Loyalty and Rewards Notice

Use & Processing · Context

This notice covers Mastercard's handling of personal information in its loyalty and rewards Programs

Mastercard International Incorporated and its affiliates (together "Mastercard", "us" or "we") use this notice to describe how they process Personal Information in connection with Mastercard's loyalty programs. "Programs" means programs in which you earn points or rewards for purchases made with your eligible Mastercard card and redeem them for promotions, discounts, cashback, rebates, sweepstakes, special offers or other benefits. "Personal Information" means any information relating to an identified or identifiable individual. The notice says it gives further information about certain aspects of processing covered by Mastercard's Global Privacy Notice, and recommends reading the two together.

Supporting quotations

Effective Date: February 9, 2026

we offer and support market-leading loyalty programs that allow you to earn points or rewards for purchases made with your eligible Mastercard card and to redeem those points or rewards for promotions, discounts, cashback, rebates, sweepstakes, special offers or other benefits (“Programs”)

This privacy notice (“Notice”) describes how Mastercard International Incorporated and its affiliates (collectively “Mastercard”, “us” or “we”) process Personal Information in connection with our Programs

“Personal Information” means any information relating to an identified or identifiable individual (“you”)

We recommend that you read this notice together with Mastercard's

This Notice provides further information about certain aspects of the processing of Personal information covered by our

Qualifications & exceptions

• Effective date: February 9, 2026.
• Points or rewards are earned on purchases made with an eligible Mastercard card.

Not stated here

• Which cards count as eligible, and which specific Programs exist, is not stated in this notice.
• The Global Privacy Notice is linked but its text is not part of this saved document.

Use & Processing · Restriction or exception

Not covered: priceless.com and processing Mastercard does for banks, merchants and partners

This notice does not cover Mastercard's processing in the context of other programs such as the priceless.com website, which has its own Priceless privacy notice. It also does not cover processing where Mastercard acts on behalf of and under the instructions of financial institutions (for example, the bank that issued your card), merchants and other partners that act as data controllers, including for processing payment transactions. For those cases the notice points you to the privacy notices of those institutions, merchants and partners.

Supporting quotations

This Notice does not cover the processing by Mastercard in the context of other programs such as the priceless.com website

This Notice also does not cover the processing where we act on behalf of and under the instructions of financial institutions (e.g., the bank that issued your Mastercard card), merchants and other partners which act as data controllers, including for processing payment transactions

Please refer to their privacy notices for information about the processing of your Personal Information in such cases.

Qualifications & exceptions

• The second exclusion applies only where Mastercard acts on behalf of and under the instructions of a financial institution, merchant or other partner that acts as a data controller.
• priceless.com is given as an example of other excluded programs ("such as").

Not stated here

• Other programs besides priceless.com that fall outside this notice are not listed.
• The Priceless notice and the partners' own notices are not part of this saved document.

Use & Processing · Company commitment

Mastercard says it needs a legal basis for each use, and relies on consent in some countries

Mastercard may use your Personal Information for the purposes in the table. Depending on the country in which you are located, it says it will only process your Personal Information when it has a legal basis, as identified in the table. The table does not list consent as a legal basis for every activity, but the notice states that in some countries consent is the only or most appropriate legal basis, and in those countries Mastercard relies on consent for all processing activities. The table pairs each processing activity with its legal bases.

Supporting quotations

We may use your Personal Information for the purposes set out below. Depending on the country in which you are located, we will only process your Personal Information when we have a legal basis for the processing, as identified in the table below.

However, please note that even though this table does not list consent as a legal basis for each processing activity, in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

Processing Activity

Legal Basis for Processing

“Personal Information” means any information relating to an identified or identifiable individual (“you”)

Qualifications & exceptions

• The legal-basis requirement is stated by country: it depends on the country in which you are located.
• Reliance on consent for all activities applies only in countries where consent is the only or most appropriate legal basis.

Not stated here

• The notice does not name the countries where consent is the only or most appropriate basis.
• The notice does not say which listed basis applies to a particular person or country.

Use & Processing · Company practice

Determining offer eligibility and qualifying transactions: consent or direction, contract, or legitimate interest

For determining your eligibility to receive offers in connection with your card type, and identifying transactions that may qualify for a point or reward, the table lists three legal bases: you consented to or directed the use of your Personal Information; the processing is necessary for entering into or performing a contract to which you are a party; or Mastercard or a third party has a legitimate interest in using your Personal Information to determine eligibility for, manage, and provide you with the Programs and their benefits.

Details not recorded for this card

Supporting quotations

Determine eligibility to receive offers in connection with your card type as well as to identify transactions that may qualify for a point or reward.

You consented to or directed the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information to be able to determine eligibility for, manage, and provide you with the Programs and their benefits.

Qualifications & exceptions

• Legal bases depend on the country in which you are located.

Use & Processing · Company practice

Push notifications and marketing about the Programs: consent or direction, contract, or legitimate interest

For sending you push notifications and marketing communications about the Programs, including contests, sweepstakes and any other marketing activities, the table lists three legal bases: you consented to or directed the use of your Personal Information; the processing is necessary for entering into or performing a contract to which you are party; or Mastercard or a third party has a legitimate interest in using your Personal Information for the purpose of marketing products and services.

Details not recorded for this card

Supporting quotations

Send you push notifications and marketing communications about the Programs (including contests, sweepstakes, and any other marketing activities).

You consented to or directed the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of marketing products and services.

Qualifications & exceptions

• Legal bases depend on the country in which you are located.

Use & Processing · Company practice

Operating and improving products, offers and websites: consent or direction, contract, or legitimate interest

For operating, evaluating and improving Mastercard's products and services, including the effectiveness of its offers and campaigns, and analyzing Program websites, mobile apps and other digital assets to facilitate their functionality, the table lists three legal bases: you consented to or directed the use of your Personal Information; the processing is necessary for entering into or performing a contract to which you are party; or Mastercard or a third party has a legitimate interest in using your Personal Information to operate, evaluate and improve its products or services and promote customer engagement with the Program.

Details not recorded for this card

Supporting quotations

Operate, evaluate, and improve our products and services, including the effectiveness of our offers and campaigns, and analyze our Program websites, mobile apps and any other digital assets to facilitate their functionality.

You consented to or directed the use of your Personal Information; or

The processing is necessary for entering into, or performance of a contract to which you are party; or

We, or a third party, have a legitimate interest in using your Personal Information to operate, evaluate, and improve our products or services and promote customer engagement with the Program.

Qualifications & exceptions

• Legal bases depend on the country in which you are located.

Use & Processing · Company practice

Anonymized aggregate reports for partners: legitimate interest or statistical and research purposes

For anonymizing Personal Information and preparing aggregated reports for internal analysis and to advise Mastercard's financial institutions, merchants and other customers and partners on spending patterns, fraud and other insights, the table lists two legal bases: Mastercard or a third party has a legitimate interest in using your Personal Information to anonymize it and prepare aggregated data reports; or the processing is undertaken for statistical and/or research purposes. Neither consent nor contract is listed in this row.

Details not recorded for this card

Supporting quotations

Anonymize Personal Information and prepare aggregated reports for internal analysis and to advise our financial institutions, merchants and other customers and partners in relation to spending patterns, fraud, and other insights.

We, or a third party, have a legitimate interest in using your Personal Information to anonymize Personal Information and prepare aggregated data reports; or

The processing is undertaken for statistical and/or research purposes (in jurisdictions where this legal basis is available).

Qualifications & exceptions

• The statistical and/or research basis applies in jurisdictions where this legal basis is available.
• Legal bases depend on the country in which you are located.

Not stated here

• The notice does not say how the anonymization is done or what the aggregated reports contain beyond the listed insights.

Use & Processing · User right or choice

You can opt out of Mastercard's processing by emailing it and naming the Program

Mastercard says you can exercise your rights to opt out of its processing of your Personal Information by emailing privacyanddataprotection@mastercard.com, indicating the name of the Program your request is about in the subject of the email.

Supporting quotations

You can exercise your rights to opt out of our processing of Personal Information by emailing us at: privacyanddataprotection@mastercard.com. Please indicate the name of the Program your request is about in the subject of your email.

Not stated here

• The notice does not say which processing can be opted out of, whether this varies by country, or how Mastercard responds.