Global Privacy Notice (with US Privacy Addendum and California Privacy Notice)

Data Access & Collection · Context

"Personal Information" means any information relating to an identifiable person

The notice defines "Personal Information" as any information relating to an identified or identifiable individual, and says that, unless otherwise specified, it may obtain different types of it, including Sensitive Personal Information where applicable laws use that concept. For California residents, the U.S. Privacy Addendum later gives a different, CCPA-based definition (information that identifies, relates to, describes or can reasonably be linked with a particular consumer or household) that excludes publicly available, deidentified or aggregated information as the CCPA defines those terms.

Supporting quotations

“Personal Information” means any information relating to an identified or identifiable individual.

unless otherwise specified, “Personal Information” means any information relating to an identified or identifiable individual.

including Sensitive Personal Information, as may be the case under applicable laws

For the purpose of this section for California residents, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the CCPA. Personal Information does not include information that is publicly available, deidentified, or aggregated (as those terms are defined in the CCPA) or otherwise excluded from the scope of the CCPA.

Qualifications & exceptions

• The broad definition applies "unless otherwise specified"; the California addendum section uses its own CCPA-based definition for California residents.
• Sensitive Personal Information is mentioned only "as may be the case under applicable laws"; the definition does not itself list what counts.

Data Access & Collection · Company practice

Mastercard lists seven broad categories of information it may collect

Mastercard says it may collect these categories of Personal Information: transaction information (such as personal account number, merchant name and location, date and total amount, and other information supplied by financial institutions or merchants when Mastercard acts for them); product and service information (registration and payment information and program-specific information when you request products or services directly or join marketing programs); website, device and mobile app usage information collected by automated means such as cookies; job applications; business contact information when you work for a business partner; identity verification information (name, e-mail, physical address, telephone number and IP address); and anything else you provide while using communication tools.

Supporting quotations

We may collect the following categories of Personal Information:

Transaction information, such as personal account number, the merchant’s name and location, the date and the total amount of the transaction, and other information provided by financial institutions or merchants when we act on their behalf.

Product and service information, such as registration and payment information, and program-specific information, when you request products or services directly from us, or participate in marketing programs.

Website, device and mobile app usage, and similar information collected via automated means, such as cookies and similar technologies.

Job applications and related information when you apply for a job with us.

Business contact information when you work for one of our business partners.

Identity verification information, such as name, e-mail address, physical address, telephone number, and IP address.

Any other information that you may provide while using communication tools.

Qualifications & exceptions

• The list says what Mastercard "may" collect; it does not say every category is collected from every person.
• Business contact information is limited to people who work for one of its business partners; job application information to people who apply for a job with Mastercard.

Data Access & Collection · Company practice

For card payments Mastercard says it generally does not collect cardholder names

When it processes payment transactions as a processor and provider of related services, Mastercard says it obtains a limited amount of information, such as the personal account number, the merchant's name and location, and the date and total amount of the transaction. It says it generally does not need or collect the cardholder's name or other contact information to process payment transactions.

Supporting quotations

As a processor of payment transactions and provider of related services, we obtain a limited amount of information in connection with your payment transactions such as the personal account number, the merchant’s name and location, the date and the total amount of the transaction.

we generally do not need or collect the cardholder’s name or other contact information to process payment transactions.

Qualifications & exceptions

• "Generally": the statement is about processing payment transactions, not about every Mastercard product, and it is not an absolute promise that names are never collected.
• Does not cover the more detailed information collected for certain products and services described next.

Data Access & Collection · Company practice

For some products, partners give Mastercard more information about you

Mastercard says that for certain products and services, the financial institution, the merchant where you transact, or another partner may give it more information about you, or Mastercard may collect it from you directly, in order to provide those products and services for the partner, support the partner's business or perform processing for it. In these situations Mastercard may act on the partner's behalf and under its instructions, and it says it will, unless the law otherwise authorizes, process the information to process payment transactions or for the purposes agreed with the partner; the partner's own privacy policy governs further detail.

Supporting quotations

for certain products and services, your financial institutions, the merchants where you make a transaction or other partners may provide us with more information about you, or we may collect it directly from you to provide you with those products and services on their behalf, support their business or perform processing activities on their behalf.

we may act on behalf of and under the instructions of financial institutions, merchants and other partners which act as data controllers.

Unless otherwise authorized by law, we will process your Personal Information to process payment transactions or for the purposes agreed between Mastercard and the financial institutions, merchants and other partners.

Please refer to their respective privacy policies for more information regarding the processing of your Personal Information.

Qualifications & exceptions

• Applies to "certain" products and services, not all; the notice does not list which ones.
• Processing is for payment transactions or purposes agreed with the partner, unless the law authorizes otherwise.

Not stated here

• The notice does not state what additional information partners provide or which products involve it.

Data Access & Collection · Company practice

Mastercard offers some products directly to you and takes information you submit

Mastercard says it may provide products and services directly to individuals, naming marketing programs, rewards programs, eWallets, Open Finance solutions, prepaid services, location alert programs and biometric authentication tools. To use them you can give information to Mastercard directly: on its websites and digital assets, in response to marketing or other communications, by signing up for a product or service, or by taking part in an offer, program or promotion.

Supporting quotations

Mastercard may provide you directly with products and services such as marketing programs, rewards programs, eWallets, Open Finance solutions, prepaid services, location alert programs, and biometric authentication tools.

you can submit information to us directly via various means including: (i) on our websites and digital assets, (ii) in response to marketing or other communications, (iii) by signing up for a Mastercard product or service, or (iv) through your participation in an offer, program or promotion.

Qualifications & exceptions

• The product list is introduced with "such as", so it is not exhaustive; the means of submitting information are "including", also not exhaustive.

Data Access & Collection · Company practice

Mastercard may also get information about you from other sources

Besides what you submit, Mastercard says it may obtain Personal Information about you from your use of its products or services, from companies that use or facilitate its products or services, from publicly available sources, or from third-party partners. It adds that information may also be passed to it by your financial institution, merchant or other business partners.

Supporting quotations

We may also obtain Personal Information about you through your use of our products or services, from companies that use or facilitate our products or services, from publicly available sources, or from third party partners.

Your Personal Information may also be passed on to us by your financial institution, merchant or other business partners.

Qualifications & exceptions

• Stated in the part of the notice about products and services Mastercard provides directly to you.

Not stated here

• The notice does not name the third-party partners or public sources, or say what types of information come from each.

Data Access & Collection · Company practice

Program sign-up can involve identity, demographic, card and login details

For the programs it offers directly, Mastercard says it may collect identifiers and contact information (name, email, telephone, billing or shipping address), authentication information such as username and password, age, date of birth, gender and family status, military and veteran status, language preferences, payment details, personal account number, commercial information such as merchant and transaction details, card expiration date and card verification code. It says each program differs and that the relevant program-specific privacy notice should be consulted for how information is used in that program.

Supporting quotations

Below is an overview of the types of Personal Information we may collect in relation to programs we offer directly to you.

Each program differs, so where applicable, please refer to the relevant program-specific privacy notice for more information on the use of your Personal Information for that specific program.

Registration and payment information: We may collect identifiers and your contact information (such as name, email address, telephone number, billing or shipping address), authentication information (e.g., username and password), age, date of birth, gender and family status, military and veteran status, language preferences, payment details, personal account number, commercial information, such as merchant’s name and location, date and total amount of the transactions, card expiration date and card verification code.

Qualifications & exceptions

• Covers programs Mastercard offers directly to individuals; each program differs, so not every item is collected for every program.

Not stated here

• The program-specific privacy notices are not supplied here, so the exact data per program is not stated.

Data Access & Collection · Company practice

Some programs collect location, financial account or biometric data, only if you sign up

Mastercard says that what it collects for a program depends on the program: location-based services will typically require address or geolocation data, Open Finance programs may require financial account information, and programs that authenticate you by facial or fingerprint recognition may require your photograph or biometric information. It says all these programs are voluntary and that your Personal Information is only collected if you subscribe to them.

Supporting quotations

programs designed to offer you location-based services will typically require the collection of your address or geolocation data.

Programs within our Open Finance solutions may require the collection of your financial account information.

programs designed to allow you to authenticate for example, via facial or fingerprint recognition may require the processing of your photograph and/or biometric information.

All these programs are voluntary, and your Personal Information is only collected if you subscribe to such programs.

Qualifications & exceptions

• The sensitive data types arise in particular programs ("depending on the program"), and collection depends on your subscribing to that program.
• The statement that collection occurs "only" on subscription is made about these programs; other sections describe other collection (for example by cookies on websites).

Data Access & Collection · Company practice

Anything else you choose to share, including content and other people's contacts

Mastercard says you may choose to provide other information, giving as examples content such as photographs, articles and comments, contact information of friends or other people you want Mastercard to contact, content you make available through social media accounts or memberships with third parties, or anything else you want to share, for example when contacting customer service.

Supporting quotations

Other information you choose to provide: You may choose to provide other information, such as different types of content (e.g., photographs, articles, comments), contact information of friends or other people you would like us to contact, content you make available through social media accounts or memberships with third parties, or any other information you want to share with us

Qualifications & exceptions

• The information is described as information you "choose" to provide; the examples are non-exhaustive ("such as").

Not stated here

• The text does not say how information about friends or other people is used or whether those people are told.

Data Access & Collection · Company practice

Mastercard collects payment, device and location data for fraud and dispute work

Mastercard says it may collect or use Personal Information for fraud prevention and monitoring, risk management, dispute resolution and related purposes. The information may include identifiers, commercial information and internet or other electronic network activity information, such as the personal account number, merchant name and location, date and total amount of transactions, IP address, fraud score, location data, merchant details, items purchased and information about the dispute. When it provides cryptocurrency and blockchain intelligence solutions it may also collect and process blockchain information such as blockchain addresses and other cryptocurrency transaction details. The paragraph links to a separate page for more information.

Supporting quotations

we may collect or use Personal Information for fraud prevention and monitoring, risk management, dispute resolution and other related purposes.

Such information may include identifiers, commercial information, and Internet or other electronic network activity information, such as the personal account number, merchant’s name and location, date and total amount of the transactions, IP address, fraud score, location data, merchant details, items purchased and information about the dispute.

When we provide cryptocurrency and blockchain intelligence solutions, we may also collect and process information gathered from the blockchain, including blockchain addresses and other cryptocurrency transaction details.

Qualifications & exceptions

• The blockchain data is collected only "when we provide cryptocurrency and blockchain intelligence solutions".
• The information "may include" these items; the list is introduced as examples rather than a closed set.

Not stated here

• The "click here" link in this paragraph points to a separate page that is not part of this notice text and was not supplied, so what it adds is not stated here.

Data Access & Collection · Procedure

A separate page explains Open Finance data collection

For more information on the collection of Personal Information in the context of its Open Finance solutions, the notice directs readers to a linked page. The text of that page is not part of this notice, so what additional collection it describes is not stated here.

Supporting quotations

For more information on our collection of Personal Information in the context of our Open Finance solutions, please click

Qualifications & exceptions

• Applies to the Open Finance solutions only.

Not stated here

• The linked Open Finance legal and privacy page was not supplied, so its content is unknown here.

Data Access & Collection · Company practice

Ads, apps and websites collect device and usage data through cookies and beacons

Mastercard, its service providers and partners may collect information about you by automated means, such as internet or other electronic network activity information, cookies and web beacons, when you interact with its ads, mobile apps, websites, pages or other digital assets. The internet and device information may include IP address, browser type, operating system, mobile device identifier, geographical area, referring URLs, and information on the actions you take or your interaction with the digital assets. The notice explains that a cookie is a text file placed on a computer's hard drive by a web server and a web beacon (also called an internet tag, pixel tag or clear GIF) helps identify when content has been accessed or visited.

Supporting quotations

We, our service providers and partners may collect certain information about you via automated means such as Internet or other electronic network activity information, cookies, and web beacons when you interact with our ads, mobile apps, or visit our websites, pages or other digital assets.

The Internet and/or Device Information we collect in this manner may include: IP address, browser type, operating system, mobile device identifier, geographical area, referring URLs and information on actions taken or interaction with our digital assets.

A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, is a technology that helps us identify when content has been accessed or visited.

Qualifications & exceptions

• Collection is by Mastercard, its service providers and its partners, not only Mastercard itself.
• The data types are what the information "may include", introduced as examples.

Data Access & Collection · Company practice

Essential cookies cannot be turned off on the site, though your browser can block them

Mastercard, its service providers and partners use essential cookies to make the site work. The notice says these cannot be disabled because they are needed for core functions like login, security, fraud prevention, network management and accessibility, and that they do not always involve personal data processing; when they do, it gives as the legal basis that they are necessary for the site to function so you can view it. It also says you can block these cookies in your browser, but doing so may affect how the site works. The notice does not explain how "cannot be disabled" and the ability to block them in a browser fit together.

Supporting quotations

We, our service providers and partners use essential cookies to make the site work properly. These cookies cannot be disabled because they are needed for core functions like login, security, fraud prevention, network management, and accessibility.

Essential cookies do not always involve personal data processing. When they do, the legal basis is that they are necessary for the site to function so you can view it.

You can block these cookies in your browser, but doing so may affect how the site works.

Qualifications & exceptions

• "Cannot be disabled" and "You can block these cookies in your browser" are both stated; the notice does not explain how they fit together.
• Essential cookies "do not always" involve personal data processing, so some may not touch Personal Information.

Not stated here

• The notice does not say where the site's cookie controls are in relation to these cookies, or which cookies are classed as essential.

Data Access & Collection · Company practice

Non-essential analytics, performance and marketing cookies depend on your banner choices

Mastercard says that, based on your choices in the cookie banner and, where required by law, with your consent, it may drop non-essential cookies for analytics, performance or marketing purposes. It says it uses this information to improve its online products and services by assessing how many users access them, which content, products and features interest visitors most, what offers customers like to see, and how the services perform technically. It gives third-party web analytics services such as Adobe Analytics as an example, whose providers use cookies and web beacons to help Mastercard analyze how visitors use its websites and apps.

Supporting quotations

based on your choices in the cookie banner and (where required by law) with your consent, we may drop non-essential cookies for analytics, performance, or marketing purposes.

we use this information to improve our online products and services by assessing how many users access or use our online products and services

we may use third-party web analytics services on our websites and mobile apps, such as those of Adobe Analytics.

Qualifications & exceptions

• Depends on your choices in the cookie banner and, where the law requires, your consent.
• The passage states the purposes as analytics, performance and marketing; the use described afterwards is improving online products and services.

Not stated here

• The notice does not say which third parties other than the Adobe Analytics example receive data from these cookies.

Data Access & Collection · Company practice

Offers, sweepstakes and promotions can involve contact details, tracking data and inferences

Mastercard, its service providers and partners may collect information about you in connection with marketing activities, including offers, sweepstakes, contests and promotions. The information may include identifiers and contact information, electronic identification data (such as username, password, security questions and IP address), and data collected in online marketing programs, including commercial information, internet or other electronic network activity information, geolocation data, and inferences drawn from Personal Information, such as personal characteristics, life habits, consumption habits, interests, location data, and voice and image recordings.

Supporting quotations

We, our service providers and partners may also collect information about you in connection with our marketing activities, including offers, sweepstakes, contests and promotions.

The information collected for these purposes may include identifiers and your contact information

and inferences drawn from Personal Information (e.g., personal characteristics, life habits, consumption habits, interests, location data, and voice and image recordings).

Qualifications & exceptions

• Applies to information collected in connection with marketing activities, not to all Mastercard activity.
• The listed items are what the information "may include"; the examples include inferences, not only data you hand over.

Data Access & Collection · Company practice

Mastercard does not respond to browser Do Not Track signals

Mastercard states that, because there is not yet a consensus on how companies should respond to web browser-based do-not-track (DNT) mechanisms, it does not respond to web browser-based DNT signals at this time. It points to an external site to learn more about browser tracking signals.

Supporting quotations

Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, Mastercard does not respond to web browser-based DNT signals at this time.

Qualifications & exceptions

• Stated "at this time"; the notice does not say whether or when this will change.

Data Access & Collection · Company practice

Job applicants' identifiers and work history are collected through the Career site

If you apply for a job at Mastercard, it says it may collect certain identifiers and professional or employment-related information from your application on its Career website. It refers to a separate Mastercard Applicant Privacy Notice for the type of information collected in connection with job applications.

Supporting quotations

If you are applying for a job at Mastercard, we may collect certain identifiers and professional or employment-related information from your job applications on our Career website.

Qualifications & exceptions

• Applies to people applying for a job at Mastercard through its Career website.

Not stated here

• The separate Applicant Privacy Notice is linked but not supplied, so the full scope of application data is not stated here.

Data Access & Collection · Company practice

People who work for business partners have their contact and credential data collected

Mastercard says it may collect Personal Information from individuals working for its business partners (financial institutions, merchants, customers, suppliers, vendors and others), including identifiers, name, job title, department, organization, business email and postal addresses, business telephone number, queries, answers to security questions, passwords and other credentials. It may use this to provide products and services to financial institutions, corporate clients, merchants, customers and partners; to manage business relationships and financial reporting; for franchise development and integrity; to protect against financial crime; to improve its service; for marketing; to comply with law; and for accounting, auditing and billing.

Supporting quotations

We may collect Personal Information from individuals working for one of our business partners (including financial institutions, merchants, customers, suppliers, vendors and other partners), including identifiers, name, job title, department and name of organization, business email and postal addresses, business telephone number, queries, answers to security questions, security passwords and other credentials.

We may use this information to provide products and services directly to financial institutions, corporate clients, merchants, customers and partners, to manage our business relationships and financial reporting, for franchise development and integrity, to protect us from financial crime, to improve our service, for marketing and to comply with applicable law, as well as for accounting, auditing and billing purposes.

Qualifications & exceptions

• Applies to individuals who work for one of Mastercard's business partners, not consumers generally.

Data Access & Collection · Company practice

In some places Mastercard processes sensitive data such as account numbers and biometrics

Mastercard says that in certain jurisdictions it may need to receive and process Sensitive Personal Information to provide products and services to you or to its financial institution, corporate client, merchant, customer and partner organizations. It says the processing will be protected with adequate security measures and conducted so as to have the lowest possible impact on your personal rights and interests. It says the following may be considered Sensitive Personal Information as defined by applicable law: personal account number, card expiration date, card verification code, answers to security questions, passwords and other credentials, address or location information (to the extent it may reveal personal tracks), voice and image recordings, electronic identification data, payment transactions, and biometric information.

Supporting quotations

In certain jurisdictions, it may be necessary for us to receive and process your Sensitive Personal Information to provide respective products and services to you and/or to financial institutions, corporate clients, merchants, customers and partners.

Such processing of your Sensitive Personal Information will be protected with adequate security measures and be conducted in a manner so as to have the lowest possible impact on your personal rights and interests.

The following information may be considered Sensitive Personal Information as defined by applicable law: personal account number, card expiration date, card verification code, answers to security questions, security passwords and other credentials, address or location information (to the extent that it may reveal your personal tracks), voice and image recordings, electronic identification data, payment transactions, and biometric information.

Qualifications & exceptions

• Stated for "certain jurisdictions" and as information that "may be considered" Sensitive Personal Information under applicable law; the notice does not name the jurisdictions.
• Address or location information counts only "to the extent that it may reveal your personal tracks".

Not stated here

• The notice does not name the jurisdictions, and does not say which items are sensitive in which place.

Data Access & Collection · User right or choice

You can choose not to provide data, but some products may then be unavailable

Mastercard says you can choose not to provide Personal Information by refraining from conducting payment transactions or from submitting Personal Information directly. It says that when it collects Personal Information from you it indicates whether and why it is necessary and the consequences of not providing it. If you do not provide it, you may not benefit from the full range of Mastercard products and services, and Mastercard may be unable to provide products or services if the information is necessary to provide them or it is legally required to collect it.

Supporting quotations

You can choose:

Not to provide Personal Information to Mastercard by refraining from conducting payment transactions or from submitting Personal Information directly to us.

When we collect Personal Information from you, we indicate whether and why it is necessary to provide it to us, as well as the consequences of failing to do so.

If you do not provide Personal Information, you may not be able to benefit from the full range of Mastercard products and services, and we may not be able to provide you with the Mastercard products or services if that information is necessary to provide you with them, or if we are legally required to collect it in relation to the provision of such product or service.

Qualifications & exceptions

• The choice described is to not provide information by not transacting or submitting it directly; it does not address data collected by other means or from third parties.

Data Access & Collection · User right or choice

You can opt out of automated collection on Mastercard's sites, but some features may not work

Mastercard says you can opt out of the collection and use of certain information it collects about you by automated means when you visit its websites or use its apps. In certain jurisdictions you can exercise your choice about cookies and similar technologies by clicking the "Manage cookies" banner displayed in the bottom right corner of Mastercard websites. Your browser may tell you how to be notified of and opt out of having certain types of cookies placed on your device. Without certain cookies you may not be able to use all features of the websites, apps or online services.

Supporting quotations

To opt out of the collection and use of certain information, which we collect about you by automated means, when you visit our websites or use our apps.

In certain jurisdictions, you can exercise your choice regarding the use of cookies and similar technologies by clicking on the ‘Manage cookies’ banner displayed in the bottom right corner of Mastercard websites.

Note that without certain cookies you may not be able to use all of the features of our websites, apps or online services.

Qualifications & exceptions

• The cookie banner choice is available "in certain jurisdictions"; the opt-out covers "certain information", not all collection.

Not stated here

• The notice does not list the jurisdictions where the banner choice is available.

Data Access & Collection · Company practice

Mastercard says its products and services are not directed at children

Mastercard states that its products and services are not directed to, likely to be accessed by, or intended for children under 18 (or the age of majority, to the extent it differs under applicable law), in accordance with applicable law.

Supporting quotations

Mastercard products and services are not directed to, likely to be accessed by, or intended for, children under the age of 18 or the age of majority (to the extent it differs under applicable law), in accordance with applicable law.

Qualifications & exceptions

• The age threshold is 18 or the age of majority where that differs under applicable law.

Cross-references

• qualified by (model-proposed): Mastercard may still process children's data with parental consent or another legal basis — The second children's statement qualifies the first: products are not directed to children, but Mastercard may still process children's Personal Information with consent or another legal basis.

Data Access & Collection · Company practice

Mastercard may still process children's data with parental consent or another legal basis

Mastercard says that, although its products and services are not directed to children, it may process Personal Information about children below 18 (or the age of majority where it differs) with the parent or guardian's consent, with the child's consent where required, or on another legal basis in accordance with applicable law. If you learn that Mastercard is processing children's Personal Information in violation of the notice, it invites you to alert it by email.

Supporting quotations

However, Mastercard may process Personal Information about children below 18 years of age or the age of majority (to the extent it differs under applicable law), with the parent or guardian’s consent, and with the child’s consent where required, or based on another legal basis in accordance with applicable law.

If you learn that Mastercard is processing children’s Personal Information in violation of this Privacy Notice, then you may alert us at

Qualifications & exceptions

• The statement that products are not directed at children sits beside this permission to process children's data; the notice reconciles them with "However" and does not say when child data is processed.

Not stated here

• The notice does not say which products or situations involve children's data.

Cross-references

• qualifies (model-proposed): Mastercard says its products and services are not directed at children — The second children's statement qualifies the first: products are not directed to children, but Mastercard may still process children's Personal Information with consent or another legal basis.

Data Access & Collection · Context

The California list covers categories collected and disclosed for a business purpose

The addendum lists categories of Personal Information, as the CCPA defines them, that Mastercard says it has collected and disclosed for a business purpose. The lettered list below runs A to I, then K and L; the source text has no category J.

Supporting quotations

Categories of Personal Information about you that we Collect and Disclose

The following is a list of categories of Personal Information (as defined by the CCPA) we have collected and disclosed for a business purpose.

Qualifications & exceptions

• The list is of categories "we have collected and disclosed for a business purpose" under the CCPA definition, so it describes past practice for California residents.

Not stated here

• The lettered list skips from I to K; the source has no category J and does not say why.

Data Access & Collection · Company practice

California categories A and B: identifiers and contact details, including other people's information

Category A (identifiers) includes personal and business contact information such as name, postal address, telephone number and job title, date of birth, unique personal identifiers or numbers, online and device identifiers, IP address, email address, account name and authentication information. Mastercard says it may collect this information about other people if you give it their information, and may associate information you submit, such as articles, comments or social media page content, with your identifiers. Category B (the categories in Cal. Civ. Code Section 1798.80(e)) lists name, address, telephone number, email address and IP address.

Supporting quotations

A. Identifiers. Examples: Personal and business contact information (e.g., name, postal address, telephone number, job title), date of birth, unique personal identifiers or numbers, online identifier, device identifier(s), internet protocol address, email address, account name, authentication information, and similar identifiers.

We may collect this information about other people if you give us their information. We may also associate information that you submit to us, such as articles, comments, or content on our social media pages, with your identifiers.

B. Categories of Personal Information in Cal. Civ. Code Section 1798.80(e). Examples: Name, address, telephone number, email address, and IP address.

Qualifications & exceptions

• Examples are introduced as "Examples"; they are not a closed list.

Not stated here

• The cited California Civil Code provision is not reproduced in the source, so the notice's reference to it is not expanded here.

Data Access & Collection · Company practice

California category C: gender, family status, age range and military or veteran status

Category C, characteristics of protected classifications under California or federal law, lists gender, family status, age range, and military and veteran status as examples.

Supporting quotations

C. Characteristics of Protected Classifications under California or Federal Law. Examples: Gender, family status, age range, and military and veteran status.

Qualifications & exceptions

• Examples only; for California residents under the CCPA categories.

Data Access & Collection · Company practice

California category D: transaction, product, preference and rewards information

Category D, commercial information, includes information Mastercard creates or retains that is fundamental to its business (such as records of personal property); transaction information (date and time, transaction ID, personal account number, merchant name and location, total amount, and other information supplied by financial institutions or merchants when Mastercard acts for them); product and service information (such as product version, registration and payment information, and program-specific information) when you request products or services directly or take part in marketing programs; preferences it infers about you from products or services purchased, obtained or considered or from purchasing or consuming histories or tendencies; and accrued points or rewards and redemption history.

Supporting quotations

D. Commercial Information. Examples: Information we create or retain that are fundamental to our business, e.g. records of personal property;

transaction information, such as date and time of transaction, or a transaction ID provided by a customer, personal account number, the merchant’s name and location, the total amount of the transaction, and other information provided by financial institutions or merchants when we act on their behalf;

preferences that we infer about you based on products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies; accrued total of points or rewards and points or rewards redemption history.

Qualifications & exceptions

• Examples only; product and service information applies when you request products or services directly or join marketing programs.

Data Access & Collection · Company practice

California categories E and F: behavioral biometrics and online activity data

Category E, biometric information, lists behavioral characteristics that can be used to establish individual identity, such as keystroke timing, device accelerometer, scroll position and mouse location. Category F, internet or other electronic network activity information, lists cookie and web beacon data, IP address, browser type, operating system, mobile device identifier, referring URLs, pages viewed and actions you take on its online properties and apps, and behavioral-based data or biometric information such as keystroke timing, device accelerometer, scroll position and mouse location.

Supporting quotations

E. Biometric Information. Examples: Behavioral characteristics, that can be used, singly or in combination with each other or with other identifying data, to establish individual identity, such as keystroke timing, device accelerometer, scroll position, and mouse location.

F. Internet or Other Electronic Network Activity Information. Examples: Cookie and web beacon data, IP address, browser type, operating system, mobile device identifier, referring URLs, pages viewed and actions you take on our online properties and apps, and behavioral-based data or biometric information, such as keystroke timing, device accelerometer, scroll position, and mouse location.

Qualifications & exceptions

• Examples only; the same behavioral data (keystroke timing, accelerometer, scroll position, mouse location) is listed under both E and F.

Data Access & Collection · Company practice

California category G: geolocation at city, state, country or IP address level

Category G, geolocation data, gives as examples your city, state or country, or your IP address.

Supporting quotations

G. Geolocation Data. Example: Your city, state or country or your IP address.

Qualifications & exceptions

• The example given is coarse location (city, state, country or IP address).

Data Access & Collection · Company practice

California category H: photos, audio including customer service call recordings, and video

Category H, sensory information, lists photographs, audio recordings (including call recordings for customer service purposes) and video recordings as examples.

Supporting quotations

H. Sensory Information. Examples: Photographs, audio recordings (including call recordings for customer service purposes), and video recordings.

Qualifications & exceptions

• Examples only; call recordings are specifically described as for customer service purposes.

Data Access & Collection · Company practice

California category I: professional and employment-related information

Category I, professional or employment-related information, lists job title, department and name of organization, and information you provide as part of a job application or in the course of employment with Mastercard, such as contact information and employment history. It refers to the Mastercard Applicant Privacy Notice for further information.

Supporting quotations

I. Professional or Employment-Related Information. Examples: Professional information such as job title, department, and name of organization. Additionally, information you provide as part of your job application or in the course of your employment with Mastercard, e.g., contact information and employment history.

Qualifications & exceptions

• Includes information provided in the course of employment with Mastercard, not only job applications.

Not stated here

• The Mastercard Applicant Privacy Notice is linked but not supplied here.

Data Access & Collection · Company commitment

California category L: sensitive information is biometric data for fraud and security, with no right-to-limit uses

Category L, sensitive Personal Information, gives biometric information, as described in E above, for fraud and security prevention as the example. Mastercard notes that it does not use or disclose sensitive personal information for purposes that would require it to offer consumers the right to limit its collection and processing of this data under the CCPA.

Supporting quotations

L. Sensitive Personal Information. Examples: Biometric information, as described in more detail above in E, for fraud and security prevention.

We note, however, that we do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under the CCPA

Qualifications & exceptions

• The no-limit-right statement is made under the CCPA for California residents and depends on Mastercard's own view of which purposes would require the right.

Not stated here

• The addendum lists only biometric information as the sensitive example, while the main notice lists additional data it says may be sensitive in some jurisdictions.

Data Access & Collection · Company practice

California addendum lists eleven kinds of sources, including government entities and public sources

The U.S. Privacy Addendum says Mastercard has collected Personal Information from these categories of sources: you or your devices directly (in connection with products it provides to you, or when you interact with its ads, websites, apps or other digital assets); affiliates you have interacted with; analytics providers; other users of its services; internet service providers; government entities; advertising networks; social networks; operating system and platform providers; business partners such as financial institutions and merchants; and publicly accessible sources.

Supporting quotations

We have collected Personal Information from the following categories of sources:

You/Your Devices: You or your devices directly, such as in connection with our products and services that we provide to you directly, or when you interact with our ads, websites, apps, or other digital assets.

Our Affiliates that you have interacted with.

Analytics Providers.

Users: Other users of our services.

ISPs: Internet service providers.

Government: Government entities.

Advertising Networks.

Social Networks.

OS/Platform Provider: Operating systems and platforms.

Partners: Business partners, such as financial institutions, merchants, and other partners in connection with our products and services.

Public: Publicly accessible sources.

Qualifications & exceptions

• Stated in the past tense ("We have collected") for the California section of the addendum; the list names categories of sources, not specific companies.

Not stated here

• The addendum does not say which data comes from which source, or what government entities supply.