Global Privacy Notice (with US Privacy Addendum and California Privacy Notice)

Sharing & Disclosure · Company practice

Social media buttons and plug-ins can tell the platform you visited

Mastercard, its service providers and partners may collect information through social media tools, widgets or plug-ins that connect you to your social media accounts, such as sign-in through a social account or sharing a link. When you visit a page containing such tools, the social media or other service provider may learn of your visit. Mastercard says your interactions with these tools are governed by the social platforms' own privacy policies, that it does not control those third parties' data handling, and it points to Section 7 of the notice. Section 7 adds that the provider may learn of the visit even if you are not logged in or have no account, and that when you visit a page with a social media button your browser connects directly to the provider and data about the visit, including IP address, is transferred to it.

Supporting quotations

We, our service providers and partners may collect certain information about you via automated means such as, social media tools, widgets or plug-ins to connect you to your social media accounts.

When you visit a website that contains such tools or plugins, the social media or other service provider may learn of your visit.

your interactions with these tools are governed by the privacy policies of the corresponding social media platforms. As we do not control these third-parties’ data handling practices

These social media providers may learn of your visit even if you are not logged in to your social media account or if you do not have an account with them.

When you visit a website with a social media button, your browser establishes a direct connection to that social media provider, and data concerning your visit, including IP address, is transferred to the social media provider.

Qualifications & exceptions

• Applies to pages that contain social media tools, widgets or plug-ins; what the provider does with the visit data is governed by that provider's policy, not this notice.
• The provider may learn of a visit even without a login or account.

Not stated here

• The notice does not say what each social media provider does with the visit data.

Cross-references

• refers to (model-proposed): Linked sites and partner features are independent; review their own privacy notices — The social media tools paragraph points to Section 7 for further details; Section 7 describes linked sites, partner features and social media providers.

Sharing & Disclosure · Company practice

Personal data may be disclosed to a buyer if Mastercard's business or assets are sold

Mastercard says it may use Personal Information to enable mergers, acquisitions and/or the sale of its business or assets. For example, if it sells any business or assets, or any part of them is acquired by a third party, it may disclose personal information relating to those businesses and assets to the prospective buyer or acquirer.

Supporting quotations

Enable mergers, acquisitions and/or sale of business or assets.

if we sell any business or assets or any part of our business or assets is acquired by a third-party, we may disclose your personal information relating to those business and assets to the prospective buyer or the acquiring third-party.

Qualifications & exceptions

• Disclosure is of personal information relating to the business or assets being sold or acquired, to a prospective buyer or the acquiring third party.

Not stated here

• The notice does not say whether affected individuals will be told or can object before a transfer.

Sharing & Disclosure · Company practice

Shared with Mastercard group companies and with service providers acting for it

Mastercard says it may share Personal Information with Mastercard's headquarters in the U.S., its affiliates and other entities within its group of companies, and with service providers acting on its behalf. It says it requires those service providers by contract to process Personal Information only in accordance with its instructions and as necessary to perform services on its behalf or to comply with applicable law, and to safeguard the security and confidentiality of the information by appropriate technical and organizational measures and confidentiality obligations binding employees who access it. The service providers act for the purposes in this notice or in the applicable program-specific privacy notice.

Supporting quotations

We May Share Personal Information with:

Mastercard’s headquarters in the U.S., our affiliates and other entities within Mastercard’s group of companies.

Service providers acting on our behalf.

With our service providers who perform services on our behalf for the purposes described in this Global Privacy Notice (or in the applicable program specific privacy notice).

We require these service providers by contract to only process Personal Information in accordance with our instructions and as necessary to perform services on our behalf or in compliance with applicable law.

We also require them to safeguard the security and confidentiality of the Personal Information they process on our behalf by implementing appropriate technical and organizational security measures and confidentiality obligations binding employees accessing Personal Information.

Qualifications & exceptions

• The contractual requirements are stated for service providers who perform services on Mastercard's behalf, not for every recipient in the list.

Not stated here

• The program-specific privacy notices are not supplied here.

Sharing & Disclosure · Company practice

Shared with banks, card issuers, merchants and partners to process payments and prevent fraud

Mastercard says it may share Personal Information with other participants in the payment ecosystem, including financial institutions and merchants. In particular it may share it with financial institutions and other entities that issue payment cards, or with merchants, to process payment transactions and perform other activities that you request; and with entities that partner with Mastercard or help it provide its products and services, for fraud prevention and monitoring and third-party identification services, to ensure the security of transactions and its payment processing system.

Supporting quotations

Other participants in the payment ecosystem, including financial institutions, and merchants.

With financial institutions and other entities that issue payment cards or merchants to process payment transactions and perform other activities that you request.

With entities that partner with Mastercard or assist Mastercard in providing its products and services, for fraud prevention and monitoring and third party identification services, to ensure the security of transactions and our payment processing system.

Qualifications & exceptions

• Sharing with issuers and merchants is for processing payment transactions and other activities you request; sharing with partners is for fraud prevention and monitoring, third-party identification services and transaction security.

Sharing & Disclosure · Company practice

Open Finance data may be shared with entities of your choice and with Mastercard's own customers

Mastercard says it may share Personal Information with other participants in the Open Finance ecosystem, including financial institutions, merchants, third parties and other entities of your choice, giving your personal financial management application as an example. It also lists sharing when it acts as a service provider for third parties and provides them with Personal Information that it processes on their behalf.

Supporting quotations

Other participants in the Open Finance ecosystem, including financial institutions, merchants and third parties.

With other participants in the Open Finance ecosystem, including financial institutions, merchants and other entities of your choice

When we act as a service provider for third parties and provide them with Personal Information that we process on their behalf.

Qualifications & exceptions

• The "entities of your choice" example is a personal financial management application, so the recipients named in the second list are chosen by you; the first list names "third parties" more broadly.

Not stated here

• The notice does not say which third parties are Open Finance participants beyond these categories.

Sharing & Disclosure · Company practice

Shared with third parties for fraud prevention and where the law, courts or authorities require

Mastercard says it may share Personal Information with third parties for fraud monitoring and prevention, or other purposes required by law, and with other entities as required under applicable law. It also lists sharing as required under applicable law or legal process, or to respond to requests from law enforcement or governmental agencies; for such requests it says it will follow the process in its Binding Corporate Rules where applicable (Section 5 says these rules are recognized by EEA data protection authorities as providing an adequate level of protection).

Supporting quotations

Third parties for fraud monitoring and prevention purposes, or other purposes required by law.

Other entities as required under applicable law

As required under applicable law or legal process, or to respond to requests from law enforcement or governmental agencies.

When receiving such requests, we will follow the process set out in our Binding Corporate Rules (see Section 5 below) where applicable.

we have established and implemented Binding Corporate Rules (“BCRs”) that have been recognized by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally.

Qualifications & exceptions

• Following the Binding Corporate Rules process applies "where applicable"; the notice does not say where that is.

Not stated here

• The Binding Corporate Rules document is linked in Section 5 but its text is not supplied here, so the request process it sets out is not described.

Cross-references

• refers to (model-proposed): Mastercard relies on Binding Corporate Rules recognized by EEA authorities, and UK BCRs — The sharing section says requests from law enforcement or governmental agencies follow the process in the Binding Corporate Rules, referring to Section 5, where the Binding Corporate Rules are described.

Sharing & Disclosure · Company practice

Disclosed to protect people, enforce terms, prevent harm to Mastercard or investigate fraud

Mastercard says it may share Personal Information when it believes disclosure is necessary to protect individuals' vital interests, to enforce its Terms of Use, to prevent Mastercard against harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

Supporting quotations

When we believe disclosure is necessary to protect individuals’ vital interests, to enforce our

, prevent Mastercard against harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

Qualifications & exceptions

• The trigger is Mastercard's own belief that disclosure is necessary; the notice does not name recipients for these disclosures.

Not stated here

• The Terms of Use are linked but not supplied here; recipients of these disclosures are not named.

Sharing & Disclosure · Company practice

Shared with third-party features and social networks you use, and with others you consent to

Mastercard says it may share Personal Information with third parties whose features you use in connection with its products and services or with your consent, with third parties whose features (for example third-party cookies, widgets and plug-ins) are integrated in its products and services, with social media networks when you directly engage with those platforms, and with other third parties with your consent. For the integrated features and social media cases it points to Section 7, which says those features are operated by third parties that are independent of Mastercard and do not necessarily share its privacy policy, and that social media providers may learn of your visit.

Supporting quotations

Third parties whose feature(s) you use in connection with our products and services or with your consent.

With third parties whose features (e.g., third-party cookies, widgets, plug-ins) are integrated in our products and services.

With social media networks when you directly engage with those platforms.

With other third parties with your consent.

These features, including geo-location tools, are operated by third parties and are clearly identified as such. Social media providers such as Facebook and Twitter, and these other third parties, are independent from Mastercard and do not necessarily share the same policy as Mastercard regarding the protection of privacy.

Qualifications & exceptions

• The consent-based item covers "other third parties" and is separate from the integrated-features and social-network items.

Not stated here

• The third parties are not named, and their own policies are outside this notice.

Sharing & Disclosure · Company commitment

If Mastercard's business is sold, the buyer receives your data and Mastercard asks it to honor this notice

Mastercard lists sharing with other entities in the event of a sale or transfer of its business or assets. It says that, should such a sale or transfer occur, it will use reasonable efforts to direct the transferee to use the Personal Information you provided in a manner consistent with its Global Privacy Notice, and that after the transfer you may contact the entity to which the information was transferred with any inquiries about its processing.

Supporting quotations

or in the event of a sale or transfer of our business or assets.

In the event we sell or transfer all or a portion of our business or assets.

we will use reasonable efforts to direct the transferee to use Personal Information you have provided to us in a manner that is consistent with our Global Privacy Notice.

Following such a sale or transfer, you may contact the entity to which we transferred your Personal Information with any inquiries concerning the processing of that information.

Qualifications & exceptions

• Mastercard commits only to "reasonable efforts" to direct the transferee, not a guarantee that the transferee follows this notice.

Sharing & Disclosure · User right or choice

For mainland China, you can ask who the third-party controllers are, and transfers leave mainland China

If you are located in mainland China, Mastercard says you may contact it as described in the "How to Contact Us" section to obtain information about the third-party recipients that act as data controllers and with whom it shares your Personal Information. It says such sharing will always be conducted to the extent necessary and will not exceed or alter the purposes and means of processing you originally consented to or that rest on a non-consent legal basis. Section 5 adds that if you are in mainland China you understand Mastercard may transfer your Personal Information to recipients outside mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and other affiliates, and that it will always comply with the requirements of applicable laws.

Supporting quotations

If you are located in mainland China, you may contact us as specified in the “How to Contact Us” section below to obtain information regarding the third-party recipients who act in the capacity of data controllers and with whom we share your Personal Information.

Such sharing will always be conducted to the extent necessary and will not exceed or alter the purposes and means of processing that you have originally consented or based on a non-consent legal basis.

If you are located in mainland China, you understand that we may transfer the Personal Information we collect about you to recipients in countries or regions other than mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and to other affiliates as listed

Qualifications & exceptions

• Applies to people located in mainland China.

Not stated here

• The list of affiliates is behind a link that is not supplied here.

Sharing & Disclosure · User right or choice

You can opt out of ads served from your activity on third-party websites

Mastercard says you can opt out of certain uses of information it collects about you by automated means when you visit third-party websites and interact with its ads. It may use service providers to serve ads on third-party sites; these ads may be customized based on data it and its partners collected on its websites and apps, and some service providers and partners may collect information about your online activities over time and across third-party websites to customize and serve these ads. Its ads are sometimes delivered with icons you can click to learn about your ability to opt out or limit use of your browsing behavior for advertising, and you can also use the Manage cookies banner.

Supporting quotations

To opt out of certain uses of information, which we collect about you by automated means, when you visit third-party websites and interact with our ads.

some of our service providers and partners may collect information about your online activities over time and across third-party websites to customize and serve these ads.

Please click where applicable, on the icon in our targeted ads to learn about your ability to opt out or limit the use of your browsing behavior for advertising purposes.

You may also exercise your choice regarding the use of cookies and similar technologies by clicking on the ‘Manage cookies’ banner displayed in the bottom right corner of our websites.

Qualifications & exceptions

• The icon-based opt-out is available "where applicable" on targeted ads, and the opt-out covers "certain uses", not all advertising.

Sharing & Disclosure · Company practice

Your data may move to the U.S. and other countries with different data protection laws

Mastercard says it is a global business and may transfer your Personal Information to the United States and other countries which may not have the same data protection laws as the country where you provided it. It says it will protect the information in accordance with this Global Privacy Notice, or as otherwise disclosed to you, as disclosed at the time of collection, or as described in a program-specific privacy notice.

Supporting quotations

We may transfer your Personal Information to the United States and other countries which may not have the same data protection laws as the country in which you initially provided the information, but we will protect your Personal Information in accordance with this Global Privacy Notice, or as otherwise disclosed to you.

We may transfer the Personal Information we collect about you to recipients in countries other than your country, including the United States, where we are headquartered.

When we transfer your Personal Information to other countries, we will protect that information as described in this Global Privacy Notice, as disclosed to you at the time of data collection or as described in our program-specific privacy notice.

Qualifications & exceptions

• The protection promise is "in accordance with this Global Privacy Notice, or as otherwise disclosed to you", so other notices given to you can govern.

Not stated here

• The program-specific privacy notices are not supplied here.

Sharing & Disclosure · Company commitment

For the EEA, UK and Switzerland, transfers use adequacy decisions, BCRs and standard clauses

Mastercard says it complies with applicable legal requirements when transferring Personal Information to countries other than where you are located. If you are located in the EEA, the UK or Switzerland, it says it will transfer your Personal Information in accordance with adequacy decisions, Binding Corporate Rules, standard contractual clauses and other data transfer mechanisms. The notice links lists of countries for which the European Commission, the UK government and the Swiss Federal Council have issued adequacy decisions.

Supporting quotations

We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located.

If you are located in the EEA, the UK or Switzerland, we will transfer your Personal Information in accordance with adequacy decisions, Binding Corporate Rules, standard contractual clauses, and other data transfer mechanisms.

See list of countries for which the European Commission has issued an adequacy decision

See list of countries for which the UK government has issued an adequacy decision

See list of countries for which the Swiss Federal Council has issued an adequacy decision

Qualifications & exceptions

• The transfer mechanisms commitment is stated for people located in the EEA, the UK or Switzerland.

Not stated here

• The adequacy decision lists are on external pages that are not supplied here.

Sharing & Disclosure · Company commitment

Mastercard relies on Binding Corporate Rules recognized by EEA authorities, and UK BCRs

Mastercard says it complies with applicable legal requirements when transferring Personal Information to other countries, including obtaining consent where required. It says it has established and implemented Binding Corporate Rules that EEA data protection authorities have recognized as providing an adequate level of protection to the Personal Information it processes globally, and that it relies equally on UK BCRs to transfer Personal Information outside the United Kingdom. Copies are available through links on the page.

Supporting quotations

We comply with applicable legal requirements, including obtaining consent where required, when transferring Personal Information to countries other than the country where you are located.

we have established and implemented Binding Corporate Rules (“BCRs”) that have been recognized by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally.

We equally rely on UK BCRs to transfer Personal Information outside of the United Kingdom.

Qualifications & exceptions

• Consent is obtained for transfers only "where required".

Not stated here

• The Binding Corporate Rules documents are linked but their text is not supplied here.

Cross-references

• referred to by (model-proposed): Shared with third parties for fraud prevention and where the law, courts or authorities require — The sharing section says requests from law enforcement or governmental agencies follow the process in the Binding Corporate Rules, referring to Section 5, where the Binding Corporate Rules are described.

Sharing & Disclosure · User right or choice

Other safeguards for transfers, and you may ask for a copy

Mastercard says it may also transfer Personal Information to countries for which adequacy decisions have been issued, use contractual protections for transfers to third parties such as the European Commission's Standard Contractual Clauses or their equivalent under applicable law, or rely on other data transfer mechanisms or requirements where applicable. Depending on your country, you may contact it as specified in the "How to Contact Us" section to obtain a copy of the safeguards it uses to transfer Personal Information outside of your jurisdiction.

Supporting quotations

We may also transfer Personal Information to countries for which adequacy decisions have been issued

use contractual protections for the transfer of Personal Information to third parties, such as the European Commission’s Standard Contractual Clauses or their equivalent under applicable law, or rely on other data transfer mechanisms or requirements where applicable.

Depending on your country, you may contact us as specified in the “How to Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of your jurisdiction.

Qualifications & exceptions

• The right to ask for a copy of safeguards applies "depending on your country".

Not stated here

• The notice does not say which countries give this right.

Sharing & Disclosure · Company practice

For mainland China, transfers go to recipients abroad, including the U.S. and Singapore

If you are located in mainland China, Mastercard says you understand that it may transfer Personal Information it collects about you to recipients in countries or regions other than mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and other affiliates listed on a linked page. It says that when it conducts international transfers it will always ensure it complies with requirements stipulated under applicable laws.

Supporting quotations

If you are located in mainland China, you understand that we may transfer the Personal Information we collect about you to recipients in countries or regions other than mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and to other affiliates as listed

When we conduct international transfers of Personal Information, we will always ensure to comply with requirements stipulated under applicable laws.

Qualifications & exceptions

• Applies to people located in mainland China, who are described as understanding the transfers.

Not stated here

• The list of affiliates is on a linked page not supplied here.

Sharing & Disclosure · Company practice

Linked sites and partner features are independent; review their own privacy notices

Mastercard says its websites may include links to other third-party websites, social media tools, widgets or plug-ins that permit sharing web content, including IP address, with third parties and social media providers, and that social media providers may learn of your visit even if you are not logged in or do not have an account. It says linked websites and partner features, which may include social networking and geo-location tools, operate independently from Mastercard and are clearly identified as such; those entities may learn of your visit whether or not you use the features. Where they are not owned or controlled by Mastercard, it suggests you review their own privacy notices or practices, and says social media providers and other third parties do not necessarily share the same privacy policy as Mastercard.

Supporting quotations

Our websites may include links to other third-party websites, social media tools, widgets or plug-ins, permitting sharing web content including IP address, with third parties and social media providers.

These social media providers may learn of your visit even if you are not logged in to your social media account or if you do not have an account with them.

These entities may learn of your visit regardless of whether you use these features.

These websites and features, which may include social networking and geo-location tools, operate independently from Mastercard, and are clearly identified as such.

Social media providers such as Facebook and Twitter, and these other third parties, are independent from Mastercard and do not necessarily share the same policy as Mastercard regarding the protection of privacy.

Please review their privacy notices if you decide to use their services and consult your social media account settings if you want to deactivate certain features.

Qualifications & exceptions

• The review suggestion applies to linked websites or features "not owned or controlled by Mastercard"; the notice does not say which are owned or controlled by Mastercard.

Not stated here

• The third parties' own privacy notices are not supplied here.

Cross-references

• referred to by (model-proposed): Social media buttons and plug-ins can tell the platform you visited — The social media tools paragraph points to Section 7 for further details; Section 7 describes linked sites, partner features and social media providers.

Sharing & Disclosure · Company practice

Social media buttons connect your browser to the provider and send your IP address

Mastercard says you can share, link to or mention things about its products and services on social media, for example by "liking" an offer on Facebook or "tweeting" one. When you visit a website with a social media button, your browser establishes a direct connection to that provider and data concerning your visit, including your IP address, is transferred to it. If you have an account with the provider, the provider may link your visit to your account even if you are not logged in.

Supporting quotations

When you visit a website with a social media button, your browser establishes a direct connection to that social media provider, and data concerning your visit, including IP address, is transferred to the social media provider.

If you have an account with the social media provider, the provider may link your visit to your account, even if you are not logged into this account.

Qualifications & exceptions

• Applies to websites that carry a social media button; what the provider does with the data is governed by its own policy.

Sharing & Disclosure · Company practice

Disclosure to advertising and analytics providers is described as only with your consent

For the categories in Section 1 of the addendum, Mastercard says it discloses Personal Information to the listed categories of third parties. It says it discloses Personal Information to advertising providers (advertising technology companies such as advertising networks) only with your consent, and to analytics providers (companies that help analyze and improve its online properties) only at your direction and with your consent. The information disclosed to each is identifiers, internet or other electronic network activity and geolocation data.

Supporting quotations

With respect to the categories of Personal Information identified above in Section 1, we disclose your Personal Information to the following categories of third parties:

We disclose your Personal Information to Advertising Providers only with your consent.

Personal Information we disclose: Identifiers; Internet or Other Electronic Network Activity; Geolocation Data.

We disclose your Personal Information to Analytics Providers only at your direction and only with your consent.

Personal Information we disclose: Identifiers; Internet or Other Electronic Network Activity; Geolocation Data.

Qualifications & exceptions

• The consent statements are made for advertising providers and analytics providers disclosures; later parts of the addendum describe cookies that may "sell" or "share" information with these same providers.

Not stated here

• The addendum does not say how consent is obtained or how it relates to the cookie banner choices.

Cross-references

• contrast (model-proposed): Cookies on the site may "sell" or "share" data for cross-context behavioral advertising — One entry says disclosure to advertising providers happens only with your consent; another says cookies on the site may sell or share data for cross-context behavioral advertising with third parties including advertising providers and analytics providers, without mentioning consent. The addendum does not explain how the two fit together.

Sharing & Disclosure · Company practice

Operating system and platform providers receive identifiers, activity data and geolocation

The addendum says Mastercard shares with operating system and platform providers (operating systems and platforms) identifiers, internet or other electronic network activity information, and geolocation data. Unlike the advertising and analytics provider entries, this entry states no consent condition.

Supporting quotations

OS/Platform Providers: Operating systems and platforms. Personal Information we share: Identifiers; Internet or Other Electronic Network Activity Information; Geolocation Data.

Qualifications & exceptions

• This entry states no consent condition, while the advertising and analytics provider entries do.

Not stated here

• The addendum does not say whether consent applies to this disclosure.

Sharing & Disclosure · Company practice

Data brokers ("Resellers") are listed as recipients of identifiers, inferences and more

Among the third parties it discloses Personal Information to, the addendum lists "Resellers: Consumer data brokers". The categories it says it discloses to them are identifiers; the categories in Cal. Civ. Code Section 1798.80(e); characteristics of protected classifications under California or federal law; geolocation data; and inferences drawn from Personal Information. Unlike the advertising and analytics provider entries, this entry states no consent condition.

Supporting quotations

Resellers: Consumer data brokers.

Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Characteristics of Protected Classifications under California or Federal Law; Geolocation Data; Inferences Drawn from Personal Information.

Qualifications & exceptions

• The entry states no consent condition, while the advertising and analytics provider entries do.
• Appears in the California section of the U.S. Privacy Addendum, so applies to disclosures for California residents.

Not stated here

• The addendum does not say whether disclosure to resellers counts as a sale or sharing under the CCPA, or which kinds of data brokers are meant.

Sharing & Disclosure · Company practice

Affiliates and vendors receive the widest range of categories of Personal Information

The addendum says Mastercard discloses to its affiliates, and to vendors and service providers, identifiers; the categories in Cal. Civ. Code Section 1798.80(e); characteristics of protected classifications under California or federal law; commercial information; internet or other electronic network activity information; geolocation data; and inferences drawn from Personal Information.

Supporting quotations

Affiliates. Personal Information we disclose: Identifiers;

Commercial Information; Internet or Other Electronic Network Activity Information; Geolocation Data; Inferences Drawn from Personal Information.

Vendors: Vendors and service providers. Personal Information we disclose: Identifiers;

Commercial Information; Internet or Other Electronic Network Activity Information; Geolocation Data; Inferences Drawn from Personal Information.

Qualifications & exceptions

• The seven categories listed for affiliates and for vendors are the same.

Sharing & Disclosure · Company practice

Third parties integrated into the services receive identifiers, activity and geolocation data

The addendum says Mastercard discloses to third parties integrated into its services identifiers, internet or other electronic network activity, and geolocation data.

Supporting quotations

Integrated Third Parties: Third parties integrated into our services. Personal Information we disclose: Identifiers; Internet or Other Electronic Network Activity; Geolocation Data.

Qualifications & exceptions

• The entry states no consent condition.

Sharing & Disclosure · Company practice

Disclosures required by law or in a merger or sale cover nearly all categories

The addendum says Mastercard discloses to third parties as required by law and similar disclosures, and to third parties in connection with a merger, sale or asset transfer, the same seven categories: identifiers; the categories in Cal. Civ. Code Section 1798.80(e); characteristics of protected classifications under California or federal law; commercial information; internet or other electronic network activity information; geolocation data; and inferences drawn from Personal Information.

Supporting quotations

Third Parties as Legally Required: Third parties as required by law and similar disclosures.

Personal Information we disclose: Identifiers;

Third Parties in Merger/Acquisition: Third parties in connection with a merger, sale, or asset transfer.

Commercial Information; Internet or Other Electronic Network Activity Information; Geolocation Data; Inferences Drawn from Personal Information.

Qualifications & exceptions

• "Similar disclosures" is not defined in the entry.

Sharing & Disclosure · Company practice

Consent-based disclosures and loyalty-related disclosures to banks and merchants

The addendum says Mastercard may disclose identifiers and commercial information to other third parties for whom it has obtained your direction or permission. It also says it discloses to financial institutions (for example banks that issued your Mastercard card) or merchants, to the extent necessary for Mastercard to offer promotions, offers, benefits, campaigns and other loyalty-related initiatives and to perform related activities for its customers, identifiers; the categories in Cal. Civ. Code Section 1798.80(e); commercial information; internet or other electronic network activity information; geolocation data; and inferences drawn from Personal Information.

Supporting quotations

Third Parties with Consent or Direction: Other third parties for whom we have obtained your direction or permission to disclose your Personal Information.

Personal Information we may disclose: Identifiers; Commercial Information

Financial Institution(s) (e.g., banks that issued your Mastercard card) or Merchants: To the extent necessary for Mastercard to offer promotions, offers, benefits, campaigns, and other loyalty-related initiatives and to perform related activities for our customers.

Qualifications & exceptions

• The disclosure to banks and merchants is limited to "the extent necessary" for promotions, offers, benefits, campaigns and loyalty-related initiatives and related activities for customers.

Sharing & Disclosure · Company practice

Cookies on the site may "sell" or "share" data for cross-context behavioral advertising

Mastercard says it does not sell your Personal Information for monetary consideration. It says, however, that some of the cookies and other technologies used on this website, which may include pixel tags, SDKs and web beacons (collectively "Cookies"), may disclose information in a way considered a "sale" or "share" for cross-context behavioral advertising (CCBA) as the CCPA defines those terms, and that these Cookies may use or share Personal Information with third parties to provide a personalized marketing experience and serve targeted advertisements based on your browsing habits and activity across other sites. It says it may sell or share, and has sold and shared in the preceding 12 months, identifiers, internet or other electronic network activity information and geolocation data (for example your IP address) with third parties including advertising providers and analytics providers.

Supporting quotations

Mastercard does not sell your Personal Information for monetary consideration.

some of the cookies and other technologies used on this website, which may include pixel tags, SDKs and web beacons (collectively “Cookies”), may disclose information in a way that is considered a “sale” or “share” (for cross-context behavioral advertising (“CCBA”)) as those terms are defined under the CCPA.

These Cookies may use or share Personal Information with third parties to provide you with a personalized marketing experience and serve targeted advertisements based on your browsing habits and activity across other sites.

We may sell or share, and have sold and shared in the preceding 12 months, the following categories of Personal Information for CCBA purposes:

Identifiers,

Internet or Other Electronic Network Activity Information, and

Geolocation Data (e.g. your IP address)

The categories of Personal Information above are sold and shared, and have been sold and shared in the preceding 12 months, with third parties including Advertising Providers and Analytics Providers.

Qualifications & exceptions

• The statement that Mastercard does not sell for monetary consideration is followed by "However": some cookies may disclose information in a way the CCPA treats as a "sale" or "share" for cross-context behavioral advertising.
• Covers the preceding 12 months for the categories listed.

Not stated here

• The addendum does not name the third parties beyond "including Advertising Providers and Analytics Providers", and does not reconcile this with the entries saying advertising and analytics disclosures occur only with consent.

Cross-references

• contrast (model-proposed): Disclosure to advertising and analytics providers is described as only with your consent — One entry says disclosure to advertising providers happens only with your consent; another says cookies on the site may sell or share data for cross-context behavioral advertising with third parties including advertising providers and analytics providers, without mentioning consent. The addendum does not explain how the two fit together.

Sharing & Disclosure · Company practice

Mastercard says it has no actual knowledge of selling or sharing data of consumers under 16

The addendum says Mastercard does not have actual knowledge that it sells or shares Personal Information of consumers under 16 years of age.

Supporting quotations

We do not have actual knowledge that we sell or share Personal Information of consumers under 16 years of age.

Qualifications & exceptions

• Limited to what Mastercard has "actual knowledge" of; it is not a statement that no such data is sold or shared.

Sharing & Disclosure · User right or choice

California residents can opt out of "sale" and "sharing" for cross-context advertising

The addendum says California residents have the right to opt out of the sale and sharing of their Personal Information for cross-context behavioral advertising (CCBA) purposes, by clicking the "Your Privacy Choices" link on the page or in the website footer and following the instructions. It says opt-out requests do not need to be submitted through the My Data portal and can be exercised directly through that link.

Supporting quotations

Right to Opt Out. You have the right to opt out of the sale and sharing of your Personal Information for purposes of CCBA.

please click the “Your Privacy Choices” link located

Requests to opt out of the sale or sharing of your Personal Information for CCBA do not need to be submitted through the My Data Portal and can be exercised directly through the “Your Privacy Choices” link described above.

Qualifications & exceptions

• The right covers "sale and sharing" for CCBA purposes only, as the CCPA defines those terms.

Sharing & Disclosure · User right or choice

Mastercard treats a Global Privacy Control signal as an opt-out for that browser and device

The addendum says California requires businesses to process Global Privacy Control (GPC) signals, also called opt-out preference signals, and explains how to enable GPC in a browser or plugin. If Mastercard receives a GPC signal it says it will treat it as a request to opt out of any sale and sharing of Personal Information for CCBA purposes for the specific device and browser used to send the signal. It stores a preference cookie on your browser to honor this choice; if you or your browser clear or expire cookies, you need to opt out again for that device and browser, such as by transmitting a GPC signal on your visit.

Supporting quotations

If we receive a GPC signal, we will treat it as a request to opt out of any sale and sharing of your Personal Information for CCBA purposes for the specific device and browser you use to transmit the GPC signal.

We will store a preference cookie on your browser to honor this choice; if you or your browser clear or expire cookies, you will need to opt out again for the device and browser, such as by transmitting a GPC signal on your visit.

Qualifications & exceptions

• The opt-out applies to the specific device and browser that sends the signal and lasts only while the preference cookie remains.

Not stated here

• The addendum does not say whether the GPC signal is honored outside California.

Sharing & Disclosure · Company practice

On this website, some cookies may count as a "sale" under state laws for targeted advertising

The U.S. section says Mastercard does not sell your Personal Information for monetary consideration. It says, however, that some of the cookies used on the website may disclose information in a way considered a "sale" under U.S. state privacy laws, and that these cookies may use or share personal information with third parties to provide a personalized marketing experience and serve targeted advertisements based on browsing habits and activity across other sites, which it calls targeted advertising.

Supporting quotations

Mastercard does not sell your Personal Information for monetary consideration.

However, some of the Cookies used on this website may disclose information in a way that is considered a “sale” as that term is defined under U.S. state privacy laws.

These Cookies may use or share personal information with third parties to provide you with a personalized marketing experience and serve targeted advertisements based on your browsing habits and activity across other sites. This is referred to as targeted advertising.

Qualifications & exceptions

• The no-sale statement refers to monetary consideration only and is followed by "However" for cookies that state laws treat as a "sale".

Not stated here

• The addendum does not name the third parties receiving data through these cookies in this section.

Sharing & Disclosure · User right or choice

U.S. residents may opt out of targeted advertising, "sale" or profiling decisions

In addition to the rights in Section 4 of the Global Privacy Notice, the U.S. section says you may have the right to opt out of the processing of Personal Information for targeted advertising or in a way that constitutes a "sale", or for profiling in furtherance of decisions that produce legal or similarly significant effects. To opt out of targeted advertising or "sale", it tells you to click the "Your Privacy Choices" link on the page or in the website footer and follow the instructions.

Supporting quotations

In addition to the rights identified in Section 4 of the Global Privacy Notice (“Your Rights and Choices”) above, you may have the following rights:

Right to opt out of the processing of Personal Information for purposes of (i) targeted advertising or in a way that constitutes a “sale”, or (ii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

please click the “Your Privacy Choices” link located

Qualifications & exceptions

• These are rights you "may have", additional to Section 4; availability depends on the applicable state law.

Sharing & Disclosure · User right or choice

U.S. state signals: Mastercard treats a GPC signal as an opt-out for that browser and device

The U.S. section says some state privacy laws require businesses to process Global Privacy Control (GPC) signals, also called opt-out preference signals, and explains how to enable GPC. If Mastercard receives a GPC signal it says it will treat it as a request to opt out of sale and use of Personal Information for targeted advertising for the specific device and browser used. It stores a preference cookie to honor the choice; if you or your browser clear or expire cookies, you need to opt out again for that device and browser.

Supporting quotations

If we receive a GPC signal, we will treat it as a request to opt out of sale and use of your Personal Information for targeted advertising purposes for the specific device and browser you use to transmit the GPC signal.

We will store a preference cookie on your browser to honor this choice; if you or your browser clear or expire cookies, you will need to opt out again for the device and browser, such as by transmitting a GPC signal on your visit.

Qualifications & exceptions

• The opt-out applies to the specific device and browser that sends the signal and lasts only while the preference cookie remains.