Global Privacy Notice (with US Privacy Addendum and California Privacy Notice)

Legal Rights & Agreement Rules · Context

The notice is issued by Mastercard International and its affiliates

The Global Privacy Notice speaks for Mastercard International Incorporated together with its affiliates, which the notice collectively calls "Mastercard". It says it covers the types of Personal Information collected, why it is collected, the other parties it may be shared with, the security measures used, the reader's rights and choices, and how to make privacy contact.

Supporting quotations

Mastercard International Incorporated and its affiliates (collectively, “Mastercard”) respect your privacy.

This Global Privacy Notice describes the types of Personal Information we collect, the purposes for which we collect that Personal Information, the other parties with whom we may share it and the measures we take to protect the security of the data. It also tells you about your rights and choices with respect to your Personal Information, and how you can contact us about our privacy practices.

Qualifications & exceptions

• "Mastercard" in the rest of the notice means the parent company and its affiliates together, not one entity.

Legal Rights & Agreement Rules · Context

The Global Privacy Notice states an effective date of 1/19/2026

The notice opens with an "Effective Date" of 1/19/2026. The separate U.S. Privacy Addendum later in the same page carries its own, later "last updated" date, so the page does not present one single date for all its parts.

Supporting quotations

Effective Date: 1/19/2026

Qualifications & exceptions

• The 1/19/2026 date is stated for the notice as a whole at its top; the U.S. Privacy Addendum states its own update date.

Not stated here

• The page text does not say what changed between the 1/19/2026 effective date and the later date shown in the addendum.

Legal Rights & Agreement Rules · Context

Practices vary by country, and some products have their own notices

Mastercard says its privacy practices may differ between the countries it operates in to reflect local practices and legal requirements. It also says specific privacy notices may apply to some of its products and services, and tells readers to visit the page or digital asset of the specific product or service to learn how that product handles information.

Supporting quotations

Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements.

Specific privacy notices may apply to some of our products and services. Please visit the webpage or digital asset of the specific product or service to learn more about our privacy and information practices in relation to that product or service.

Qualifications & exceptions

• A product- or service-specific notice may apply instead of or alongside this notice for that product; the notice does not say which controls if they differ.

Not stated here

• The product-specific notices are not supplied with this page, and the text does not say which products have one.

Legal Rights & Agreement Rules · Restriction or exception

You may be obliged to give complete and accurate information when you consent

Mastercard states that you may be subject to obligations under applicable laws, such as the obligation to provide complete and accurate Personal Information when consenting to the processing of your Personal Information. The notice does not say which laws or what consequences follow.

Supporting quotations

You may be subject to obligations under applicable laws, such as the obligation to provide complete and accurate Personal Information when consenting to the processing of your Personal Information.

Qualifications & exceptions

• Stated as something you "may" be subject to under applicable laws, in the context of giving consent to processing.

Not stated here

• The notice does not name the laws, and does not say what happens if information is incomplete or inaccurate.

Legal Rights & Agreement Rules · Company commitment

Mastercard says it relies on consent, necessity, legal duty or legitimate interest depending on the country

Where applicable law requires, Mastercard says it will only use Personal Information with your consent, as necessary to provide products and services, to comply with a legal obligation, or when a legitimate and overriding interest necessitates the use. It says that, depending on the country, it will only process Personal Information where permitted by law and when it has a legal basis for the processing identified in the table that follows. It adds that although the table does not list consent as a legal basis for each activity, in some countries consent is the only or most appropriate legal basis, and in those countries it relies on consent.

Supporting quotations

Where required under applicable law, we will only use your Personal Information with your consent; as necessary to provide you with products and services; to comply with a legal obligation; or when there is a legitimate and overriding interest that necessitates the use.

Depending on the country in which you are located, we will only process your Personal Information, where permitted under applicable laws, and when we have a legal basis for the processing as identified in the table below.

even though the chart below does not list consent as a legal basis for each processing activity, in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries, we rely on consent.

Qualifications & exceptions

• The legal-basis commitments apply "where required under applicable law" and depend on the country where you are located.
• Consent may be the legal basis in some countries even where the table does not list it.

Not stated here

• The notice does not say which countries treat consent as the only or most appropriate basis.

Legal Rights & Agreement Rules · Company practice

Payments: Mastercard mostly acts as processor and only sometimes as controller

In the legal-basis table, for processing payment transactions (including authorization, clearing, chargebacks and related dispute resolution), Mastercard says that in most cases it acts as a processor on behalf of financial institutions, merchants and other partners who are the data controllers; controllers are responsible for ensuring a legal basis, and where applicable Mastercard has taken steps to ensure they obtained your consent. In some limited cases, such as chargebacks, it may process as a controller, provided that you consented, the processing is necessary for entering into or performing a contract with you, or it is necessary to comply with a legal or regulatory obligation.

Supporting quotations

Process your payment transactions (including authorization, clearing, chargebacks and other related dispute resolution activities).

In most cases, we process your payment transactions as a processor on behalf of your financial institutions, merchants and other partners which act as data controllers. When we act as a processor, controllers are responsible for ensuring a legal basis for the processing of your Personal Information.

Where applicable, we have taken steps to ensure that controllers have obtained your consent to our processing of your Personal Information on their behalf.

In some limited cases (e.g., chargebacks), we may process your payment transactions as a controller, provided that:

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

The processing is necessary for compliance with a legal or regulatory obligation.

Qualifications & exceptions

• Table cell for the payment-processing row; the grounds apply "where required under applicable law" per the column heading.
• The controller grounds apply to "some limited cases (e.g., chargebacks)", not to payment processing generally.

Not stated here

• The table does not say which cases beyond chargebacks count as limited cases where Mastercard acts as controller.

Legal Rights & Agreement Rules · Company practice

Fraud prevention: as controller Mastercard cites consent, law, contract or legitimate interest

In the legal-basis table, for protecting against and preventing fraud and cyber threats, unauthorized transactions, claims and other liabilities, and managing risk exposure and franchise quality for the integrity and security of its payments network, Mastercard says it may act as a controller or a processor. When it acts as a controller it relies on one of these grounds: your consent; compliance with a legal or regulatory obligation; necessity for entering into or performing a contract with you; or its or a third party's legitimate interest in protecting against fraud and securing its network and the payment transactions it processes (including blockchain in relation to cryptocurrency).

Supporting quotations

Protect against and prevent fraud and cyber threats, unauthorized transactions, claims and other liabilities, and manage risk exposure and franchise quality with respect to the integrity and security of our payments network.

When we process Personal Information for fraud and cyber threat prevention, we may act as a controller or as a processor. When we act as a controller, we rely on one of the following legal grounds:

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal or regulatory obligation; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of protecting against fraud, securing our network and the payment transactions that we process (including blockchain in relation to cryptocurrency).

Qualifications & exceptions

• The listed legal grounds apply when Mastercard acts as a controller for fraud and cyber threat prevention; the table gives no grounds for its processor role.
• Grounds apply "where required under applicable law" per the column heading.

Not stated here

• The table does not say when Mastercard acts as controller rather than processor for fraud prevention.

Legal Rights & Agreement Rules · Company practice

Fraud prevention: separate notices cover fraud monitoring and the MATCH program

For fraud prevention, the legal-basis table includes Mastercard's or a third party's legitimate interest in protecting against fraud and securing its network and the payment transactions it processes, including blockchain in relation to cryptocurrency. It points to a Fraud & Security Notice for more on fraud prevention and monitoring, and to a MATCH Notice for the Mastercard Alert To Control High-risk Merchants (MATCH) program.

Supporting quotations

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of protecting against fraud, securing our network and the payment transactions that we process (including blockchain in relation to cryptocurrency).

For more information on our fraud prevention and monitoring activities, please see our

For more information on the Mastercard Alert To Control High-risk Merchants (MATCH) program, please see our

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Not stated here

• The Fraud & Security Notice and the MATCH Notice are linked but not supplied here, so their content is unknown.

Legal Rights & Agreement Rules · Company practice

Open Finance: consent, legal duty, contract or legitimate interest, or processor for partners

In the legal-basis table, for providing Open Finance solutions (including connectivity and dispute resolution services), Mastercard lists as grounds: your consent; compliance with a legal or regulatory obligation; necessity for entering into or performing a contract with you; or its or a third party's legitimate interest, for example detecting fraud risks or resolving disputes. It adds that in some cases it provides Open Finance solutions as a processor for your service provider, merchants and other partners that are controllers; the controllers are then responsible for a legal basis, and where applicable Mastercard has taken steps to ensure they obtained your consent. It points to an Open Finance Legal & Privacy Center for more information.

Supporting quotations

Provide our Open Finance solutions, including our connectivity and dispute resolution services.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal or regulatory obligation; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for such purpose (e.g., detecting fraud risks or resolving disputes).

In some cases, we provide our Open Finance solutions as a processor on behalf of your service provider, merchants and other partners which act as data controllers.

Where applicable, we have taken steps to ensure that controllers have obtained your consent to our processing of your Personal Information on their behalf.

For more information on our Open Finance activities, please see our

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The processor statement applies to "some cases" of Open Finance; the table does not say which.

Not stated here

• The Open Finance Legal & Privacy Center is linked but not supplied.

Legal Rights & Agreement Rules · Company practice

Accounts and identity checks: consent, contract, legal duty or legitimate interest

In the legal-basis table, for creating and managing accounts, verifying your identity, providing services and responding to inquiries, Mastercard lists as grounds: your consent; necessity for entering into or performing a contract with you; compliance with a legal or regulatory obligation; or its or a third party's legitimate interest in creating and managing accounts, verifying identity and responding to inquiries.

Supporting quotations

Create and manage any accounts you may have with us, verify your identity, provide our services, and respond to your inquiries.

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are a party; or

The processing is necessary for compliance with a legal or regulatory obligation; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of creating and managing accounts and verifying your identity, and responding to your inquiries.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Legal Rights & Agreement Rules · Company practice

Offers, loyalty, contests and donation programs: consent, contract or legitimate interest

In the legal-basis table, the activity of providing, administering and communicating about products, services, offers, loyalty programs and promotions of Mastercard, financial institutions, merchants and partners includes loyalty program operation, contests, sweepstakes, donation service program operation and any other marketing activities. The grounds listed are your consent; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in providing you with products and services. The cell points to a Loyalty Programs Notice and a Mastercard Donation Service Privacy Notice.

Supporting quotations

Provide, administer, and communicate with you about products, services, offers, loyalty programs and promotions (including loyalty program operation, contests, sweepstakes, donation service program operation, and any other marketing activities) of Mastercard, financial institutions, merchants, and partners.

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of providing you with products and services.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The row lists no legal-obligation ground; the legitimate interest is stated as "providing you with products and services".

Not stated here

• The Loyalty Programs Notice and Donation Service Privacy Notice are linked but not supplied.

Legal Rights & Agreement Rules · Company practice

Customer, supplier and vendor relationships: consent, contract or legitimate interest

In the legal-basis table, for managing customer, supplier and vendor relationships, including creating and publishing business directories that may include business contact information, Mastercard lists as grounds: your consent; necessity for entering into or performing a contract to which you are a party; or its or a third party's legitimate interest in managing those relationships.

Supporting quotations

Manage our customer, supplier and vendor relationships, including to create and publish business directories (which may include business contact information).

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of managing our customer, supplier and vendor relationships.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Legal Rights & Agreement Rules · Company practice

Running and improving the business, ad measurement and spending analysis: consent, contract or legitimate interest

In the legal-basis table, operating, evaluating and improving the business includes developing new products and services; cleansing, organizing and preparing data for permissible purposes; determining the effectiveness of and optimizing Mastercard's advertising; analyzing its products, services, websites, mobile apps and other digital assets to facilitate their functionality; and analyzing and comparing the spending approach of customers who have signed up to a marketing program (such as Priceless Specials) to understand and improve the program's effectiveness. The grounds listed are your consent; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in operating, evaluating and improving its products or services.

Supporting quotations

Operate, evaluate and improve our business (including developing new products and services or cleansing, organizing, and preparing data for permissible purposes); determining the effectiveness of and optimizing our advertising; analyzing our products, services, websites, mobile apps and any other digital assets in order to facilitate their functionality;

analyzing and comparing our customers’ approach to spending that have signed up to our marketing program (such as Priceless Specials) in order to understand and improve the effectiveness of the program.

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of operating, evaluating and improving our products or services.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The spending analysis concerns customers who have signed up to a marketing program such as Priceless Specials, not all cardholders.

Not stated here

• "Permissible purposes" for prepared data is not defined in the table.

Legal Rights & Agreement Rules · Company practice

Due diligence, accounting, billing and collections: legal duty, contract or legitimate interest

In the legal-basis table, performing due diligence reviews, accounting, auditing, billing, reconciliation and collection activities rests on: compliance with a legal or regulatory obligation; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in performing due diligence, billing, reconciliation and collection activities. Consent is not listed for this row.

Supporting quotations

Performing due diligence reviews, accounting, auditing, billing, reconciliation and collection activities.

The processing is necessary for compliance with a legal or regulatory obligation; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of performing due diligence, billing, reconciliation and collection activities.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• Consent is not listed for this row, although the preceding text says some countries rely on consent even where the table does not list it.

Legal Rights & Agreement Rules · Company practice

Employment interest: contacting you about jobs rests on contract, legitimate interest or legal duty

In the legal-basis table, evaluating your interest in employment and contacting you about possible employment with Mastercard rests on necessity for entering into or performing a contract with you; Mastercard's or a third party's legitimate interest in evaluating your interest and contacting you; or compliance with a legal or regulatory obligation. The cell points to the Mastercard Applicant Privacy Notice for more information.

Supporting quotations

Evaluate your interest in employment and contact you regarding possible employment with Mastercard.

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of evaluating your interest in employment and contacting you regarding possible employment; or

The processing is necessary for compliance with a legal or regulatory obligation.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Not stated here

• The Applicant Privacy Notice is linked but not supplied.

Legal Rights & Agreement Rules · Company practice

Public feedback: processing public posts rests on legitimate interest

In the legal-basis table, assessing public feedback about Mastercard by processing publicly available information, including social media posts, and responding to customer inquiries on public platforms, rests on Mastercard's or a third party's legitimate interest in processing publicly available information to understand public feedback, improve its products and services, and respond to inquiries on public platforms.

Supporting quotations

Assess public feedback about Mastercard by processing publicly available information, including social media posts, and respond to customer inquiries directed to us on public platforms.

We, or a third party, have a legitimate interest in processing publicly available information for the purpose of understanding public feedback about Mastercard, improving our products and services, and responding to customer inquiries directed to us via public platforms.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• Legitimate interest is the only ground listed for this row.

Legal Rights & Agreement Rules · Company practice

Enforcing terms and defending legal rights: contract, legal duty or legitimate interest

In the legal-basis table, enforcing Mastercard's Terms of Use, or processing as necessary to establish, exercise and defend legal rights, rests on necessity for entering into or performing a contract with you; compliance with a legal or regulatory obligation; or Mastercard's or a third party's legitimate interest in enforcing the Terms of Use and establishing, exercising and defending legal rights.

Supporting quotations

Enforce our

or as necessary to establish, exercise and defend legal rights.

The processing is necessary for entering into, or performance of a contract to which you are party; or

The processing is necessary for compliance with a legal or regulatory obligation; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of enforcing the

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Not stated here

• The Terms of Use are linked but not supplied here.

Legal Rights & Agreement Rules · Company practice

Legal compliance and requests from courts, law enforcement or agencies

In the legal-basis table, processing as may be required by applicable laws and regulations, including Know Your Customer, anti-money-laundering, anti-corruption and sanctions screening requirements, or as requested by any judicial process, law enforcement or governmental agency having or claiming jurisdiction over Mastercard or its affiliates, rests on compliance with a legal or regulatory obligation, and on Mastercard's or a third party's legitimate interest in responding to a judicial process, law enforcement or governmental agency.

Supporting quotations

As may be required by applicable laws and regulations, including for compliance with Know Your Customers, Anti-Money Laundering, anti-corruption and sanctions screening requirements, or as requested by any judicial process, law enforcement or governmental agency having or claiming jurisdiction over Mastercard or Mastercard’s affiliates.

The processing is necessary for compliance with a legal or regulatory obligation; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of responding to a judicial process, law enforcement or governmental agency.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• Covers agencies "having or claiming jurisdiction", so a request from an agency whose jurisdiction is only claimed is within the wording.

Not stated here

• The table does not say what information is disclosed to authorities or whether affected individuals are notified.

Legal Rights & Agreement Rules · Company practice

Complying with industry standards and Mastercard policies: consent, legal duty, contract or legitimate interest

In the legal-basis table, complying with industry standards and Mastercard's own policies rests on your consent; compliance with a legal or regulatory obligation; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in complying with industry standards and its policies.

Supporting quotations

Comply with industry standards and our policies.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal or regulatory obligation; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of complying with industry standards and our policies.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Not stated here

• The standards and policies referred to are not supplied in this source, and the notice does not say which ones are meant.

Legal Rights & Agreement Rules · Company practice

Product development and AI use: the legitimate-interest cell repeats the industry-standards wording

In the legal-basis table, developing and improving products and services, detecting and preventing deceptive, fraudulent or illegal activity and improving customer and consumer experience, with artificial intelligence and machine learning techniques used to process and analyze data, rests on your consent; compliance with a legal obligation or other regulatory obligations; necessity for entering into or performing a contract with you; or a legitimate interest. The legitimate-interest cell is worded as a legitimate interest "for the purposes of complying with industry standards and our policies", which is the same wording as the previous row, and does not mention product development, fraud detection or AI.

Supporting quotations

Develop and improve products and services, detect, and prevent deceptive, fraudulent, or illegal activity, and improve customer and consumer experience.

we may use techniques such as artificial intelligence and machine learning to process and analyze data.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of complying with industry standards and our policies.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The legitimate-interest wording for this row names compliance with industry standards and policies as its purpose, not the row's own activities.

Not stated here

• The notice does not explain whether the legitimate-interest wording in this row is intended to cover development, fraud detection and AI use, or repeats the previous row's wording by mistake.

Legal Rights & Agreement Rules · Company practice

Business sale or merger: legal duty, contract or a legitimate interest worded as industry standards

In the legal-basis table, enabling mergers, acquisitions and/or the sale of Mastercard's business or assets (including disclosing personal information about the affected business or assets to a prospective buyer or acquirer) rests on compliance with a legal obligation or other regulatory obligations; necessity for entering into or performing a contract with you; or a legitimate interest. The legitimate-interest cell is worded as a legitimate interest "for the purposes of complying with industry standards and our policies", the same wording used in the two previous rows, and does not mention business transfers.

Supporting quotations

Enable mergers, acquisitions and/or sale of business or assets.

we may disclose your personal information relating to those business and assets to the prospective buyer or acquiring third-party.

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of complying with industry standards and our policies.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The legitimate-interest wording in this row names compliance with industry standards and policies as its purpose, not business transfers.

Not stated here

• The notice does not explain whether the legitimate-interest wording in this row is intended to cover business transfers or repeats an earlier row's wording.
• The standards and policies referred to are not supplied in this source.

Legal Rights & Agreement Rules · Procedure

Other purposes are explained in a specific privacy notice at the time of collection

In the legal-basis table, the row for other purposes for which Mastercard provides specific notice at the time of collection gives no legal ground itself; it tells the reader to consult the Specific Privacy Notice at the time of the collection.

Supporting quotations

For other purposes for which we provide specific notice at the time of collection.

Please consult the Specific Privacy Notice at the time of the collection.

Qualifications & exceptions

• The legal basis for these purposes is not stated in this table.

Not stated here

• The specific privacy notices are given at the time of collection and are not part of this notice, so the grounds for those purposes are unknown here.

Legal Rights & Agreement Rules · Company commitment

Mastercard says it has weighed legitimate interests against your rights where required

Where required under applicable law, Mastercard says it has carried out balancing tests for processing based on its or a third party's legitimate interests, to ensure that the legitimate interest is not overridden by your interests, fundamental rights or freedoms. For more information on the balancing tests you may contact Mastercard as described in the "How to Contact Us" section.

Supporting quotations

Where required under applicable law, we have carried out balancing tests for the data processing based on our or a third party’s legitimate interests to ensure that such legitimate interest is not overridden by your interests, fundamental rights or freedoms.

For more information on our balancing tests, you may contact us as described in the “How to Contact Us” section below.

Qualifications & exceptions

• Balancing tests are stated as carried out "where required under applicable law"; the notice does not say where that is.

Not stated here

• The results of the balancing tests are not published in this notice; the notice only offers contact for more information.

Legal Rights & Agreement Rules · Restriction or exception

If you give Mastercard information about someone else, you must make sure sharing it is lawful

Mastercard says that if you provide information or material relating to another individual, you must make sure that sharing it with Mastercard, and its further use as described to you from time to time, is in line with applicable laws. As an example, it says you should duly inform that individual about the processing of their Personal Information and obtain their consent, as may be necessary under applicable laws.

Supporting quotations

If you provide us with any information or material relating to another individual, you must make sure that the sharing with us and our further use as described to you from time to time is in line with applicable laws

you should duly inform that individual about the processing of her/his Personal Information and obtain her/his consent, as may be necessary under applicable laws.

Qualifications & exceptions

• Informing the other person and obtaining consent is required only "as may be necessary under applicable laws".

Not stated here

• The notice does not say what happens if you do not comply.

Legal Rights & Agreement Rules · User right or choice

Your rights and choices depend on your country

Mastercard says that, depending on your country, you may have rights regarding the Personal Information it maintains and choices about what it collects from you, how it uses it and how it communicates with you. The rights listed are to opt out of some collection or uses, to access and correct data and to restrict, object to or delete processing, to receive your data for transfer to another company, to withdraw consent, and to complain to a supervisory authority.

Supporting quotations

Depending on your country, you may have the right or choice to:

You may have certain rights regarding the Personal Information we maintain about you and certain choices about what Personal Information we collect from you, how we use it, and how we communicate with you.

Qualifications & exceptions

• Rights are stated as ones you "may have" depending on your country; the notice does not list which countries give which rights.

Not stated here

• The notice does not say which countries or which people qualify for each right.

Legal Rights & Agreement Rules · User right or choice

You may be able to complain to a supervisory authority, including where an incident took place

Where applicable, you may lodge a complaint with your relevant supervisory authority or regulator. Mastercard adds that, depending on your country, this may include the relevant authority in your country of residence, your place of work or where an incident took place.

Supporting quotations

Where applicable, lodge a complaint with your relevant supervisory authority or regulator.

you may also have the right to lodge a complaint with the relevant supervisory authority or regulator, including in your country of residence, place of work or where an incident took place.

Qualifications & exceptions

• Stated "where applicable" and "depending on the country", so not every reader has this right.

Legal Rights & Agreement Rules · Procedure

Use the My Data portal or the contact route to exercise rights; U.S. residents may have more

You, or a party authorized to act for you, can exercise your rights on Mastercard's "My Data" portal or by submitting a request as described in the "How to Contact Us" section. If you reside in the United States, the notice says you may have additional rights as described in the U.S. Privacy Addendum, and that U.S. state residents with legal privacy rights can request them through the My Data portal, by email, or by calling a toll-free number.

Supporting quotations

You, or a party authorized to act on your behalf, can exercise your rights on Mastercard’s

portal or by submitting a request as described in the “How to Contact Us” section below.

If you reside in the United States, you may have additional rights as described in our U.S. Privacy Addendum.

If you reside in a state in the United States which recognizes privacy rights under law, you may exercise your rights under applicable privacy law by submitting your request on Mastercard’s

Qualifications & exceptions

• U.S. additional rights are described in the U.S. Privacy Addendum and apply to residents of states that recognize privacy rights under law.

Not stated here

• The My Data portal is a separate web page not supplied here.

Legal Rights & Agreement Rules · User right or choice

U.S. residents may have additional rights described in the U.S. Privacy Addendum

If you reside in the United States, Mastercard says you may have additional rights as described in its U.S. Privacy Addendum, which is part of the same page.

Supporting quotations

If you reside in the United States, you may have additional rights as described in our U.S. Privacy Addendum.

Qualifications & exceptions

• Applies to people residing in the United States.

Legal Rights & Agreement Rules · Context

A My Data report shows how many privacy requests Mastercard processed worldwide

Mastercard points to a "My Data Report" section of its My Data portal for information on the number of privacy requests it processed pursuant to privacy laws globally. The report itself is on the portal and is not part of this notice.

Supporting quotations

For information on the number of privacy requests Mastercard processed pursuant to privacy laws globally, please review the

Not stated here

• The My Data Report is on a linked portal page that is not supplied here, so the request counts are unknown.

Legal Rights & Agreement Rules · Restriction or exception

The list of rights is not exhaustive and may be limited by local law

Mastercard notes that its list of rights may not be exhaustive, so you may have additional rights under your local laws. It also says the rights listed may be limited in some circumstances by local law requirements.

Supporting quotations

Note that this list may not be exhaustive, which means that you may have additional rights in accordance with your local laws.

In addition, the above rights may be limited in some circumstances by local law requirements.

Qualifications & exceptions

• Both statements depend on your local law; the notice does not say which circumstances limit the rights.

Not stated here

• The notice does not say which local-law requirements can limit the rights.

Legal Rights & Agreement Rules · Procedure

Contact Mastercard to update preferences, leave mailing lists or make a rights request

To update your preferences, ask Mastercard to remove your information from its mailing lists, or submit a request to exercise your rights under applicable law, the notice tells you to contact it as specified in the "How To Contact Us" section. It also says it developed the My Data portal to facilitate the exercise of rights, which you or a party authorized to act for you can use or you can submit a request as described in the contact section.

Supporting quotations

To update your preferences, ask us to remove your information from our mailing lists or submit a request to exercise your rights under applicable law, contact us as specified in the "How To Contact Us" section below.

We have developed Mastercard’s “

” portal to facilitate the exercise of your rights.

Qualifications & exceptions

• The My Data portal is one route; the other is the contact methods in the contact section.

Not stated here

• The My Data portal is a separate web page not supplied here.

Legal Rights & Agreement Rules · Procedure

Tell Mastercard about privacy problems; it tries to respond within a reasonable time

If Mastercard falls short of your expectations in processing your Personal Information, or you wish to complain about its privacy practices, it asks you to tell it and to give full details of the issue. It says it attempts to review and respond to all complaints within a reasonable time and as required under applicable law.

Supporting quotations

If we fall short of your expectations in processing your Personal Information or you wish to make a complaint about our privacy practices, please tell us because it gives us an opportunity to fix the problem.

We attempt to review and respond to all complaints within a reasonable time and as required under applicable law.

Qualifications & exceptions

• Response is an attempt "within a reasonable time", with no fixed deadline stated.

Legal Rights & Agreement Rules · Procedure

An APEC certification dispute resolution route is available through the TRUSTe seal

Mastercard says that to learn more about its APEC Certification and to access dispute resolution, you can click on the TRUSTe seal. The seal and the dispute resolution service are outside this text.

Supporting quotations

To learn more about the APEC Certification and access Dispute Resolution, please click on the TRUSTe seal.

Not stated here

• The TRUSTe dispute resolution page is not part of this source, so how that process works is not stated here.

Legal Rights & Agreement Rules · Company commitment

Mastercard says its practices comply with the APEC Cross Border Privacy Rules system

Mastercard states that its privacy practices, as described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System and the Global CBPR Forum, which provide a framework for organizations to ensure protection of Personal Information transferred among participating APEC economies. This is stated twice in the section with links to the APEC and Global CBPR Forum pages.

Supporting quotations

Mastercard’s privacy practices, described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System and the Global CBPR Forum.

These systems provide a framework for organizations to ensure protection of Personal Information transferred among participating APEC economies.

Additionally, Mastercard’s privacy practices, described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System and the Global CBPR Forum.

Qualifications & exceptions

• The framework applies to transfers among participating APEC economies.

Not stated here

• The APEC and Global CBPR Forum pages are linked but not supplied.

Legal Rights & Agreement Rules · Company commitment

Mastercard may update the notice and says it will post a prominent notice of material changes

Mastercard says the notice may be updated periodically to reflect changes in its privacy practices. It says it will post a prominent notice on relevant websites to notify you of any significant or material changes before they take effect and will indicate at the top of the notice when it was most recently updated. In certain circumstances it may seek your consent if it updates the notice.

Supporting quotations

This Global Privacy Notice may be updated periodically to reflect changes in our privacy practices.

We will post a prominent notice on relevant websites to notify you of any significant or material changes to our Global Privacy Notice prior to them being effective and indicate at the top of the Notice when it was most recently updated.

If we update our Global Privacy Notice, in certain circumstances, we may seek your consent.

Qualifications & exceptions

• The advance notice is for "significant or material" changes on "relevant websites"; other changes are not promised prior notice.

Not stated here

• The notice does not say in which circumstances consent will be sought or how far ahead material changes are announced.

Legal Rights & Agreement Rules · Procedure

Contact the Global Privacy Office by email, My Data portal, phone or mail

Mastercard says you can email its Global Privacy Office, submit a request on the My Data portal, or call a toll-free number (1-833-244-4084) to exercise your rights. For questions, comments or complaints about the notice and its privacy practices, or to update privacy preferences, you can email the same address or write to the Global Privacy Office, Mastercard International Incorporated, 2000 Purchase Street, Purchase, New York 10577, USA.

Supporting quotations

You can e-mail our Global Privacy Office at

or by calling us toll-free at 1-833-244-4084.

If you have any questions, comments or complaints about this Global Privacy Notice and our privacy practices, or would like to update your privacy preferences, please email us at

Global Privacy Office Mastercard International Incorporated 2000 Purchase Street Purchase, New York 10577 USA

Qualifications & exceptions

• Applies generally; regional entities and routes are given separately for some regions.

Legal Rights & Agreement Rules · Procedure

U.S. state residents can use the portal, email or phone and see the U.S. Privacy Addendum

If you reside in a U.S. state that recognizes privacy rights under law, Mastercard says you may exercise your rights under applicable privacy law by submitting a request on the My Data portal, emailing it, or calling its toll-free number, and refers you to the U.S. Privacy Addendum for more information.

Supporting quotations

If you reside in a state in the United States which recognizes privacy rights under law, you may exercise your rights under applicable privacy law by submitting your request on Mastercard’s

For more information on exercising these rights, please see our U.S. Privacy Addendum.

Qualifications & exceptions

• Applies to residents of U.S. states that recognize privacy rights under law.

Legal Rights & Agreement Rules · Procedure

In Quebec, contact the Data Protection Officer; ask your bank or merchant about card purchases

If you are located in Quebec, Canada, Mastercard says you may contact its Data Protection Officer by email. For inquiries about your Mastercard card and your purchase, it says to contact your financial institution or merchant.

Supporting quotations

If you are located in Quebec, Canada, you may contact our Data Protection Officer at

For inquiries about your Mastercard card and your purchase, you should contact your financial institution or merchant.

Qualifications & exceptions

• Applies to people located in Quebec, Canada.

Legal Rights & Agreement Rules · Procedure

In the EEA, UK and Switzerland, Mastercard Europe SA is the responsible controller

If you are located in the EEA, the UK or Switzerland, Mastercard says Mastercard Europe SA is the entity responsible for processing your Personal Information (the data controller). You can submit rights requests on the My Data portal, by email, or by writing to the Europe Data Protection Officer at Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium.

Supporting quotations

If you are located in the EEA, the UK or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information (or data controller).

Europe Data Protection Officer Mastercard Europe SA Chaussée de Tervuren 198A B-1410 Waterloo Belgium

Qualifications & exceptions

• Applies to people located in the EEA, the UK or Switzerland.

Legal Rights & Agreement Rules · Procedure

Brazil and Latin America and Caribbean readers have their own responsible entity and officers

If you are located in Brazil, Mastercard says Mastercard Brasil Soluções de Pagamento Ltda. is the entity responsible for processing your Personal Information, and you can submit rights requests on the My Data portal, by email or by writing to the Brazil Data Protection Officer in São Paulo. If you are located in the Caribbean and Latin America, you can submit requests on the My Data portal and may also contact the Data Protection Officer responsible for those regions by email.

Supporting quotations

If you are located in Brazil, Mastercard Brasil Soluções de Pagamento Ltda. is the entity responsible for the processing of your Personal Information.

Brazil Data Protection Officer Mastercard Brasil Soluções de Pagamento Ltda.

If you are located in the Caribbean and Latin America, you may submit your request to exercise your rights to your Personal Information on Mastercard’s

Qualifications & exceptions

• Brazil and the Caribbean and Latin America are treated separately; the Caribbean and Latin America text does not name a responsible entity.

Not stated here

• The notice does not name the entity responsible for processing in the Caribbean and Latin America.

Legal Rights & Agreement Rules · Procedure

In Asia Pacific, the Middle East and Africa, Mastercard Asia Pacific Pte. Ltd. is responsible

If you are located in Asia Pacific (excluding mainland China and South Korea), the Middle East or Africa, Mastercard says Mastercard Asia Pacific Pte. Ltd. is the entity responsible for processing your Personal Information. You can submit rights requests by email, by calling a toll-free number listed on a linked page, or by writing to the Asia Pacific, Middle East and Africa Data Protection Officer at Mastercard Asia/Pacific Pte Ltd, 3 Fraser Street, DUO Tower, Level 17, Singapore 189352.

Supporting quotations

If you are located in Asia Pacific (excluding mainland China and South Korea), Middle East or Africa, Mastercard Asia Pacific Pte. Ltd. is the entity responsible for the processing of your Personal Information.

Asia Pacific, Middle East and Africa Data Protection Officer Mastercard Asia/Pacific Pte Ltd 3 Fraser Street, DUO Tower, Level 17 Singapore 189352

Qualifications & exceptions

• Excludes mainland China and South Korea, which are addressed separately.

Not stated here

• The toll-free numbers are on a linked page not supplied here.

Legal Rights & Agreement Rules · User right or choice

In South Africa you may also complain to the South African Information Regulator

If you are located in South Africa, Mastercard says you may also send your complaint to the South African Information Regulator, and gives an email address, a postal address and a website for it.

Supporting quotations

If you are located in South Africa, you may also send your complaint to the South African Information Regulator at the following:

Email:

Qualifications & exceptions

• Applies to people located in South Africa; the regulator is in addition to Mastercard's own contact routes.

Legal Rights & Agreement Rules · Procedure

In mainland China and South Korea, separate entities are responsible

If you are located in mainland China, Mastercard says Mastercard Shanghai Business Consulting Ltd. is the entity responsible for processing your Personal Information, and you can submit rights requests by email or by writing to the China Data Protection Officer in Shanghai. If you are located in South Korea, Mastercard says Mastercard International Korea Co., Ltd. is designated as its domestic representative for processing your Personal Information, and you can submit requests by email or by calling a toll-free number listed on a linked page.

Supporting quotations

If you are located in mainland China, Mastercard Shanghai Business Consulting Ltd. is the entity responsible for the processing of your Personal Information.

China Data Protection Officer Room 2907-14, Part of 29/F Tower 2 Shanghai IFC, 8 Century Avenue China (Shanghai) Pilot Free Trade Zone

If you are located in South Korea, Mastercard International Korea Co., Ltd. is designated as our domestic representative for the processing of your Personal Information.

Qualifications & exceptions

• Mainland China and South Korea are covered separately from the rest of Asia Pacific; South Korea uses a "domestic representative" rather than a responsible entity.

Not stated here

• The Korea business address and toll-free number are on linked pages not supplied here.

Legal Rights & Agreement Rules · Procedure

In South Korea, Mastercard International Korea is the designated domestic representative

If you are located in South Korea, Mastercard says Mastercard International Korea Co., Ltd. is designated as its domestic representative for processing your Personal Information. The entity is led by the Korea Division President, with the Korea business address given on a linked page. You can submit a request to exercise your rights by email or by calling a toll-free number listed on a linked page.

Supporting quotations

If you are located in South Korea, Mastercard International Korea Co., Ltd. is designated as our domestic representative for the processing of your Personal Information.

You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com, or calling our toll-free number listed

Qualifications & exceptions

• Applies to people located in South Korea; the entity is a "domestic representative", and the text does not call it the controller.

Not stated here

• The Korea business address and the toll-free number are on linked pages that are not supplied here.

Legal Rights & Agreement Rules · Context

The U.S. Privacy Addendum adds state-law information for U.S. residents

The notice says that if you reside in the United States, the U.S. Privacy Addendum supplements the information in the Global Privacy Notice for certain states, as indicated in Section 11. It says the addendum applies to residents of the United States whose states have passed state-specific privacy laws.

Supporting quotations

If you reside in the United States, this U.S. Privacy Addendum supplements the information above for certain states, as indicated in this Section 11.

This U.S. Privacy Addendum supplements the information contained in the Global Privacy Notice. This U.S. Privacy Addendum applies to residents in the United States whose states have passed state-specific privacy laws.

Qualifications & exceptions

• Applies to U.S. residents whose states have passed state-specific privacy laws, and only supplements the Global Privacy Notice rather than replacing it.

Not stated here

• The addendum does not list at this point which states are covered; a later section lists some states.

Legal Rights & Agreement Rules · Context

The U.S. Privacy Addendum says it was last updated June 16, 2026

The U.S. Privacy Addendum states "LAST UPDATED: June 16, 2026". The Global Privacy Notice above it states a different, earlier effective date of 1/19/2026, so the page carries two dates for its two parts.

Supporting quotations

LAST UPDATED: June 16, 2026

Qualifications & exceptions

• The June 16, 2026 date belongs to the U.S. Privacy Addendum; the main notice states its own effective date.

Not stated here

• The page does not say what changed in the addendum on June 16, 2026.

Legal Rights & Agreement Rules · Context

California residents may rely on the Global Privacy Notice plus the CCPA information below

For California residents from whom Mastercard collects Personal Information as a business under the CCPA, the addendum says they may rely on the Global Privacy Notice and the additional information in the California section. California job applicants are sent to a separate Mastercard Applicant Privacy Notice. For this section, "Personal Information" is defined by reference to the CCPA: information that identifies, relates to, describes or can reasonably be linked with a particular consumer or household, excluding information that is publicly available, deidentified or aggregated as the CCPA defines those terms.

Supporting quotations

If you are a California resident from whom we collect Personal Information as a business under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) (“CCPA”), you may rely on the Global Privacy Notice and the additional information below.

If you are a job applicant who is a California resident, please see the

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the CCPA.

Personal Information does not include information that is publicly available, deidentified, or aggregated (as those terms are defined in the CCPA) or otherwise excluded from the scope of the CCPA.

Qualifications & exceptions

• Applies to California residents from whom Mastercard collects Personal Information "as a business under" the CCPA; job applicants are directed to a different notice.

Not stated here

• The Mastercard Applicant Privacy Notice is linked but not supplied here.

Legal Rights & Agreement Rules · Company commitment

Mastercard says it does not use sensitive data in ways that require a right to limit under the CCPA

The addendum says Mastercard does not use or disclose sensitive personal information for purposes which would require it to offer consumers the right to limit under the CCPA.

Supporting quotations

We do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit under the CCPA.

Qualifications & exceptions

• Made under the CCPA for California consumers; which purposes require the right is Mastercard's own assessment.

Legal Rights & Agreement Rules · User right or choice

California residents may request what data is collected, its sources, purposes, recipients and specifics

The addendum says California residents may exercise a right to know and access by submitting a verifiable request for information about: the categories of Personal Information collected about them; the categories of sources; the business or commercial purpose for collecting, selling or sharing it; the categories of third parties to whom it is disclosed; and the specific pieces of Personal Information collected about them.

Supporting quotations

If you are a California resident, you may exercise the following rights.

Right to Know and Access. You may submit a verifiable request for information regarding:

what categories of Personal Information we have collected about you;

the categories of sources from which Personal Information is collected;

the business or commercial purpose for collecting, selling, or sharing Personal Information;

the categories of third parties to whom we disclose Personal Information; and

the specific pieces of Personal Information we have collected about you.

Qualifications & exceptions

• Applies to California residents and requires a "verifiable" request.

Not stated here

• The verification process and any exceptions are described in later text, not in this list.

Legal Rights & Agreement Rules · User right or choice

California residents can ask Mastercard to delete or correct their data, subject to exceptions

The addendum says that, subject to certain exceptions, California residents may submit a verifiable request that Mastercard delete Personal Information it has collected from them, and that Mastercard maintains a record of such requests as the CCPA requires. It also says residents have the right to correct inaccurate Personal Information Mastercard maintains about them.

Supporting quotations

Right to Delete. Subject to certain exceptions, you may submit a verifiable request that we delete Personal Information about you that we have collected from you.

We maintain a record of such requests as required by the CCPA.

Right to Correct. You have the right to correct inaccurate Personal Information that we maintain about you.

Qualifications & exceptions

• Deletion applies to information collected "from you" and is "subject to certain exceptions" that the addendum does not list.

Not stated here

• The exceptions to the right to delete are not listed in this source.

Legal Rights & Agreement Rules · Procedure

How California residents or their agents submit requests

To exercise rights to know, access, delete or correct under the CCPA, the addendum says to submit a request on the My Data portal, email the privacy address, or call a toll-free number. An authorized agent acting for a California resident to know, delete, correct or opt out can use the same channels, and Mastercard says it will require a written authorization signed by the resident whose Personal Information is the subject of the request.

Supporting quotations

To exercise your rights to know, access, delete, or correct under the CCPA, please submit your request on Mastercard’s

or call our toll-free number: 1-833-244-4084.

If you are acting as an authorized agent to make a request to know, delete, correct, or opt out on behalf of a California resident, you may submit a request on Mastercard’s

Please note that we will require you to attach a written authorization signed by the resident whose Personal Information will be subject to the request.

Qualifications & exceptions

• An authorized agent must attach a written authorization signed by the resident.

Not stated here

• The My Data portal is a separate web page not supplied here.

Legal Rights & Agreement Rules · Company commitment

Mastercard publishes yearly CCPA request metrics on the My Data portal

The addendum says that each calendar year Mastercard compiles metrics describing how it has complied with requests to delete, access, correct and opt out of sharing, which can be viewed on the My Data portal.

Supporting quotations

Each calendar year, we compile various metrics describing how we have complied with requests to delete, access, correct, and opt-out of sharing.

Not stated here

• The metrics themselves are on the My Data portal and not supplied here.

Legal Rights & Agreement Rules · User right or choice

Mastercard says it honors U.S. state privacy rights wherever you live, naming twenty states

The U.S. section says Mastercard honors your privacy rights in accordance with applicable U.S. state laws no matter where you reside. If you are a U.S. resident from whom it collects Personal Information as a controller, you may have rights under an applicable state privacy law, including those in effect in Alabama, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, or under a state privacy law that becomes effective in the future. It says you may rely on the disclosures in the Global Privacy Notice about how it collects, uses and discloses personal information and the choices you can make.

Supporting quotations

At Mastercard, we honor your privacy rights in accordance with applicable U.S. state laws, no matter where you reside.

If you are a U.S. resident from whom we collect Personal Information as a controller, you may have certain rights under an applicable U.S. state privacy law, including those in effect in Alabama, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, or under a state privacy law that becomes effective in the future.

You may rely on the disclosures in the

regarding how we collect, use, and disclose your personal information as well as the choices you can make related to your personal information.

Qualifications & exceptions

• Rights depend on "an applicable U.S. state privacy law"; the state list is introduced with "including", and applies to U.S. residents from whom Mastercard collects Personal Information as a controller.

Not stated here

• The addendum does not say which rights each state law gives or whether the list is complete.

Legal Rights & Agreement Rules · User right or choice

You may ask for information about how your biometric data is processed and disclosed

The U.S. section lists a right to obtain information about biometric data processing, including the category or description of your biometric data, the source it was collected from, the purpose for collection and processing, the identity of any third party it was disclosed to and the purposes for disclosure, and the category or description of the specific biometric data disclosed to third parties.

Supporting quotations

Right to obtain information about biometric data processing, including the category or description of your biometric data, the source from which it was collected, the purpose for collection and processing, the identity of any third party to whom it was disclosed and the purposes for disclosure, and the category or description of specific biometric data that was disclosed to third parties.

Qualifications & exceptions

• Listed among the rights you "may have" under applicable state laws.

Legal Rights & Agreement Rules · User right or choice

You may ask which third parties received your personal data, such as advertising and analytics providers

The U.S. section lists a right to obtain information about third parties to whom Mastercard has disclosed personal data, such as Advertising Providers and Analytics Providers.

Supporting quotations

Right to obtain information about third parties to whom we have disclosed personal data, such as Advertising Providers and Analytics Providers.

Qualifications & exceptions

• Listed among the rights you "may have" under applicable state laws; the examples are introduced with "such as".

Legal Rights & Agreement Rules · Procedure

U.S. rights can be exercised through the My Data portal, email or phone, including by an agent

The U.S. section says you (or, where permitted by law, your authorized agent) can exercise your rights on the My Data portal, by emailing Mastercard, or by calling its toll-free number, and refers to the California authorized-agent text and to Section 7 of the California disclosures for more on exercising these rights.

Supporting quotations

You (or, where permitted by law, your authorized agent) can exercise your rights on Mastercard’s

or by calling our toll-free number at 1-833-244-4084.

Please refer to Section 7 of the Additional Disclosures for California Residents above for more information on exercising these rights.

Qualifications & exceptions

• An authorized agent may act only "where permitted by law".

Not stated here

• The My Data portal is a separate web page not supplied here.

Legal Rights & Agreement Rules · Context

A printable U.S. version is offered as a downloadable file

At the end of the page Mastercard offers a printable version of its U.S. Global Privacy Notice as a download link. The downloadable file is separate from this page text.

Supporting quotations

Get a printable version of our U.S. Global Privacy Notice

Not stated here

• The downloadable file is not supplied here, so whether it matches this page text is not stated.