
For fraud detection and prevention;
Qualifications & exceptions
The list covers these purposes 'and related purposes', so it is not stated to be closed.
'Everyday Business Purposes' also include legal compliance, audits, contract enforcement, de-identification and back-ups
The 'Everyday Business Purposes' list also includes: legal and regulatory compliance, including all uses and disclosures required by law or reasonably needed for compliance with company policies and procedures (such as anti-money laundering, security and incident response, intellectual property protection and ethics hotlines); corporate audit, management, finance and accounting analysis and reporting; enforcing contracts and protecting against injury, theft, legal liability, fraud or abuse, and protecting people or property, including physical security; de-identifying, depersonalizing or anonymizing data or creating aggregated datasets (for example for consolidated reporting, research or analytics); making back-up copies for business continuity and disaster recovery; and corporate governance, including mergers, acquisitions and divestitures.
Details not recorded for this card
Supporting quotations
Everyday Business Purposes” encompasses the following business purposes and related purposes for which Personal Information may be used:
For legal and regulatory compliance, including all uses and disclosures of Personal Information that are required by law or reasonably needed for compliance with company policies and procedures, such as anti-money laundering programs, security and incident response programs, intellectual property protection programs, and corporate ethics and compliance hotlines;
For corporate audit, management, finance and accounting analysis, and reporting;
To enforce our contracts and to protect against injury, theft, legal liability, fraud, or abuse, and to protect people or property, including physical security programs;
To de-identify, depersonalize, or anonymize the data or create aggregated datasets, such as for consolidating reporting, research, or analytics;
To make back-up copies for business continuity and disaster recovery purposes; and
For corporate governance, including mergers, acquisitions, and divestitures.
Qualifications & exceptions
The list covers these purposes 'and related purposes', so it is not stated to be closed.
Not stated here
The notice does not define which company policies and procedures count for the compliance item.
Some automatically collected website data is used non-identifiably and not to profile you or target ads
Visa says that in some cases the information it collects is used only in a non-identifiable way. Its example is information about all website users, used to optimize its websites and understand traffic patterns. Visa says it does not use this information to profile you or target its ads.
Details not recorded for this card
Supporting quotations
In some cases, the information we collect is only used in a non-identifiable way. For example, we use information we collect about all website users to optimize our websites and to understand website traffic patterns. We do not use this information to profile you or target our ads.
Qualifications & exceptions
The commitment not to profile you or target ads is stated for information used only in a non-identifiable way, not for information used in an identifiable way.
Visa may use online information identifiably, including to authenticate you, personalize content and target ads
In other cases Visa may use the information it collects online in an identifiable way. Its examples are authenticating you or your device, delivering personalized content, and using the information for analytics, fraud detection and security. It may also use the information for online ad targeting. Visa's Cookie Notice gives more information about its online data collection technologies and your choices.
Details not recorded for this card
Supporting quotations
In other cases, we may use the information in an identifiable way. For example, we may authenticate you or your device, deliver personalized content or use the information for analytics, fraud detection, and security. We may also use the information for online ad targeting.
provides more information about our online data collection technologies and your choices
Not stated here
The Cookie Notice is a separate linked document whose text is not supplied here, so the choices it offers are not stated.
As a service provider, Visa processes your information as its client instructs, and clients manage your privacy rights
When Visa acts as a service provider (also called a data processor) for its clients, it says it processes your information only as the client instructs to provide the services, and for other appropriate purposes such as recordkeeping and compliance. It relies on its clients to give you appropriate privacy notices and to manage your privacy rights. By contrast, the notice says that where Visa acts as a controller and collects information directly from an individual, the controller is the Visa entity named in the terms the individual signs.
Details not recorded for this card
Supporting quotations
When Visa acts as a service provider (also called a data processor) for our clients, we only process your information as instructed by our client to provide the services and for other appropriate purposes, such as recordkeeping and compliance. We rely on our clients to provide you with appropriate privacy notices and to manage your privacy rights.
When we act on behalf of our Visa clients, we only collect, use, and share Personal Information as authorized by our contracts with our clients.
Where Visa acts a controller under applicable laws and collects information directly from an individual, the controller is the Visa entity listed on the terms and conditions you sign when enrolling in a Visa service, product, or offer.
Qualifications & exceptions
Processing is as instructed by the client, and for other appropriate purposes such as recordkeeping and compliance.
Job applicants' information is used and retained for recruiting, compliance and other customary HR purposes
If you applied for a job at Visa, the Personal Information in your application is used and retained for recruiting, compliance and other customary human resources purposes. This includes, where permitted, processing information to monitor Visa's pathways for employee recruitment.
Details not recorded for this card
Supporting quotations
If you have applied for a job at Visa, the Personal Information in your application will be used and retained for recruiting, compliance, and other customary human resources purposes. This includes, where permitted, processing information to monitor our pathways for employee recruitment.
Qualifications & exceptions
Processing to monitor recruitment pathways is included where permitted.
Not stated here
The separate Candidate Privacy Notice listed among the supplemental notices is not part of this document, and no retention period for application data is stated here.