Visa U.S. Social Security Number Policy and Sensitive Personal Information Statement

Data Access & Collection · Company practice

Visa collects Social Security numbers and other sensitive personal information

Visa says it collects U.S. Social Security numbers and other sensitive personal information as part of its ordinary business. The statement does not say whose information this is (for example cardholders, customers of a company that issues Visa cards, or Visa's own workers), why or how it is collected, or what else counts as "sensitive personal information". The statement is Visa's own and does not mention Chime.

Supporting quotations

Visa collects U.S. Social Security numbers and other sensitive personal information in the ordinary course of its business.

Qualifications & exceptions

• Social Security numbers are U.S. Social Security numbers
• Collected in the ordinary course of Visa's business

Not stated here

• Whose information Visa collects (cardholders, customers of card issuers such as Chime, workers or others) is not stated
• The purposes and methods of collection are not stated
• "Sensitive personal information" is not defined beyond Social Security numbers
• The statement does not say how it relates to Chime or to Chime's own handling of this information

Security & Safeguards · Company commitment

Visa says it has safeguards to help protect sensitive personal information

Visa says it has put in place reasonable technical, physical and administrative safeguards to help protect sensitive personal information from unlawful use and unauthorized disclosure. The wording is "help protect", so it describes an effort and not a promise that misuse or disclosure cannot happen. Apart from the two items listed in the statement, the safeguards themselves are not described.

Supporting quotations

We have implemented reasonable technical, physical and administrative safeguards to help protect sensitive personal information from unlawful use and unauthorized disclosure.

Qualifications & exceptions

• Described as reasonable and as helping to protect, not as a guarantee
• Aimed at unlawful use and unauthorized disclosure

Not stated here

• The specific technical, physical and administrative safeguards are not described beyond the two listed items
• The statement does not say how Visa checks that the safeguards work

Security & Safeguards · Company practice

All Visa workers are required to follow the safeguards

Visa says every Visa worker must follow its established safeguards, and that those safeguards include the two items listed after this sentence. Because the safeguards "include" the listed items, the statement does not say the list is complete. It does not define "workers" (for example whether contractors are included) or say how compliance is checked or enforced.

Supporting quotations

All Visa workers are required to follow these established safeguards, which include the following:

Qualifications & exceptions

• Applies to Visa workers; service providers are covered separately in the access and disclosure items
• The safeguards "include" the listed items, so the list is not stated to be complete

Not stated here

• Whether "workers" includes contractors or temporary staff is not stated
• How compliance is checked or enforced is not stated

Security & Safeguards · Company commitment

Access to sensitive personal information is limited to people who need it

Visa says access to sensitive personal information is limited to Visa workers and service providers who need it to perform tasks for Visa. The statement does not say how that need is decided, which service providers have access, or what controls enforce the limit.

Supporting quotations

Access to sensitive personal information is limited to those workers and service providers who have a need to access the information to perform tasks for Visa.

Qualifications & exceptions

• Access is for workers and service providers only
• The need must be to perform tasks for Visa

Not stated here

• How a need to access is decided is not stated
• The service providers and the access controls are not identified

Sharing & Disclosure · Company commitment

Visa discloses to third parties only under its own privacy and security policy

Visa says it discloses sensitive personal information to third parties only in accordance with its established privacy and security policy. That policy is not part of this statement, so this document does not show what it allows or forbids. The next list item adds a narrower statement about who may receive the information.

Supporting quotations

Sensitive personal information is only disclosed to third parties in accordance with Visa established privacy and security policy.

Not stated here

• Visa's established privacy and security policy is referred to but not supplied, so its terms are unknown
• Which third parties receive sensitive personal information is not stated here

Sharing & Disclosure · Company commitment

Visa discloses to service providers, auditors, advisors and successors who must protect it

Visa says one of the two situations in which it will disclose sensitive personal information is disclosure to service providers, auditors, advisors and/or successors in interest. These recipients must be legally or contractually obligated to protect the information. The statement does not name them, describe the protection they owe, or explain when a successor in interest would receive the information.

Supporting quotations

Visa will only disclose sensitive personal information (1) to those service providers, auditors, advisors and/or successors in interest who are legally or contractually obligated to protect them,

Qualifications & exceptions

• Recipients must be legally or contractually obligated to protect the information
• One of two stated situations; the other is disclosure as required or permitted by law

Not stated here

• The recipients are not named
• The protections the recipients are obligated to provide are not described
• When a successor in interest would receive the information is not explained

Sharing & Disclosure · Company commitment

Visa discloses sensitive personal information when the law requires or permits it

Visa says the other situation in which it will disclose sensitive personal information is where disclosure is required or permitted by law. Because law may permit disclosures as well as require them, this route can be broader than a legal duty. The sentence does not say whether recipients under this route must also be obligated to protect the information, or which laws apply.

Supporting quotations

Visa will only disclose sensitive personal information

or (2) as required or permitted by law.

Qualifications & exceptions

• One of two stated situations; the other is disclosure to recipients obligated to protect the information

Not stated here

• Which laws are meant is not stated
• Whether recipients under this route must protect the information is not stated

Legal Rights & Agreement Rules · Procedure

Questions can be sent to privacy@visa.com

Visa gives privacy@visa.com as the address for questions about this statement. The statement describes no process for asking to see, correct or delete sensitive personal information and gives no response time.

Supporting quotations

If you have any questions, please contact us at

privacy@visa.com

Not stated here

• No process for access, correction or deletion requests is described
• No response time is stated