Mastercard - Global Privacy Notice
Effective Date: 2/2/2022
This Global Privacy Notice describes the types of Personal Information we collect, the purposes for which we collect that Personal Information, the other parties with whom we may share it and the measures we take to protect the security of the data. It also tells you about your rights and choices with respect to your Personal Information, and how you can contact us about our privacy practices.
Please note that we also act on behalf of and under the instructions of financial institutions, merchants and other partners which act as data controllers, including for processing payment transactions. Please refer to their respective privacy policies for more information regarding the processing of your Personal Information in these contexts.
Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements. Specific privacy notices may apply to some of our products and services. Please visit the webpage or digital asset of the specific product or service to learn more about our privacy and information practices in relation to that product or service.
1. Personal Information We May Collect
“Personal Information” means any information relating to an identified or identifiable individual. We may collect the following categories of Personal Information:
- Transaction information, such as personal account number, the merchant’s name and location, the date and the total amount of the transaction, and other information provided by financial institutions or merchants when we act on their behalf.
- Product and service information, such as registration and payment information, and program-specific information, when you request products or services directly from us, or participate in marketing programs.
- Website, device and mobile app usage, and similar information collected via automated means, such as cookies and similar technologies.
- Job applications and related information when you apply for a job with us.
- Business contact information when you work for one of our business partners.
For the purpose of this Global Privacy Notice, unless otherwise specified, “Personal Information” means any information relating to an identified or identifiable individual. We may obtain different types of Personal Information relating to you in the situations described below.
Personal Information We Receive from Financial Institutions, Merchants, and Other Partners in Connection with Mastercard’s Products or Services
As a processor of payment transactions and provider of related services, we obtain a limited amount of information in connection with your payment transactions such as the personal account number, the merchant’s name and location, the date and the total amount of the transaction. Importantly, we generally do not need or collect the cardholder’s name or other contact information to process payment transactions.
In addition, for certain products and services, your financial institutions, the merchants where you make a transaction or other partners may provide us with more information about you, or we may collect it directly from you to provide you with those products and services on their behalf, support their business or perform processing activities on their behalf.
In the above situations, we act on behalf of and under the instructions of financial institutions, merchants and other partners which act as data controllers. Unless otherwise authorized by law, we will process your Personal Information to process payment transactions or for the purposes agreed between Mastercard and the financial institutions, merchants and other partners. Please refer to their respective privacy policies for more information regarding the processing of your Personal Information.
Personal Information We Collect when Providing Mastercard’s Products and Services Directly to You
Mastercard may provide you directly with products and services such as marketing programs, rewards programs, eWallets, Open Banking solutions, prepaid services, location alert programs, and biometric authentication tools. To benefit from one or more of these products and services, you can submit information to us directly via various means including: (i) on our websites and digital assets, (ii) in response to marketing or other communications, (iii) by signing up for a Mastercard product or service, or (iv) through your participation in an offer, program or promotion. We may also obtain Personal Information about you through your use of our products or services, from companies that use or facilitate our products or services, from publicly available sources, or from third party partners. Your Personal Information may also be passed on to us by your financial institution, merchant or other business partners.
Below is an overview of the types of Personal Information we may collect in relation to programs we offer directly to you. Each program differs, so where applicable, please refer to the relevant program-specific privacy notice for more information on the use of your Personal Information for that specific program.
- Registration and payment information: We may collect identifiers and your contact information (such as name, email address, phone number, billing or shipping address), authentication information (e.g., username and password), age, date of birth, gender and family status, military and veteran status, language preferences, payment details, personal account number, commercial information, such as merchant’s name and location, date and total amount of the transactions, card expiration date and card verification code.
- Information we process to provide you with the program: We may collect different types of Personal Information depending on the program. For example, programs designed to offer you location-based services will typically require the collection of your address or geolocation data. Programs within our Open Banking solutions may require the collection of your financial account information. Similarly, programs designed to allow you to authenticate for example, via facial or fingerprint recognition may require the processing of your photograph and/or biometric information. All these programs are voluntary, and your Personal Information is only collected if you subscribe to such programs.
- Other information you choose to provide: You may choose to provide other information, such as different types of content (e.g., photographs, articles, comments), contact information of friends or other people you would like us to contact, content you make available through social media accounts or memberships with third parties, or any other information you want to share with us, for example when you contact customer service.
In addition, we may collect or use Personal Information for fraud prevention and monitoring, risk management, dispute resolution and other related purposes. Such information may include identifiers, commercial information, and Internet or other electronic network activity information, such as the personal account number, merchant’s name and location, date and total amount of the transactions, IP address, fraud score, location data, merchant details, items purchased and information about the dispute. For more information, please click here.
For more information on our collection of Personal Information in the context of our Open Banking solutions, please click here.
Personal Information We Obtain from Your Interaction with Mastercard’s Ads, Websites, Apps or Other Digital Assets
We, our service providers and partners may collect certain information about you via automated means such as Internet or other electronic network activity information, cookies, and web beacons when you interact with our ads, mobile apps, or visit our websites, pages or other digital assets. The information we collect in this manner may include: IP address, browser type, operating system, mobile device identifier, geographical area, referring URLs and information on actions taken or interaction with our digital assets. A “cookie” is a text file placed on a computer’s hard drive by a web server. A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, is a technology that helps us identify when content has been accessed or visited.
We use this information to improve our online products and services by assessing how many users access or use our online products and services, which content, products and features of our online products and services most interest our visitors, what types of offers our customers like to see and how our online products and services perform from a technical point of view. For instance, we may use third-party web analytics services on our websites and mobile apps, such as those of Adobe Omniture. The analytics providers that administer these services use technologies such as cookies and web beacons to help us analyze how visitors use our websites and apps.
We, our service providers and partners may also collect information about you in connection with our marketing activities, including offers, sweepstakes, contests and promotions. The information collected for these purposes may include identifiers and your contact information (e.g., name, postal address, email address, phone number), electronic identification data (e.g., username, password, security questions, IP address), and data collected in the context of online marketing programs, including commercial information, Internet or other electronic network activity information, geolocation data, and inferences drawn from Personal Information (e.g., personal characteristics, life habits, consumption habits, interests, location data, and voice and image recordings).
We, our service providers and partners may also collect information about you to provide you with content and advertising tailored to your individual interests based on inferences drawn from Personal Information. The information collected for these purposes may include Internet or other electronic network activity information, such as details about things like the particular pages or ads you view on our websites and apps and the actions you take on our websites and apps.
In addition, some of our online products and services include advanced fraud prevention technology using behavioral-based data or biometric information, such as keystroke timing, device accelerometer, scroll position and mouse-location.
Where required under applicable law, we obtain your consent prior to using the above automated means, and prior to sending you marketing communications, tailored content and advertising.
Please see the “Your Rights and Choices” section of this Global Privacy Notice to learn about your choices.
Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, Mastercard does not respond to web browser-based DNT signals at this time. To learn more about browser tracking signals and DNT, visit http://www.allaboutdnt.com.
Personal Information We Obtain when You Apply for a Job with Us
If you are applying for a job at Mastercard, we may collect certain identifiers and professional or employment-related information from your job applications on our Career website, such as your contact information (including name, postal address, email address and phone number), job history, curriculum vitae, contact details of your referees and any other Personal Information you choose to submit along with your application.
Personal Information We Collect in the Context of Our Business Relationship with Financial Institution, Merchant or other Entity Partnering with Mastercard
We may collect Personal Information from individuals working for one of our business partners (including financial institutions, merchants, customers, suppliers, vendors and other partners), including identifiers, name, job title, department and name of organization, business email and postal addresses, business telephone number, queries, answers to security questions, security passwords and other credentials. We may use this information to provide products and services directly to financial institutions, corporate clients, merchants, customers and partners, to manage our business relationships and financial reporting, for franchise development and integrity, to protect us from financial crime, to improve our service, for marketing and to comply with applicable law, as well as for accounting, auditing and billing purposes.
2. How We May Use Your Personal Information
We May Use Your Personal Information to:
- Process your payment transactions.
- Protect against and prevent fraud, and other legal or information security risks. For more information, please see our Fraud & Security Notice.
- Provide our Open Banking solutions.
- Provide and communicate with you about products and services offered by Mastercard, financial institutions, merchants and partners.
- Provide you with personalized services and recommendations.
- Operate, evaluate and improve our business, including anonymization and analytics.
- Process your job application.
- Serve other purposes for which we provide specific notice at the time of collection, and as otherwise authorized or required by law.
- Generate anonymized and aggregated data to prepare insights to advise Mastercard’s customers and partners regarding spending patterns, fraud and other trends.
- Learn more about you, including your preferences or other characteristics. We treat these inferences as Personal Information where required under applicable law.
Where required under applicable law, we will only use your Personal Information with your consent; as necessary to provide you with products and services; to comply with a legal obligation; or when there is a legitimate and overriding interest that necessitates the use.
We may use Personal Information we obtain about you for the purposes set out below. Depending on the country in which you are located, we will only process your Personal Information, when we have a legal basis for the processing as identified in the table below. However, please note that even though the chart below does not list consent as a legal basis for each processing activity, in some countries consent is the only legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.
In most cases, we process your payment transactions as a processor on behalf of your financial institutions, merchants and other partners which act as data controllers. When we act as a processor, controllers are responsible for ensuring a legal basis for the processing of your Personal Information. Please refer to their respective privacy policies for more information regarding the processing of your Personal Information in these contexts.
In some limited cases (e.g., chargebacks), we may process your payment transactions as a controller, provided that:
When we process Personal Information for fraud and cyber threat prevention, we may act as a controller or as a processor. When we act as a controller, we rely on one of the following legal grounds:
For more information on our fraud prevention and monitoring activities, please see our Fraud & Security Notice.
In some cases, we provide our Open Banking solutions as a processor on behalf of your service provider, merchants and other partners which act as data controllers. When we act as a processor, controllers are responsible for ensuring a legal basis for the processing of your Personal Information. Please refer to their respective privacy policies for more information regarding the processing of your Personal Information in these contexts.
For more information on our Open Banking activities, please see our Open Banking Privacy Notice.
Please consult the Specific Privacy Notice at the time of the collection.
Where required under applicable law, we have carried out balancing tests for the data processing based on our or a third party’s legitimate interests to ensure that such legitimate interest is not overridden by your interests, fundamental rights or freedoms. For more information on our balancing tests, you may contact us as described in the “How to Contact Us” section below.
We will not subject you to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, unless you explicitly consented to the processing where required under applicable law, the processing is necessary for entering into, or performance of a contract between you and Mastercard, or when we are legally required to use your Personal Information in this way, for example to prevent fraud.
If you provide us with any information or material relating to another individual, you must make sure that the sharing with us and our further use as described to you from time to time is in line with applicable laws, so for example you should duly inform that individual about the processing of her/his Personal Information and obtain her/his consent, as may be necessary under applicable laws.
3. How We Share Your Personal Information
We May Share Personal Information with:
- Mastercard’s headquarters in the U.S., our affiliates and other entities within Mastercard’s group of companies.
- Service providers acting on our behalf.
- Other participants in the payment ecosystem, including financial institutions, and merchants.
- Other participants in the Open Banking ecosystem, including financial institutions, merchants and third parties.
- Third parties for fraud monitoring and prevention purposes, or other purposes required by law.
- Third parties whose feature you use in connection with our products and services or with your consent.
- Other entities as required under applicable law or in the event of a sale or transfer of our business or assets.
We do not sell Personal Information we collect about you, as defined by the California Consumer Privacy Act.
4. Your Rights and Choices
Depending on your country, you may have the right or choice to:
- Access your Personal Information, obtain a copy of it, rectify it, restrict or object to its processing, or request its deletion, destruction or anonymization.
- Receive the Personal Information you provided to us to transmit it to another company.
- Withdraw any consent provided.
- Where applicable, lodge a complaint with your relevant supervisory authority or regulator.
You have certain rights regarding the Personal Information we maintain about you and certain choices about what Personal Information we collect from you, how we use it, and how we communicate with you.
If you are located in California, we will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights, except where the different price or level of quality of good or service is reasonably related to the value of the data that we receive from you. In some instances, we may not be able to provide you with the good or service that you request if you choose to exercise certain rights.
You can choose:
- Not to provide Personal Information to Mastercard by refraining from conducting payment transactions or from submitting Personal Information directly to us. When we collect Personal Information from you, we indicate whether and why it is necessary to provide it to us, as well as the consequences of failing to do so. If you do not provide Personal Information, you may not be able to benefit from the full range of Mastercard products and services, and we may not be able to provide you with the Mastercard products or services if that information is necessary to provide you with them, or if we are legally required to collect it in relation to the provision of such product or service.
- To tell us not to send you marketing emails by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us as indicated below. You also may opt out of receiving marketing emails from Mastercard by clicking here.
- To opt out of the anonymization of your Personal Information to perform data analyses by clicking here.
Depending on the country in which you are located, you may have the right to:
- Request access to and receive information about the Personal Information we maintain about you, to update and correct inaccuracies in your Personal Information, to restrict or to object to the processing of your Personal Information, to have the information anonymized, destroyed or deleted, as appropriate, or to exercise your right to data portability to easily transfer your Personal Information to another company. In addition, you may also have the right to lodge a complaint with the relevant supervisory authority or regulator, including in your country of residence, place of work or where an incident took place.
- Withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.
For information on the number of privacy requests Mastercard processed pursuant to the California Consumer Privacy Act and other privacy laws globally, please review the “MyData Report” section of the “My Data Center” portal.
You may opt out from certain processing of your Personal Information, e.g., via our opt-out webpage.
Note that this list may not be exhaustive, which means that you may have additional rights in accordance with your local laws. In addition, the above rights may be limited in some circumstances by local law requirements.
To update your preferences, ask us to remove your information from our mailing lists or submit a request to exercise your rights under applicable law, contact us as specified in the "How To Contact Us" section below.
We have developed Mastercard’s “My Data Center” portal to facilitate the exercise of your rights. You, or a party authorized to act on your behalf, can exercise your rights on Mastercard’s “My Data Center” portal or by submitting a request as described in the “How To Contact Us" section below.
If we fall short of your expectations in processing your Personal Information or you wish to make a complaint about our privacy practices, please tell us because it gives us an opportunity to fix the problem. To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time and as required under applicable law.
To learn more about the APEC Certification and access Dispute Resolution, please click on the TRUSTe seal.
5. Data Transfers
Mastercard is a global business. We may transfer your Personal Information to the United States and other countries which may not have the same data protection laws as the country in which you initially provided the information, but we will protect your Personal Information in accordance with this Global Privacy Notice, or as otherwise disclosed to you.
We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located. If you are located in the EEA, we will transfer your Personal Information in accordance with adequacy decisions (see list of countries for which the European Commission has issued an adequacy decision here), Binding Corporate Rules, standard contractual clauses, and other data transfer mechanisms.
Mastercard’s privacy practices, described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System. The APEC CBPR system provides a framework for organizations to ensure protection of Personal Information transferred among participating APEC economies. More information about the APEC framework can be found here.
Mastercard is a global business. We may transfer the Personal Information we collect about you to recipients in countries other than your country, including the United States, where we are headquartered. These countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your Personal Information to other countries, we will protect that information as described in this Global Privacy Notice, as disclosed to you at the time of data collection or as described in our program-specific privacy notice.
We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located. In particular, we have established and implemented Binding Corporate Rules (“BCRs”) that have been recognized by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally. A copy of our EEA BCRs is available here.
We may also transfer Personal Information to countries for which adequacy decisions have been issued (see list of countries for which the European Commission has issued an adequacy decision here), use contractual protections for the transfer of Personal Information to third parties, such as the European Commission’s Standard Contractual Clauses or their equivalent under applicable law, or rely on other data transfer mechanisms where applicable. Depending on your country, you may contact us as specified in the “How to Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of your jurisdiction.
Additionally, Mastercard’s privacy practices, described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System. The APEC CBPR system provides a framework for organizations to ensure protection of Personal Information transferred among participating APEC economies. More information about the APEC framework can be found here.
6. How We Protect Your Personal Information
We maintain appropriate security safeguards to protect your Personal Information and only retain it for a limited period of time.
The security of your Personal Information is important to Mastercard. We are committed to protecting the information we collect. We maintain reasonable administrative, technical and physical safeguards designed to protect the Personal Information you provide or we collect against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. We use SSL encryption on a number of our websites from which we transfer certain Personal Information.
We also take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.
7. Features and Links to Other Websites
Our websites may include links to other third-party websites, social media tools, widgets or plug-ins, permitting sharing web content including IP address, with third parties and social media providers. These social media providers may learn of your visit even if you are not logged in to your social media account or if you do not have an account with them. To the extent any linked websites or features you visit or use are not owned or controlled by Mastercard, we suggest that you review their own privacy notices or policies.
Our websites may provide links to other websites for your convenience and information. Our website may also contain certain features for which we partner with other entities. These entities may learn of your visit regardless of whether you use these features. These websites and features, which may include social networking and geo-location tools, operate independently from Mastercard, and are clearly identified as such. To the extent any linked websites or features you visit or use are not owned or controlled by Mastercard, we suggest that you review the privacy practices of the websites.
Mastercard offers you the possibility to share, link to, or mention things on social media about Mastercard’s products and services. For example, you may “like” an offer via your Facebook account, or “tweet” an offer using Twitter. When you visit a website with a social media button, your browser establishes a direct connection to that social media provider, and data concerning your visit, including IP address, is transferred to the social media provider. If you have an account with the social media provider, the provider may link your visit to your account, even if you are not logged into this account.
You may also choose to use certain features on our websites that can be accessed through, or for which we partner with, other entities that are not otherwise affiliated with Mastercard. These features, including geo-location tools, are operated by third parties and are clearly identified as such. Social media providers such as Facebook and Twitter, and these other third parties, are independent from Mastercard and do not necessarily share the same policy as Mastercard regarding the protection of privacy. Please review their privacy notices if you decide to use their services and consult your social media account settings if you want to deactivate certain features.
8. Children’s Privacy
Mastercard products and services are not directed to, or intended for, children under the age of 16.
9. Updates to This Global Privacy Notice
This Global Privacy Notice may be updated periodically to reflect changes in our privacy practices.
This Global Privacy Notice may be updated periodically to reflect changes in our Personal Information practices. We will post a prominent notice on relevant websites to notify you of any significant or material changes to our Global Privacy Notice prior to them being effective and indicate at the top of the Notice when it was most recently updated. If we update our Global Privacy Notice, in certain circumstances, we may seek your consent.
10. How to Contact Us
You can e-mail our Global Privacy Office at firstname.lastname@example.org. You may also submit a request to exercise your rights to your Personal Information on Mastercard’s “My Data Center” portal or by emailing us at: email@example.com.
If you have any questions, comments or complaints about this Global Privacy Notice and our privacy practices, or would like to update your privacy preferences, please email us at: firstname.lastname@example.org or write to us at:
Global Privacy Office
Mastercard International Incorporated
2000 Purchase Street
Purchase, New York 10577
If you are located in California, to exercise your rights under the CCPA, you may submit your request on Mastercard’s “My Data Center” portal, email us at: email@example.com, or call our toll-free number: 1-833-244-4084.
If you are located in the EEA, the UK or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information (or data controller). You may submit your request to exercise your rights to your Personal Information on Mastercard’s “My Data Center” portal, or email us at: firstname.lastname@example.org, or write to us at:
Europe Data Protection Officer
Mastercard Europe SA
Chaussée de Tervuren 198A
If you are located in Brazil, Mastercard Brasil Soluções de Pagamento Ltda. is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information on Mastercard’s “My Data Center” portal, or email us at: email@example.com or write to us at:
Brazil Data Protection Officer
Mastercard Brasil Soluções de Pagamento Ltda.
Avenida das Nações Unidas, 14.171, 20º andar, Crystal Tower
If you are located in Asia Pacific, Middle East or Africa, Mastercard Asia Pacific Pte. Ltd. Is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information by emailing us at: firstname.lastname@example.org or write to us at:
Asia Pacific, Middle East and Africa Data Protection Officer
Mastercard Asia/Pacific Pte Ltd
3 Fraser Street, DUO Tower, Level 17
For inquiries about your Mastercard card and your purchase, you should contact your financial institution or merchant. More information about how to contact them can be found on their respective websites.