Fraud and Security Notice

Legal Rights & Agreement Rules · Company practice

Mastercard acts as a processor for many fraud activities and a controller for others

For many of its fraud and security activities Mastercard says it acts as a data processor on behalf of and under the instructions of financial institutions and merchants. Mastercard International Incorporated and its affiliates say they process personal information as a data controller to protect you against fraud. The notice defines personal information as any information relating to an identified or identifiable individual.

Supporting quotations

For many of our fraud and security activities, we act as a data processor on behalf of and under the instructions of financial institutions and merchants.

process various types of Personal Information, as a data controller, to protect you against fraud.

If you are located in the EEA, UK or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information.

WE PROCESS PERSONAL INFORMATION FOR FRAUD PREVENTION AND MONITORING AND FOR PROVIDING CYBER SECURITY SOLUTIONS FOR OUR CUSTOMERS

Qualifications & exceptions

• If you are located in the EEA, UK or Switzerland, Mastercard Europe SA is the responsible entity.

Not stated here

• How financial institutions and merchants use data Mastercard processes on their behalf is not described in this passage.

Legal Rights & Agreement Rules · Context

The notice shows an effective date of 11/30/2022

The Fraud & Security Notice gives its effective date as 11/30/2022. Because the day is 30, this reads as month/day/year, November 30, 2022.

Supporting quotations

Fraud & Security Notice

Effective Date: 11/30/2022

Legal Rights & Agreement Rules · Company commitment

Mastercard says it processes only with a valid legal ground, and relies on consent in some countries

Mastercard says it processes personal information for the listed purposes only when it has a valid legal ground under applicable law, depending on the country where you are located. It adds that in some countries consent is the only or most appropriate legal basis, and there it relies on consent for all processing activities; this consent may be obtained for Mastercard by your financial institution, merchant, service provider or another partner.

Supporting quotations

We will only process your Personal Information for the below purposes when we have a valid legal ground for the processing in accordance with applicable law, depending on the country in which you are located.

in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

In certain cases, this consent may be obtained from you on our behalf by your financial institution, merchant, service provider, or another partner.

Qualifications & exceptions

• The legal ground depends on the country where you are located.
• In certain cases consent may be obtained for Mastercard by your financial institution, merchant, service provider or another partner.

Not stated here

• The notice does not say which countries rely on consent or how consent given through a partner can be withdrawn.

Legal Rights & Agreement Rules · Restriction or exception

The chart covers Mastercard as controller; partners are responsible when Mastercard is a processor

The chart describes the processing activities for which Mastercard acts as a data controller. Where Mastercard acts as a data processor for financial institutions, merchants or other partners who are controllers, those partners are responsible for ensuring a valid legal ground, and the notice refers you to their privacy policies for how your personal information is processed.

Supporting quotations

The chart below describes the processing activities for which we act as a data controller.

Where we act as a data processor on behalf of financial institutions, merchants, or other partners who operate as data controllers, the financial institutions, merchants, or other partners are responsible for ensuring a valid legal ground for the data processing.

Please refer to their respective privacy policies for more information regarding the processing of your Personal Information.

For many of our fraud and security activities, we act as a data processor on behalf of and under the instructions of financial institutions and merchants.

Qualifications & exceptions

• Applies only to processing activities where Mastercard acts as controller; processor activities follow the partner's legal ground.

Not stated here

• Those partners' privacy policies are not part of this notice.

Legal Rights & Agreement Rules · Company practice

Protecting against fraud, cyber incidents and managing risk: four possible legal bases

Mastercard lists protecting you and others against fraud and cyber incidents, strengthening the cyber resilience of your operations, and managing risk exposure and franchise quality as a processing activity. The legal bases it lists are your consent, compliance with a legal or regulatory obligation, necessity for entering into or performing a contract to which you are a party, and a legitimate interest of Mastercard or a third party in preventing and protecting against fraud and securing its network and the payment transactions it processes.

Supporting quotations

Protect you and others against fraud, cyber incidents and strengthen the cyber resilience of your operations, and manage risk exposure and franchise quality.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of, a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of preventing and protecting against fraud, securing our network and the payment transactions that we process.

Legal Basis for Processing (where required under applicable law)

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Monitoring and preventing fraud, unauthorized transactions and claims: four possible legal bases

Mastercard lists monitoring and preventing fraud, unauthorized transactions, claims and other liabilities on its payment network, and monitoring and preventing fraud on the blockchain in relation to cryptocurrency, as a processing activity. The legal bases it lists are your consent, compliance with a legal or regulatory obligation, necessity for a contract to which you are a party, and a legitimate interest of Mastercard or a third party in monitoring and preventing against fraud.

Supporting quotations

Monitor and prevent fraud, unauthorized transactions, claims and other liabilities on our payment network, as well as monitor and prevent fraud on the blockchain in relation to cryptocurrency.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of, a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of monitoring and preventing against fraud.

Legal Basis for Processing (where required under applicable law)

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Authenticating you and verifying your identity: four possible legal bases

Mastercard lists authenticating you and verifying your identity as a processing activity. The legal bases it lists are your consent, compliance with a legal or regulatory obligation, necessity for a contract to which you are a party, and a legitimate interest of Mastercard or a third party in authenticating you and verifying your identity.

Supporting quotations

Authenticate you and verify your identity.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of, a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of authenticating you and verifying your identity.

Legal Basis for Processing (where required under applicable law)

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Keeping payment networks secure: legal obligation or legitimate interest

Mastercard lists maintaining the integrity and security of its payment networks as a processing activity. The only legal bases it lists are compliance with a legal or regulatory obligation, and a legitimate interest of Mastercard or a third party in maintaining that integrity and security.

Supporting quotations

Maintain the integrity and security of our payment networks.

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

We, or a third party, have a legitimate interest in using your Personal Information for maintaining the integrity and security of our payment networks.

Legal Basis for Processing (where required under applicable law)

in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.
• The chart lists no consent basis for this activity, but the notice says that in countries where consent is the only or most appropriate basis Mastercard relies on consent for all processing activities.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Complying with legal obligations, including anti-money laundering: legal obligation or legitimate interest

Mastercard lists complying with legal obligations, including under applicable anti money laundering legislation, as a processing activity. The only legal bases it lists are compliance with a legal or regulatory obligation, and a legitimate interest of Mastercard or a third party in using personal information for compliance with legal obligations.

Supporting quotations

Comply with legal obligations, including under applicable anti money laundering legislation.

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

We, or a third party, have a legitimate interest in using your Personal Information for compliance with legal obligations.

Legal Basis for Processing (where required under applicable law)

in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.
• The chart lists no consent basis for this activity, but the notice says that in countries where consent is the only or most appropriate basis Mastercard relies on consent for all processing activities.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Internal research and development on fraud detection: legitimate interest only

Mastercard lists conducting internal research and development to evaluate and enhance its fraud detection, prevention, monitoring and cyber resilience operations and products as a processing activity. The only legal basis it lists is a legitimate interest of Mastercard or a third party in using personal information for internal research and development aimed at preventing and protecting against fraud, securing its network and the payment transactions it processes.

Supporting quotations

Conduct internal research and development which aim at evaluating and enhancing our fraud detection, prevention, monitoring and cyber resilience operations and products.

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of conducting internal research and development with the aim of preventing and protecting against fraud, securing our network and the payment transactions that we process.

Legal Basis for Processing (where required under applicable law)

in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.
• The chart lists no consent basis for this activity, but the notice says that in countries where consent is the only or most appropriate basis Mastercard relies on consent for all processing activities.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

The legal basis listed for building fraud models is a legitimate interest

For aggregating personal information and creating models to identify and prevent fraud, Mastercard lists only one legal basis: a legitimate interest of Mastercard or a third party in aggregating personal information and creating models to identify, prevent and protect its customers and the payment ecosystem against fraud. The chart row lists no consent, legal obligation or contract basis for this activity.

Supporting quotations

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of aggregating Personal Information and creating models to identify, prevent and protect our customers and the payment ecosystem against fraud.

Aggregate some of your Personal Information to create rules-based or artificial intelligence models to identify past and potential future fraud or money laundering patterns

Qualifications & exceptions

• Listed 'where required under applicable law'; the notice also says that in countries where consent is the only or most appropriate basis it relies on consent for all processing activities.

Not stated here

• The notice does not say which country's law makes this basis apply.

Legal Rights & Agreement Rules · User right or choice

Your rights and choices are in the Global Privacy Notice and can be exercised by email

The notice says you have certain rights and choices regarding the personal information Mastercard maintains about you. For those rights, and for how Mastercard shares, transfers, retains or protects personal information, it points you to its Global Privacy Notice. You, or a party authorized to act on your behalf, can exercise the rights detailed there by emailing privacyanddataprotection@mastercard.com.

Supporting quotations

You have certain rights and choices regarding the Personal Information we maintain about you.

For more information about your rights, to contact us, or to learn more about how we share, transfer, retain or protect your Personal Information, please read our Global Privacy Notice.

You, or a party authorized to act on your behalf, can exercise your rights that are detailed in the Global Privacy Notice by emailing us at: privacyanddataprotection@mastercard.com.

Qualifications & exceptions

• Applies to the rights detailed in the Global Privacy Notice; a party authorized to act on your behalf may also exercise them.

Not stated here

• This notice does not list the rights, response times, identity checks or retention periods; it refers to the Global Privacy Notice, which was not supplied here.

Legal Rights & Agreement Rules · Context

This notice adds detail to the Global Privacy Notice; some products have their own notices

The notice says it provides further information about certain aspects of the processing of personal information covered by the Global Privacy Notice. It adds that some of the security and fraud prevention and monitoring solutions mentioned above may have their own specific privacy notices, which you are asked to consult.

Supporting quotations

This Fraud and Security Notice provides further information about certain aspects of the processing of Personal Information covered by our Global Privacy Notice.

Some of the security and fraud prevention and monitoring solutions mentioned above may have their specific privacy notices. Please consult them for more information.

Qualifications & exceptions

• Covers certain aspects of processing, not all of Mastercard's processing.

Not stated here

• The Global Privacy Notice and any product-specific notices were not supplied with this document.