Global Cookie and Tracker Notice

Legal Rights & Agreement Rules · Context

Notice states an effective date of 09/09/2026

This version of the Global Cookie and Tracker Notice states an effective date of 09/09/2026. The text does not say whether it replaces an earlier notice or lists changes.

Supporting quotations

Effective Date: 09/09/2026

Not stated here

• Whether this version replaces an earlier notice, and what changed, is not stated in the supplied text.

Legal Rights & Agreement Rules · Context

"Mastercard" means the company and its affiliates

In this Notice, "Mastercard" covers Mastercard International Incorporated together with its affiliates, so the practices described are attributed to that whole group rather than a single company.

Supporting quotations

Mastercard International Incorporated and its affiliates (collectively, “Mastercard”)

Qualifications & exceptions

• Includes affiliates, not only Mastercard International Incorporated.

Not stated here

• The affiliates are not named or listed in the supplied text.

Data Access & Collection · Context

Notice covers Mastercard's own Sites and its emails

The Notice explains how Mastercard uses Cookies on websites, applications and other online environments globally ("Sites") and Email Trackers in emails it sends. It applies only to Mastercard-provided Sites, meaning Sites Mastercard owns or operates and offers directly to users. Sites run by Mastercard's clients or partners are outside the Notice unless that Site's Consent Tool says the Notice applies.

Supporting quotations

This Global Cookie and Tracker Notice explains how Mastercard uses Cookies on websites, applications, and other online environments globally (“Sites”) and Email Trackers in emails we send.

This Notice applies only to “Mastercard-provided Sites,” meaning Sites that Mastercard owns or operates and makes available directly to users. Sites provided by our clients or partners are outside the scope of this Notice unless the Consent Tool for that Site indicates that this Notice applies.

Qualifications & exceptions

• Applies only to Mastercard-provided Sites: Sites Mastercard owns or operates and makes available directly to users.
• Client or partner Sites are outside the Notice unless the Consent Tool on that Site indicates that this Notice applies.

Not stated here

• Which client or partner Sites say this Notice applies is shown in each Site's Consent Tool, which is not supplied.

Cross-references

• has exception (model-proposed): On some partner Sites the partner stays the data controller — The scope rule excludes client and partner Sites; this block describes Sites provided by a client or partner whose Consent Tool says Mastercard manages Cookies and Trackers, where the client or partner stays controller for other processing.

Legal Rights & Agreement Rules · Restriction or exception

On some partner Sites the partner stays the data controller

Where a client or partner provides a Site, and that Site's Consent Tool says Mastercard manages Cookies and Trackers for it (but Mastercard does not process any other Personal Information as controller), the client or partner is the data controller for all processing that does not involve Cookies and Trackers.

Supporting quotations

If a Site is provided to you by one of our clients or partners, and the Consent Tool on that Site indicates that Mastercard manages Cookies and Trackers for the Site (but does not process any other Personal Information as controller), that client or partner acts as the data controller for all processing activities that do not involve the use of Cookies and Trackers.

Qualifications & exceptions

• Applies only to Sites provided by a client or partner whose Consent Tool indicates that Mastercard manages Cookies and Trackers for the Site.
• Applies where Mastercard does not process any other Personal Information as controller.
• Covers processing activities that do not involve Cookies and Trackers; the supplied text does not say who is controller for the Cookie and Tracker processing itself.

Not stated here

• Who acts as controller for the Cookie and Tracker processing on those Sites is not stated in this block.

Cross-references

• exception to (model-proposed): Notice covers Mastercard's own Sites and its emails — The scope rule excludes client and partner Sites; this block describes Sites provided by a client or partner whose Consent Tool says Mastercard manages Cookies and Trackers, where the client or partner stays controller for other processing.

Data Access & Collection · Procedure

The Consent Tool gives the Site-specific cookie details

The Notice is meant to be read together with each Site's cookie banner (the Consent Tool). Together they explain the types of Cookies used, why, and the choices available. The Consent Tool is described as the source of the most current, Site-specific details, including the Cookies used on that Site; this Notice itself does not list individual Cookies.

Supporting quotations

It should be read alongside information provided through our consent management tool or “cookie banner” (“Consent Tool”) on Sites. This Notice, together with our Consent Tool, explains the types of Cookies we use, why we use them, and the choices available to you. The Consent Tool provides the most current, Site-specific details, including the Cookies used on the corresponding Site.

The Cookies used on a particular Site are listed in that Site’s Consent Tool.

Qualifications & exceptions

• Site-specific details, including which Cookies a given Site uses, are given in that Site's Consent Tool.
• The Notice describes categories of Cookies, not the Cookies on a particular Site.

Not stated here

• The individual Cookie names and the per-Site lists are not in the supplied Notice text.

Legal Rights & Agreement Rules · Procedure

Broader privacy practices sit in other privacy notices

For broader privacy practices the Notice points to Mastercard's Global Privacy Notice. If a Site has its own privacy notice, the Notice says to refer to that notice instead.

Supporting quotations

To learn more about our broader privacy practices, please see our Global Privacy Notice. If a Site has its own privacy notice, please refer to that notice instead.

Qualifications & exceptions

• A Site's own privacy notice, where it has one, is the notice to use instead of the Global Privacy Notice.

Not stated here

• The Global Privacy Notice is linked but its text is not supplied, so its content is not described here.

Data Access & Collection · Context

"Cookies" covers pixels, SDKs, web beacons and other tracking tools

In this Notice "Cookies" is a broad term: it means cookies, pixel tags, SDKs, web beacons and any other online tracking technologies Mastercard uses on Sites. The Notice also explains that an SDK is a set of tools and code from a service or platform that is built into a Site. So the Notice's rules and choices for "Cookies" reach beyond ordinary browser cookie files.

Supporting quotations

A Software Development Kit (“SDK”) is a set of tools and code provided by a service or platform that is integrated into a Site.

“Cookies” to refer to cookies, pixel tags, SDKs, web beacons, and any other online tracking technologies we use on Sites.

Qualifications & exceptions

• Applies to tracking technologies Mastercard uses on Sites (not Email Trackers, which have their own definition).

Data Access & Collection · Context

"Email Trackers" are small images or tagged links in emails

"Email Trackers" means tracking technologies Mastercard embeds in emails. They generally take the form of a small image file (tracking pixel, web beacon or clear GIF) or a tagged link that loads or redirects when you open the email or click its content.

Supporting quotations

“Email Trackers” to refer to tracking technologies we embed in emails and which generally take the form of a small image file (tracking pixel, web beacon or clear GIF) or a tagged link that loads or redirects when you open an email or click on its content.

Qualifications & exceptions

• Described as what Email Trackers "generally" look like, so other forms are not ruled out.
• They load or redirect when you open an email or click on its content.

Cross-references

• defines (model-proposed): Mastercard puts trackers in some of its emails — The Email Trackers definition explains the technology used in the emails described in the Email Trackers section.

Data Access & Collection · Context

A "Session" can end when you close the browser or go idle

The Notice defines "Session" as the period during which a user interacts with a Site. A Session can end when the user closes the browser or after a specified period of inactivity.

Supporting quotations

“Session” refers to the period during which a user interacts with a Site (which can end when the user closes their browser or after a specified period of inactivity).

Qualifications & exceptions

• "Can end": closing the browser or a specified period of inactivity are given as examples of how a Session ends.

Not stated here

• The length of the inactivity period is not stated.

Legal Rights & Agreement Rules · Context

Cookie data does not always count as "Personal Information"

"Personal Information" is defined as any information relating to an identified or identifiable individual. The Notice adds that information collected by Cookies does not always meet that definition, depending on applicable privacy laws.

Supporting quotations

“Personal Information” means any information relating to an identified or identifiable individual. Information collected by Cookies does not always meet the definition of Personal Information, depending on applicable privacy laws.

Qualifications & exceptions

• Whether Cookie data is Personal Information depends on applicable privacy laws.

Not stated here

• The Notice does not say which laws or which Cookie data fall on either side of the definition.

Use & Processing · Company practice

Mastercard uses Cookies, including third-party ones, to measure and show ads

Mastercard says it uses Cookies, including Cookies provided by third parties, to improve its Sites, measure their performance, understand its audience, enhance the user experience, and to show ads based on browsing habits and activity on the Sites and other Sites.

Supporting quotations

We use Cookies, including Cookies provided by third parties, to improve our Sites, measure the performance of our Sites, understand our audience, enhance the user experience, and to show ads based on browsing habits and activity on the Sites and other Sites.

Qualifications & exceptions

• Includes Cookies provided by third parties.
• Ads are based on browsing habits and activity on "the Sites and other Sites".

Not stated here

• The Notice does not say whether "other Sites" means only other Mastercard Sites or also sites run by others.

Sharing & Disclosure · Company practice

Third parties can place Cookies on Mastercard Sites for their own purposes

Third-party Cookies are provided by other companies, such as Mastercard's analytics or advertising partners. They may be placed or accessed through Mastercard Sites either on Mastercard's behalf or for purposes determined by those other parties. First-party Cookies are placed by the Site you are using.

Supporting quotations

First-party Cookies are Cookies placed by the Site you are using (for example, by us). Third-party Cookies are Cookies provided by other companies, such as our analytics or advertising partners, and may be placed or accessed through our Sites either on our behalf or for purposes determined by those parties.

Qualifications & exceptions

• Third-party Cookies may serve purposes the third party determines, not only purposes set by Mastercard.
• Examples given are analytics and advertising partners.

Not stated here

• Which third parties place Cookies is shown on each Site's Consent Tool, not in this Notice.

Use & Processing · Restriction or exception

Essential Cookies cannot be turned off

Essential Cookies are described as necessary for a Site to work properly and as something that cannot be disabled. They enable core functions such as security, network management and accessibility.

Supporting quotations

Essential Cookies. These Cookies are necessary for the Site to work properly and cannot be disabled. These Cookies enable core functionality such as security, network management, and accessibility.

Qualifications & exceptions

• Cannot be disabled.
• Functions are given by example ("such as"): security, network management and accessibility.

Use & Processing · Company practice

Functional Cookies remember your choices and enable some services

Functional Cookies let a Site remember choices you make, such as the language you select, or enable services such as viewing videos. They allow Mastercard to tailor Sites to you and provide enhanced functionality. Without them, certain functionality may not be available.

Supporting quotations

Functional Cookies. These Cookies enable our Sites to remember choices you make, for example, the language you select, or to enable services, such as viewing videos. These Cookies allow us to tailor the Sites to you and provide enhanced functionality. Without these Cookies, certain functionalities may not be available.

Qualifications & exceptions

• Without these Cookies certain functionalities may not be available ("may").

Data Access & Collection · Company practice

Performance Cookies track how you use a Site

Performance Cookies collect and report information on how you use a Site, which Mastercard says it uses to improve performance, correct errors and provide a quality user experience. For example, they show how long you spend on the Site and from where you are accessing it, and whether you have visited Mastercard's Sites before so Mastercard can count the number of unique users.

Supporting quotations

Performance Cookies. These Cookies help improve our Site by collecting and reporting information on how you use it. This information enables us to improve site performance, correct any errors, and provide a quality user experience. For instance, it helps us understand how long you spend on the Site and from where you are accessing it. It also helps us see if you have visited our Sites before so we can identify the number of unique users we receive.

Qualifications & exceptions

• Examples of what they reveal are introduced by "for instance" and "also", so the list is not stated to be complete.

Inference & Profiling · Company practice

Advertising Cookies analyze your interests to show personalized ads

Advertising Cookies are used to analyze your interests and preferences so Mastercard can show you relevant ads on this Site and other Sites and provide a personalized marketing experience. They may be placed through a Mastercard Site by third-party data, social media or advertising companies that Mastercard partners with. They can also help measure and improve advertising campaigns, including by understanding how users interact with ads and by creating or using audience segments for advertising or measurement purposes.

Supporting quotations

Advertising Cookies. These Cookies are used to analyze your interests and preferences to show you relevant ads on this Site and other Sites and provide a personalized marketing experience. They may be placed through our Site by third-party data, social media, or advertising companies that we partner with. They can also help us measure and improve advertising campaigns, including by understanding how users interact with ads and marketing content and by creating or using audience segments for advertising or measurement purposes.

Qualifications & exceptions

• Third-party data, social media or advertising companies "may" place them through the Site; only those Mastercard partners with are described.
• Ads can appear on this Site and "other Sites".

Not stated here

• The Notice does not say whether "other Sites" means only Mastercard Sites or also sites run by others.

Use & Processing · User right or choice

Mastercard generally asks consent before non-Essential Cookies

Mastercard says it generally asks for your consent to place non-Essential Cookies on its Sites, and points to a "Cookies Details" link under the Cookie names shown for each category to learn more.

Supporting quotations

We generally ask for your consent to place non-Essential Cookies on our Sites.

Click ‘Cookies Details’ under the Cookie names shown for each category in the Cookie Tool to learn more.

Qualifications & exceptions

• "Generally": the sentence does not promise consent in every case; a later legal-basis section says Mastercard relies on consent in countries that require it and may rely on other legal bases elsewhere.
• Applies to non-Essential Cookies; Essential Cookies cannot be disabled.

Not stated here

• The sentence names a "Cookie Tool", while the defined term elsewhere is "Consent Tool"; the Notice does not say whether these are the same.

Cross-references

• qualified by (model-proposed): Mastercard relies on consent where the country requires it — The later legal-basis section limits the general statement that Mastercard asks for consent: it relies on consent in countries that require it and may rely on other legal bases elsewhere.

Data Access & Collection · Company practice

Mastercard puts trackers in some of its emails

Mastercard says it uses Email Trackers in some of the emails it sends, such as newsletters and service updates, where permitted by applicable law. They help it learn whether messages are delivered, whether they are opened or interacted with, and whether there are issues such as deliverability problems or unusual activity that need attention.

Supporting quotations

We use Email Trackers in some of the emails we send, such as newsletters, service updates, and other communications where permitted by applicable law. Email Trackers help us understand whether our messages are delivered successfully, whether they are opened or interacted with, and whether there are issues — such as deliverability problems or unusual activity — that require attention.

Qualifications & exceptions

• Only "some" emails carry Email Trackers.
• Used where permitted by applicable law; newsletters and service updates are given as examples ("such as").

Not stated here

• Which emails include Email Trackers is not stated.

Cross-references

• defined by (model-proposed): "Email Trackers" are small images or tagged links in emails — The Email Trackers definition explains the technology used in the emails described in the Email Trackers section.

Use & Processing · Company practice

Email Tracker data is used for delivery checks, security and content

Mastercard says it uses information collected by Email Trackers to confirm emails are delivered correctly and to maintain security, to understand whether its communications are effective so it can improve its content, and to manage or protect its email services. As an example of the security use, it gives helping to verify that an account-related email is opened on a recognised device.

Supporting quotations

We use information collected by Email Trackers to:

confirm emails are delivered correctly, to maintain security (for example, helping verify that an account-related email is opened on a recognised device).

understand whether our communications are effective, improving our content.

manage or protect our email services.

Qualifications & exceptions

• The account-related email example is introduced by "for example" and is not stated to be the only security use.

Data Access & Collection · Company practice

Essential Cookies typically collect session, security and consent-state data

Mastercard says Essential Cookies typically collect the technical and session information a Site needs to work, such as unique session identifiers, authentication tokens, security event data (for example anomaly, fraud or bot-detection signals), load-balancing or routing identifiers, basic device or browser metadata, and preferences needed to keep your session going (for example your cookie consent state). A "Session" is the period during which you interact with a Site.

Supporting quotations

Essential or ‘strictly necessary’ Cookies typically collect technical and session information required for the Site to work properly, such as:

unique session identifiers

authentication tokens

security event data (e.g., anomaly, fraud, or bot detection signals)

load-balancing or routing identifiers

basic device/browser metadata necessary to deliver the Site

preferences needed to maintain your session (e.g., cookie consent state)

“Session” refers to the period during which a user interacts with a Site

Qualifications & exceptions

• Described as what these Cookies "typically" collect; the list is introduced by "such as" and is not stated to be complete.
• Device or browser metadata is limited to what is "necessary to deliver the Site".

Data Access & Collection · Company practice

Functional Cookies may record preferences, past interactions and a browser identifier

Mastercard says Functional Cookies may collect information about your saved preferences (such as language, region, accessibility settings or display configuration), your previous interactions with the Site (for example whether you completed an onboarding step or dismissed an informational banner), and a device- or browser-level identifier that lets it recognise your browser when you return.

Supporting quotations

Functional Cookies may collect information about:

your saved preferences (such as language, region, accessibility settings, or display configuration)

previous interactions with the Site (e.g., whether you completed an onboarding step or dismissed an informational banner)

a device- or browser-level identifier that allows us to recognise your browser when you return

Qualifications & exceptions

• Introduced as what these Cookies "may" collect; the examples in brackets are illustrative.

Linking & Identification · Company practice

Functional Cookies can tie a preference to your account on login Sites

On Sites that require login, Functional Cookies may collect limited profile-linked identifiers where required to provide a personalised experience, for example tying a preference to a user account.

Supporting quotations

limited profile-linked identifiers where required to provide a personalised experience on Sites that require login (e.g., tying a preference to a user account).

Qualifications & exceptions

• Only on Sites that require login.
• Only "limited" profile-linked identifiers, and only where required to provide a personalised experience.

Not stated here

• Which identifiers count as profile-linked is not specified.

Data Access & Collection · Company practice

Performance Cookies may collect browsing, device and referral data

Mastercard says Performance Cookies collect information that helps it understand how visitors use and interact with its Sites. This may include unique identifiers and session details, pages viewed and navigation paths, clicks and other on-site interactions, time spent on pages and visit frequency, device and browser characteristics, screen resolution, referring URLs, and other technical signals needed to measure performance, diagnose issues and analyse how features and content are used.

Supporting quotations

collect information that helps us understand how visitors use and interact with our Sites. This may include:

unique identifiers and session details

pages viewed and navigation paths

clicks and other on-site interactions

time spent on pages and visit frequency

device and browser characteristics

screen resolution

referring URLs

other technical signals needed to measure performance, diagnose issues, and analyse how features and content are used across our Sites.

Qualifications & exceptions

• Introduced by "may include"; the list is not stated to be complete.

Inference & Profiling · Company practice

Performance Cookies may infer approximate location from your IP address

Among the information Performance Cookies may collect, Mastercard lists approximate location inferred from your IP address.

Supporting quotations

approximate location inferred from IP address

Qualifications & exceptions

• Approximate location only, as inferred from IP address; listed as something Performance Cookies "may" collect.

Data Access & Collection · Company practice

Advertising Cookies may record your actions, ad clicks and audience segments

Mastercard says Advertising Cookies can perform the same functions as "Analytics Cookies" and are also used by Mastercard and third parties to help show relevant ads on its Sites and other Sites. They may collect additional information about how you interact with ads and marketing content, which can include actions that indicate your interests (such as form submissions, downloads or sign-ups), campaign-specific identifiers added to URLs or Cookies, ad click information including click IDs generated by third-party platforms, which ads you viewed or interacted with, and membership in audience segments created for advertising or measurement.

Supporting quotations

Advertising Cookies can perform the same functions as Analytics Cookies, and they are also used by us and third parties to help show you relevant ads on our Sites and other Sites. They may collect and use additional information related to how you interact with ads and marketing content. This can include:

actions you take that indicate your interests and activities, such as form submissions, downloads or sign-ups

campaign-specific identifiers added to URLs or Cookies to attribute your activity to a particular advertisement

ad click information, including click IDs generated by third-party platforms

engagement with marketing content, such as which ads you viewed or interacted with

membership in audience segments created for advertising or measurement purposes.

They can also help us measure and improve advertising campaigns, including by understanding how users interact with ads and marketing content and by creating or using audience segments for advertising or measurement purposes.

Qualifications & exceptions

• Used by Mastercard and by third parties.
• Introduced by "can include"; the list is not stated to be complete.

Not stated here

• "Analytics Cookies" is not one of the four categories the Notice lists (Essential, Functional, Performance, Advertising), so exactly which Cookies it refers to is not stated.
• Whether "other Sites" means only Mastercard Sites or also sites run by others is not stated.

Linking & Identification · Company practice

Ad partners' Cookies may combine your data with data from other sources

Cookies from third-party advertising partners on Mastercard Sites may permit those partners to combine information collected about you or your device during your visit with information they obtain from other "Sources".

Supporting quotations

Cookies of third-party advertising partners on our Sites may permit these partners to combine information collected about you or your device while visiting our Sites with information they obtain from other Sources.

Qualifications & exceptions

• Applies to Cookies of third-party advertising partners on Mastercard Sites; stated as something the Cookies "may permit".

Not stated here

• "Sources" is capitalised but not defined in the supplied text, so what other information is combined is not stated.
• Which partners do this is not stated in this block.

Sharing & Disclosure · Company practice

Google and other ad partners decide for themselves how they use the data

Mastercard says Google and its other advertising partners may independently determine how they use information their Cookies collect about you or your device on Mastercard Sites, and it refers you to their privacy notices for more information.

Supporting quotations

Google and our other advertising partners may independently determine how they use information collected about you or your device by their Cookies on our Sites. See their privacy notices for more information.

Qualifications & exceptions

• Applies to information collected by those partners' own Cookies on Mastercard Sites.
• The partners' own privacy notices are the stated source for how they use it.

Not stated here

• The partners' privacy notices are not supplied, and the Notice does not limit their uses.

Sharing & Disclosure · Company practice

Google may use data from Mastercard Sites as an independent controller

Google may collect or receive information from Mastercard Sites and use it as an independent controller for ad personalisation, measurement and reporting, and to improve its own products. The Notice directs you to Google's Privacy Policy and to Google documentation for users in the EEA and UK for how Google processes this information.

Supporting quotations

Google may collect or receive information from our Sites and use it as an independent controller for personalisation of ads, measurement, reporting and to improve its products.

Qualifications & exceptions

• Google uses the information as an independent controller, for its own purposes listed: personalisation of ads, measurement, reporting and improving its products.

Not stated here

• Google's Privacy Policy and EEA/UK documentation are linked but not supplied.

Sharing & Disclosure · Company practice

Mastercard is a joint controller with Meta for Meta Pixel event data

Mastercard says it acts as a joint controller with Meta Platforms Ireland Ltd. under the Meta Business Tools Terms for collecting Event Data through the Meta Pixel and sending it to Meta. It points to the Meta Privacy Policy for the information the EU's GDPR requires about Meta Ireland's processing and your rights.

Supporting quotations

We act as a joint controller with Meta Platforms Ireland Ltd.

for the collection of Event Data (as defined in the Meta Business Tools Terms) through the Meta Pixel and its transmission to Meta.

Qualifications & exceptions

• Joint control covers collection of Event Data (as defined in the Meta Business Tools Terms) through the Meta Pixel and its transmission to Meta.
• The GDPR-required information is stated to relate to Meta Ireland's processing.

Not stated here

• The Meta Business Tools Terms and Meta Privacy Policy are linked but not supplied.
• Which Sites use the Meta Pixel, and whether joint control applies outside the EU, is not stated.

Legal Rights & Agreement Rules · Company commitment

Mastercard processes cookie data only where it has a legal basis

Mastercard says it processes Personal Information collected through Cookies and Email Trackers only where applicable law in the country where you are located permits it and only where it has a legal basis. The basis it relies on may differ by jurisdiction and by the type of Cookie or Email Tracker. Information collected by Cookies does not always count as Personal Information under this Notice.

Supporting quotations

We only process Personal Information collected using Cookies and Email Trackers where this is permitted under applicable laws in the country where you are located, and only where we have a legal basis for doing so. Because global privacy laws differ, the legal basis we rely on may vary by jurisdiction and by the type of Cookie or Email Tracker used.

Information collected by Cookies does not always meet the definition of Personal Information, depending on applicable privacy laws.

Qualifications & exceptions

• Depends on the country where you are located.
• The legal basis may vary by jurisdiction and by type of Cookie or Email Tracker.
• Concerns Personal Information; Cookie data is not always Personal Information, depending on applicable privacy laws.

Cross-references

• qualifies (model-proposed): Analytics and ad Cookies rest on consent, or legitimate interests where allowed — The general rule that Personal Information from Cookies and Email Trackers is processed only where law permits and a legal basis exists is applied by the table rows that follow.

Legal Rights & Agreement Rules · Company practice

Mastercard relies on consent where the country requires it

Mastercard says that in some countries consent is required before placing or accessing certain non-essential Cookies, or before using certain Email Trackers for functionality, performance or advertising. In those countries it relies on your consent. In other countries it may rely on additional or alternative legal bases, described in the table that follows. This sits alongside the general statement that it processes this information only where it has a legal basis.

Supporting quotations

In some countries, consent is required before placing or accessing certain non-essential Cookies or before using certain Email Trackers for functionality, performance, or advertising. In those countries, Mastercard relies on your consent. In other countries, we may rely on additional or alternative legal bases as described below.

Processing Activity Legal Basis for Processing (where required under applicable law)

only where we have a legal basis for doing so

Qualifications & exceptions

• Consent is relied on in countries where consent is required for non-essential Cookies or for Email Trackers used for functionality, performance or advertising.
• In other countries other legal bases may be used ("may").
• The table's second column is headed "where required under applicable law".

Not stated here

• The Notice does not list which countries require consent.

Cross-references

• qualifies (model-proposed): Mastercard generally asks consent before non-Essential Cookies — The later legal-basis section limits the general statement that Mastercard asks for consent: it relies on consent in countries that require it and may rely on other legal bases elsewhere.

Legal Rights & Agreement Rules · Company practice

Analytics and ad Cookies rest on consent, or legitimate interests where allowed

For using Performance, Functional and Advertising Cookies to understand how users interact with Sites, personalise content, or measure and improve campaigns, the table lists your consent to placing the Cookie and the related use of your Personal Information, where required by law (including EU ePrivacy rules). In countries that permit this without consent, Mastercard says it may rely on its legitimate interests in understanding and improving how users engage with its Sites, products or communications, provided those interests are not overridden by your privacy rights under applicable law. The row also covers Email Trackers used for functionality, performance or advertising where consent is required.

Supporting quotations

Using Performance, Functional, and Advertising Cookies to understand how users interact with our Sites, to personalize content, or to measure and improve campaigns. This includes any use of Email Trackers for functionality, performance, or advertising-related purposes where consent is required.

Your consent to the placement of the Cookie and the related use of your Personal Information, where required by law (including EU ePrivacy rules).

In countries permitting this without consent, we may rely on our legitimate interests in understanding and improving how users engage with our Sites, products, or communications, provided these interests are not overriden by your privacy rights under applicable law.

Qualifications & exceptions

• Consent applies where required by law, including EU ePrivacy rules.
• Legitimate interests are available only in countries that permit the activity without consent, and only if not overridden by your privacy rights under applicable law.
• Email Trackers are included only where consent is required.

Not stated here

• Which countries permit the activity without consent is not listed.

Cross-references

• qualified by (model-proposed): Mastercard processes cookie data only where it has a legal basis — The general rule that Personal Information from Cookies and Email Trackers is processed only where law permits and a legal basis exists is applied by the table rows that follow.

Security & Safeguards · Company practice

Login and security Cookies rest on contract, legitimate interests or legal duty

For activities that help a Site function properly and securely, including registration, authentication, fraud prevention and login, the table lists three legal bases: that it is necessary for performance of a contract (where Cookies support a registration or login process you started); Mastercard's legitimate interests in a reliable, secure Site experience and in preventing fraud or misuse; and compliance with a legal obligation, where certain security or auditing activities are mandated by law.

Supporting quotations

Activities to help the Site to function properly and securely, including supporting registration, authentication, fraud prevention, and login functionalities.

Necessary for performance of a contract (where we use Cookies to support registration or login processes initiated by you).

Legitimate interests in measures intended to provide a reliable, secure Site experience and preventing fraud or misuse.

Compliance with a legal obligation, where certain security related or auditing activities are mandated by applicable law.

Qualifications & exceptions

• The contract basis applies where Cookies support registration or login processes initiated by you.
• The legal-obligation basis applies where certain security-related or auditing activities are mandated by applicable law.

Security & Safeguards · Company practice

Integrity and deliverability tracking rests on legitimate interests, with consent where required

For Cookies that support system integrity, detect technical issues, or measure deliverability or system performance, including certain Email Trackers used for security, authentication or deliverability diagnostics, the table lists legitimate interests in the security and stability of Mastercard's Sites, systems and communications, and compliance with a legal or regulatory obligation relating to security and fraud prevention. It also lists consent, where required under applicable law for any technology that stores or accesses information on your device.

Supporting quotations

Using Cookies that support system integrity, detect technical issues, or measure deliverability or system performance (including certain Email Trackers used for security, authentication, or deliverability diagnostics).

Legitimate interests in measures intended to promote the security and stability of our Sites, systems, and communications.

Compliance with legal or regulatory obligation relating to security and fraud prevention.

Consent, where required under applicable law for any technology that stores or accesses information on your device.

Qualifications & exceptions

• Consent is listed only where required under applicable law for technology that stores or accesses information on your device.
• Only certain Email Trackers are covered: those used for security, authentication or deliverability diagnostics.

Sharing & Disclosure · Procedure

Details on how personal information is shared are in another notice

On sharing, this Notice refers you to Mastercard's Global Privacy Notice, or a Site's own privacy notice if it has one, for details about how Mastercard shares Personal Information. The sharing the Notice itself describes concerns third-party Cookies and advertising partners.

Supporting quotations

for details about how we share Personal Information.

Qualifications & exceptions

• A Site's own privacy notice replaces the Global Privacy Notice for this purpose where one exists.

Not stated here

• How Mastercard shares Personal Information beyond the Cookie and advertising-partner passages is not in this Notice; the Global Privacy Notice is linked but not supplied.

Use & Processing · User right or choice

A Manage Cookies control lets you withdraw consent or reject non-essential Cookies

Mastercard says you can change your Cookie preferences at any time using the "Manage Cookies" button (a link on some Sites) at the bottom of the Site page. It says this allows you to withdraw consent or reject all Cookies except those strictly necessary for the Site to work properly.

Supporting quotations

You can change your Cookie preferences at any time by using the “Manage Cookies” button (link on some Sites) at the bottom of the Site page. This allows you to withdraw consent or reject all Cookies except those that are strictly necessary for the Site to work properly.

Qualifications & exceptions

• Available through a button or link at the bottom of the Site page; the text says "link on some Sites".
• Rejects all Cookies except those strictly necessary for the Site to work properly.

Not stated here

• Whether every Site has this control is not stated.
• "Cookies" is defined separately from "Email Trackers", so whether this control or browser settings affect Email Trackers is not stated.

Use & Processing · User right or choice

Browser settings may let you manage or delete some Cookies

When visiting websites, Mastercard says you may also be able to manage or delete some Cookies through your browser settings, and points to your browser's help menu or allaboutcookies.org for more.

Supporting quotations

When visiting websites, you may also be able to manage or delete some Cookies through your browser settings.

Qualifications & exceptions

• Applies to websites; "may" be able to manage or delete "some" Cookies.

Not stated here

• Whether browser settings reach SDKs and other technologies in apps is not stated.

Use & Processing · User right or choice

Google, Meta and LinkedIn account settings may adjust platform use of your data

If you have an account with a third-party platform whose Cookies operate on Mastercard Sites, Mastercard says you may be able to adjust in your account settings how that platform uses data collected from your interactions. It lists Google's Safety Centre, Meta's Privacy Centre and LinkedIn's Privacy Centre for more information.

Supporting quotations

If you have an account with one of the third-party platforms whose Cookies operate on our Sites, you may be able to adjust how those platforms use data collected from your interactions in your account settings.

Google’s Safety Centre

Meta’s Privacy Centre

LinkedIn’s Privacy Centre

Qualifications & exceptions

• Only if you have an account with the platform; "may be able to" adjust.

Not stated here

• LinkedIn Cookies are named only in this list; the Notice does not otherwise describe what LinkedIn does on its Sites.

Use & Processing · Context

Rejecting or deleting Cookies can break parts of the Sites

Mastercard warns that if you reject or delete Cookies, some parts of its Sites may not function properly or may become inaccessible.

Supporting quotations

Please note that if you reject or delete Cookies, some parts of our Sites may not function properly or may become inaccessible.

Qualifications & exceptions

• "Some parts" of the Sites and "may": not stated to affect all of a Site.

Legal Rights & Agreement Rules · Procedure

Your privacy rights and how to use them are in another notice

To learn more about your choices or to exercise your privacy rights, Mastercard refers you to its Global Privacy Notice, or a Site's own privacy notice if it has one. This Notice does not itself describe the rights or how to exercise them.

Supporting quotations

To learn more about your choices or to exercise your privacy rights, please consult our Global Privacy Notice (or if a Site has its own privacy notice, that notice).

Qualifications & exceptions

• A Site's own privacy notice replaces the Global Privacy Notice where one exists.

Not stated here

• The rights and how to exercise them are not described in this Notice; the Global Privacy Notice is linked but not supplied.

Legal Rights & Agreement Rules · Procedure

Data transfers are covered in Section 5 of the Global Privacy Notice

On data transfers, the Notice only refers you to Section 5, Data Transfers, in the Global Privacy Notice, or the corresponding section of a Site's own privacy notice. It states no transfer practices itself.

Supporting quotations

See Section 5 Data Transfers in our Global Privacy Notice (or if a Site has its own privacy notice, the corresponding section in that notice).

Qualifications & exceptions

• A Site's own privacy notice's corresponding section replaces it where the Site has its own notice.

Not stated here

• Where Personal Information is transferred, and on what safeguards, is not stated in this Notice. The cited Section 5 is in the Global Privacy Notice, which is not supplied.

Security & Safeguards · Procedure

How information is protected is in Section 6 of the Global Privacy Notice

On protecting Personal Information, the Notice only refers you to Section 6, How We Protect Your Personal Information, in the Global Privacy Notice, or the corresponding section of a Site's own privacy notice. It states no protection measures itself.

Supporting quotations

See Section 6 How We Protect Your Personal Information in our Global Privacy Notice (or if a Site has its own privacy notice, the corresponding section in that notice).

Qualifications & exceptions

• A Site's own privacy notice's corresponding section replaces it where the Site has its own notice.

Not stated here

• The protection measures are not stated in this Notice. The cited Section 6 is in the Global Privacy Notice, which is not supplied.