Loyalty and Rewards Notice

Data Access & Collection · Company practice

Program account data includes registered card details, CVC2 and login credentials

Under the Programs, Mastercard collects account information and contact details: full name, email address, the payment card number(s) you choose to register for a Program, expiry date, CVC2, login credentials, your accrued total of points or rewards, and your points or rewards redemption history. Depending on the program, you may also choose to provide additional details, such as your address, phone number, date of birth, tax ID number, and gender where permitted by law.

Supporting quotations

Under the Programs, we collect the following types of Personal Information relating to you:

Account information and contact details, such as full name, email address, payment card number(s) you choose to register for a Program, expiry date, CVC2, login credentials, accrued total of points or rewards and points or rewards redemption history.

Depending on the program, you may also choose to provide additional details, such as your address, phone number, date of birth, tax ID number, and gender where permitted by law.

Qualifications & exceptions

• The additional details (address, phone number, date of birth, tax ID number, gender) depend on the program and are ones you may choose to provide.
• Gender is collected only where permitted by law.

Not stated here

• The notice does not say which programs ask for the additional details.

Data Access & Collection · Company practice

Mastercard collects transaction details for cards enrolled in a Program

For card(s) enrolled in a Program, Mastercard collects transaction information such as the date and time of payment(s), personal account number, name of merchant, commercial and transaction code, currency and amount of a purchase, and a tokenized ID generated to identify whether your purchases are eligible for the Programs.

Supporting quotations

Transaction information related to the card(s) enrolled in a Program, such as date / time of payment(s), personal account number, name of merchant, commercial and transaction code, currency and amount of a purchase, and a tokenized ID generated to identify whether your purchases are eligible for the Programs.

Qualifications & exceptions

• The items listed are examples ("such as"), not a complete list.

Data Access & Collection · Company practice

Offer preferences, survey answers and support messages are also collected

Mastercard also collects your preferences for or interest in specific offers or categories of offers, information you provide when completing voluntary surveys, and information provided in connection with customer support, such as the date, time and content of your message.

Supporting quotations

Your preferences for or interest in specific offers or categories of offers.

Information provided when completing voluntary surveys.

Information provided in connection with our customer support, such as date, time and content of your message.

Qualifications & exceptions

• Survey information comes only from surveys that are voluntary.
• Support information is described by example ("such as" date, time and content of your message).

Data Access & Collection · Company practice

Location is collected if you choose to enable sharing to see nearby offers

Mastercard collects your geographic location if you choose to enable the sharing of your location to see offers near you. Separately, the device-related information the notice lists includes IP address and "location data", collected through cookies and similar technologies; the notice does not say whether that location data depends on the same location-sharing choice.

Supporting quotations

Your geographic location (if you choose to enable the sharing of your location to see offers near you).

IP address, location data

Not stated here

• Whether the "location data" listed under device-related information is covered by the same enable-sharing choice is not stated.

Data Access & Collection · Company practice

Device details and interaction data are collected through cookies and similar technologies

Mastercard collects device-related information (for example device ID, device model, browser type, operating system, referring URL, IP address and location data) and information about your interaction with the Programs on its websites or with emails it sends you (for example dates and times of action). It collects this information through cookies and similar technologies such as web beacons and other trackers, as described in the consent tools provided on its websites or in its emails.

Supporting quotations

Device-related information (e.g., device ID, device model, browser type, operating system, referring URL, IP address, location data) and information about your interaction with our Programs on our websites or with the emails that we send to you (e.g., dates and times of action).

We collect such information via cookies and similar technologies (such as web beacons and other trackers), as described in the consent tools provided on our websites or in the emails that we send to you.

Qualifications & exceptions

• Collection is described as happening through cookies and similar technologies, as set out in the consent tools on Mastercard's websites or in its emails.
• Device items and interaction items are examples ("e.g.").

Not stated here

• The content of the consent tools, and what choices they offer, is not part of this notice.

Data Access & Collection · Company practice

Information comes from third parties as well as directly from you

Mastercard says it obtains the categories of Personal Information above from third parties such as financial institutions, loyalty program operators and merchants, directly from you, and from your interaction with cookies and similar technologies.

Supporting quotations

We obtain the above categories of Personal Information from various sources: from third parties such as financial institutions, loyalty program operators and merchants, directly from you, or from your interaction with cookies and similar technologies.

Qualifications & exceptions

• Third-party sources are named by example ("such as").

Data Access & Collection · Context

Some collected information may count as sensitive, depending on applicable law

The notice says that, depending on applicable law, some of the information collected may qualify as sensitive Personal Information. It does not say which items might qualify.

Supporting quotations

Depending on applicable law, some of this information may qualify as sensitive Personal Information.

Not stated here

• Which categories qualify as sensitive, and which law applies, are not stated.