Global Privacy Notice (with US Privacy Addendum and California Privacy Notice)

Legal Rights & Agreement Rules · Context

The notice is issued by Mastercard International and its affiliates

The Global Privacy Notice speaks for Mastercard International Incorporated together with its affiliates, which the notice collectively calls "Mastercard". It says it covers the types of Personal Information collected, why it is collected, the other parties it may be shared with, the security measures used, the reader's rights and choices, and how to make privacy contact.

Supporting quotations

Mastercard International Incorporated and its affiliates (collectively, “Mastercard”) respect your privacy.

This Global Privacy Notice describes the types of Personal Information we collect, the purposes for which we collect that Personal Information, the other parties with whom we may share it and the measures we take to protect the security of the data. It also tells you about your rights and choices with respect to your Personal Information, and how you can contact us about our privacy practices.

Qualifications & exceptions

• "Mastercard" in the rest of the notice means the parent company and its affiliates together, not one entity.

Legal Rights & Agreement Rules · Context

The Global Privacy Notice states an effective date of 1/19/2026

The notice opens with an "Effective Date" of 1/19/2026. The separate U.S. Privacy Addendum later in the same page carries its own, later "last updated" date, so the page does not present one single date for all its parts.

Supporting quotations

Effective Date: 1/19/2026

Qualifications & exceptions

• The 1/19/2026 date is stated for the notice as a whole at its top; the U.S. Privacy Addendum states its own update date.

Not stated here

• The page text does not say what changed between the 1/19/2026 effective date and the later date shown in the addendum.

Use & Processing · Company practice

Mastercard often handles data for banks and merchants, who set the rules

Mastercard says it also acts on behalf of and under the instructions of financial institutions, merchants and other partners that act as data controllers, including to process payment transactions. In those situations the reader is pointed to those controllers' own privacy policies for how their Personal Information is processed. Mastercard says that, unless the law otherwise authorizes, it will process Personal Information in those situations to process payment transactions or for the purposes agreed between Mastercard and those partners.

Supporting quotations

we also act on behalf of and under the instructions of financial institutions, merchants and other partners which act as data controllers, including for processing payment transactions. Please refer to their respective privacy policies for more information regarding the processing of your Personal Information in these contexts.

Unless otherwise authorized by law, we will process your Personal Information to process payment transactions or for the purposes agreed between Mastercard and the financial institutions, merchants and other partners.

Qualifications & exceptions

• Applies to the situations where Mastercard acts for a bank, merchant or other partner as controller, not to every Mastercard activity.
• Processing in those situations is limited to payment transactions or the purposes agreed with the partner, unless the law authorizes otherwise.

Not stated here

• The partners' own privacy policies are not part of this page, so what they do with the data is not stated here.

Legal Rights & Agreement Rules · Context

Practices vary by country, and some products have their own notices

Mastercard says its privacy practices may differ between the countries it operates in to reflect local practices and legal requirements. It also says specific privacy notices may apply to some of its products and services, and tells readers to visit the page or digital asset of the specific product or service to learn how that product handles information.

Supporting quotations

Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements.

Specific privacy notices may apply to some of our products and services. Please visit the webpage or digital asset of the specific product or service to learn more about our privacy and information practices in relation to that product or service.

Qualifications & exceptions

• A product- or service-specific notice may apply instead of or alongside this notice for that product; the notice does not say which controls if they differ.

Not stated here

• The product-specific notices are not supplied with this page, and the text does not say which products have one.

Use & Processing · User right or choice

Three links near the top lead to opt-out and data request pages

Below the introduction the page lists three links: Data Analytics Opt-Out, Marketing Email Opt-Out and My Data. The text here gives only the link names; it does not describe what each one covers or how it works.

Supporting quotations

Data Analytics Opt-Out

Marketing Email Opt-Out

My Data

Qualifications & exceptions

• The page text names the three links but does not describe their scope; the linked pages are not supplied.

Not stated here

• What each linked page lets the reader do, and for which products or regions, is not stated in this page text.

Data Access & Collection · Context

"Personal Information" means any information relating to an identifiable person

The notice defines "Personal Information" as any information relating to an identified or identifiable individual, and says that, unless otherwise specified, it may obtain different types of it, including Sensitive Personal Information where applicable laws use that concept. For California residents, the U.S. Privacy Addendum later gives a different, CCPA-based definition (information that identifies, relates to, describes or can reasonably be linked with a particular consumer or household) that excludes publicly available, deidentified or aggregated information as the CCPA defines those terms.

Supporting quotations

“Personal Information” means any information relating to an identified or identifiable individual.

unless otherwise specified, “Personal Information” means any information relating to an identified or identifiable individual.

including Sensitive Personal Information, as may be the case under applicable laws

For the purpose of this section for California residents, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the CCPA. Personal Information does not include information that is publicly available, deidentified, or aggregated (as those terms are defined in the CCPA) or otherwise excluded from the scope of the CCPA.

Qualifications & exceptions

• The broad definition applies "unless otherwise specified"; the California addendum section uses its own CCPA-based definition for California residents.
• Sensitive Personal Information is mentioned only "as may be the case under applicable laws"; the definition does not itself list what counts.

Data Access & Collection · Company practice

Mastercard lists seven broad categories of information it may collect

Mastercard says it may collect these categories of Personal Information: transaction information (such as personal account number, merchant name and location, date and total amount, and other information supplied by financial institutions or merchants when Mastercard acts for them); product and service information (registration and payment information and program-specific information when you request products or services directly or join marketing programs); website, device and mobile app usage information collected by automated means such as cookies; job applications; business contact information when you work for a business partner; identity verification information (name, e-mail, physical address, telephone number and IP address); and anything else you provide while using communication tools.

Supporting quotations

We may collect the following categories of Personal Information:

Transaction information, such as personal account number, the merchant’s name and location, the date and the total amount of the transaction, and other information provided by financial institutions or merchants when we act on their behalf.

Product and service information, such as registration and payment information, and program-specific information, when you request products or services directly from us, or participate in marketing programs.

Website, device and mobile app usage, and similar information collected via automated means, such as cookies and similar technologies.

Job applications and related information when you apply for a job with us.

Business contact information when you work for one of our business partners.

Identity verification information, such as name, e-mail address, physical address, telephone number, and IP address.

Any other information that you may provide while using communication tools.

Qualifications & exceptions

• The list says what Mastercard "may" collect; it does not say every category is collected from every person.
• Business contact information is limited to people who work for one of its business partners; job application information to people who apply for a job with Mastercard.

Data Access & Collection · Company practice

For card payments Mastercard says it generally does not collect cardholder names

When it processes payment transactions as a processor and provider of related services, Mastercard says it obtains a limited amount of information, such as the personal account number, the merchant's name and location, and the date and total amount of the transaction. It says it generally does not need or collect the cardholder's name or other contact information to process payment transactions.

Supporting quotations

As a processor of payment transactions and provider of related services, we obtain a limited amount of information in connection with your payment transactions such as the personal account number, the merchant’s name and location, the date and the total amount of the transaction.

we generally do not need or collect the cardholder’s name or other contact information to process payment transactions.

Qualifications & exceptions

• "Generally": the statement is about processing payment transactions, not about every Mastercard product, and it is not an absolute promise that names are never collected.
• Does not cover the more detailed information collected for certain products and services described next.

Data Access & Collection · Company practice

For some products, partners give Mastercard more information about you

Mastercard says that for certain products and services, the financial institution, the merchant where you transact, or another partner may give it more information about you, or Mastercard may collect it from you directly, in order to provide those products and services for the partner, support the partner's business or perform processing for it. In these situations Mastercard may act on the partner's behalf and under its instructions, and it says it will, unless the law otherwise authorizes, process the information to process payment transactions or for the purposes agreed with the partner; the partner's own privacy policy governs further detail.

Supporting quotations

for certain products and services, your financial institutions, the merchants where you make a transaction or other partners may provide us with more information about you, or we may collect it directly from you to provide you with those products and services on their behalf, support their business or perform processing activities on their behalf.

we may act on behalf of and under the instructions of financial institutions, merchants and other partners which act as data controllers.

Unless otherwise authorized by law, we will process your Personal Information to process payment transactions or for the purposes agreed between Mastercard and the financial institutions, merchants and other partners.

Please refer to their respective privacy policies for more information regarding the processing of your Personal Information.

Qualifications & exceptions

• Applies to "certain" products and services, not all; the notice does not list which ones.
• Processing is for payment transactions or purposes agreed with the partner, unless the law authorizes otherwise.

Not stated here

• The notice does not state what additional information partners provide or which products involve it.

Data Access & Collection · Company practice

Mastercard offers some products directly to you and takes information you submit

Mastercard says it may provide products and services directly to individuals, naming marketing programs, rewards programs, eWallets, Open Finance solutions, prepaid services, location alert programs and biometric authentication tools. To use them you can give information to Mastercard directly: on its websites and digital assets, in response to marketing or other communications, by signing up for a product or service, or by taking part in an offer, program or promotion.

Supporting quotations

Mastercard may provide you directly with products and services such as marketing programs, rewards programs, eWallets, Open Finance solutions, prepaid services, location alert programs, and biometric authentication tools.

you can submit information to us directly via various means including: (i) on our websites and digital assets, (ii) in response to marketing or other communications, (iii) by signing up for a Mastercard product or service, or (iv) through your participation in an offer, program or promotion.

Qualifications & exceptions

• The product list is introduced with "such as", so it is not exhaustive; the means of submitting information are "including", also not exhaustive.

Data Access & Collection · Company practice

Mastercard may also get information about you from other sources

Besides what you submit, Mastercard says it may obtain Personal Information about you from your use of its products or services, from companies that use or facilitate its products or services, from publicly available sources, or from third-party partners. It adds that information may also be passed to it by your financial institution, merchant or other business partners.

Supporting quotations

We may also obtain Personal Information about you through your use of our products or services, from companies that use or facilitate our products or services, from publicly available sources, or from third party partners.

Your Personal Information may also be passed on to us by your financial institution, merchant or other business partners.

Qualifications & exceptions

• Stated in the part of the notice about products and services Mastercard provides directly to you.

Not stated here

• The notice does not name the third-party partners or public sources, or say what types of information come from each.

Data Access & Collection · Company practice

Program sign-up can involve identity, demographic, card and login details

For the programs it offers directly, Mastercard says it may collect identifiers and contact information (name, email, telephone, billing or shipping address), authentication information such as username and password, age, date of birth, gender and family status, military and veteran status, language preferences, payment details, personal account number, commercial information such as merchant and transaction details, card expiration date and card verification code. It says each program differs and that the relevant program-specific privacy notice should be consulted for how information is used in that program.

Supporting quotations

Below is an overview of the types of Personal Information we may collect in relation to programs we offer directly to you.

Each program differs, so where applicable, please refer to the relevant program-specific privacy notice for more information on the use of your Personal Information for that specific program.

Registration and payment information: We may collect identifiers and your contact information (such as name, email address, telephone number, billing or shipping address), authentication information (e.g., username and password), age, date of birth, gender and family status, military and veteran status, language preferences, payment details, personal account number, commercial information, such as merchant’s name and location, date and total amount of the transactions, card expiration date and card verification code.

Qualifications & exceptions

• Covers programs Mastercard offers directly to individuals; each program differs, so not every item is collected for every program.

Not stated here

• The program-specific privacy notices are not supplied here, so the exact data per program is not stated.

Data Access & Collection · Company practice

Some programs collect location, financial account or biometric data, only if you sign up

Mastercard says that what it collects for a program depends on the program: location-based services will typically require address or geolocation data, Open Finance programs may require financial account information, and programs that authenticate you by facial or fingerprint recognition may require your photograph or biometric information. It says all these programs are voluntary and that your Personal Information is only collected if you subscribe to them.

Supporting quotations

programs designed to offer you location-based services will typically require the collection of your address or geolocation data.

Programs within our Open Finance solutions may require the collection of your financial account information.

programs designed to allow you to authenticate for example, via facial or fingerprint recognition may require the processing of your photograph and/or biometric information.

All these programs are voluntary, and your Personal Information is only collected if you subscribe to such programs.

Qualifications & exceptions

• The sensitive data types arise in particular programs ("depending on the program"), and collection depends on your subscribing to that program.
• The statement that collection occurs "only" on subscription is made about these programs; other sections describe other collection (for example by cookies on websites).

Data Access & Collection · Company practice

Anything else you choose to share, including content and other people's contacts

Mastercard says you may choose to provide other information, giving as examples content such as photographs, articles and comments, contact information of friends or other people you want Mastercard to contact, content you make available through social media accounts or memberships with third parties, or anything else you want to share, for example when contacting customer service.

Supporting quotations

Other information you choose to provide: You may choose to provide other information, such as different types of content (e.g., photographs, articles, comments), contact information of friends or other people you would like us to contact, content you make available through social media accounts or memberships with third parties, or any other information you want to share with us

Qualifications & exceptions

• The information is described as information you "choose" to provide; the examples are non-exhaustive ("such as").

Not stated here

• The text does not say how information about friends or other people is used or whether those people are told.

Legal Rights & Agreement Rules · Restriction or exception

You may be obliged to give complete and accurate information when you consent

Mastercard states that you may be subject to obligations under applicable laws, such as the obligation to provide complete and accurate Personal Information when consenting to the processing of your Personal Information. The notice does not say which laws or what consequences follow.

Supporting quotations

You may be subject to obligations under applicable laws, such as the obligation to provide complete and accurate Personal Information when consenting to the processing of your Personal Information.

Qualifications & exceptions

• Stated as something you "may" be subject to under applicable laws, in the context of giving consent to processing.

Not stated here

• The notice does not name the laws, and does not say what happens if information is incomplete or inaccurate.

Data Access & Collection · Company practice

Mastercard collects payment, device and location data for fraud and dispute work

Mastercard says it may collect or use Personal Information for fraud prevention and monitoring, risk management, dispute resolution and related purposes. The information may include identifiers, commercial information and internet or other electronic network activity information, such as the personal account number, merchant name and location, date and total amount of transactions, IP address, fraud score, location data, merchant details, items purchased and information about the dispute. When it provides cryptocurrency and blockchain intelligence solutions it may also collect and process blockchain information such as blockchain addresses and other cryptocurrency transaction details. The paragraph links to a separate page for more information.

Supporting quotations

we may collect or use Personal Information for fraud prevention and monitoring, risk management, dispute resolution and other related purposes.

Such information may include identifiers, commercial information, and Internet or other electronic network activity information, such as the personal account number, merchant’s name and location, date and total amount of the transactions, IP address, fraud score, location data, merchant details, items purchased and information about the dispute.

When we provide cryptocurrency and blockchain intelligence solutions, we may also collect and process information gathered from the blockchain, including blockchain addresses and other cryptocurrency transaction details.

Qualifications & exceptions

• The blockchain data is collected only "when we provide cryptocurrency and blockchain intelligence solutions".
• The information "may include" these items; the list is introduced as examples rather than a closed set.

Not stated here

• The "click here" link in this paragraph points to a separate page that is not part of this notice text and was not supplied, so what it adds is not stated here.

Data Access & Collection · Procedure

A separate page explains Open Finance data collection

For more information on the collection of Personal Information in the context of its Open Finance solutions, the notice directs readers to a linked page. The text of that page is not part of this notice, so what additional collection it describes is not stated here.

Supporting quotations

For more information on our collection of Personal Information in the context of our Open Finance solutions, please click

Qualifications & exceptions

• Applies to the Open Finance solutions only.

Not stated here

• The linked Open Finance legal and privacy page was not supplied, so its content is unknown here.

Data Access & Collection · Company practice

Ads, apps and websites collect device and usage data through cookies and beacons

Mastercard, its service providers and partners may collect information about you by automated means, such as internet or other electronic network activity information, cookies and web beacons, when you interact with its ads, mobile apps, websites, pages or other digital assets. The internet and device information may include IP address, browser type, operating system, mobile device identifier, geographical area, referring URLs, and information on the actions you take or your interaction with the digital assets. The notice explains that a cookie is a text file placed on a computer's hard drive by a web server and a web beacon (also called an internet tag, pixel tag or clear GIF) helps identify when content has been accessed or visited.

Supporting quotations

We, our service providers and partners may collect certain information about you via automated means such as Internet or other electronic network activity information, cookies, and web beacons when you interact with our ads, mobile apps, or visit our websites, pages or other digital assets.

The Internet and/or Device Information we collect in this manner may include: IP address, browser type, operating system, mobile device identifier, geographical area, referring URLs and information on actions taken or interaction with our digital assets.

A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, is a technology that helps us identify when content has been accessed or visited.

Qualifications & exceptions

• Collection is by Mastercard, its service providers and its partners, not only Mastercard itself.
• The data types are what the information "may include", introduced as examples.

Data Access & Collection · Company practice

Essential cookies cannot be turned off on the site, though your browser can block them

Mastercard, its service providers and partners use essential cookies to make the site work. The notice says these cannot be disabled because they are needed for core functions like login, security, fraud prevention, network management and accessibility, and that they do not always involve personal data processing; when they do, it gives as the legal basis that they are necessary for the site to function so you can view it. It also says you can block these cookies in your browser, but doing so may affect how the site works. The notice does not explain how "cannot be disabled" and the ability to block them in a browser fit together.

Supporting quotations

We, our service providers and partners use essential cookies to make the site work properly. These cookies cannot be disabled because they are needed for core functions like login, security, fraud prevention, network management, and accessibility.

Essential cookies do not always involve personal data processing. When they do, the legal basis is that they are necessary for the site to function so you can view it.

You can block these cookies in your browser, but doing so may affect how the site works.

Qualifications & exceptions

• "Cannot be disabled" and "You can block these cookies in your browser" are both stated; the notice does not explain how they fit together.
• Essential cookies "do not always" involve personal data processing, so some may not touch Personal Information.

Not stated here

• The notice does not say where the site's cookie controls are in relation to these cookies, or which cookies are classed as essential.

Data Access & Collection · Company practice

Non-essential analytics, performance and marketing cookies depend on your banner choices

Mastercard says that, based on your choices in the cookie banner and, where required by law, with your consent, it may drop non-essential cookies for analytics, performance or marketing purposes. It says it uses this information to improve its online products and services by assessing how many users access them, which content, products and features interest visitors most, what offers customers like to see, and how the services perform technically. It gives third-party web analytics services such as Adobe Analytics as an example, whose providers use cookies and web beacons to help Mastercard analyze how visitors use its websites and apps.

Supporting quotations

based on your choices in the cookie banner and (where required by law) with your consent, we may drop non-essential cookies for analytics, performance, or marketing purposes.

we use this information to improve our online products and services by assessing how many users access or use our online products and services

we may use third-party web analytics services on our websites and mobile apps, such as those of Adobe Analytics.

Qualifications & exceptions

• Depends on your choices in the cookie banner and, where the law requires, your consent.
• The passage states the purposes as analytics, performance and marketing; the use described afterwards is improving online products and services.

Not stated here

• The notice does not say which third parties other than the Adobe Analytics example receive data from these cookies.

Data Access & Collection · Company practice

Offers, sweepstakes and promotions can involve contact details, tracking data and inferences

Mastercard, its service providers and partners may collect information about you in connection with marketing activities, including offers, sweepstakes, contests and promotions. The information may include identifiers and contact information, electronic identification data (such as username, password, security questions and IP address), and data collected in online marketing programs, including commercial information, internet or other electronic network activity information, geolocation data, and inferences drawn from Personal Information, such as personal characteristics, life habits, consumption habits, interests, location data, and voice and image recordings.

Supporting quotations

We, our service providers and partners may also collect information about you in connection with our marketing activities, including offers, sweepstakes, contests and promotions.

The information collected for these purposes may include identifiers and your contact information

and inferences drawn from Personal Information (e.g., personal characteristics, life habits, consumption habits, interests, location data, and voice and image recordings).

Qualifications & exceptions

• Applies to information collected in connection with marketing activities, not to all Mastercard activity.
• The listed items are what the information "may include"; the examples include inferences, not only data you hand over.

Inference & Profiling · Company practice

Mastercard collects what you view and do to tailor content and ads

Mastercard, its service providers and partners may also collect information to provide content and advertising tailored to your individual interests based on inferences drawn from Personal Information. The information may include internet or other electronic network activity information, such as the pages or ads you view on Mastercard's websites and apps and the actions you take there.

Supporting quotations

We, our service providers and partners may also collect information about you to provide you with content and advertising tailored to your individual interests based on inferences drawn from Personal Information.

such as details about things like the particular pages or ads you view on our websites and apps and the actions you take on our websites and apps.

Qualifications & exceptions

• The tailoring described is based on activity on Mastercard's own websites and apps; cross-site ad choices are described in the rights and choices section.

Sharing & Disclosure · Company practice

Social media buttons and plug-ins can tell the platform you visited

Mastercard, its service providers and partners may collect information through social media tools, widgets or plug-ins that connect you to your social media accounts, such as sign-in through a social account or sharing a link. When you visit a page containing such tools, the social media or other service provider may learn of your visit. Mastercard says your interactions with these tools are governed by the social platforms' own privacy policies, that it does not control those third parties' data handling, and it points to Section 7 of the notice. Section 7 adds that the provider may learn of the visit even if you are not logged in or have no account, and that when you visit a page with a social media button your browser connects directly to the provider and data about the visit, including IP address, is transferred to it.

Supporting quotations

We, our service providers and partners may collect certain information about you via automated means such as, social media tools, widgets or plug-ins to connect you to your social media accounts.

When you visit a website that contains such tools or plugins, the social media or other service provider may learn of your visit.

your interactions with these tools are governed by the privacy policies of the corresponding social media platforms. As we do not control these third-parties’ data handling practices

These social media providers may learn of your visit even if you are not logged in to your social media account or if you do not have an account with them.

When you visit a website with a social media button, your browser establishes a direct connection to that social media provider, and data concerning your visit, including IP address, is transferred to the social media provider.

Qualifications & exceptions

• Applies to pages that contain social media tools, widgets or plug-ins; what the provider does with the visit data is governed by that provider's policy, not this notice.
• The provider may learn of a visit even without a login or account.

Not stated here

• The notice does not say what each social media provider does with the visit data.

Cross-references

• refers to (model-proposed): Linked sites and partner features are independent; review their own privacy notices — The social media tools paragraph points to Section 7 for further details; Section 7 describes linked sites, partner features and social media providers.

Security & Safeguards · Company practice

Fraud tools may use how you type, move and scroll

Mastercard says some of its online products and services include advanced fraud prevention technology that uses behavioral-based data or biometric information, giving as examples keystroke timing, device accelerometer, scroll position and mouse location.

Supporting quotations

some of our online products and services include advanced fraud prevention technology using behavioral-based data or biometric information, such as keystroke timing, device accelerometer, scroll position and mouse-location.

Qualifications & exceptions

• Applies to "some" online products and services, not all, and the examples are introduced with "such as".

Not stated here

• The notice does not say which products use this technology or how long the data is kept.

Use & Processing · Company commitment

Where the law requires, Mastercard says it obtains consent first

Mastercard says that where applicable law requires it, it obtains your consent before using the automated means described above and before sending marketing communications, tailored content and advertising. The notice sends readers to its "Your Rights and Choices" section to learn about their choices.

Supporting quotations

Where required under applicable law, we obtain your consent prior to using the above automated means, and prior to sending you marketing communications, tailored content and advertising.

Please see the “Your Rights and Choices” section of this Global Privacy Notice to learn about your choices.

Qualifications & exceptions

• Consent is promised only "where required under applicable law"; it is not a general consent rule for every place or every use.

Not stated here

• The notice does not say in which places or for which uses the law is treated as requiring consent.

Data Access & Collection · Company practice

Mastercard does not respond to browser Do Not Track signals

Mastercard states that, because there is not yet a consensus on how companies should respond to web browser-based do-not-track (DNT) mechanisms, it does not respond to web browser-based DNT signals at this time. It points to an external site to learn more about browser tracking signals.

Supporting quotations

Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, Mastercard does not respond to web browser-based DNT signals at this time.

Qualifications & exceptions

• Stated "at this time"; the notice does not say whether or when this will change.

Data Access & Collection · Company practice

Job applicants' identifiers and work history are collected through the Career site

If you apply for a job at Mastercard, it says it may collect certain identifiers and professional or employment-related information from your application on its Career website. It refers to a separate Mastercard Applicant Privacy Notice for the type of information collected in connection with job applications.

Supporting quotations

If you are applying for a job at Mastercard, we may collect certain identifiers and professional or employment-related information from your job applications on our Career website.

Qualifications & exceptions

• Applies to people applying for a job at Mastercard through its Career website.

Not stated here

• The separate Applicant Privacy Notice is linked but not supplied, so the full scope of application data is not stated here.

Data Access & Collection · Company practice

People who work for business partners have their contact and credential data collected

Mastercard says it may collect Personal Information from individuals working for its business partners (financial institutions, merchants, customers, suppliers, vendors and others), including identifiers, name, job title, department, organization, business email and postal addresses, business telephone number, queries, answers to security questions, passwords and other credentials. It may use this to provide products and services to financial institutions, corporate clients, merchants, customers and partners; to manage business relationships and financial reporting; for franchise development and integrity; to protect against financial crime; to improve its service; for marketing; to comply with law; and for accounting, auditing and billing.

Supporting quotations

We may collect Personal Information from individuals working for one of our business partners (including financial institutions, merchants, customers, suppliers, vendors and other partners), including identifiers, name, job title, department and name of organization, business email and postal addresses, business telephone number, queries, answers to security questions, security passwords and other credentials.

We may use this information to provide products and services directly to financial institutions, corporate clients, merchants, customers and partners, to manage our business relationships and financial reporting, for franchise development and integrity, to protect us from financial crime, to improve our service, for marketing and to comply with applicable law, as well as for accounting, auditing and billing purposes.

Qualifications & exceptions

• Applies to individuals who work for one of Mastercard's business partners, not consumers generally.

Data Access & Collection · Company practice

In some places Mastercard processes sensitive data such as account numbers and biometrics

Mastercard says that in certain jurisdictions it may need to receive and process Sensitive Personal Information to provide products and services to you or to its financial institution, corporate client, merchant, customer and partner organizations. It says the processing will be protected with adequate security measures and conducted so as to have the lowest possible impact on your personal rights and interests. It says the following may be considered Sensitive Personal Information as defined by applicable law: personal account number, card expiration date, card verification code, answers to security questions, passwords and other credentials, address or location information (to the extent it may reveal personal tracks), voice and image recordings, electronic identification data, payment transactions, and biometric information.

Supporting quotations

In certain jurisdictions, it may be necessary for us to receive and process your Sensitive Personal Information to provide respective products and services to you and/or to financial institutions, corporate clients, merchants, customers and partners.

Such processing of your Sensitive Personal Information will be protected with adequate security measures and be conducted in a manner so as to have the lowest possible impact on your personal rights and interests.

The following information may be considered Sensitive Personal Information as defined by applicable law: personal account number, card expiration date, card verification code, answers to security questions, security passwords and other credentials, address or location information (to the extent that it may reveal your personal tracks), voice and image recordings, electronic identification data, payment transactions, and biometric information.

Qualifications & exceptions

• Stated for "certain jurisdictions" and as information that "may be considered" Sensitive Personal Information under applicable law; the notice does not name the jurisdictions.
• Address or location information counts only "to the extent that it may reveal your personal tracks".

Not stated here

• The notice does not name the jurisdictions, and does not say which items are sensitive in which place.

Use & Processing · Company practice

Core uses: process payments, prevent fraud and run Open Finance

The list of uses begins with processing payment transactions, protecting against and preventing fraud and other legal or information security risks, and providing Mastercard's Open Finance solutions. The fraud item points to a Fraud & Security Notice and a MATCH Notice, and the Open Finance item to a separate Open Finance page, for more information.

Supporting quotations

We May Use Your Personal Information to:

Process your payment transactions.

Protect against and prevent fraud, and other legal or information security risks.

Provide our

Qualifications & exceptions

• The list is introduced with "We May Use Your Personal Information to"; items state what Mastercard may do, not that each applies to every person.

Not stated here

• The Fraud & Security Notice, MATCH Notice and Open Finance page are linked but not supplied, so their additional detail is unknown here.

Use & Processing · Company practice

Uses for accounts, identity checks, communications, loyalty and personalized recommendations

Mastercard says it may use Personal Information to create and manage accounts you may have with it, verify your identity, provide its services and respond to inquiries; to provide and communicate with you about products and services offered by Mastercard, financial institutions, merchants and partners; to offer and support loyalty programs (with a link to a Loyalty Notice); and to provide personalized services and recommendations.

Supporting quotations

Create and manage any accounts you may have with us, verify your identity, provide our services, and respond to your inquiries.

Provide and communicate with you about products and services offered by Mastercard, financial institutions, merchants and partners.

Offer and support loyalty programs.

Provide you with personalized services and recommendations.

Qualifications & exceptions

• Communications cover products and services offered not only by Mastercard but also by financial institutions, merchants and partners.

Not stated here

• The Loyalty Notice is linked but not supplied.

Use & Processing · Company practice

Business contacts may be published in business directories

Mastercard says it may use Personal Information to manage its customer, supplier and vendor relationships, including to create and publish business directories, which may include business contact information.

Supporting quotations

Manage our customer, supplier and vendor relationships, including to create and publish business directories (which may include business contact information).

Qualifications & exceptions

• Concerns customer, supplier and vendor relationships; the notice does not say who can see the directories or where they are published.

Not stated here

• Who can access the published directories is not stated.

Use & Processing · Company practice

Uses to run and improve the business, including preparing data for analytics

Mastercard says it may use Personal Information to operate, evaluate and improve its business, including cleansing, preparing and/or anonymizing data for analytics and to develop new products and services.

Supporting quotations

Operate, evaluate and improve our business, including cleansing, preparing, and/or anonymizing data for analytics and to develop new products and services.

Use & Processing · Company practice

Mastercard may use artificial intelligence and machine learning on personal data

Mastercard says it may use Personal Information to develop and improve products and services, detect and prevent deceptive, fraudulent or illegal activity, and improve customer and consumer experience. For these processing activities it says it may use techniques such as artificial intelligence and machine learning to process and analyze data.

Supporting quotations

Develop and improve products and services, detect, and prevent deceptive, fraudulent, or illegal activity, and improve customer and consumer experience.

For these processing activities, we may use techniques such as artificial intelligence and machine learning to process and analyze data.

Qualifications & exceptions

• The AI and machine learning statement is tied to these three processing activities (product development, fraud and illegal activity detection, and customer experience), and "techniques such as" makes the list of techniques non-exhaustive.

Not stated here

• The notice does not say what data feeds the models or whether automated decisions affecting individuals are made.

Use & Processing · Company practice

Anonymized and aggregated data is used to advise Mastercard's customers and partners

Mastercard says it may use Personal Information to generate anonymized and aggregated data in order to prepare insights that advise Mastercard's customers and partners about spending patterns, fraud and other trends.

Supporting quotations

Generate anonymized and aggregated data to prepare insights to advise Mastercard’s customers and partners regarding spending patterns, fraud and other trends.

Qualifications & exceptions

• The output described is anonymized and aggregated data; the notice does not describe the anonymization method here.

Not stated here

• The notice does not define "anonymized" or "aggregated" or describe how re-identification is prevented.

Use & Processing · Company practice

Public social media posts about Mastercard may be processed

Mastercard says it may use Personal Information to assess public feedback about Mastercard by processing publicly available information, including social media posts, and to respond to customer inquiries directed to it on public platforms.

Supporting quotations

Assess public feedback about Mastercard by processing publicly available information, including social media posts, and respond to customer inquiries directed to us on public platforms.

Use & Processing · Company practice

Job application information is used to process the application

Mastercard says it may use Personal Information to process your job application, and refers to a separate Applicant Privacy Notice.

Supporting quotations

Process your job application.

Qualifications & exceptions

• Applies to people who apply for a job with Mastercard.

Not stated here

• The Applicant Privacy Notice is linked but not supplied.

Sharing & Disclosure · Company practice

Personal data may be disclosed to a buyer if Mastercard's business or assets are sold

Mastercard says it may use Personal Information to enable mergers, acquisitions and/or the sale of its business or assets. For example, if it sells any business or assets, or any part of them is acquired by a third party, it may disclose personal information relating to those businesses and assets to the prospective buyer or acquirer.

Supporting quotations

Enable mergers, acquisitions and/or sale of business or assets.

if we sell any business or assets or any part of our business or assets is acquired by a third-party, we may disclose your personal information relating to those business and assets to the prospective buyer or the acquiring third-party.

Qualifications & exceptions

• Disclosure is of personal information relating to the business or assets being sold or acquired, to a prospective buyer or the acquiring third party.

Not stated here

• The notice does not say whether affected individuals will be told or can object before a transfer.

Inference & Profiling · Company practice

Mastercard may infer your preferences and other characteristics

Mastercard says it may use Personal Information to learn more about you, including your preferences or other characteristics, and that it treats these inferences as Personal Information where required under applicable law.

Supporting quotations

Learn more about you, including your preferences or other characteristics.

We treat these inferences as Personal Information where required under applicable law.

Qualifications & exceptions

• Inferences are treated as Personal Information only "where required under applicable law", so elsewhere the notice does not promise that treatment.

Not stated here

• The notice does not say which laws require this treatment or which inferences are made.

Use & Processing · Company practice

Other purposes apply if notified at collection or authorized or required by law

Mastercard says it may also use Personal Information for other purposes for which it provides specific notice at the time of collection, and as otherwise authorized or required by law.

Supporting quotations

Serve other purposes for which we provide specific notice at the time of collection, and as otherwise authorized or required by law.

Qualifications & exceptions

• Other purposes are tied either to specific notice at the time of collection or to legal authorization or requirement.

Legal Rights & Agreement Rules · Company commitment

Mastercard says it relies on consent, necessity, legal duty or legitimate interest depending on the country

Where applicable law requires, Mastercard says it will only use Personal Information with your consent, as necessary to provide products and services, to comply with a legal obligation, or when a legitimate and overriding interest necessitates the use. It says that, depending on the country, it will only process Personal Information where permitted by law and when it has a legal basis for the processing identified in the table that follows. It adds that although the table does not list consent as a legal basis for each activity, in some countries consent is the only or most appropriate legal basis, and in those countries it relies on consent.

Supporting quotations

Where required under applicable law, we will only use your Personal Information with your consent; as necessary to provide you with products and services; to comply with a legal obligation; or when there is a legitimate and overriding interest that necessitates the use.

Depending on the country in which you are located, we will only process your Personal Information, where permitted under applicable laws, and when we have a legal basis for the processing as identified in the table below.

even though the chart below does not list consent as a legal basis for each processing activity, in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries, we rely on consent.

Qualifications & exceptions

• The legal-basis commitments apply "where required under applicable law" and depend on the country where you are located.
• Consent may be the legal basis in some countries even where the table does not list it.

Not stated here

• The notice does not say which countries treat consent as the only or most appropriate basis.

Legal Rights & Agreement Rules · Company practice

Payments: Mastercard mostly acts as processor and only sometimes as controller

In the legal-basis table, for processing payment transactions (including authorization, clearing, chargebacks and related dispute resolution), Mastercard says that in most cases it acts as a processor on behalf of financial institutions, merchants and other partners who are the data controllers; controllers are responsible for ensuring a legal basis, and where applicable Mastercard has taken steps to ensure they obtained your consent. In some limited cases, such as chargebacks, it may process as a controller, provided that you consented, the processing is necessary for entering into or performing a contract with you, or it is necessary to comply with a legal or regulatory obligation.

Supporting quotations

Process your payment transactions (including authorization, clearing, chargebacks and other related dispute resolution activities).

In most cases, we process your payment transactions as a processor on behalf of your financial institutions, merchants and other partners which act as data controllers. When we act as a processor, controllers are responsible for ensuring a legal basis for the processing of your Personal Information.

Where applicable, we have taken steps to ensure that controllers have obtained your consent to our processing of your Personal Information on their behalf.

In some limited cases (e.g., chargebacks), we may process your payment transactions as a controller, provided that:

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

The processing is necessary for compliance with a legal or regulatory obligation.

Qualifications & exceptions

• Table cell for the payment-processing row; the grounds apply "where required under applicable law" per the column heading.
• The controller grounds apply to "some limited cases (e.g., chargebacks)", not to payment processing generally.

Not stated here

• The table does not say which cases beyond chargebacks count as limited cases where Mastercard acts as controller.

Legal Rights & Agreement Rules · Company practice

Fraud prevention: as controller Mastercard cites consent, law, contract or legitimate interest

In the legal-basis table, for protecting against and preventing fraud and cyber threats, unauthorized transactions, claims and other liabilities, and managing risk exposure and franchise quality for the integrity and security of its payments network, Mastercard says it may act as a controller or a processor. When it acts as a controller it relies on one of these grounds: your consent; compliance with a legal or regulatory obligation; necessity for entering into or performing a contract with you; or its or a third party's legitimate interest in protecting against fraud and securing its network and the payment transactions it processes (including blockchain in relation to cryptocurrency).

Supporting quotations

Protect against and prevent fraud and cyber threats, unauthorized transactions, claims and other liabilities, and manage risk exposure and franchise quality with respect to the integrity and security of our payments network.

When we process Personal Information for fraud and cyber threat prevention, we may act as a controller or as a processor. When we act as a controller, we rely on one of the following legal grounds:

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal or regulatory obligation; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of protecting against fraud, securing our network and the payment transactions that we process (including blockchain in relation to cryptocurrency).

Qualifications & exceptions

• The listed legal grounds apply when Mastercard acts as a controller for fraud and cyber threat prevention; the table gives no grounds for its processor role.
• Grounds apply "where required under applicable law" per the column heading.

Not stated here

• The table does not say when Mastercard acts as controller rather than processor for fraud prevention.

Legal Rights & Agreement Rules · Company practice

Fraud prevention: separate notices cover fraud monitoring and the MATCH program

For fraud prevention, the legal-basis table includes Mastercard's or a third party's legitimate interest in protecting against fraud and securing its network and the payment transactions it processes, including blockchain in relation to cryptocurrency. It points to a Fraud & Security Notice for more on fraud prevention and monitoring, and to a MATCH Notice for the Mastercard Alert To Control High-risk Merchants (MATCH) program.

Supporting quotations

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of protecting against fraud, securing our network and the payment transactions that we process (including blockchain in relation to cryptocurrency).

For more information on our fraud prevention and monitoring activities, please see our

For more information on the Mastercard Alert To Control High-risk Merchants (MATCH) program, please see our

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Not stated here

• The Fraud & Security Notice and the MATCH Notice are linked but not supplied here, so their content is unknown.

Legal Rights & Agreement Rules · Company practice

Open Finance: consent, legal duty, contract or legitimate interest, or processor for partners

In the legal-basis table, for providing Open Finance solutions (including connectivity and dispute resolution services), Mastercard lists as grounds: your consent; compliance with a legal or regulatory obligation; necessity for entering into or performing a contract with you; or its or a third party's legitimate interest, for example detecting fraud risks or resolving disputes. It adds that in some cases it provides Open Finance solutions as a processor for your service provider, merchants and other partners that are controllers; the controllers are then responsible for a legal basis, and where applicable Mastercard has taken steps to ensure they obtained your consent. It points to an Open Finance Legal & Privacy Center for more information.

Supporting quotations

Provide our Open Finance solutions, including our connectivity and dispute resolution services.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal or regulatory obligation; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for such purpose (e.g., detecting fraud risks or resolving disputes).

In some cases, we provide our Open Finance solutions as a processor on behalf of your service provider, merchants and other partners which act as data controllers.

Where applicable, we have taken steps to ensure that controllers have obtained your consent to our processing of your Personal Information on their behalf.

For more information on our Open Finance activities, please see our

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The processor statement applies to "some cases" of Open Finance; the table does not say which.

Not stated here

• The Open Finance Legal & Privacy Center is linked but not supplied.

Legal Rights & Agreement Rules · Company practice

Accounts and identity checks: consent, contract, legal duty or legitimate interest

In the legal-basis table, for creating and managing accounts, verifying your identity, providing services and responding to inquiries, Mastercard lists as grounds: your consent; necessity for entering into or performing a contract with you; compliance with a legal or regulatory obligation; or its or a third party's legitimate interest in creating and managing accounts, verifying identity and responding to inquiries.

Supporting quotations

Create and manage any accounts you may have with us, verify your identity, provide our services, and respond to your inquiries.

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are a party; or

The processing is necessary for compliance with a legal or regulatory obligation; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of creating and managing accounts and verifying your identity, and responding to your inquiries.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Legal Rights & Agreement Rules · Company practice

Offers, loyalty, contests and donation programs: consent, contract or legitimate interest

In the legal-basis table, the activity of providing, administering and communicating about products, services, offers, loyalty programs and promotions of Mastercard, financial institutions, merchants and partners includes loyalty program operation, contests, sweepstakes, donation service program operation and any other marketing activities. The grounds listed are your consent; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in providing you with products and services. The cell points to a Loyalty Programs Notice and a Mastercard Donation Service Privacy Notice.

Supporting quotations

Provide, administer, and communicate with you about products, services, offers, loyalty programs and promotions (including loyalty program operation, contests, sweepstakes, donation service program operation, and any other marketing activities) of Mastercard, financial institutions, merchants, and partners.

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of providing you with products and services.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The row lists no legal-obligation ground; the legitimate interest is stated as "providing you with products and services".

Not stated here

• The Loyalty Programs Notice and Donation Service Privacy Notice are linked but not supplied.

Legal Rights & Agreement Rules · Company practice

Customer, supplier and vendor relationships: consent, contract or legitimate interest

In the legal-basis table, for managing customer, supplier and vendor relationships, including creating and publishing business directories that may include business contact information, Mastercard lists as grounds: your consent; necessity for entering into or performing a contract to which you are a party; or its or a third party's legitimate interest in managing those relationships.

Supporting quotations

Manage our customer, supplier and vendor relationships, including to create and publish business directories (which may include business contact information).

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of managing our customer, supplier and vendor relationships.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Legal Rights & Agreement Rules · Company practice

Running and improving the business, ad measurement and spending analysis: consent, contract or legitimate interest

In the legal-basis table, operating, evaluating and improving the business includes developing new products and services; cleansing, organizing and preparing data for permissible purposes; determining the effectiveness of and optimizing Mastercard's advertising; analyzing its products, services, websites, mobile apps and other digital assets to facilitate their functionality; and analyzing and comparing the spending approach of customers who have signed up to a marketing program (such as Priceless Specials) to understand and improve the program's effectiveness. The grounds listed are your consent; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in operating, evaluating and improving its products or services.

Supporting quotations

Operate, evaluate and improve our business (including developing new products and services or cleansing, organizing, and preparing data for permissible purposes); determining the effectiveness of and optimizing our advertising; analyzing our products, services, websites, mobile apps and any other digital assets in order to facilitate their functionality;

analyzing and comparing our customers’ approach to spending that have signed up to our marketing program (such as Priceless Specials) in order to understand and improve the effectiveness of the program.

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of operating, evaluating and improving our products or services.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The spending analysis concerns customers who have signed up to a marketing program such as Priceless Specials, not all cardholders.

Not stated here

• "Permissible purposes" for prepared data is not defined in the table.

Legal Rights & Agreement Rules · Company practice

Due diligence, accounting, billing and collections: legal duty, contract or legitimate interest

In the legal-basis table, performing due diligence reviews, accounting, auditing, billing, reconciliation and collection activities rests on: compliance with a legal or regulatory obligation; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in performing due diligence, billing, reconciliation and collection activities. Consent is not listed for this row.

Supporting quotations

Performing due diligence reviews, accounting, auditing, billing, reconciliation and collection activities.

The processing is necessary for compliance with a legal or regulatory obligation; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of performing due diligence, billing, reconciliation and collection activities.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• Consent is not listed for this row, although the preceding text says some countries rely on consent even where the table does not list it.

Inference & Profiling · Company practice

Personalized offers: Mastercard may analyze your email address and site activity

In the legal-basis table, providing personalized services and recommendations is explained with an example: Mastercard may use Personal Information such as your email address and your interaction with its website to analyze your preferences, interests and behavior, in order to decide to give you tailored content and the most relevant offers, recommendations and email communications about a specific product from Mastercard, financial institutions, merchants and partners. The grounds listed are your consent; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in providing personalized services and recommendations.

Supporting quotations

Provide you with personalized services and recommendations.

we may use your Personal Information such as your email address and your interaction with our website to analyze your preferences, interests and behavior in order to decide to provide you with tailored content and the most relevant offers, recommendations and email communications about a specific product from Mastercard, financial institutions, merchants and partners.

You consented to the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of providing you personalized services and recommendations.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The example uses "such as" email address and website interaction, so other data may also be used.

Use & Processing · Company practice

Anonymized spending reports may be built from payment data, and the table mentions training AI

In the legal-basis table, Mastercard says it anonymizes Personal Information and prepares and furnishes aggregated data reports of anonymized information (including compilations, analyses, analytical and predictive models and rules, and other aggregated reports) to advise financial institutions, merchants and other customers and partners about past and potential future patterns of spending, fraud, credit risk and other insights. It says the Personal Information it anonymizes may include payment transactions. The grounds listed are its or a third party's legitimate interest in anonymizing and preparing and furnishing the reports, or that the processing is undertaken for statistical and/or research purposes (in jurisdictions where that legal ground is available) and training its AI.

Supporting quotations

Anonymize Personal Information and prepare and furnish aggregated data reports showing anonymized information (including compilations, analyses, analytical and predictive models and rules, and other aggregated reports)

for the purpose of advising our financial institutions, merchants and other customers and partners regarding past and potential future patterns of spending, fraud, credit risk,

The Personal Information we anonymize may include payment transactions.

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of anonymizing Personal Information and preparing and furnishing aggregated data reports; or

The processing is undertaken for statistical and/or research purposes (in jurisdictions where this legal ground is available) and training our AI.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The statistical or research ground is stated only "in jurisdictions where this legal ground is available".
• The anonymization concerns Personal Information that may include payment transactions.

Not stated here

• The notice does not say what "training our AI" involves or which data is used for it beyond the anonymization described here.

Cross-references

• contrast (model-proposed): Mastercard says it does not collect, use or sell personal data to train large language models — The legal-basis table lists training Mastercard's AI as part of a processing ground, while the U.S. section says it does not collect, use or sell Personal Information to train large language models. The notice does not say whether the AI referred to in the table includes large language models.

Use & Processing · Company commitment

Mastercard says it will not try to re-identify anonymized data unless the law permits

The legal-basis table adds that, to the extent Mastercard maintains or otherwise processes deidentified or anonymized information, it will maintain and use it in deidentified or anonymized form and will not attempt to reidentify it unless otherwise permitted by applicable law.

Supporting quotations

To the extent we maintain or otherwise process deidentified or anonymized information, we will maintain and use the information in deidentified or anonymized form and will not attempt to reidentify the information unless otherwise permitted by applicable law.

Qualifications & exceptions

• The commitment is qualified by "unless otherwise permitted by applicable law", so legal permission to re-identify would not be excluded.

Not stated here

• The notice does not say what laws would permit re-identification.

Legal Rights & Agreement Rules · Company practice

Employment interest: contacting you about jobs rests on contract, legitimate interest or legal duty

In the legal-basis table, evaluating your interest in employment and contacting you about possible employment with Mastercard rests on necessity for entering into or performing a contract with you; Mastercard's or a third party's legitimate interest in evaluating your interest and contacting you; or compliance with a legal or regulatory obligation. The cell points to the Mastercard Applicant Privacy Notice for more information.

Supporting quotations

Evaluate your interest in employment and contact you regarding possible employment with Mastercard.

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of evaluating your interest in employment and contacting you regarding possible employment; or

The processing is necessary for compliance with a legal or regulatory obligation.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Not stated here

• The Applicant Privacy Notice is linked but not supplied.

Legal Rights & Agreement Rules · Company practice

Public feedback: processing public posts rests on legitimate interest

In the legal-basis table, assessing public feedback about Mastercard by processing publicly available information, including social media posts, and responding to customer inquiries on public platforms, rests on Mastercard's or a third party's legitimate interest in processing publicly available information to understand public feedback, improve its products and services, and respond to inquiries on public platforms.

Supporting quotations

Assess public feedback about Mastercard by processing publicly available information, including social media posts, and respond to customer inquiries directed to us on public platforms.

We, or a third party, have a legitimate interest in processing publicly available information for the purpose of understanding public feedback about Mastercard, improving our products and services, and responding to customer inquiries directed to us via public platforms.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• Legitimate interest is the only ground listed for this row.

Legal Rights & Agreement Rules · Company practice

Enforcing terms and defending legal rights: contract, legal duty or legitimate interest

In the legal-basis table, enforcing Mastercard's Terms of Use, or processing as necessary to establish, exercise and defend legal rights, rests on necessity for entering into or performing a contract with you; compliance with a legal or regulatory obligation; or Mastercard's or a third party's legitimate interest in enforcing the Terms of Use and establishing, exercising and defending legal rights.

Supporting quotations

Enforce our

or as necessary to establish, exercise and defend legal rights.

The processing is necessary for entering into, or performance of a contract to which you are party; or

The processing is necessary for compliance with a legal or regulatory obligation; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of enforcing the

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Not stated here

• The Terms of Use are linked but not supplied here.

Legal Rights & Agreement Rules · Company practice

Legal compliance and requests from courts, law enforcement or agencies

In the legal-basis table, processing as may be required by applicable laws and regulations, including Know Your Customer, anti-money-laundering, anti-corruption and sanctions screening requirements, or as requested by any judicial process, law enforcement or governmental agency having or claiming jurisdiction over Mastercard or its affiliates, rests on compliance with a legal or regulatory obligation, and on Mastercard's or a third party's legitimate interest in responding to a judicial process, law enforcement or governmental agency.

Supporting quotations

As may be required by applicable laws and regulations, including for compliance with Know Your Customers, Anti-Money Laundering, anti-corruption and sanctions screening requirements, or as requested by any judicial process, law enforcement or governmental agency having or claiming jurisdiction over Mastercard or Mastercard’s affiliates.

The processing is necessary for compliance with a legal or regulatory obligation; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of responding to a judicial process, law enforcement or governmental agency.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• Covers agencies "having or claiming jurisdiction", so a request from an agency whose jurisdiction is only claimed is within the wording.

Not stated here

• The table does not say what information is disclosed to authorities or whether affected individuals are notified.

Legal Rights & Agreement Rules · Company practice

Complying with industry standards and Mastercard policies: consent, legal duty, contract or legitimate interest

In the legal-basis table, complying with industry standards and Mastercard's own policies rests on your consent; compliance with a legal or regulatory obligation; necessity for entering into or performing a contract with you; or Mastercard's or a third party's legitimate interest in complying with industry standards and its policies.

Supporting quotations

Comply with industry standards and our policies.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal or regulatory obligation; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of complying with industry standards and our policies.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").

Not stated here

• The standards and policies referred to are not supplied in this source, and the notice does not say which ones are meant.

Legal Rights & Agreement Rules · Company practice

Product development and AI use: the legitimate-interest cell repeats the industry-standards wording

In the legal-basis table, developing and improving products and services, detecting and preventing deceptive, fraudulent or illegal activity and improving customer and consumer experience, with artificial intelligence and machine learning techniques used to process and analyze data, rests on your consent; compliance with a legal obligation or other regulatory obligations; necessity for entering into or performing a contract with you; or a legitimate interest. The legitimate-interest cell is worded as a legitimate interest "for the purposes of complying with industry standards and our policies", which is the same wording as the previous row, and does not mention product development, fraud detection or AI.

Supporting quotations

Develop and improve products and services, detect, and prevent deceptive, fraudulent, or illegal activity, and improve customer and consumer experience.

we may use techniques such as artificial intelligence and machine learning to process and analyze data.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of complying with industry standards and our policies.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The legitimate-interest wording for this row names compliance with industry standards and policies as its purpose, not the row's own activities.

Not stated here

• The notice does not explain whether the legitimate-interest wording in this row is intended to cover development, fraud detection and AI use, or repeats the previous row's wording by mistake.

Legal Rights & Agreement Rules · Company practice

Business sale or merger: legal duty, contract or a legitimate interest worded as industry standards

In the legal-basis table, enabling mergers, acquisitions and/or the sale of Mastercard's business or assets (including disclosing personal information about the affected business or assets to a prospective buyer or acquirer) rests on compliance with a legal obligation or other regulatory obligations; necessity for entering into or performing a contract with you; or a legitimate interest. The legitimate-interest cell is worded as a legitimate interest "for the purposes of complying with industry standards and our policies", the same wording used in the two previous rows, and does not mention business transfers.

Supporting quotations

Enable mergers, acquisitions and/or sale of business or assets.

we may disclose your personal information relating to those business and assets to the prospective buyer or acquiring third-party.

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purposes of complying with industry standards and our policies.

Qualifications & exceptions

• Grounds apply "where required under applicable law" per the table column heading; they are listed as alternatives ("or").
• The legitimate-interest wording in this row names compliance with industry standards and policies as its purpose, not business transfers.

Not stated here

• The notice does not explain whether the legitimate-interest wording in this row is intended to cover business transfers or repeats an earlier row's wording.
• The standards and policies referred to are not supplied in this source.

Legal Rights & Agreement Rules · Procedure

Other purposes are explained in a specific privacy notice at the time of collection

In the legal-basis table, the row for other purposes for which Mastercard provides specific notice at the time of collection gives no legal ground itself; it tells the reader to consult the Specific Privacy Notice at the time of the collection.

Supporting quotations

For other purposes for which we provide specific notice at the time of collection.

Please consult the Specific Privacy Notice at the time of the collection.

Qualifications & exceptions

• The legal basis for these purposes is not stated in this table.

Not stated here

• The specific privacy notices are given at the time of collection and are not part of this notice, so the grounds for those purposes are unknown here.

Legal Rights & Agreement Rules · Company commitment

Mastercard says it has weighed legitimate interests against your rights where required

Where required under applicable law, Mastercard says it has carried out balancing tests for processing based on its or a third party's legitimate interests, to ensure that the legitimate interest is not overridden by your interests, fundamental rights or freedoms. For more information on the balancing tests you may contact Mastercard as described in the "How to Contact Us" section.

Supporting quotations

Where required under applicable law, we have carried out balancing tests for the data processing based on our or a third party’s legitimate interests to ensure that such legitimate interest is not overridden by your interests, fundamental rights or freedoms.

For more information on our balancing tests, you may contact us as described in the “How to Contact Us” section below.

Qualifications & exceptions

• Balancing tests are stated as carried out "where required under applicable law"; the notice does not say where that is.

Not stated here

• The results of the balancing tests are not published in this notice; the notice only offers contact for more information.

Use & Processing · User right or choice

Mastercard says it will not make solely automated decisions with legal or similar effects, with exceptions

Mastercard says it will not subject you to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, unless: you explicitly consented where required under applicable law; the processing is necessary for entering into or performing a contract between you and Mastercard; or it is legally required to use your Personal Information in this way, for example to prevent fraud.

Supporting quotations

We will not subject you to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, unless you explicitly consented to the processing where required under applicable law, the processing is necessary for entering into, or performance of a contract between you and Mastercard, or when we are legally required to use your Personal Information in this way, for example to prevent fraud.

Qualifications & exceptions

• The commitment covers decisions "based solely on automated processing" with legal or similarly significant effects; it has three exceptions (explicit consent where required by law, contract necessity, legal requirement such as fraud prevention).

Not stated here

• The notice does not say which of Mastercard's decisions, if any, fall under the exceptions.

Legal Rights & Agreement Rules · Restriction or exception

If you give Mastercard information about someone else, you must make sure sharing it is lawful

Mastercard says that if you provide information or material relating to another individual, you must make sure that sharing it with Mastercard, and its further use as described to you from time to time, is in line with applicable laws. As an example, it says you should duly inform that individual about the processing of their Personal Information and obtain their consent, as may be necessary under applicable laws.

Supporting quotations

If you provide us with any information or material relating to another individual, you must make sure that the sharing with us and our further use as described to you from time to time is in line with applicable laws

you should duly inform that individual about the processing of her/his Personal Information and obtain her/his consent, as may be necessary under applicable laws.

Qualifications & exceptions

• Informing the other person and obtaining consent is required only "as may be necessary under applicable laws".

Not stated here

• The notice does not say what happens if you do not comply.

Account & Service Control · Restriction or exception

If you do not provide data needed for legal duties or a contract, you may lose access to services

Mastercard says that where the Personal Information it collects from you is needed to meet its legal or regulatory obligations or to enter into an agreement with you, and you do not provide it when requested, it may not be able to provide (or continue to provide) its products or services to you, and you may not be able to purchase the products you require or fully use its services.

Supporting quotations

Where the Personal Information we collect from you is needed to meet our legal or regulatory obligations or enter into an agreement with you, if you do not provide your Personal Information when requested, we may not be able to provide (or continue to provide) our products or services to you and you may not be able to purchase our products you require or fully use our services.

Qualifications & exceptions

• Applies only where the information is needed to meet legal or regulatory obligations or to enter into an agreement with you.

Sharing & Disclosure · Company practice

Shared with Mastercard group companies and with service providers acting for it

Mastercard says it may share Personal Information with Mastercard's headquarters in the U.S., its affiliates and other entities within its group of companies, and with service providers acting on its behalf. It says it requires those service providers by contract to process Personal Information only in accordance with its instructions and as necessary to perform services on its behalf or to comply with applicable law, and to safeguard the security and confidentiality of the information by appropriate technical and organizational measures and confidentiality obligations binding employees who access it. The service providers act for the purposes in this notice or in the applicable program-specific privacy notice.

Supporting quotations

We May Share Personal Information with:

Mastercard’s headquarters in the U.S., our affiliates and other entities within Mastercard’s group of companies.

Service providers acting on our behalf.

With our service providers who perform services on our behalf for the purposes described in this Global Privacy Notice (or in the applicable program specific privacy notice).

We require these service providers by contract to only process Personal Information in accordance with our instructions and as necessary to perform services on our behalf or in compliance with applicable law.

We also require them to safeguard the security and confidentiality of the Personal Information they process on our behalf by implementing appropriate technical and organizational security measures and confidentiality obligations binding employees accessing Personal Information.

Qualifications & exceptions

• The contractual requirements are stated for service providers who perform services on Mastercard's behalf, not for every recipient in the list.

Not stated here

• The program-specific privacy notices are not supplied here.

Sharing & Disclosure · Company practice

Shared with banks, card issuers, merchants and partners to process payments and prevent fraud

Mastercard says it may share Personal Information with other participants in the payment ecosystem, including financial institutions and merchants. In particular it may share it with financial institutions and other entities that issue payment cards, or with merchants, to process payment transactions and perform other activities that you request; and with entities that partner with Mastercard or help it provide its products and services, for fraud prevention and monitoring and third-party identification services, to ensure the security of transactions and its payment processing system.

Supporting quotations

Other participants in the payment ecosystem, including financial institutions, and merchants.

With financial institutions and other entities that issue payment cards or merchants to process payment transactions and perform other activities that you request.

With entities that partner with Mastercard or assist Mastercard in providing its products and services, for fraud prevention and monitoring and third party identification services, to ensure the security of transactions and our payment processing system.

Qualifications & exceptions

• Sharing with issuers and merchants is for processing payment transactions and other activities you request; sharing with partners is for fraud prevention and monitoring, third-party identification services and transaction security.

Sharing & Disclosure · Company practice

Open Finance data may be shared with entities of your choice and with Mastercard's own customers

Mastercard says it may share Personal Information with other participants in the Open Finance ecosystem, including financial institutions, merchants, third parties and other entities of your choice, giving your personal financial management application as an example. It also lists sharing when it acts as a service provider for third parties and provides them with Personal Information that it processes on their behalf.

Supporting quotations

Other participants in the Open Finance ecosystem, including financial institutions, merchants and third parties.

With other participants in the Open Finance ecosystem, including financial institutions, merchants and other entities of your choice

When we act as a service provider for third parties and provide them with Personal Information that we process on their behalf.

Qualifications & exceptions

• The "entities of your choice" example is a personal financial management application, so the recipients named in the second list are chosen by you; the first list names "third parties" more broadly.

Not stated here

• The notice does not say which third parties are Open Finance participants beyond these categories.

Sharing & Disclosure · Company practice

Shared with third parties for fraud prevention and where the law, courts or authorities require

Mastercard says it may share Personal Information with third parties for fraud monitoring and prevention, or other purposes required by law, and with other entities as required under applicable law. It also lists sharing as required under applicable law or legal process, or to respond to requests from law enforcement or governmental agencies; for such requests it says it will follow the process in its Binding Corporate Rules where applicable (Section 5 says these rules are recognized by EEA data protection authorities as providing an adequate level of protection).

Supporting quotations

Third parties for fraud monitoring and prevention purposes, or other purposes required by law.

Other entities as required under applicable law

As required under applicable law or legal process, or to respond to requests from law enforcement or governmental agencies.

When receiving such requests, we will follow the process set out in our Binding Corporate Rules (see Section 5 below) where applicable.

we have established and implemented Binding Corporate Rules (“BCRs”) that have been recognized by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally.

Qualifications & exceptions

• Following the Binding Corporate Rules process applies "where applicable"; the notice does not say where that is.

Not stated here

• The Binding Corporate Rules document is linked in Section 5 but its text is not supplied here, so the request process it sets out is not described.

Cross-references

• refers to (model-proposed): Mastercard relies on Binding Corporate Rules recognized by EEA authorities, and UK BCRs — The sharing section says requests from law enforcement or governmental agencies follow the process in the Binding Corporate Rules, referring to Section 5, where the Binding Corporate Rules are described.

Sharing & Disclosure · Company practice

Disclosed to protect people, enforce terms, prevent harm to Mastercard or investigate fraud

Mastercard says it may share Personal Information when it believes disclosure is necessary to protect individuals' vital interests, to enforce its Terms of Use, to prevent Mastercard against harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

Supporting quotations

When we believe disclosure is necessary to protect individuals’ vital interests, to enforce our

, prevent Mastercard against harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

Qualifications & exceptions

• The trigger is Mastercard's own belief that disclosure is necessary; the notice does not name recipients for these disclosures.

Not stated here

• The Terms of Use are linked but not supplied here; recipients of these disclosures are not named.

Sharing & Disclosure · Company practice

Shared with third-party features and social networks you use, and with others you consent to

Mastercard says it may share Personal Information with third parties whose features you use in connection with its products and services or with your consent, with third parties whose features (for example third-party cookies, widgets and plug-ins) are integrated in its products and services, with social media networks when you directly engage with those platforms, and with other third parties with your consent. For the integrated features and social media cases it points to Section 7, which says those features are operated by third parties that are independent of Mastercard and do not necessarily share its privacy policy, and that social media providers may learn of your visit.

Supporting quotations

Third parties whose feature(s) you use in connection with our products and services or with your consent.

With third parties whose features (e.g., third-party cookies, widgets, plug-ins) are integrated in our products and services.

With social media networks when you directly engage with those platforms.

With other third parties with your consent.

These features, including geo-location tools, are operated by third parties and are clearly identified as such. Social media providers such as Facebook and Twitter, and these other third parties, are independent from Mastercard and do not necessarily share the same policy as Mastercard regarding the protection of privacy.

Qualifications & exceptions

• The consent-based item covers "other third parties" and is separate from the integrated-features and social-network items.

Not stated here

• The third parties are not named, and their own policies are outside this notice.

Sharing & Disclosure · Company commitment

If Mastercard's business is sold, the buyer receives your data and Mastercard asks it to honor this notice

Mastercard lists sharing with other entities in the event of a sale or transfer of its business or assets. It says that, should such a sale or transfer occur, it will use reasonable efforts to direct the transferee to use the Personal Information you provided in a manner consistent with its Global Privacy Notice, and that after the transfer you may contact the entity to which the information was transferred with any inquiries about its processing.

Supporting quotations

or in the event of a sale or transfer of our business or assets.

In the event we sell or transfer all or a portion of our business or assets.

we will use reasonable efforts to direct the transferee to use Personal Information you have provided to us in a manner that is consistent with our Global Privacy Notice.

Following such a sale or transfer, you may contact the entity to which we transferred your Personal Information with any inquiries concerning the processing of that information.

Qualifications & exceptions

• Mastercard commits only to "reasonable efforts" to direct the transferee, not a guarantee that the transferee follows this notice.

Security & Safeguards · Company commitment

Mastercard requires privacy and security protections in third-party agreements

Mastercard says that before transferring or sharing any Personal Information (including access to it) it requires appropriate privacy and information security protections in agreements with third parties. It says it operates a comprehensive Third Party Risk Management Program and performs appropriate due diligence as part of it.

Supporting quotations

Prior to the transfer or sharing of any Personal Information (including access to Personal Information), we require appropriate privacy and information security protections in agreements with third parties.

We operate a comprehensive Third Party Risk Management Program and we perform appropriate due diligence as part thereof

Qualifications & exceptions

• Stated for transfer or sharing with third parties; the notice does not say what protections are "appropriate".

Sharing & Disclosure · User right or choice

For mainland China, you can ask who the third-party controllers are, and transfers leave mainland China

If you are located in mainland China, Mastercard says you may contact it as described in the "How to Contact Us" section to obtain information about the third-party recipients that act as data controllers and with whom it shares your Personal Information. It says such sharing will always be conducted to the extent necessary and will not exceed or alter the purposes and means of processing you originally consented to or that rest on a non-consent legal basis. Section 5 adds that if you are in mainland China you understand Mastercard may transfer your Personal Information to recipients outside mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and other affiliates, and that it will always comply with the requirements of applicable laws.

Supporting quotations

If you are located in mainland China, you may contact us as specified in the “How to Contact Us” section below to obtain information regarding the third-party recipients who act in the capacity of data controllers and with whom we share your Personal Information.

Such sharing will always be conducted to the extent necessary and will not exceed or alter the purposes and means of processing that you have originally consented or based on a non-consent legal basis.

If you are located in mainland China, you understand that we may transfer the Personal Information we collect about you to recipients in countries or regions other than mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and to other affiliates as listed

Qualifications & exceptions

• Applies to people located in mainland China.

Not stated here

• The list of affiliates is behind a link that is not supplied here.

Legal Rights & Agreement Rules · User right or choice

Your rights and choices depend on your country

Mastercard says that, depending on your country, you may have rights regarding the Personal Information it maintains and choices about what it collects from you, how it uses it and how it communicates with you. The rights listed are to opt out of some collection or uses, to access and correct data and to restrict, object to or delete processing, to receive your data for transfer to another company, to withdraw consent, and to complain to a supervisory authority.

Supporting quotations

Depending on your country, you may have the right or choice to:

You may have certain rights regarding the Personal Information we maintain about you and certain choices about what Personal Information we collect from you, how we use it, and how we communicate with you.

Qualifications & exceptions

• Rights are stated as ones you "may have" depending on your country; the notice does not list which countries give which rights.

Not stated here

• The notice does not say which countries or which people qualify for each right.

Use & Processing · User right or choice

You may be able to opt out of cookies, marketing, real-time data preparation and anonymization

Among the rights and choices that may be available depending on your country, Mastercard lists the right to opt out of some collection or uses of your Personal Information, including the use of cookies and similar technologies, the use of your Personal Information for marketing purposes, the preparation of transaction data for real-time services that your bank or another party may offer you, and the anonymization of your Personal Information for data analyses.

Supporting quotations

Opt out of some collection or uses of your Personal Information, including the use of cookies and similar technologies, the use of your Personal Information for marketing purposes, the preparation of transaction data for real-time services that your bank or another party may offer you, and the anonymization of your Personal Information for data analyses.

Qualifications & exceptions

• Available "depending on your country"; the opt-out covers "some" collection or uses, and the list is introduced with "including".

Not stated here

• This list item does not say how to opt out of the real-time services data preparation.

Retention & Deletion · User right or choice

You may be able to access, correct, restrict, object to, delete or anonymize your data

Depending on your country, Mastercard lists rights to access your Personal Information and obtain a copy, rectify it, restrict or object to its processing, or request its deletion, destruction or anonymization. It also lists a right to request access to and receive information about the Personal Information it maintains, to update and correct inaccuracies, to restrict or object to processing, to have information anonymized, destroyed or deleted as appropriate, and to data portability.

Supporting quotations

Access your Personal Information, obtain a copy of it, rectify it, restrict or object to its processing, or request its deletion, destruction or anonymization.

Depending on the country in which you are located, you may have the right to:

Request access to and receive information about the Personal Information we maintain about you, to update and correct inaccuracies in your Personal Information, to restrict or to object to the processing of your Personal Information, to have the information anonymized, destroyed or deleted, as appropriate

Qualifications & exceptions

• Stated as rights you "may have" depending on your country; deletion or destruction is "as appropriate" in the second list.

Not stated here

• The notice does not state timelines, exceptions or which data these rights apply to.

Use & Processing · User right or choice

You may be able to move your data and withdraw consent at any time

Depending on your country, you may have the right to receive the Personal Information you provided to Mastercard so you can transmit it to another company, and to withdraw any consent you provided. The consent withdrawal is described as available at any time and free of charge; Mastercard says it will apply your preferences going forward, and that withdrawal will not affect the lawfulness of processing before the withdrawal.

Supporting quotations

Receive the Personal Information you provided to us to transmit it to another company.

Withdraw any consent provided.

Withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.

or to exercise your right to data portability to easily transfer your Personal Information to another company.

Qualifications & exceptions

• Portability covers information "you provided to us"; consent withdrawal is not retroactive.

Legal Rights & Agreement Rules · User right or choice

You may be able to complain to a supervisory authority, including where an incident took place

Where applicable, you may lodge a complaint with your relevant supervisory authority or regulator. Mastercard adds that, depending on your country, this may include the relevant authority in your country of residence, your place of work or where an incident took place.

Supporting quotations

Where applicable, lodge a complaint with your relevant supervisory authority or regulator.

you may also have the right to lodge a complaint with the relevant supervisory authority or regulator, including in your country of residence, place of work or where an incident took place.

Qualifications & exceptions

• Stated "where applicable" and "depending on the country", so not every reader has this right.

Legal Rights & Agreement Rules · Procedure

Use the My Data portal or the contact route to exercise rights; U.S. residents may have more

You, or a party authorized to act for you, can exercise your rights on Mastercard's "My Data" portal or by submitting a request as described in the "How to Contact Us" section. If you reside in the United States, the notice says you may have additional rights as described in the U.S. Privacy Addendum, and that U.S. state residents with legal privacy rights can request them through the My Data portal, by email, or by calling a toll-free number.

Supporting quotations

You, or a party authorized to act on your behalf, can exercise your rights on Mastercard’s

portal or by submitting a request as described in the “How to Contact Us” section below.

If you reside in the United States, you may have additional rights as described in our U.S. Privacy Addendum.

If you reside in a state in the United States which recognizes privacy rights under law, you may exercise your rights under applicable privacy law by submitting your request on Mastercard’s

Qualifications & exceptions

• U.S. additional rights are described in the U.S. Privacy Addendum and apply to residents of states that recognize privacy rights under law.

Not stated here

• The My Data portal is a separate web page not supplied here.

Account & Service Control · Company commitment

Mastercard says it will not deny or reprice service for exercising rights, with exceptions

Mastercard says it will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights, except where the different price or level of quality is reasonably related to the value of the data it receives from you. It adds that in some instances it may not be able to provide the goods or services you request if you exercise certain rights.

Supporting quotations

We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights, except where the different price or level of quality of goods or services is reasonably related to the value of the data that we receive from you.

In some instances, we may not be able to provide you with the goods or services that you request if you choose to exercise certain rights.

Qualifications & exceptions

• Exception where the price or quality difference is "reasonably related to the value of the data" received from you; and some services may be unavailable if you exercise certain rights.

Not stated here

• The notice does not say which rights affect which services.

Data Access & Collection · User right or choice

You can choose not to provide data, but some products may then be unavailable

Mastercard says you can choose not to provide Personal Information by refraining from conducting payment transactions or from submitting Personal Information directly. It says that when it collects Personal Information from you it indicates whether and why it is necessary and the consequences of not providing it. If you do not provide it, you may not benefit from the full range of Mastercard products and services, and Mastercard may be unable to provide products or services if the information is necessary to provide them or it is legally required to collect it.

Supporting quotations

You can choose:

Not to provide Personal Information to Mastercard by refraining from conducting payment transactions or from submitting Personal Information directly to us.

When we collect Personal Information from you, we indicate whether and why it is necessary to provide it to us, as well as the consequences of failing to do so.

If you do not provide Personal Information, you may not be able to benefit from the full range of Mastercard products and services, and we may not be able to provide you with the Mastercard products or services if that information is necessary to provide you with them, or if we are legally required to collect it in relation to the provision of such product or service.

Qualifications & exceptions

• The choice described is to not provide information by not transacting or submitting it directly; it does not address data collected by other means or from third parties.

Data Access & Collection · User right or choice

You can opt out of automated collection on Mastercard's sites, but some features may not work

Mastercard says you can opt out of the collection and use of certain information it collects about you by automated means when you visit its websites or use its apps. In certain jurisdictions you can exercise your choice about cookies and similar technologies by clicking the "Manage cookies" banner displayed in the bottom right corner of Mastercard websites. Your browser may tell you how to be notified of and opt out of having certain types of cookies placed on your device. Without certain cookies you may not be able to use all features of the websites, apps or online services.

Supporting quotations

To opt out of the collection and use of certain information, which we collect about you by automated means, when you visit our websites or use our apps.

In certain jurisdictions, you can exercise your choice regarding the use of cookies and similar technologies by clicking on the ‘Manage cookies’ banner displayed in the bottom right corner of Mastercard websites.

Note that without certain cookies you may not be able to use all of the features of our websites, apps or online services.

Qualifications & exceptions

• The cookie banner choice is available "in certain jurisdictions"; the opt-out covers "certain information", not all collection.

Not stated here

• The notice does not list the jurisdictions where the banner choice is available.

Sharing & Disclosure · User right or choice

You can opt out of ads served from your activity on third-party websites

Mastercard says you can opt out of certain uses of information it collects about you by automated means when you visit third-party websites and interact with its ads. It may use service providers to serve ads on third-party sites; these ads may be customized based on data it and its partners collected on its websites and apps, and some service providers and partners may collect information about your online activities over time and across third-party websites to customize and serve these ads. Its ads are sometimes delivered with icons you can click to learn about your ability to opt out or limit use of your browsing behavior for advertising, and you can also use the Manage cookies banner.

Supporting quotations

To opt out of certain uses of information, which we collect about you by automated means, when you visit third-party websites and interact with our ads.

some of our service providers and partners may collect information about your online activities over time and across third-party websites to customize and serve these ads.

Please click where applicable, on the icon in our targeted ads to learn about your ability to opt out or limit the use of your browsing behavior for advertising purposes.

You may also exercise your choice regarding the use of cookies and similar technologies by clicking on the ‘Manage cookies’ banner displayed in the bottom right corner of our websites.

Qualifications & exceptions

• The icon-based opt-out is available "where applicable" on targeted ads, and the opt-out covers "certain uses", not all advertising.

Use & Processing · User right or choice

You can unsubscribe from marketing emails with a link or by contacting Mastercard

Mastercard says you can tell it not to send you marketing emails by clicking the unsubscribe link in the marketing emails you receive or by contacting it as indicated in the notice. You can also opt out of marketing emails from Mastercard through a linked opt-out page.

Supporting quotations

To tell us not to send you marketing emails by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us as indicated below.

You also may opt out of receiving marketing emails from Mastercard by clicking

Not stated here

• The linked Marketing Email Opt-Out page is not supplied here.

Use & Processing · User right or choice

You can opt out of having your data anonymized for data analyses

Mastercard says you can opt out of the anonymization of your Personal Information to perform data analyses through a linked opt-out page.

Supporting quotations

To opt out of the anonymization of your Personal Information to perform data analyses by clicking

Not stated here

• The linked Data Analytics Opt-Out page is not supplied here, so what the opt-out covers beyond this sentence is unknown.

Use & Processing · User right or choice

Withdrawing consent is free, works going forward and does not undo earlier processing

Mastercard says you may withdraw any consent you previously gave for processing your Personal Information at any time and free of charge. It says it will apply your preferences going forward and that withdrawal will not affect the lawfulness of processing before the withdrawal.

Supporting quotations

Withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge.

We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.

Qualifications & exceptions

• Applies to consent you previously gave; processing before withdrawal remains lawful.

Legal Rights & Agreement Rules · User right or choice

U.S. residents may have additional rights described in the U.S. Privacy Addendum

If you reside in the United States, Mastercard says you may have additional rights as described in its U.S. Privacy Addendum, which is part of the same page.

Supporting quotations

If you reside in the United States, you may have additional rights as described in our U.S. Privacy Addendum.

Qualifications & exceptions

• Applies to people residing in the United States.

Legal Rights & Agreement Rules · Context

A My Data report shows how many privacy requests Mastercard processed worldwide

Mastercard points to a "My Data Report" section of its My Data portal for information on the number of privacy requests it processed pursuant to privacy laws globally. The report itself is on the portal and is not part of this notice.

Supporting quotations

For information on the number of privacy requests Mastercard processed pursuant to privacy laws globally, please review the

Not stated here

• The My Data Report is on a linked portal page that is not supplied here, so the request counts are unknown.

Use & Processing · User right or choice

You may opt out of certain processing through an opt-out webpage

Mastercard says you may opt out from certain processing of your Personal Information, for example through its opt-out webpage.

Supporting quotations

You may opt out from certain processing of your Personal Information, e.g., via our

Qualifications & exceptions

• Applies to "certain processing"; the opt-out webpage is given as one example route.

Not stated here

• The opt-out webpage is linked but not supplied here, so the processing it covers is unknown.

Legal Rights & Agreement Rules · Restriction or exception

The list of rights is not exhaustive and may be limited by local law

Mastercard notes that its list of rights may not be exhaustive, so you may have additional rights under your local laws. It also says the rights listed may be limited in some circumstances by local law requirements.

Supporting quotations

Note that this list may not be exhaustive, which means that you may have additional rights in accordance with your local laws.

In addition, the above rights may be limited in some circumstances by local law requirements.

Qualifications & exceptions

• Both statements depend on your local law; the notice does not say which circumstances limit the rights.

Not stated here

• The notice does not say which local-law requirements can limit the rights.

Legal Rights & Agreement Rules · Procedure

Contact Mastercard to update preferences, leave mailing lists or make a rights request

To update your preferences, ask Mastercard to remove your information from its mailing lists, or submit a request to exercise your rights under applicable law, the notice tells you to contact it as specified in the "How To Contact Us" section. It also says it developed the My Data portal to facilitate the exercise of rights, which you or a party authorized to act for you can use or you can submit a request as described in the contact section.

Supporting quotations

To update your preferences, ask us to remove your information from our mailing lists or submit a request to exercise your rights under applicable law, contact us as specified in the "How To Contact Us" section below.

We have developed Mastercard’s “

” portal to facilitate the exercise of your rights.

Qualifications & exceptions

• The My Data portal is one route; the other is the contact methods in the contact section.

Not stated here

• The My Data portal is a separate web page not supplied here.

Legal Rights & Agreement Rules · Procedure

Tell Mastercard about privacy problems; it tries to respond within a reasonable time

If Mastercard falls short of your expectations in processing your Personal Information, or you wish to complain about its privacy practices, it asks you to tell it and to give full details of the issue. It says it attempts to review and respond to all complaints within a reasonable time and as required under applicable law.

Supporting quotations

If we fall short of your expectations in processing your Personal Information or you wish to make a complaint about our privacy practices, please tell us because it gives us an opportunity to fix the problem.

We attempt to review and respond to all complaints within a reasonable time and as required under applicable law.

Qualifications & exceptions

• Response is an attempt "within a reasonable time", with no fixed deadline stated.

Legal Rights & Agreement Rules · Procedure

An APEC certification dispute resolution route is available through the TRUSTe seal

Mastercard says that to learn more about its APEC Certification and to access dispute resolution, you can click on the TRUSTe seal. The seal and the dispute resolution service are outside this text.

Supporting quotations

To learn more about the APEC Certification and access Dispute Resolution, please click on the TRUSTe seal.

Not stated here

• The TRUSTe dispute resolution page is not part of this source, so how that process works is not stated here.

Sharing & Disclosure · Company practice

Your data may move to the U.S. and other countries with different data protection laws

Mastercard says it is a global business and may transfer your Personal Information to the United States and other countries which may not have the same data protection laws as the country where you provided it. It says it will protect the information in accordance with this Global Privacy Notice, or as otherwise disclosed to you, as disclosed at the time of collection, or as described in a program-specific privacy notice.

Supporting quotations

We may transfer your Personal Information to the United States and other countries which may not have the same data protection laws as the country in which you initially provided the information, but we will protect your Personal Information in accordance with this Global Privacy Notice, or as otherwise disclosed to you.

We may transfer the Personal Information we collect about you to recipients in countries other than your country, including the United States, where we are headquartered.

When we transfer your Personal Information to other countries, we will protect that information as described in this Global Privacy Notice, as disclosed to you at the time of data collection or as described in our program-specific privacy notice.

Qualifications & exceptions

• The protection promise is "in accordance with this Global Privacy Notice, or as otherwise disclosed to you", so other notices given to you can govern.

Not stated here

• The program-specific privacy notices are not supplied here.

Sharing & Disclosure · Company commitment

For the EEA, UK and Switzerland, transfers use adequacy decisions, BCRs and standard clauses

Mastercard says it complies with applicable legal requirements when transferring Personal Information to countries other than where you are located. If you are located in the EEA, the UK or Switzerland, it says it will transfer your Personal Information in accordance with adequacy decisions, Binding Corporate Rules, standard contractual clauses and other data transfer mechanisms. The notice links lists of countries for which the European Commission, the UK government and the Swiss Federal Council have issued adequacy decisions.

Supporting quotations

We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located.

If you are located in the EEA, the UK or Switzerland, we will transfer your Personal Information in accordance with adequacy decisions, Binding Corporate Rules, standard contractual clauses, and other data transfer mechanisms.

See list of countries for which the European Commission has issued an adequacy decision

See list of countries for which the UK government has issued an adequacy decision

See list of countries for which the Swiss Federal Council has issued an adequacy decision

Qualifications & exceptions

• The transfer mechanisms commitment is stated for people located in the EEA, the UK or Switzerland.

Not stated here

• The adequacy decision lists are on external pages that are not supplied here.

Sharing & Disclosure · Company commitment

Mastercard relies on Binding Corporate Rules recognized by EEA authorities, and UK BCRs

Mastercard says it complies with applicable legal requirements when transferring Personal Information to other countries, including obtaining consent where required. It says it has established and implemented Binding Corporate Rules that EEA data protection authorities have recognized as providing an adequate level of protection to the Personal Information it processes globally, and that it relies equally on UK BCRs to transfer Personal Information outside the United Kingdom. Copies are available through links on the page.

Supporting quotations

We comply with applicable legal requirements, including obtaining consent where required, when transferring Personal Information to countries other than the country where you are located.

we have established and implemented Binding Corporate Rules (“BCRs”) that have been recognized by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally.

We equally rely on UK BCRs to transfer Personal Information outside of the United Kingdom.

Qualifications & exceptions

• Consent is obtained for transfers only "where required".

Not stated here

• The Binding Corporate Rules documents are linked but their text is not supplied here.

Cross-references

• referred to by (model-proposed): Shared with third parties for fraud prevention and where the law, courts or authorities require — The sharing section says requests from law enforcement or governmental agencies follow the process in the Binding Corporate Rules, referring to Section 5, where the Binding Corporate Rules are described.

Sharing & Disclosure · User right or choice

Other safeguards for transfers, and you may ask for a copy

Mastercard says it may also transfer Personal Information to countries for which adequacy decisions have been issued, use contractual protections for transfers to third parties such as the European Commission's Standard Contractual Clauses or their equivalent under applicable law, or rely on other data transfer mechanisms or requirements where applicable. Depending on your country, you may contact it as specified in the "How to Contact Us" section to obtain a copy of the safeguards it uses to transfer Personal Information outside of your jurisdiction.

Supporting quotations

We may also transfer Personal Information to countries for which adequacy decisions have been issued

use contractual protections for the transfer of Personal Information to third parties, such as the European Commission’s Standard Contractual Clauses or their equivalent under applicable law, or rely on other data transfer mechanisms or requirements where applicable.

Depending on your country, you may contact us as specified in the “How to Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of your jurisdiction.

Qualifications & exceptions

• The right to ask for a copy of safeguards applies "depending on your country".

Not stated here

• The notice does not say which countries give this right.

Legal Rights & Agreement Rules · Company commitment

Mastercard says its practices comply with the APEC Cross Border Privacy Rules system

Mastercard states that its privacy practices, as described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System and the Global CBPR Forum, which provide a framework for organizations to ensure protection of Personal Information transferred among participating APEC economies. This is stated twice in the section with links to the APEC and Global CBPR Forum pages.

Supporting quotations

Mastercard’s privacy practices, described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System and the Global CBPR Forum.

These systems provide a framework for organizations to ensure protection of Personal Information transferred among participating APEC economies.

Additionally, Mastercard’s privacy practices, described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System and the Global CBPR Forum.

Qualifications & exceptions

• The framework applies to transfers among participating APEC economies.

Not stated here

• The APEC and Global CBPR Forum pages are linked but not supplied.

Sharing & Disclosure · Company practice

For mainland China, transfers go to recipients abroad, including the U.S. and Singapore

If you are located in mainland China, Mastercard says you understand that it may transfer Personal Information it collects about you to recipients in countries or regions other than mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and other affiliates listed on a linked page. It says that when it conducts international transfers it will always ensure it complies with requirements stipulated under applicable laws.

Supporting quotations

If you are located in mainland China, you understand that we may transfer the Personal Information we collect about you to recipients in countries or regions other than mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and to other affiliates as listed

When we conduct international transfers of Personal Information, we will always ensure to comply with requirements stipulated under applicable laws.

Qualifications & exceptions

• Applies to people located in mainland China, who are described as understanding the transfers.

Not stated here

• The list of affiliates is on a linked page not supplied here.

Security & Safeguards · Company commitment

Mastercard says it keeps reasonable safeguards and uses SSL on some websites

Mastercard says it maintains appropriate security safeguards to protect your Personal Information. It says it maintains reasonable administrative, technical and physical safeguards designed to protect the Personal Information you provide or it collects against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use, and that it uses SSL encryption on a number of its websites from which it transfers certain Personal Information.

Supporting quotations

We maintain appropriate security safeguards to protect your Personal Information

We maintain reasonable administrative, technical and physical safeguards designed to protect the Personal Information you provide or we collect against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.

We use SSL encryption on a number of our websites from which we transfer certain Personal Information.

Qualifications & exceptions

• The safeguards are "reasonable" and "designed to" protect, which is not a guarantee against all loss or access; SSL encryption is stated for "a number of" websites, not all.

Not stated here

• The notice does not say which websites use SSL encryption or what other security measures exist.

Security & Safeguards · Company commitment

After a security breach Mastercard says it assesses harm and follows legal reporting duties

Mastercard says that in the event of a breach of its security safeguards it will assess the extent of harm (if any) to individuals and comply with reporting and notification obligations in accordance with the applicable law. The notice does not promise notification beyond what applicable law requires.

Supporting quotations

In the event of a breach of our security safeguards, we will assess the extent of harm (if any) to individuals, and comply with reporting and notification obligations in accordance with the applicable law.

Qualifications & exceptions

• Reporting and notification are tied to "the applicable law".

Not stated here

• The notice does not give a notification deadline or say which individuals would be told.

Retention & Deletion · Company commitment

Mastercard keeps data for a limited period, then deletes or de-identifies it unless the law requires longer

Mastercard says it only retains Personal Information for a limited period of time. It says it takes measures to delete your Personal Information or keep it in a form that does not permit identifying you when it is no longer necessary for the purposes for which it was processed, unless the law requires it to keep the information longer. It says it takes into account criteria such as the type of products and services requested or provided, the nature and length of your relationship, possible re-enrolment, the impact on services if some information is deleted, mandatory retention periods provided by law and the statute of limitations.

Supporting quotations

only retain it for a limited period of time.

We also take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period.

When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

Qualifications & exceptions

• Deletion or de-identification applies when the information is "no longer necessary" for the purposes of processing, and legal retention requirements can extend the period.

Not stated here

• The notice gives no specific retention periods for any category of data.

Sharing & Disclosure · Company practice

Linked sites and partner features are independent; review their own privacy notices

Mastercard says its websites may include links to other third-party websites, social media tools, widgets or plug-ins that permit sharing web content, including IP address, with third parties and social media providers, and that social media providers may learn of your visit even if you are not logged in or do not have an account. It says linked websites and partner features, which may include social networking and geo-location tools, operate independently from Mastercard and are clearly identified as such; those entities may learn of your visit whether or not you use the features. Where they are not owned or controlled by Mastercard, it suggests you review their own privacy notices or practices, and says social media providers and other third parties do not necessarily share the same privacy policy as Mastercard.

Supporting quotations

Our websites may include links to other third-party websites, social media tools, widgets or plug-ins, permitting sharing web content including IP address, with third parties and social media providers.

These social media providers may learn of your visit even if you are not logged in to your social media account or if you do not have an account with them.

These entities may learn of your visit regardless of whether you use these features.

These websites and features, which may include social networking and geo-location tools, operate independently from Mastercard, and are clearly identified as such.

Social media providers such as Facebook and Twitter, and these other third parties, are independent from Mastercard and do not necessarily share the same policy as Mastercard regarding the protection of privacy.

Please review their privacy notices if you decide to use their services and consult your social media account settings if you want to deactivate certain features.

Qualifications & exceptions

• The review suggestion applies to linked websites or features "not owned or controlled by Mastercard"; the notice does not say which are owned or controlled by Mastercard.

Not stated here

• The third parties' own privacy notices are not supplied here.

Cross-references

• referred to by (model-proposed): Social media buttons and plug-ins can tell the platform you visited — The social media tools paragraph points to Section 7 for further details; Section 7 describes linked sites, partner features and social media providers.

Sharing & Disclosure · Company practice

Social media buttons connect your browser to the provider and send your IP address

Mastercard says you can share, link to or mention things about its products and services on social media, for example by "liking" an offer on Facebook or "tweeting" one. When you visit a website with a social media button, your browser establishes a direct connection to that provider and data concerning your visit, including your IP address, is transferred to it. If you have an account with the provider, the provider may link your visit to your account even if you are not logged in.

Supporting quotations

When you visit a website with a social media button, your browser establishes a direct connection to that social media provider, and data concerning your visit, including IP address, is transferred to the social media provider.

If you have an account with the social media provider, the provider may link your visit to your account, even if you are not logged into this account.

Qualifications & exceptions

• Applies to websites that carry a social media button; what the provider does with the data is governed by its own policy.

Data Access & Collection · Company practice

Mastercard says its products and services are not directed at children

Mastercard states that its products and services are not directed to, likely to be accessed by, or intended for children under 18 (or the age of majority, to the extent it differs under applicable law), in accordance with applicable law.

Supporting quotations

Mastercard products and services are not directed to, likely to be accessed by, or intended for, children under the age of 18 or the age of majority (to the extent it differs under applicable law), in accordance with applicable law.

Qualifications & exceptions

• The age threshold is 18 or the age of majority where that differs under applicable law.

Cross-references

• qualified by (model-proposed): Mastercard may still process children's data with parental consent or another legal basis — The second children's statement qualifies the first: products are not directed to children, but Mastercard may still process children's Personal Information with consent or another legal basis.

Data Access & Collection · Company practice

Mastercard may still process children's data with parental consent or another legal basis

Mastercard says that, although its products and services are not directed to children, it may process Personal Information about children below 18 (or the age of majority where it differs) with the parent or guardian's consent, with the child's consent where required, or on another legal basis in accordance with applicable law. If you learn that Mastercard is processing children's Personal Information in violation of the notice, it invites you to alert it by email.

Supporting quotations

However, Mastercard may process Personal Information about children below 18 years of age or the age of majority (to the extent it differs under applicable law), with the parent or guardian’s consent, and with the child’s consent where required, or based on another legal basis in accordance with applicable law.

If you learn that Mastercard is processing children’s Personal Information in violation of this Privacy Notice, then you may alert us at

Qualifications & exceptions

• The statement that products are not directed at children sits beside this permission to process children's data; the notice reconciles them with "However" and does not say when child data is processed.

Not stated here

• The notice does not say which products or situations involve children's data.

Cross-references

• qualifies (model-proposed): Mastercard says its products and services are not directed at children — The second children's statement qualifies the first: products are not directed to children, but Mastercard may still process children's Personal Information with consent or another legal basis.

Legal Rights & Agreement Rules · Company commitment

Mastercard may update the notice and says it will post a prominent notice of material changes

Mastercard says the notice may be updated periodically to reflect changes in its privacy practices. It says it will post a prominent notice on relevant websites to notify you of any significant or material changes before they take effect and will indicate at the top of the notice when it was most recently updated. In certain circumstances it may seek your consent if it updates the notice.

Supporting quotations

This Global Privacy Notice may be updated periodically to reflect changes in our privacy practices.

We will post a prominent notice on relevant websites to notify you of any significant or material changes to our Global Privacy Notice prior to them being effective and indicate at the top of the Notice when it was most recently updated.

If we update our Global Privacy Notice, in certain circumstances, we may seek your consent.

Qualifications & exceptions

• The advance notice is for "significant or material" changes on "relevant websites"; other changes are not promised prior notice.

Not stated here

• The notice does not say in which circumstances consent will be sought or how far ahead material changes are announced.

Legal Rights & Agreement Rules · Procedure

Contact the Global Privacy Office by email, My Data portal, phone or mail

Mastercard says you can email its Global Privacy Office, submit a request on the My Data portal, or call a toll-free number (1-833-244-4084) to exercise your rights. For questions, comments or complaints about the notice and its privacy practices, or to update privacy preferences, you can email the same address or write to the Global Privacy Office, Mastercard International Incorporated, 2000 Purchase Street, Purchase, New York 10577, USA.

Supporting quotations

You can e-mail our Global Privacy Office at

or by calling us toll-free at 1-833-244-4084.

If you have any questions, comments or complaints about this Global Privacy Notice and our privacy practices, or would like to update your privacy preferences, please email us at

Global Privacy Office Mastercard International Incorporated 2000 Purchase Street Purchase, New York 10577 USA

Qualifications & exceptions

• Applies generally; regional entities and routes are given separately for some regions.

Legal Rights & Agreement Rules · Procedure

U.S. state residents can use the portal, email or phone and see the U.S. Privacy Addendum

If you reside in a U.S. state that recognizes privacy rights under law, Mastercard says you may exercise your rights under applicable privacy law by submitting a request on the My Data portal, emailing it, or calling its toll-free number, and refers you to the U.S. Privacy Addendum for more information.

Supporting quotations

If you reside in a state in the United States which recognizes privacy rights under law, you may exercise your rights under applicable privacy law by submitting your request on Mastercard’s

For more information on exercising these rights, please see our U.S. Privacy Addendum.

Qualifications & exceptions

• Applies to residents of U.S. states that recognize privacy rights under law.

Legal Rights & Agreement Rules · Procedure

In Quebec, contact the Data Protection Officer; ask your bank or merchant about card purchases

If you are located in Quebec, Canada, Mastercard says you may contact its Data Protection Officer by email. For inquiries about your Mastercard card and your purchase, it says to contact your financial institution or merchant.

Supporting quotations

If you are located in Quebec, Canada, you may contact our Data Protection Officer at

For inquiries about your Mastercard card and your purchase, you should contact your financial institution or merchant.

Qualifications & exceptions

• Applies to people located in Quebec, Canada.

Legal Rights & Agreement Rules · Procedure

In the EEA, UK and Switzerland, Mastercard Europe SA is the responsible controller

If you are located in the EEA, the UK or Switzerland, Mastercard says Mastercard Europe SA is the entity responsible for processing your Personal Information (the data controller). You can submit rights requests on the My Data portal, by email, or by writing to the Europe Data Protection Officer at Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium.

Supporting quotations

If you are located in the EEA, the UK or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information (or data controller).

Europe Data Protection Officer Mastercard Europe SA Chaussée de Tervuren 198A B-1410 Waterloo Belgium

Qualifications & exceptions

• Applies to people located in the EEA, the UK or Switzerland.

Legal Rights & Agreement Rules · Procedure

Brazil and Latin America and Caribbean readers have their own responsible entity and officers

If you are located in Brazil, Mastercard says Mastercard Brasil Soluções de Pagamento Ltda. is the entity responsible for processing your Personal Information, and you can submit rights requests on the My Data portal, by email or by writing to the Brazil Data Protection Officer in São Paulo. If you are located in the Caribbean and Latin America, you can submit requests on the My Data portal and may also contact the Data Protection Officer responsible for those regions by email.

Supporting quotations

If you are located in Brazil, Mastercard Brasil Soluções de Pagamento Ltda. is the entity responsible for the processing of your Personal Information.

Brazil Data Protection Officer Mastercard Brasil Soluções de Pagamento Ltda.

If you are located in the Caribbean and Latin America, you may submit your request to exercise your rights to your Personal Information on Mastercard’s

Qualifications & exceptions

• Brazil and the Caribbean and Latin America are treated separately; the Caribbean and Latin America text does not name a responsible entity.

Not stated here

• The notice does not name the entity responsible for processing in the Caribbean and Latin America.

Legal Rights & Agreement Rules · Procedure

In Asia Pacific, the Middle East and Africa, Mastercard Asia Pacific Pte. Ltd. is responsible

If you are located in Asia Pacific (excluding mainland China and South Korea), the Middle East or Africa, Mastercard says Mastercard Asia Pacific Pte. Ltd. is the entity responsible for processing your Personal Information. You can submit rights requests by email, by calling a toll-free number listed on a linked page, or by writing to the Asia Pacific, Middle East and Africa Data Protection Officer at Mastercard Asia/Pacific Pte Ltd, 3 Fraser Street, DUO Tower, Level 17, Singapore 189352.

Supporting quotations

If you are located in Asia Pacific (excluding mainland China and South Korea), Middle East or Africa, Mastercard Asia Pacific Pte. Ltd. is the entity responsible for the processing of your Personal Information.

Asia Pacific, Middle East and Africa Data Protection Officer Mastercard Asia/Pacific Pte Ltd 3 Fraser Street, DUO Tower, Level 17 Singapore 189352

Qualifications & exceptions

• Excludes mainland China and South Korea, which are addressed separately.

Not stated here

• The toll-free numbers are on a linked page not supplied here.

Legal Rights & Agreement Rules · User right or choice

In South Africa you may also complain to the South African Information Regulator

If you are located in South Africa, Mastercard says you may also send your complaint to the South African Information Regulator, and gives an email address, a postal address and a website for it.

Supporting quotations

If you are located in South Africa, you may also send your complaint to the South African Information Regulator at the following:

Email:

Qualifications & exceptions

• Applies to people located in South Africa; the regulator is in addition to Mastercard's own contact routes.

Legal Rights & Agreement Rules · Procedure

In mainland China and South Korea, separate entities are responsible

If you are located in mainland China, Mastercard says Mastercard Shanghai Business Consulting Ltd. is the entity responsible for processing your Personal Information, and you can submit rights requests by email or by writing to the China Data Protection Officer in Shanghai. If you are located in South Korea, Mastercard says Mastercard International Korea Co., Ltd. is designated as its domestic representative for processing your Personal Information, and you can submit requests by email or by calling a toll-free number listed on a linked page.

Supporting quotations

If you are located in mainland China, Mastercard Shanghai Business Consulting Ltd. is the entity responsible for the processing of your Personal Information.

China Data Protection Officer Room 2907-14, Part of 29/F Tower 2 Shanghai IFC, 8 Century Avenue China (Shanghai) Pilot Free Trade Zone

If you are located in South Korea, Mastercard International Korea Co., Ltd. is designated as our domestic representative for the processing of your Personal Information.

Qualifications & exceptions

• Mainland China and South Korea are covered separately from the rest of Asia Pacific; South Korea uses a "domestic representative" rather than a responsible entity.

Not stated here

• The Korea business address and toll-free number are on linked pages not supplied here.

Legal Rights & Agreement Rules · Procedure

In South Korea, Mastercard International Korea is the designated domestic representative

If you are located in South Korea, Mastercard says Mastercard International Korea Co., Ltd. is designated as its domestic representative for processing your Personal Information. The entity is led by the Korea Division President, with the Korea business address given on a linked page. You can submit a request to exercise your rights by email or by calling a toll-free number listed on a linked page.

Supporting quotations

If you are located in South Korea, Mastercard International Korea Co., Ltd. is designated as our domestic representative for the processing of your Personal Information.

You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com, or calling our toll-free number listed

Qualifications & exceptions

• Applies to people located in South Korea; the entity is a "domestic representative", and the text does not call it the controller.

Not stated here

• The Korea business address and the toll-free number are on linked pages that are not supplied here.

Legal Rights & Agreement Rules · Context

The U.S. Privacy Addendum adds state-law information for U.S. residents

The notice says that if you reside in the United States, the U.S. Privacy Addendum supplements the information in the Global Privacy Notice for certain states, as indicated in Section 11. It says the addendum applies to residents of the United States whose states have passed state-specific privacy laws.

Supporting quotations

If you reside in the United States, this U.S. Privacy Addendum supplements the information above for certain states, as indicated in this Section 11.

This U.S. Privacy Addendum supplements the information contained in the Global Privacy Notice. This U.S. Privacy Addendum applies to residents in the United States whose states have passed state-specific privacy laws.

Qualifications & exceptions

• Applies to U.S. residents whose states have passed state-specific privacy laws, and only supplements the Global Privacy Notice rather than replacing it.

Not stated here

• The addendum does not list at this point which states are covered; a later section lists some states.

Legal Rights & Agreement Rules · Context

The U.S. Privacy Addendum says it was last updated June 16, 2026

The U.S. Privacy Addendum states "LAST UPDATED: June 16, 2026". The Global Privacy Notice above it states a different, earlier effective date of 1/19/2026, so the page carries two dates for its two parts.

Supporting quotations

LAST UPDATED: June 16, 2026

Qualifications & exceptions

• The June 16, 2026 date belongs to the U.S. Privacy Addendum; the main notice states its own effective date.

Not stated here

• The page does not say what changed in the addendum on June 16, 2026.

Legal Rights & Agreement Rules · Context

California residents may rely on the Global Privacy Notice plus the CCPA information below

For California residents from whom Mastercard collects Personal Information as a business under the CCPA, the addendum says they may rely on the Global Privacy Notice and the additional information in the California section. California job applicants are sent to a separate Mastercard Applicant Privacy Notice. For this section, "Personal Information" is defined by reference to the CCPA: information that identifies, relates to, describes or can reasonably be linked with a particular consumer or household, excluding information that is publicly available, deidentified or aggregated as the CCPA defines those terms.

Supporting quotations

If you are a California resident from whom we collect Personal Information as a business under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) (“CCPA”), you may rely on the Global Privacy Notice and the additional information below.

If you are a job applicant who is a California resident, please see the

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the CCPA.

Personal Information does not include information that is publicly available, deidentified, or aggregated (as those terms are defined in the CCPA) or otherwise excluded from the scope of the CCPA.

Qualifications & exceptions

• Applies to California residents from whom Mastercard collects Personal Information "as a business under" the CCPA; job applicants are directed to a different notice.

Not stated here

• The Mastercard Applicant Privacy Notice is linked but not supplied here.

Data Access & Collection · Context

The California list covers categories collected and disclosed for a business purpose

The addendum lists categories of Personal Information, as the CCPA defines them, that Mastercard says it has collected and disclosed for a business purpose. The lettered list below runs A to I, then K and L; the source text has no category J.

Supporting quotations

Categories of Personal Information about you that we Collect and Disclose

The following is a list of categories of Personal Information (as defined by the CCPA) we have collected and disclosed for a business purpose.

Qualifications & exceptions

• The list is of categories "we have collected and disclosed for a business purpose" under the CCPA definition, so it describes past practice for California residents.

Not stated here

• The lettered list skips from I to K; the source has no category J and does not say why.

Data Access & Collection · Company practice

California categories A and B: identifiers and contact details, including other people's information

Category A (identifiers) includes personal and business contact information such as name, postal address, telephone number and job title, date of birth, unique personal identifiers or numbers, online and device identifiers, IP address, email address, account name and authentication information. Mastercard says it may collect this information about other people if you give it their information, and may associate information you submit, such as articles, comments or social media page content, with your identifiers. Category B (the categories in Cal. Civ. Code Section 1798.80(e)) lists name, address, telephone number, email address and IP address.

Supporting quotations

A. Identifiers. Examples: Personal and business contact information (e.g., name, postal address, telephone number, job title), date of birth, unique personal identifiers or numbers, online identifier, device identifier(s), internet protocol address, email address, account name, authentication information, and similar identifiers.

We may collect this information about other people if you give us their information. We may also associate information that you submit to us, such as articles, comments, or content on our social media pages, with your identifiers.

B. Categories of Personal Information in Cal. Civ. Code Section 1798.80(e). Examples: Name, address, telephone number, email address, and IP address.

Qualifications & exceptions

• Examples are introduced as "Examples"; they are not a closed list.

Not stated here

• The cited California Civil Code provision is not reproduced in the source, so the notice's reference to it is not expanded here.

Data Access & Collection · Company practice

California category C: gender, family status, age range and military or veteran status

Category C, characteristics of protected classifications under California or federal law, lists gender, family status, age range, and military and veteran status as examples.

Supporting quotations

C. Characteristics of Protected Classifications under California or Federal Law. Examples: Gender, family status, age range, and military and veteran status.

Qualifications & exceptions

• Examples only; for California residents under the CCPA categories.

Data Access & Collection · Company practice

California category D: transaction, product, preference and rewards information

Category D, commercial information, includes information Mastercard creates or retains that is fundamental to its business (such as records of personal property); transaction information (date and time, transaction ID, personal account number, merchant name and location, total amount, and other information supplied by financial institutions or merchants when Mastercard acts for them); product and service information (such as product version, registration and payment information, and program-specific information) when you request products or services directly or take part in marketing programs; preferences it infers about you from products or services purchased, obtained or considered or from purchasing or consuming histories or tendencies; and accrued points or rewards and redemption history.

Supporting quotations

D. Commercial Information. Examples: Information we create or retain that are fundamental to our business, e.g. records of personal property;

transaction information, such as date and time of transaction, or a transaction ID provided by a customer, personal account number, the merchant’s name and location, the total amount of the transaction, and other information provided by financial institutions or merchants when we act on their behalf;

preferences that we infer about you based on products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies; accrued total of points or rewards and points or rewards redemption history.

Qualifications & exceptions

• Examples only; product and service information applies when you request products or services directly or join marketing programs.

Data Access & Collection · Company practice

California categories E and F: behavioral biometrics and online activity data

Category E, biometric information, lists behavioral characteristics that can be used to establish individual identity, such as keystroke timing, device accelerometer, scroll position and mouse location. Category F, internet or other electronic network activity information, lists cookie and web beacon data, IP address, browser type, operating system, mobile device identifier, referring URLs, pages viewed and actions you take on its online properties and apps, and behavioral-based data or biometric information such as keystroke timing, device accelerometer, scroll position and mouse location.

Supporting quotations

E. Biometric Information. Examples: Behavioral characteristics, that can be used, singly or in combination with each other or with other identifying data, to establish individual identity, such as keystroke timing, device accelerometer, scroll position, and mouse location.

F. Internet or Other Electronic Network Activity Information. Examples: Cookie and web beacon data, IP address, browser type, operating system, mobile device identifier, referring URLs, pages viewed and actions you take on our online properties and apps, and behavioral-based data or biometric information, such as keystroke timing, device accelerometer, scroll position, and mouse location.

Qualifications & exceptions

• Examples only; the same behavioral data (keystroke timing, accelerometer, scroll position, mouse location) is listed under both E and F.

Data Access & Collection · Company practice

California category G: geolocation at city, state, country or IP address level

Category G, geolocation data, gives as examples your city, state or country, or your IP address.

Supporting quotations

G. Geolocation Data. Example: Your city, state or country or your IP address.

Qualifications & exceptions

• The example given is coarse location (city, state, country or IP address).

Data Access & Collection · Company practice

California category H: photos, audio including customer service call recordings, and video

Category H, sensory information, lists photographs, audio recordings (including call recordings for customer service purposes) and video recordings as examples.

Supporting quotations

H. Sensory Information. Examples: Photographs, audio recordings (including call recordings for customer service purposes), and video recordings.

Qualifications & exceptions

• Examples only; call recordings are specifically described as for customer service purposes.

Data Access & Collection · Company practice

California category I: professional and employment-related information

Category I, professional or employment-related information, lists job title, department and name of organization, and information you provide as part of a job application or in the course of employment with Mastercard, such as contact information and employment history. It refers to the Mastercard Applicant Privacy Notice for further information.

Supporting quotations

I. Professional or Employment-Related Information. Examples: Professional information such as job title, department, and name of organization. Additionally, information you provide as part of your job application or in the course of your employment with Mastercard, e.g., contact information and employment history.

Qualifications & exceptions

• Includes information provided in the course of employment with Mastercard, not only job applications.

Not stated here

• The Mastercard Applicant Privacy Notice is linked but not supplied here.

Inference & Profiling · Company practice

California category K: inferences about characteristics, habits and interests

Category K, inferences drawn from Personal Information, lists personal characteristics, life habits, consumption habits and interests as examples.

Supporting quotations

K. Inferences Drawn from Personal Information. Examples: Personal characteristics, life habits, consumption habits, and interests.

Qualifications & exceptions

• Examples only; the lettered list has no category J before this one.

Data Access & Collection · Company commitment

California category L: sensitive information is biometric data for fraud and security, with no right-to-limit uses

Category L, sensitive Personal Information, gives biometric information, as described in E above, for fraud and security prevention as the example. Mastercard notes that it does not use or disclose sensitive personal information for purposes that would require it to offer consumers the right to limit its collection and processing of this data under the CCPA.

Supporting quotations

L. Sensitive Personal Information. Examples: Biometric information, as described in more detail above in E, for fraud and security prevention.

We note, however, that we do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under the CCPA

Qualifications & exceptions

• The no-limit-right statement is made under the CCPA for California residents and depends on Mastercard's own view of which purposes would require the right.

Not stated here

• The addendum lists only biometric information as the sensitive example, while the main notice lists additional data it says may be sensitive in some jurisdictions.

Data Access & Collection · Company practice

California addendum lists eleven kinds of sources, including government entities and public sources

The U.S. Privacy Addendum says Mastercard has collected Personal Information from these categories of sources: you or your devices directly (in connection with products it provides to you, or when you interact with its ads, websites, apps or other digital assets); affiliates you have interacted with; analytics providers; other users of its services; internet service providers; government entities; advertising networks; social networks; operating system and platform providers; business partners such as financial institutions and merchants; and publicly accessible sources.

Supporting quotations

We have collected Personal Information from the following categories of sources:

You/Your Devices: You or your devices directly, such as in connection with our products and services that we provide to you directly, or when you interact with our ads, websites, apps, or other digital assets.

Our Affiliates that you have interacted with.

Analytics Providers.

Users: Other users of our services.

ISPs: Internet service providers.

Government: Government entities.

Advertising Networks.

Social Networks.

OS/Platform Provider: Operating systems and platforms.

Partners: Business partners, such as financial institutions, merchants, and other partners in connection with our products and services.

Public: Publicly accessible sources.

Qualifications & exceptions

• Stated in the past tense ("We have collected") for the California section of the addendum; the list names categories of sources, not specific companies.

Not stated here

• The addendum does not say which data comes from which source, or what government entities supply.

Use & Processing · Company practice

Core business purposes: providing services, support, payments and enabling transactions

The addendum lists these business purposes for collecting, using and disclosing Personal Information: providing its services; communicating with you, giving updates and information about services and products, providing information you request, responding to comments and questions and providing customer support; facilitating the connection of third-party services or applications; facilitating transactions and payments; and otherwise enabling or effecting, directly or indirectly, a commercial transaction.

Supporting quotations

Use of your Personal Information

We collect, use, and disclose your Personal Information in accordance with the specific business purposes below:

Providing Services: Providing our services.

Communicating: Communicating with you, providing you with updates and other information relating to our services and products, providing information that you request, responding to comments and questions, and otherwise providing customer support.

Connecting Third Party Services: Facilitating the connection of third-party services or applications.

Facilitating Payments: Facilitating transactions and payments.

Enabling Transactions: Otherwise enabling or effecting, directly or indirectly, a commercial transaction.

Qualifications & exceptions

• These purposes are listed in the addendum for U.S. state-law disclosures and add to the main notice's list of uses.

Use & Processing · Company practice

Marketing, personalization and text messages are listed as business purposes

The addendum lists as business purposes: marketing, such as developing and providing promotional and advertising materials that may be useful, relevant, valuable or of interest to you; personalizing your experience on its services, such as presenting tailored content; and sending you personalized text messages as requested on its Talent Community, with a reference to a Talent Community Privacy Notice for more information.

Supporting quotations

Marketing: Marketing purposes, such as developing and providing promotional and advertising materials that may be useful, relevant, valuable, or otherwise of interest to you.

Personalization: Personalizing your experience on our services, such as presenting tailored content.

Sending Messages: Sending you personalized text messages as requested on our Talent Community.

Qualifications & exceptions

• Text messages are sent "as requested" on the Talent Community, not as general marketing.

Not stated here

• The Talent Community Privacy Notice is linked but not supplied here.

Use & Processing · Company practice

Business purposes also include deidentifying data, research, audits, debugging and improving services

The addendum also lists as business purposes: deidentifying and aggregating information collected through its services and using it for lawful purposes; auditing related to your interaction with its services and concurrent transactions, including counting ad impressions to unique visitors, verifying positioning and quality of ad impressions and auditing compliance with other standards; debugging to identify and repair errors that impair existing intended functionality; short-term, transient use; undertaking internal research for technological development and demonstration; and verifying or maintaining the quality or safety of its services and improving, upgrading or enhancing them.

Supporting quotations

Deidentification and Aggregation: Deidentifying and aggregating information collected through our services and using it for lawful purposes.

Auditing Interactions: Auditing related to your interaction with our services and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with other standards.

Debugging: Debugging to identify and repair errors that impair existing intended functionality.

Transient Use: Short-term, transient use.

Research: Undertaking internal research for technological development and demonstration.

Improving Our Services: Undertaking activities to verify or maintain the quality or safety of our services, and to improve, upgrade, or enhance our services.

Qualifications & exceptions

• The deidentified and aggregated information may be used "for lawful purposes", which the addendum does not narrow further.
• Auditing "including, but not limited to" counting ad impressions and verifying their quality.

Use & Processing · Company practice

Business purposes include safety, legal compliance, enforcement and fraud prosecution

The addendum lists as business purposes: responding to trust and safety issues that may arise; compliance, including enforcing its Terms of Use or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity.

Supporting quotations

Safety Issues: Responding to trust and safety issues that may arise.

Compliance: For compliance purposes, including enforcing our

or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.

Fraud and Incident Prevention: Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.

Qualifications & exceptions

• Compliance includes responding to requests by "any judicial process or governmental agency", with no limit on which agency is stated here.

Not stated here

• The Terms of Use are linked but not supplied here.

Use & Processing · Company practice

Business purposes also cover loyalty programs, vendors who act for clients, and job applications

The addendum lists as business purposes: offering and supporting loyalty programs that let you earn points, cashback rewards, prize draw entries or other benefits for purchases made with your eligible Mastercard card; contracting with vendors and service providers to perform services on its behalf or on their behalf, including maintaining or servicing accounts, customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, advertising or marketing services and analytics services, or similar services on behalf of Mastercard's clients; processing your job application; and other purposes for which it provides specific notice when the information is collected.

Supporting quotations

Loyalty Program Operation: Offering and supporting loyalty programs that allow you to earn points, cashback rewards, prize draw entries, or other benefits for purchases made with your eligible Mastercard card.

Contracting Vendors: Contracting with vendors and service providers to perform services on our behalf or on their behalf, including maintaining or servicing accounts, providing customer service, processing, or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services on behalf of Mastercard’s clients.

Job Applications: Processing your job application.

Notified Purpose: For other purposes for which we provide specific notice at the time the information is collected.

Qualifications & exceptions

• Loyalty benefits relate to purchases made with your eligible Mastercard card.

Not stated here

• The Mastercard Applicant Privacy Notice is linked in the job applications item but not supplied here.

Sharing & Disclosure · Company practice

Disclosure to advertising and analytics providers is described as only with your consent

For the categories in Section 1 of the addendum, Mastercard says it discloses Personal Information to the listed categories of third parties. It says it discloses Personal Information to advertising providers (advertising technology companies such as advertising networks) only with your consent, and to analytics providers (companies that help analyze and improve its online properties) only at your direction and with your consent. The information disclosed to each is identifiers, internet or other electronic network activity and geolocation data.

Supporting quotations

With respect to the categories of Personal Information identified above in Section 1, we disclose your Personal Information to the following categories of third parties:

We disclose your Personal Information to Advertising Providers only with your consent.

Personal Information we disclose: Identifiers; Internet or Other Electronic Network Activity; Geolocation Data.

We disclose your Personal Information to Analytics Providers only at your direction and only with your consent.

Personal Information we disclose: Identifiers; Internet or Other Electronic Network Activity; Geolocation Data.

Qualifications & exceptions

• The consent statements are made for advertising providers and analytics providers disclosures; later parts of the addendum describe cookies that may "sell" or "share" information with these same providers.

Not stated here

• The addendum does not say how consent is obtained or how it relates to the cookie banner choices.

Cross-references

• contrast (model-proposed): Cookies on the site may "sell" or "share" data for cross-context behavioral advertising — One entry says disclosure to advertising providers happens only with your consent; another says cookies on the site may sell or share data for cross-context behavioral advertising with third parties including advertising providers and analytics providers, without mentioning consent. The addendum does not explain how the two fit together.

Sharing & Disclosure · Company practice

Operating system and platform providers receive identifiers, activity data and geolocation

The addendum says Mastercard shares with operating system and platform providers (operating systems and platforms) identifiers, internet or other electronic network activity information, and geolocation data. Unlike the advertising and analytics provider entries, this entry states no consent condition.

Supporting quotations

OS/Platform Providers: Operating systems and platforms. Personal Information we share: Identifiers; Internet or Other Electronic Network Activity Information; Geolocation Data.

Qualifications & exceptions

• This entry states no consent condition, while the advertising and analytics provider entries do.

Not stated here

• The addendum does not say whether consent applies to this disclosure.

Sharing & Disclosure · Company practice

Data brokers ("Resellers") are listed as recipients of identifiers, inferences and more

Among the third parties it discloses Personal Information to, the addendum lists "Resellers: Consumer data brokers". The categories it says it discloses to them are identifiers; the categories in Cal. Civ. Code Section 1798.80(e); characteristics of protected classifications under California or federal law; geolocation data; and inferences drawn from Personal Information. Unlike the advertising and analytics provider entries, this entry states no consent condition.

Supporting quotations

Resellers: Consumer data brokers.

Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Characteristics of Protected Classifications under California or Federal Law; Geolocation Data; Inferences Drawn from Personal Information.

Qualifications & exceptions

• The entry states no consent condition, while the advertising and analytics provider entries do.
• Appears in the California section of the U.S. Privacy Addendum, so applies to disclosures for California residents.

Not stated here

• The addendum does not say whether disclosure to resellers counts as a sale or sharing under the CCPA, or which kinds of data brokers are meant.

Sharing & Disclosure · Company practice

Affiliates and vendors receive the widest range of categories of Personal Information

The addendum says Mastercard discloses to its affiliates, and to vendors and service providers, identifiers; the categories in Cal. Civ. Code Section 1798.80(e); characteristics of protected classifications under California or federal law; commercial information; internet or other electronic network activity information; geolocation data; and inferences drawn from Personal Information.

Supporting quotations

Affiliates. Personal Information we disclose: Identifiers;

Commercial Information; Internet or Other Electronic Network Activity Information; Geolocation Data; Inferences Drawn from Personal Information.

Vendors: Vendors and service providers. Personal Information we disclose: Identifiers;

Commercial Information; Internet or Other Electronic Network Activity Information; Geolocation Data; Inferences Drawn from Personal Information.

Qualifications & exceptions

• The seven categories listed for affiliates and for vendors are the same.

Sharing & Disclosure · Company practice

Third parties integrated into the services receive identifiers, activity and geolocation data

The addendum says Mastercard discloses to third parties integrated into its services identifiers, internet or other electronic network activity, and geolocation data.

Supporting quotations

Integrated Third Parties: Third parties integrated into our services. Personal Information we disclose: Identifiers; Internet or Other Electronic Network Activity; Geolocation Data.

Qualifications & exceptions

• The entry states no consent condition.

Sharing & Disclosure · Company practice

Disclosures required by law or in a merger or sale cover nearly all categories

The addendum says Mastercard discloses to third parties as required by law and similar disclosures, and to third parties in connection with a merger, sale or asset transfer, the same seven categories: identifiers; the categories in Cal. Civ. Code Section 1798.80(e); characteristics of protected classifications under California or federal law; commercial information; internet or other electronic network activity information; geolocation data; and inferences drawn from Personal Information.

Supporting quotations

Third Parties as Legally Required: Third parties as required by law and similar disclosures.

Personal Information we disclose: Identifiers;

Third Parties in Merger/Acquisition: Third parties in connection with a merger, sale, or asset transfer.

Commercial Information; Internet or Other Electronic Network Activity Information; Geolocation Data; Inferences Drawn from Personal Information.

Qualifications & exceptions

• "Similar disclosures" is not defined in the entry.

Sharing & Disclosure · Company practice

Consent-based disclosures and loyalty-related disclosures to banks and merchants

The addendum says Mastercard may disclose identifiers and commercial information to other third parties for whom it has obtained your direction or permission. It also says it discloses to financial institutions (for example banks that issued your Mastercard card) or merchants, to the extent necessary for Mastercard to offer promotions, offers, benefits, campaigns and other loyalty-related initiatives and to perform related activities for its customers, identifiers; the categories in Cal. Civ. Code Section 1798.80(e); commercial information; internet or other electronic network activity information; geolocation data; and inferences drawn from Personal Information.

Supporting quotations

Third Parties with Consent or Direction: Other third parties for whom we have obtained your direction or permission to disclose your Personal Information.

Personal Information we may disclose: Identifiers; Commercial Information

Financial Institution(s) (e.g., banks that issued your Mastercard card) or Merchants: To the extent necessary for Mastercard to offer promotions, offers, benefits, campaigns, and other loyalty-related initiatives and to perform related activities for our customers.

Qualifications & exceptions

• The disclosure to banks and merchants is limited to "the extent necessary" for promotions, offers, benefits, campaigns and loyalty-related initiatives and related activities for customers.

Legal Rights & Agreement Rules · Company commitment

Mastercard says it does not use sensitive data in ways that require a right to limit under the CCPA

The addendum says Mastercard does not use or disclose sensitive personal information for purposes which would require it to offer consumers the right to limit under the CCPA.

Supporting quotations

We do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit under the CCPA.

Qualifications & exceptions

• Made under the CCPA for California consumers; which purposes require the right is Mastercard's own assessment.

Sharing & Disclosure · Company practice

Cookies on the site may "sell" or "share" data for cross-context behavioral advertising

Mastercard says it does not sell your Personal Information for monetary consideration. It says, however, that some of the cookies and other technologies used on this website, which may include pixel tags, SDKs and web beacons (collectively "Cookies"), may disclose information in a way considered a "sale" or "share" for cross-context behavioral advertising (CCBA) as the CCPA defines those terms, and that these Cookies may use or share Personal Information with third parties to provide a personalized marketing experience and serve targeted advertisements based on your browsing habits and activity across other sites. It says it may sell or share, and has sold and shared in the preceding 12 months, identifiers, internet or other electronic network activity information and geolocation data (for example your IP address) with third parties including advertising providers and analytics providers.

Supporting quotations

Mastercard does not sell your Personal Information for monetary consideration.

some of the cookies and other technologies used on this website, which may include pixel tags, SDKs and web beacons (collectively “Cookies”), may disclose information in a way that is considered a “sale” or “share” (for cross-context behavioral advertising (“CCBA”)) as those terms are defined under the CCPA.

These Cookies may use or share Personal Information with third parties to provide you with a personalized marketing experience and serve targeted advertisements based on your browsing habits and activity across other sites.

We may sell or share, and have sold and shared in the preceding 12 months, the following categories of Personal Information for CCBA purposes:

Identifiers,

Internet or Other Electronic Network Activity Information, and

Geolocation Data (e.g. your IP address)

The categories of Personal Information above are sold and shared, and have been sold and shared in the preceding 12 months, with third parties including Advertising Providers and Analytics Providers.

Qualifications & exceptions

• The statement that Mastercard does not sell for monetary consideration is followed by "However": some cookies may disclose information in a way the CCPA treats as a "sale" or "share" for cross-context behavioral advertising.
• Covers the preceding 12 months for the categories listed.

Not stated here

• The addendum does not name the third parties beyond "including Advertising Providers and Analytics Providers", and does not reconcile this with the entries saying advertising and analytics disclosures occur only with consent.

Cross-references

• contrast (model-proposed): Disclosure to advertising and analytics providers is described as only with your consent — One entry says disclosure to advertising providers happens only with your consent; another says cookies on the site may sell or share data for cross-context behavioral advertising with third parties including advertising providers and analytics providers, without mentioning consent. The addendum does not explain how the two fit together.

Sharing & Disclosure · Company practice

Mastercard says it has no actual knowledge of selling or sharing data of consumers under 16

The addendum says Mastercard does not have actual knowledge that it sells or shares Personal Information of consumers under 16 years of age.

Supporting quotations

We do not have actual knowledge that we sell or share Personal Information of consumers under 16 years of age.

Qualifications & exceptions

• Limited to what Mastercard has "actual knowledge" of; it is not a statement that no such data is sold or shared.

Retention & Deletion · Company commitment

California section: data is deleted or de-identified when no longer needed, unless the law requires longer

The California section repeats that Mastercard takes measures to delete Personal Information or keep it in a form that does not permit identifying you when it is no longer necessary for the purposes for which it is processed, unless the law requires longer retention. It lists the same criteria for deciding retention periods.

Supporting quotations

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it unless we are required by law to keep this information for a longer period.

When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

Qualifications & exceptions

• Deletion or de-identification applies when the information is no longer necessary for the purposes of processing; legal retention requirements can extend it.

Not stated here

• No specific retention periods are given.

Legal Rights & Agreement Rules · User right or choice

California residents may request what data is collected, its sources, purposes, recipients and specifics

The addendum says California residents may exercise a right to know and access by submitting a verifiable request for information about: the categories of Personal Information collected about them; the categories of sources; the business or commercial purpose for collecting, selling or sharing it; the categories of third parties to whom it is disclosed; and the specific pieces of Personal Information collected about them.

Supporting quotations

If you are a California resident, you may exercise the following rights.

Right to Know and Access. You may submit a verifiable request for information regarding:

what categories of Personal Information we have collected about you;

the categories of sources from which Personal Information is collected;

the business or commercial purpose for collecting, selling, or sharing Personal Information;

the categories of third parties to whom we disclose Personal Information; and

the specific pieces of Personal Information we have collected about you.

Qualifications & exceptions

• Applies to California residents and requires a "verifiable" request.

Not stated here

• The verification process and any exceptions are described in later text, not in this list.

Legal Rights & Agreement Rules · User right or choice

California residents can ask Mastercard to delete or correct their data, subject to exceptions

The addendum says that, subject to certain exceptions, California residents may submit a verifiable request that Mastercard delete Personal Information it has collected from them, and that Mastercard maintains a record of such requests as the CCPA requires. It also says residents have the right to correct inaccurate Personal Information Mastercard maintains about them.

Supporting quotations

Right to Delete. Subject to certain exceptions, you may submit a verifiable request that we delete Personal Information about you that we have collected from you.

We maintain a record of such requests as required by the CCPA.

Right to Correct. You have the right to correct inaccurate Personal Information that we maintain about you.

Qualifications & exceptions

• Deletion applies to information collected "from you" and is "subject to certain exceptions" that the addendum does not list.

Not stated here

• The exceptions to the right to delete are not listed in this source.

Account & Service Control · Procedure

Requests are verified, including two-step verification on the My Data portal

The addendum says requests for access, deletion or correction are subject to Mastercard's ability to reasonably verify your identity in light of the information requested, under CCPA requirements. For the My Data portal it describes a two-step verification: besides email, name and surname, an additional second factor chosen during registration (a mobile one-time passcode or security answer). Before disclosing information it also asks consumers to answer specific questions about the products they use that are in scope of the request, and for requests by email it verifies identity using contact information (email, name and surname) and specific questions about the products they use.

Supporting quotations

Requests for access, deletion, or correction of Personal Information are subject to our ability to reasonably verify your identity in light of the information requested, pursuant to relevant CCPA requirements, limitations, and regulations.

a two-step verification will enable their account to be guarded by an extra layer of security. In addition to your email, name, and surname, we require additional verification through the second factor of authentication that you have chosen (mobile one-time passcode or security answer) during registration.

Before disclosing information, we also ask consumers to respond to specific questions about the products they use and that are in scope of their privacy request.

when consumers reach out to Mastercard via email, we verify their identity by using their contact information (email, name, and surname) and specific questions about the products they use.

Qualifications & exceptions

• Verification is required for access, deletion and correction requests; the two-step method described applies to requests made through the My Data portal.

Sharing & Disclosure · User right or choice

California residents can opt out of "sale" and "sharing" for cross-context advertising

The addendum says California residents have the right to opt out of the sale and sharing of their Personal Information for cross-context behavioral advertising (CCBA) purposes, by clicking the "Your Privacy Choices" link on the page or in the website footer and following the instructions. It says opt-out requests do not need to be submitted through the My Data portal and can be exercised directly through that link.

Supporting quotations

Right to Opt Out. You have the right to opt out of the sale and sharing of your Personal Information for purposes of CCBA.

please click the “Your Privacy Choices” link located

Requests to opt out of the sale or sharing of your Personal Information for CCBA do not need to be submitted through the My Data Portal and can be exercised directly through the “Your Privacy Choices” link described above.

Qualifications & exceptions

• The right covers "sale and sharing" for CCBA purposes only, as the CCPA defines those terms.

Sharing & Disclosure · User right or choice

Mastercard treats a Global Privacy Control signal as an opt-out for that browser and device

The addendum says California requires businesses to process Global Privacy Control (GPC) signals, also called opt-out preference signals, and explains how to enable GPC in a browser or plugin. If Mastercard receives a GPC signal it says it will treat it as a request to opt out of any sale and sharing of Personal Information for CCBA purposes for the specific device and browser used to send the signal. It stores a preference cookie on your browser to honor this choice; if you or your browser clear or expire cookies, you need to opt out again for that device and browser, such as by transmitting a GPC signal on your visit.

Supporting quotations

If we receive a GPC signal, we will treat it as a request to opt out of any sale and sharing of your Personal Information for CCBA purposes for the specific device and browser you use to transmit the GPC signal.

We will store a preference cookie on your browser to honor this choice; if you or your browser clear or expire cookies, you will need to opt out again for the device and browser, such as by transmitting a GPC signal on your visit.

Qualifications & exceptions

• The opt-out applies to the specific device and browser that sends the signal and lasts only while the preference cookie remains.

Not stated here

• The addendum does not say whether the GPC signal is honored outside California.

Account & Service Control · Company commitment

California residents will not be treated worse for exercising CCPA rights, with a data-value exception

The addendum says residents have the right not to be retaliated against for exercising their CCPA privacy rights, subject to certain limitations. Mastercard says it will not deny, charge different prices for, or provide a different level of quality of goods or services if you exercise your rights, except where the different price or level of quality is reasonably related to the value of the data it receives from you.

Supporting quotations

You have the right not to be retaliated against for the exercise of your CCPA privacy rights, subject to certain limitations.

We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise your rights, except where the different price or level of quality of goods or services is reasonably related to the value of the data that we receive from you.

Qualifications & exceptions

• The right is "subject to certain limitations" and has an exception for price or quality differences reasonably related to the value of the data received.

Not stated here

• The "certain limitations" are not listed in this source.

Legal Rights & Agreement Rules · Procedure

How California residents or their agents submit requests

To exercise rights to know, access, delete or correct under the CCPA, the addendum says to submit a request on the My Data portal, email the privacy address, or call a toll-free number. An authorized agent acting for a California resident to know, delete, correct or opt out can use the same channels, and Mastercard says it will require a written authorization signed by the resident whose Personal Information is the subject of the request.

Supporting quotations

To exercise your rights to know, access, delete, or correct under the CCPA, please submit your request on Mastercard’s

or call our toll-free number: 1-833-244-4084.

If you are acting as an authorized agent to make a request to know, delete, correct, or opt out on behalf of a California resident, you may submit a request on Mastercard’s

Please note that we will require you to attach a written authorization signed by the resident whose Personal Information will be subject to the request.

Qualifications & exceptions

• An authorized agent must attach a written authorization signed by the resident.

Not stated here

• The My Data portal is a separate web page not supplied here.

Legal Rights & Agreement Rules · Company commitment

Mastercard publishes yearly CCPA request metrics on the My Data portal

The addendum says that each calendar year Mastercard compiles metrics describing how it has complied with requests to delete, access, correct and opt out of sharing, which can be viewed on the My Data portal.

Supporting quotations

Each calendar year, we compile various metrics describing how we have complied with requests to delete, access, correct, and opt-out of sharing.

Not stated here

• The metrics themselves are on the My Data portal and not supplied here.

Legal Rights & Agreement Rules · User right or choice

Mastercard says it honors U.S. state privacy rights wherever you live, naming twenty states

The U.S. section says Mastercard honors your privacy rights in accordance with applicable U.S. state laws no matter where you reside. If you are a U.S. resident from whom it collects Personal Information as a controller, you may have rights under an applicable state privacy law, including those in effect in Alabama, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, or under a state privacy law that becomes effective in the future. It says you may rely on the disclosures in the Global Privacy Notice about how it collects, uses and discloses personal information and the choices you can make.

Supporting quotations

At Mastercard, we honor your privacy rights in accordance with applicable U.S. state laws, no matter where you reside.

If you are a U.S. resident from whom we collect Personal Information as a controller, you may have certain rights under an applicable U.S. state privacy law, including those in effect in Alabama, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, or under a state privacy law that becomes effective in the future.

You may rely on the disclosures in the

regarding how we collect, use, and disclose your personal information as well as the choices you can make related to your personal information.

Qualifications & exceptions

• Rights depend on "an applicable U.S. state privacy law"; the state list is introduced with "including", and applies to U.S. residents from whom Mastercard collects Personal Information as a controller.

Not stated here

• The addendum does not say which rights each state law gives or whether the list is complete.

Sharing & Disclosure · Company practice

On this website, some cookies may count as a "sale" under state laws for targeted advertising

The U.S. section says Mastercard does not sell your Personal Information for monetary consideration. It says, however, that some of the cookies used on the website may disclose information in a way considered a "sale" under U.S. state privacy laws, and that these cookies may use or share personal information with third parties to provide a personalized marketing experience and serve targeted advertisements based on browsing habits and activity across other sites, which it calls targeted advertising.

Supporting quotations

Mastercard does not sell your Personal Information for monetary consideration.

However, some of the Cookies used on this website may disclose information in a way that is considered a “sale” as that term is defined under U.S. state privacy laws.

These Cookies may use or share personal information with third parties to provide you with a personalized marketing experience and serve targeted advertisements based on your browsing habits and activity across other sites. This is referred to as targeted advertising.

Qualifications & exceptions

• The no-sale statement refers to monetary consideration only and is followed by "However" for cookies that state laws treat as a "sale".

Not stated here

• The addendum does not name the third parties receiving data through these cookies in this section.

Use & Processing · Company commitment

Mastercard says it does not collect, use or sell personal data to train large language models

The U.S. section says Mastercard does not collect, use or sell Personal Information for the purpose of training large language models. This wording is about large language models; elsewhere the notice's legal-basis table refers to "training our AI" as a ground for processing anonymized information.

Supporting quotations

We also do not collect, use, or sell Personal Information for the purpose of training large language models.

Qualifications & exceptions

• The statement is about large language models and is in the U.S. Privacy Addendum.

Not stated here

• The notice does not say whether "training our AI" in the legal-basis table includes large language models, or what AI is trained.

Cross-references

• contrast (model-proposed): Anonymized spending reports may be built from payment data, and the table mentions training AI — The legal-basis table lists training Mastercard's AI as part of a processing ground, while the U.S. section says it does not collect, use or sell Personal Information to train large language models. The notice does not say whether the AI referred to in the table includes large language models.

Sharing & Disclosure · User right or choice

U.S. residents may opt out of targeted advertising, "sale" or profiling decisions

In addition to the rights in Section 4 of the Global Privacy Notice, the U.S. section says you may have the right to opt out of the processing of Personal Information for targeted advertising or in a way that constitutes a "sale", or for profiling in furtherance of decisions that produce legal or similarly significant effects. To opt out of targeted advertising or "sale", it tells you to click the "Your Privacy Choices" link on the page or in the website footer and follow the instructions.

Supporting quotations

In addition to the rights identified in Section 4 of the Global Privacy Notice (“Your Rights and Choices”) above, you may have the following rights:

Right to opt out of the processing of Personal Information for purposes of (i) targeted advertising or in a way that constitutes a “sale”, or (ii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

please click the “Your Privacy Choices” link located

Qualifications & exceptions

• These are rights you "may have", additional to Section 4; availability depends on the applicable state law.

Inference & Profiling · User right or choice

Mastercard says it does not make profiling decisions with significant effects, but lists rights if it did

The U.S. section says Mastercard does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. It adds that, where applicable, you have the right to question the result of any profiling, to be informed of the reason it resulted in the decision and, if feasible, what actions might have secured a different decision; to review the data used in the profiling and, if the decision was based on inaccurate information, to have it corrected and the decision reevaluated; and to appeal a decision Mastercard makes about your privacy rights.

Supporting quotations

While we do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable, you have the right to question the result of any profiling, to be informed of the reason the profiling resulted in the decision

the right to review the data used in the profiling, and if the decision is determined to have been based on inaccurate Personal Information

the right to appeal a decision we make with respect to your privacy rights.

Qualifications & exceptions

• The rights apply "where applicable" and mostly matter if profiling decisions with legal or similarly significant effects occurred, which Mastercard says it does not engage in.

Not stated here

• The "Your Privacy Choices" link in this paragraph points to a linked page that is not supplied here.

Sharing & Disclosure · User right or choice

U.S. state signals: Mastercard treats a GPC signal as an opt-out for that browser and device

The U.S. section says some state privacy laws require businesses to process Global Privacy Control (GPC) signals, also called opt-out preference signals, and explains how to enable GPC. If Mastercard receives a GPC signal it says it will treat it as a request to opt out of sale and use of Personal Information for targeted advertising for the specific device and browser used. It stores a preference cookie to honor the choice; if you or your browser clear or expire cookies, you need to opt out again for that device and browser.

Supporting quotations

If we receive a GPC signal, we will treat it as a request to opt out of sale and use of your Personal Information for targeted advertising purposes for the specific device and browser you use to transmit the GPC signal.

We will store a preference cookie on your browser to honor this choice; if you or your browser clear or expire cookies, you will need to opt out again for the device and browser, such as by transmitting a GPC signal on your visit.

Qualifications & exceptions

• The opt-out applies to the specific device and browser that sends the signal and lasts only while the preference cookie remains.

Legal Rights & Agreement Rules · User right or choice

You may ask for information about how your biometric data is processed and disclosed

The U.S. section lists a right to obtain information about biometric data processing, including the category or description of your biometric data, the source it was collected from, the purpose for collection and processing, the identity of any third party it was disclosed to and the purposes for disclosure, and the category or description of the specific biometric data disclosed to third parties.

Supporting quotations

Right to obtain information about biometric data processing, including the category or description of your biometric data, the source from which it was collected, the purpose for collection and processing, the identity of any third party to whom it was disclosed and the purposes for disclosure, and the category or description of specific biometric data that was disclosed to third parties.

Qualifications & exceptions

• Listed among the rights you "may have" under applicable state laws.

Legal Rights & Agreement Rules · User right or choice

You may ask which third parties received your personal data, such as advertising and analytics providers

The U.S. section lists a right to obtain information about third parties to whom Mastercard has disclosed personal data, such as Advertising Providers and Analytics Providers.

Supporting quotations

Right to obtain information about third parties to whom we have disclosed personal data, such as Advertising Providers and Analytics Providers.

Qualifications & exceptions

• Listed among the rights you "may have" under applicable state laws; the examples are introduced with "such as".

Legal Rights & Agreement Rules · Procedure

U.S. rights can be exercised through the My Data portal, email or phone, including by an agent

The U.S. section says you (or, where permitted by law, your authorized agent) can exercise your rights on the My Data portal, by emailing Mastercard, or by calling its toll-free number, and refers to the California authorized-agent text and to Section 7 of the California disclosures for more on exercising these rights.

Supporting quotations

You (or, where permitted by law, your authorized agent) can exercise your rights on Mastercard’s

or by calling our toll-free number at 1-833-244-4084.

Please refer to Section 7 of the Additional Disclosures for California Residents above for more information on exercising these rights.

Qualifications & exceptions

• An authorized agent may act only "where permitted by law".

Not stated here

• The My Data portal is a separate web page not supplied here.

Legal Rights & Agreement Rules · Context

A printable U.S. version is offered as a downloadable file

At the end of the page Mastercard offers a printable version of its U.S. Global Privacy Notice as a download link. The downloadable file is separate from this page text.

Supporting quotations

Get a printable version of our U.S. Global Privacy Notice

Not stated here

• The downloadable file is not supplied here, so whether it matches this page text is not stated.