Global Privacy Notice (with US Privacy Addendum and California Privacy Notice)

Use & Processing · Company practice

Mastercard often handles data for banks and merchants, who set the rules

Mastercard says it also acts on behalf of and under the instructions of financial institutions, merchants and other partners that act as data controllers, including to process payment transactions. In those situations the reader is pointed to those controllers' own privacy policies for how their Personal Information is processed. Mastercard says that, unless the law otherwise authorizes, it will process Personal Information in those situations to process payment transactions or for the purposes agreed between Mastercard and those partners.

Supporting quotations

we also act on behalf of and under the instructions of financial institutions, merchants and other partners which act as data controllers, including for processing payment transactions. Please refer to their respective privacy policies for more information regarding the processing of your Personal Information in these contexts.

Unless otherwise authorized by law, we will process your Personal Information to process payment transactions or for the purposes agreed between Mastercard and the financial institutions, merchants and other partners.

Qualifications & exceptions

• Applies to the situations where Mastercard acts for a bank, merchant or other partner as controller, not to every Mastercard activity.
• Processing in those situations is limited to payment transactions or the purposes agreed with the partner, unless the law authorizes otherwise.

Not stated here

• The partners' own privacy policies are not part of this page, so what they do with the data is not stated here.

Use & Processing · User right or choice

Three links near the top lead to opt-out and data request pages

Below the introduction the page lists three links: Data Analytics Opt-Out, Marketing Email Opt-Out and My Data. The text here gives only the link names; it does not describe what each one covers or how it works.

Supporting quotations

Data Analytics Opt-Out

Marketing Email Opt-Out

My Data

Qualifications & exceptions

• The page text names the three links but does not describe their scope; the linked pages are not supplied.

Not stated here

• What each linked page lets the reader do, and for which products or regions, is not stated in this page text.

Use & Processing · Company commitment

Where the law requires, Mastercard says it obtains consent first

Mastercard says that where applicable law requires it, it obtains your consent before using the automated means described above and before sending marketing communications, tailored content and advertising. The notice sends readers to its "Your Rights and Choices" section to learn about their choices.

Supporting quotations

Where required under applicable law, we obtain your consent prior to using the above automated means, and prior to sending you marketing communications, tailored content and advertising.

Please see the “Your Rights and Choices” section of this Global Privacy Notice to learn about your choices.

Qualifications & exceptions

• Consent is promised only "where required under applicable law"; it is not a general consent rule for every place or every use.

Not stated here

• The notice does not say in which places or for which uses the law is treated as requiring consent.

Use & Processing · Company practice

Core uses: process payments, prevent fraud and run Open Finance

The list of uses begins with processing payment transactions, protecting against and preventing fraud and other legal or information security risks, and providing Mastercard's Open Finance solutions. The fraud item points to a Fraud & Security Notice and a MATCH Notice, and the Open Finance item to a separate Open Finance page, for more information.

Supporting quotations

We May Use Your Personal Information to:

Process your payment transactions.

Protect against and prevent fraud, and other legal or information security risks.

Provide our

Qualifications & exceptions

• The list is introduced with "We May Use Your Personal Information to"; items state what Mastercard may do, not that each applies to every person.

Not stated here

• The Fraud & Security Notice, MATCH Notice and Open Finance page are linked but not supplied, so their additional detail is unknown here.

Use & Processing · Company practice

Uses for accounts, identity checks, communications, loyalty and personalized recommendations

Mastercard says it may use Personal Information to create and manage accounts you may have with it, verify your identity, provide its services and respond to inquiries; to provide and communicate with you about products and services offered by Mastercard, financial institutions, merchants and partners; to offer and support loyalty programs (with a link to a Loyalty Notice); and to provide personalized services and recommendations.

Supporting quotations

Create and manage any accounts you may have with us, verify your identity, provide our services, and respond to your inquiries.

Provide and communicate with you about products and services offered by Mastercard, financial institutions, merchants and partners.

Offer and support loyalty programs.

Provide you with personalized services and recommendations.

Qualifications & exceptions

• Communications cover products and services offered not only by Mastercard but also by financial institutions, merchants and partners.

Not stated here

• The Loyalty Notice is linked but not supplied.

Use & Processing · Company practice

Business contacts may be published in business directories

Mastercard says it may use Personal Information to manage its customer, supplier and vendor relationships, including to create and publish business directories, which may include business contact information.

Supporting quotations

Manage our customer, supplier and vendor relationships, including to create and publish business directories (which may include business contact information).

Qualifications & exceptions

• Concerns customer, supplier and vendor relationships; the notice does not say who can see the directories or where they are published.

Not stated here

• Who can access the published directories is not stated.

Use & Processing · Company practice

Uses to run and improve the business, including preparing data for analytics

Mastercard says it may use Personal Information to operate, evaluate and improve its business, including cleansing, preparing and/or anonymizing data for analytics and to develop new products and services.

Supporting quotations

Operate, evaluate and improve our business, including cleansing, preparing, and/or anonymizing data for analytics and to develop new products and services.

Use & Processing · Company practice

Mastercard may use artificial intelligence and machine learning on personal data

Mastercard says it may use Personal Information to develop and improve products and services, detect and prevent deceptive, fraudulent or illegal activity, and improve customer and consumer experience. For these processing activities it says it may use techniques such as artificial intelligence and machine learning to process and analyze data.

Supporting quotations

Develop and improve products and services, detect, and prevent deceptive, fraudulent, or illegal activity, and improve customer and consumer experience.

For these processing activities, we may use techniques such as artificial intelligence and machine learning to process and analyze data.

Qualifications & exceptions

• The AI and machine learning statement is tied to these three processing activities (product development, fraud and illegal activity detection, and customer experience), and "techniques such as" makes the list of techniques non-exhaustive.

Not stated here

• The notice does not say what data feeds the models or whether automated decisions affecting individuals are made.

Use & Processing · Company practice

Anonymized and aggregated data is used to advise Mastercard's customers and partners

Mastercard says it may use Personal Information to generate anonymized and aggregated data in order to prepare insights that advise Mastercard's customers and partners about spending patterns, fraud and other trends.

Supporting quotations

Generate anonymized and aggregated data to prepare insights to advise Mastercard’s customers and partners regarding spending patterns, fraud and other trends.

Qualifications & exceptions

• The output described is anonymized and aggregated data; the notice does not describe the anonymization method here.

Not stated here

• The notice does not define "anonymized" or "aggregated" or describe how re-identification is prevented.

Use & Processing · Company practice

Public social media posts about Mastercard may be processed

Mastercard says it may use Personal Information to assess public feedback about Mastercard by processing publicly available information, including social media posts, and to respond to customer inquiries directed to it on public platforms.

Supporting quotations

Assess public feedback about Mastercard by processing publicly available information, including social media posts, and respond to customer inquiries directed to us on public platforms.

Use & Processing · Company practice

Job application information is used to process the application

Mastercard says it may use Personal Information to process your job application, and refers to a separate Applicant Privacy Notice.

Supporting quotations

Process your job application.

Qualifications & exceptions

• Applies to people who apply for a job with Mastercard.

Not stated here

• The Applicant Privacy Notice is linked but not supplied.

Use & Processing · Company practice

Other purposes apply if notified at collection or authorized or required by law

Mastercard says it may also use Personal Information for other purposes for which it provides specific notice at the time of collection, and as otherwise authorized or required by law.

Supporting quotations

Serve other purposes for which we provide specific notice at the time of collection, and as otherwise authorized or required by law.

Qualifications & exceptions

• Other purposes are tied either to specific notice at the time of collection or to legal authorization or requirement.

Use & Processing · Company practice

Anonymized spending reports may be built from payment data, and the table mentions training AI

In the legal-basis table, Mastercard says it anonymizes Personal Information and prepares and furnishes aggregated data reports of anonymized information (including compilations, analyses, analytical and predictive models and rules, and other aggregated reports) to advise financial institutions, merchants and other customers and partners about past and potential future patterns of spending, fraud, credit risk and other insights. It says the Personal Information it anonymizes may include payment transactions. The grounds listed are its or a third party's legitimate interest in anonymizing and preparing and furnishing the reports, or that the processing is undertaken for statistical and/or research purposes (in jurisdictions where that legal ground is available) and training its AI.

Supporting quotations

Anonymize Personal Information and prepare and furnish aggregated data reports showing anonymized information (including compilations, analyses, analytical and predictive models and rules, and other aggregated reports)

for the purpose of advising our financial institutions, merchants and other customers and partners regarding past and potential future patterns of spending, fraud, credit risk,

The Personal Information we anonymize may include payment transactions.

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of anonymizing Personal Information and preparing and furnishing aggregated data reports; or

The processing is undertaken for statistical and/or research purposes (in jurisdictions where this legal ground is available) and training our AI.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The statistical or research ground is stated only "in jurisdictions where this legal ground is available".
• The anonymization concerns Personal Information that may include payment transactions.

Not stated here

• The notice does not say what "training our AI" involves or which data is used for it beyond the anonymization described here.

Cross-references

• contrast (model-proposed): Mastercard says it does not collect, use or sell personal data to train large language models — The legal-basis table lists training Mastercard's AI as part of a processing ground, while the U.S. section says it does not collect, use or sell Personal Information to train large language models. The notice does not say whether the AI referred to in the table includes large language models.

Use & Processing · Company commitment

Mastercard says it will not try to re-identify anonymized data unless the law permits

The legal-basis table adds that, to the extent Mastercard maintains or otherwise processes deidentified or anonymized information, it will maintain and use it in deidentified or anonymized form and will not attempt to reidentify it unless otherwise permitted by applicable law.

Supporting quotations

To the extent we maintain or otherwise process deidentified or anonymized information, we will maintain and use the information in deidentified or anonymized form and will not attempt to reidentify the information unless otherwise permitted by applicable law.

Qualifications & exceptions

• The commitment is qualified by "unless otherwise permitted by applicable law", so legal permission to re-identify would not be excluded.

Not stated here

• The notice does not say what laws would permit re-identification.

Use & Processing · User right or choice

Mastercard says it will not make solely automated decisions with legal or similar effects, with exceptions

Mastercard says it will not subject you to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, unless: you explicitly consented where required under applicable law; the processing is necessary for entering into or performing a contract between you and Mastercard; or it is legally required to use your Personal Information in this way, for example to prevent fraud.

Supporting quotations

We will not subject you to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, unless you explicitly consented to the processing where required under applicable law, the processing is necessary for entering into, or performance of a contract between you and Mastercard, or when we are legally required to use your Personal Information in this way, for example to prevent fraud.

Qualifications & exceptions

• The commitment covers decisions "based solely on automated processing" with legal or similarly significant effects; it has three exceptions (explicit consent where required by law, contract necessity, legal requirement such as fraud prevention).

Not stated here

• The notice does not say which of Mastercard's decisions, if any, fall under the exceptions.

Use & Processing · User right or choice

You may be able to opt out of cookies, marketing, real-time data preparation and anonymization

Among the rights and choices that may be available depending on your country, Mastercard lists the right to opt out of some collection or uses of your Personal Information, including the use of cookies and similar technologies, the use of your Personal Information for marketing purposes, the preparation of transaction data for real-time services that your bank or another party may offer you, and the anonymization of your Personal Information for data analyses.

Supporting quotations

Opt out of some collection or uses of your Personal Information, including the use of cookies and similar technologies, the use of your Personal Information for marketing purposes, the preparation of transaction data for real-time services that your bank or another party may offer you, and the anonymization of your Personal Information for data analyses.

Qualifications & exceptions

• Available "depending on your country"; the opt-out covers "some" collection or uses, and the list is introduced with "including".

Not stated here

• This list item does not say how to opt out of the real-time services data preparation.

Use & Processing · User right or choice

You may be able to move your data and withdraw consent at any time

Depending on your country, you may have the right to receive the Personal Information you provided to Mastercard so you can transmit it to another company, and to withdraw any consent you provided. The consent withdrawal is described as available at any time and free of charge; Mastercard says it will apply your preferences going forward, and that withdrawal will not affect the lawfulness of processing before the withdrawal.

Supporting quotations

Receive the Personal Information you provided to us to transmit it to another company.

Withdraw any consent provided.

Withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.

or to exercise your right to data portability to easily transfer your Personal Information to another company.

Qualifications & exceptions

• Portability covers information "you provided to us"; consent withdrawal is not retroactive.

Use & Processing · User right or choice

You can unsubscribe from marketing emails with a link or by contacting Mastercard

Mastercard says you can tell it not to send you marketing emails by clicking the unsubscribe link in the marketing emails you receive or by contacting it as indicated in the notice. You can also opt out of marketing emails from Mastercard through a linked opt-out page.

Supporting quotations

To tell us not to send you marketing emails by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us as indicated below.

You also may opt out of receiving marketing emails from Mastercard by clicking

Not stated here

• The linked Marketing Email Opt-Out page is not supplied here.

Use & Processing · User right or choice

You can opt out of having your data anonymized for data analyses

Mastercard says you can opt out of the anonymization of your Personal Information to perform data analyses through a linked opt-out page.

Supporting quotations

To opt out of the anonymization of your Personal Information to perform data analyses by clicking

Not stated here

• The linked Data Analytics Opt-Out page is not supplied here, so what the opt-out covers beyond this sentence is unknown.

Use & Processing · User right or choice

Withdrawing consent is free, works going forward and does not undo earlier processing

Mastercard says you may withdraw any consent you previously gave for processing your Personal Information at any time and free of charge. It says it will apply your preferences going forward and that withdrawal will not affect the lawfulness of processing before the withdrawal.

Supporting quotations

Withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge.

We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.

Qualifications & exceptions

• Applies to consent you previously gave; processing before withdrawal remains lawful.

Use & Processing · User right or choice

You may opt out of certain processing through an opt-out webpage

Mastercard says you may opt out from certain processing of your Personal Information, for example through its opt-out webpage.

Supporting quotations

You may opt out from certain processing of your Personal Information, e.g., via our

Qualifications & exceptions

• Applies to "certain processing"; the opt-out webpage is given as one example route.

Not stated here

• The opt-out webpage is linked but not supplied here, so the processing it covers is unknown.

Use & Processing · Company practice

Core business purposes: providing services, support, payments and enabling transactions

The addendum lists these business purposes for collecting, using and disclosing Personal Information: providing its services; communicating with you, giving updates and information about services and products, providing information you request, responding to comments and questions and providing customer support; facilitating the connection of third-party services or applications; facilitating transactions and payments; and otherwise enabling or effecting, directly or indirectly, a commercial transaction.

Supporting quotations

Use of your Personal Information

We collect, use, and disclose your Personal Information in accordance with the specific business purposes below:

Providing Services: Providing our services.

Communicating: Communicating with you, providing you with updates and other information relating to our services and products, providing information that you request, responding to comments and questions, and otherwise providing customer support.

Connecting Third Party Services: Facilitating the connection of third-party services or applications.

Facilitating Payments: Facilitating transactions and payments.

Enabling Transactions: Otherwise enabling or effecting, directly or indirectly, a commercial transaction.

Qualifications & exceptions

• These purposes are listed in the addendum for U.S. state-law disclosures and add to the main notice's list of uses.

Use & Processing · Company practice

Marketing, personalization and text messages are listed as business purposes

The addendum lists as business purposes: marketing, such as developing and providing promotional and advertising materials that may be useful, relevant, valuable or of interest to you; personalizing your experience on its services, such as presenting tailored content; and sending you personalized text messages as requested on its Talent Community, with a reference to a Talent Community Privacy Notice for more information.

Supporting quotations

Marketing: Marketing purposes, such as developing and providing promotional and advertising materials that may be useful, relevant, valuable, or otherwise of interest to you.

Personalization: Personalizing your experience on our services, such as presenting tailored content.

Sending Messages: Sending you personalized text messages as requested on our Talent Community.

Qualifications & exceptions

• Text messages are sent "as requested" on the Talent Community, not as general marketing.

Not stated here

• The Talent Community Privacy Notice is linked but not supplied here.

Use & Processing · Company practice

Business purposes also include deidentifying data, research, audits, debugging and improving services

The addendum also lists as business purposes: deidentifying and aggregating information collected through its services and using it for lawful purposes; auditing related to your interaction with its services and concurrent transactions, including counting ad impressions to unique visitors, verifying positioning and quality of ad impressions and auditing compliance with other standards; debugging to identify and repair errors that impair existing intended functionality; short-term, transient use; undertaking internal research for technological development and demonstration; and verifying or maintaining the quality or safety of its services and improving, upgrading or enhancing them.

Supporting quotations

Deidentification and Aggregation: Deidentifying and aggregating information collected through our services and using it for lawful purposes.

Auditing Interactions: Auditing related to your interaction with our services and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with other standards.

Debugging: Debugging to identify and repair errors that impair existing intended functionality.

Transient Use: Short-term, transient use.

Research: Undertaking internal research for technological development and demonstration.

Improving Our Services: Undertaking activities to verify or maintain the quality or safety of our services, and to improve, upgrade, or enhance our services.

Qualifications & exceptions

• The deidentified and aggregated information may be used "for lawful purposes", which the addendum does not narrow further.
• Auditing "including, but not limited to" counting ad impressions and verifying their quality.

Use & Processing · Company practice

Business purposes include safety, legal compliance, enforcement and fraud prosecution

The addendum lists as business purposes: responding to trust and safety issues that may arise; compliance, including enforcing its Terms of Use or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity.

Supporting quotations

Safety Issues: Responding to trust and safety issues that may arise.

Compliance: For compliance purposes, including enforcing our

or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.

Fraud and Incident Prevention: Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.

Qualifications & exceptions

• Compliance includes responding to requests by "any judicial process or governmental agency", with no limit on which agency is stated here.

Not stated here

• The Terms of Use are linked but not supplied here.

Use & Processing · Company practice

Business purposes also cover loyalty programs, vendors who act for clients, and job applications

The addendum lists as business purposes: offering and supporting loyalty programs that let you earn points, cashback rewards, prize draw entries or other benefits for purchases made with your eligible Mastercard card; contracting with vendors and service providers to perform services on its behalf or on their behalf, including maintaining or servicing accounts, customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, advertising or marketing services and analytics services, or similar services on behalf of Mastercard's clients; processing your job application; and other purposes for which it provides specific notice when the information is collected.

Supporting quotations

Loyalty Program Operation: Offering and supporting loyalty programs that allow you to earn points, cashback rewards, prize draw entries, or other benefits for purchases made with your eligible Mastercard card.

Contracting Vendors: Contracting with vendors and service providers to perform services on our behalf or on their behalf, including maintaining or servicing accounts, providing customer service, processing, or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services on behalf of Mastercard’s clients.

Job Applications: Processing your job application.

Notified Purpose: For other purposes for which we provide specific notice at the time the information is collected.

Qualifications & exceptions

• Loyalty benefits relate to purchases made with your eligible Mastercard card.

Not stated here

• The Mastercard Applicant Privacy Notice is linked in the job applications item but not supplied here.

Use & Processing · Company commitment

Mastercard says it does not collect, use or sell personal data to train large language models

The U.S. section says Mastercard does not collect, use or sell Personal Information for the purpose of training large language models. This wording is about large language models; elsewhere the notice's legal-basis table refers to "training our AI" as a ground for processing anonymized information.

Supporting quotations

We also do not collect, use, or sell Personal Information for the purpose of training large language models.

Qualifications & exceptions

• The statement is about large language models and is in the U.S. Privacy Addendum.

Not stated here

• The notice does not say whether "training our AI" in the legal-basis table includes large language models, or what AI is trained.

Cross-references

• contrast (model-proposed): Anonymized spending reports may be built from payment data, and the table mentions training AI — The legal-basis table lists training Mastercard's AI as part of a processing ground, while the U.S. section says it does not collect, use or sell Personal Information to train large language models. The notice does not say whether the AI referred to in the table includes large language models.