For the purpose of this Privacy Notice, “Personal Information” means any information relating to an identified or identifiable individual. In connection with priceless™, we obtain Personal Information relating to you from various sources described below.

Where applicable, we indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so. If you do not provide Personal Information when requested, you may not be able to benefit from priceless™ if that information is necessary to provide you with the service or if we are legally required to collect it.

Personal Information Provided by You

• Registration and payment information: When you register on priceless™, we may collect your contact information (such as name, email address, phone number, billing or shipping address), username and password, personal account number, card expiration date and card verification code.
• Information we process to provide you with the program: We may collect different types of Personal Information depending on the program. For example, priceless™ programs designed to offer you location-based services will typically require the collection of your address or location. All these programs are voluntary, and your Personal Information is only collected if you subscribe to such programs.
• Other information you choose to provide: You may choose to provide other information, such as different types of content (e.g., photographs, comments), contact information of friends or other people you would like us to contact, content you make available through social media accounts or memberships with third parties, or any other information you want to share with us.

Personal Information Provided by Third Parties

We may obtain Personal Information about you from third parties which may be located in countries other than your country. For example, another priceless™ user may provide us with the contact information of a gift recipient, another individual who will share a priceless™ experience with the purchaser, or a person who the user wishes to invite to use priceless™. We may also obtain data from service providers that provide us with publicly available data.

Personal Information We Obtain from Your Interaction with priceless™, Mastercard Ads, Websites or Other Digital Assets

We, our service providers and partners may collect certain information about you via automated means such as cookies and web beacons when you interact with priceless™, our ads, mobile apps, or visit our websites, pages or other digital assets. The information we collect in this manner may include: IP address, browser type, operating system, mobile device identifier, geographical area, referring URLs and information on actions taken or interaction with our digital assets. A “cookie” is a text file placed on a computer’s hard drive by a web server. A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, is a technology that helps us identify when content has been accessed or visited.

We use this information to improve priceless™ and our other online products and services by assessing how many users access or use our online products and services, which content, products and features of our online products and services most interest our visitors, what types of offers our customers like to see and how our online products and services perform from a technical point of view. For instance, we may use third-party web analytics services on our websites and mobile apps, such as those of Adobe Omniture. The analytics providers that administer these services use technologies such as cookies and web beacons to help us analyze how visitors use our websites and apps.

We, our service providers and partners may also collect information about you to provide you with content and advertising tailored to your individual interests. The information collected for these purposes may include details about things like the particular pages or ads you view on our websites and apps and the actions you take on our websites and apps.

We, our service providers and partners may collect certain information about you via automated means such as, social media tools, widgets or plug-ins to connect you to your social media accounts. These features may allow you to sign in through your social media account, share a link or post directly to your social media account. When you visit a website that contains such tools or plugins, the social media or other service provider may learn of your visit. However, your interactions with these tools are governed by the privacy policies of the corresponding social media platforms. As we do not control these third-parties’ data handling practices, we recommend that you review their privacy policies, terms of use, and license agreements (if any). For further details, please consult Section 7 (“Features and Links to Other Websites”) of this Privacy Notice.

In addition, some of our online products and services include advanced fraud prevention technology using behavioral-based data, such as keystroke timing, device accelerometer, scroll position and mouse-location.

Where required under applicable law, we obtain your consent prior to using the above automated means, and prior to sending you marketing communications, tailored content and advertisings.

Please see the “Your Rights and Choices” section of this Privacy Notice to learn about your choices.

Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, Mastercard does not respond to web browser-based DNT signals at this time. To learn more about browser tracking signals and DNT, visit http://www.allaboutdnt.com.

We may use Personal Information we obtain about you for the purposes to:

• Provide and administer the services, including offers, programs and promotions of Mastercard, financial institutions, merchants and partners, which may include the disclosure of your Personal Information to certain third parties including merchants on your behalf. 
• Determine eligibility to register for priceless™ and to receive certain offers in connection with your card type.
• Create and manage your priceless™ account, communicate with you and respond to your inquiries.
• Communicate with you in connection with priceless™ by email, phone, and/or SMS or other means. For example, we may contact you by email and/or at the phone number you provided at the time of purchase to fulfill or facilitate your use of the purchased Offer.  
• Protect against and prevent fraud, unauthorized transactions, claims and other liabilities.
• Send you marketing communications and deliver advertisements to you about our products, services, offers, programs and promotions of Mastercard, its issuers, acquirers, retailers and partners (including contests, sweepstakes and any other marketing activities).
• Provide you with personalized services, recommendations, ads and email communications from Mastercard, its issuers, acquirers, retailers and partners. For example, we may analyze your preferences, spending patterns, interests and behavior in order to provide you with personalized content and the most relevant offers, recommendations and email communications, based on your interaction with the priceless™, your online behavior and other Personal Information we may obtain about you. We will seek additional consent from you for this use, where required by law.
• Facilitate your interaction with us through social media.
• Process and fulfill purchases made on or through priceless™.
• Operate, evaluate and improve our business, and provide you with information and services (including by developing new products and services, such as new programs designed to make it easier for cardholders to make payments with a Mastercard Card based on information indicating what features would appeal to you and our customers, or products designed to improve the security of payment transactions; managing our communications; determining the effectiveness of our advertising; analyzing our products, services and websites; facilitating the functionality of our websites).
• Perform data analyses (including anonymization of Personal Information).
• Enforce our Terms of Use and our other legal rights.
• Comply with applicable legal requirements and industry standards and our policies.
• Perform auditing, research and analysis in order to maintain, protect and improve our services.

We may process your Personal Information for the above purposes when:

• You have consented to the use of your Personal Information;
• We need your Personal Information to provide you with the priceless™ program, services and products requested by you, or to respond to your inquiries;
• We have a legal obligation to use your Personal Information such as to prevent fraud in payment transactions;
• We or a third party, have a legitimate interest in using your Personal Information to ensure and improve the safety, security and performance of our products and services, and to protect against and prevent fraud.

We also may use your Personal Information in other ways for which we provide specific notice at the time of collection. We will seek additional consent for other uses, where required by law.

Where required under applicable law, we have carried out balancing tests for the data processing based on our or a third party’s legitimate interests to ensure that such legitimate interest is not overridden by your interests, fundamental rights or freedoms. For more information on our balancing tests, you may contact us as described in the “How to Contact Us” section below.

We will not subject you to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, unless you explicitly consented to the processing, the processing is necessary for entering into, or performance of a contract between you and Mastercard, or when we are legally required to use your Personal Information in this way, for example to prevent fraud.

If you provide us with any information or material relating to another individual, you should make sure that the sharing with us and our further use as described to you from time to time is in line with applicable laws, so for example you should duly inform that individual about the processing of her/his Personal Information and obtain her/his consent, as may be necessary under applicable laws.

We do not disclose Personal Information we collect about you, except as described in this Privacy Notice or otherwise disclosed to you at the time of the data collection. We do not sell Personal Information we collect about you, as defined by the California Consumer Privacy Act.

We transfer Personal Information globally within the Mastercard group of affiliated companies consistent with the terms of this Privacy Notice or as we otherwise disclose at the time the data is collected.  If you are located in the EEA or Switzerland, we will transfer your Personal Information in accordance with the Mastercard Binding Corporate Rules available here.

We may also share your Personal Information:

• With entities that partner with Mastercard or assist Mastercard in providing its products and services, such as merchants and alliance partners (including nonprofits) who fulfill your purchased Offer. For example, if you purchase a priceless™ experience to a restaurant, sports event, or an award show, we will disclose your Personal Information to the Offer provider merchant (e.g., restaurant) for the fulfillment of your Offer, or as otherwise necessary to provide you with the services. Such third parties may act as a data controller with respect to such data in order to provide you with additional services in connection with priceless™.
• With our service providers who perform services on our behalf for the purposes described in this Privacy Notice. We require these service providers by contract to only process Personal Information in accordance with our instructions and as necessary to perform services on our behalf or in compliance with applicable law. We also require them to safeguard the security and confidentiality of the Personal Information they process on our behalf by implementing appropriate technical and organizational security measures and confidentiality obligations binding employees accessing Personal Information.
• With third parties whose features (e.g. third-party cookies, widgets, plug-ins) are integrated in our products and services. For further details, please consult Section 7 (Features and Links to Other websites) of this Privacy Notice.
• With social media networks when you directly engage with those platforms. For further details, please consult Section 7 (Features and Links to Other Websites) of this Privacy Notice.
• With other third parties with your consent.
• As required under applicable law or legal process, or when we believe disclosure is necessary to protect individuals’ vital interests, to enforce our Terms of Use, prevent Mastercard against harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

In the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use Personal Information you have provided to us in a manner that is consistent with this Privacy Notice. Following such a sale or transfer, you may contact the entity to which we transferred your Personal Information with any inquiries concerning the processing of that information.

You have certain rights regarding the Personal Information we maintain about you and certain choices about what Personal Information we collect from you, how we use it, and how we communicate with you.

If you are located in California, we will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights, except where the different price or level of good or service is reasonably related to the value of the data that we receive from you. In some instances, we may not be able to provide you with the good or service that you request if you choose to exercise certain rights.

You can choose:

• Not to provide Personal Information to Mastercard by refraining from conducting payment transactions or from submitting Personal Information directly to us. When we collect Personal Information from you, we indicate whether and why it is necessary to provide it to us, as well as the consequences of failing to do so. If you do not provide Personal Information, you may not be able to benefit from the full range of the services, and we may not be able to provide you with our services if that information is necessary to provide you with them, or if we are legally required to collect it in relation to the provision of such product or service.
• To opt out of the collection and use of certain information, which we collect about you by automated means, when you visit our websites or use our apps. In certain jurisdictions, you can exercise your choice regarding the use of cookies and similar technologies via the Cookie Consent tool displayed in the bottom right corner of this website. Your browser may tell you how to be notified of and opt out of having certain types of cookies placed on your device. Note that without certain cookies you may not be able to use all of the features of our websites, apps or online services. 
• To opt out of certain uses of information, which we collect about you by automated means, when you visit third-party websites and interact with our ads. We may use service providers to serve ads on those third-party websites. These ads may be customized and served based on the use of data we and our partners have collected on our websites and apps. In addition, some of our service providers and partners may collect information about your online activities over time and across third-party websites to customize and serve these ads. Mastercard ads are sometimes delivered with icons that help consumers (i) learn more about how their data is being used and (ii) exercise choices they may have regarding the use of their data. Please click here or, where applicable, on the icon in our targeted ads to learn about your ability to opt out or limit the use of your browsing behavior for advertising purposes.
• To tell us not to send you marketing emails by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us as indicated below. You also may opt out of receiving marketing emails from Mastercard by clicking here.

Depending on the country in which you are located, you may have the right to:

• Request access to and receive information about the Personal Information we maintain about you, to update and correct inaccuracies in your Personal Information, to restrict or to object to the processing of your Personal Information, to have the information anonymized or deleted, as appropriate, or to exercise your right to data portability to easily transfer your Personal Information to another company. In addition, you may also have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work or where an incident took place.
• Withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.

Those rights may be limited in some circumstances by local law requirements. 

To update your preferences, ask us to remove your information from our mailing lists or submit a request to exercise your rights under applicable law, contact us as specified in the "How To Contact Us" section below.

We have developed Mastercard’s “My Data Center” portal to facilitate the exercise of your rights.

If we fall short of your expectations in processing your Personal Information or you wish to make a complaint about our privacy practices, please tell us because it gives us an opportunity to fix the problem. To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time and as required under applicable law.

Mastercard is a global business. We may transfer the Personal Information we collect about you to recipients in countries other than your country, including the United States, where we are headquartered. These countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your Personal Information to other countries, we will protect that information as described in this Privacy Notice, or as disclosed to you at the time of data collection.

We comply with applicable legal requirements providing adequate safeguards for the transfer of Personal Information to countries other than the country where you are located. In particular, we have established and implemented a set of Binding Corporate Rules (“BCRs”) that have been recognized by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally. A copy of our BCRs is available here. We may also transfer Personal Information to countries for which adequacy decisions have been issued, or use contractual protections for the transfer of Personal Information to third parties, such as the European Commission’s Standard Contractual Clauses or their equivalent under applicable law, or rely on third parties’ certification to the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks where applicable. You may contact us as specified in the “How to Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of the EEA.

The security of your Personal Information is important to Mastercard. We are committed to protecting the information we collect. We maintain reasonable administrative, technical and physical safeguards designed to protect the Personal Information you provide or we collect against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. We use SSL encryption on a number of our websites from which we transfer certain Personal Information.

We also take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

Our websites may provide links to other websites for your convenience and information. Our website may also contain certain features for which we partner with other entities. These entities may learn of your visit regardless of whether you use these features. These websites and features, which may include social networking sites and geo-location tools, operate independently from Mastercard, and are clearly identified as such. To the extent any linked websites or features you visit or use are not owned or controlled by Mastercard, we suggest that you review the privacy practices of the websites.

Mastercard offers you the possibility to share, link to, or mention things on social media about Mastercard’s products and services.  For example, you may “like” an offer via your Facebook account, or “tweet” an offer using Twitter. When you visit a website with a social media button, your browser establish a direct connection to that social media provider, and data concerning your visit, including IP address, is transferred to the social media provider. If you have an account with the social media provider, the provider may link your visit to your account, even if you are not logged into this account.

You may also choose to use certain features on our websites that can be accessed through, or for which we partner with, other entities that are not otherwise affiliated with Mastercard. These features, including geo-location tools, are operated by third parties and are clearly identified as such. Social media providers such as Facebook and Twitter, and these other third parties, are independent from Mastercard and do not necessarily share the same policy as Mastercard regarding the protection of privacy. Please verify their privacy notices if you decide to use their services and consult your social media account settings if you want to deactivate certain features.

This Privacy Notice may be updated periodically to reflect changes in our Personal Information practices. We will post a prominent notice on relevant websites to notify you of any significant or material changes to our Privacy Notice prior to them being effective and indicate at the top of the Notice when it was most recently updated. If we update our Privacy Notice, in certain circumstances, we may seek your consent.

If you have any questions, comments or complaints about this Privacy Notice and our privacy practices, or would like to update your privacy preferences, please email us at: privacyanddataprotection@mastercard.com or write to us at:

Global Privacy Office

Mastercard International Incorporated

2000 Purchase Street

Purchase, New York 10577

USA

If you are located in the EEA or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information on Mastercard’s “My Data Center” portal,  or email us at: privacyanddataprotection@mastercard.com, or write to us at:

EEA Data Protection Officer

Mastercard Europe SA

Chaussée de Tervuren 198A

B-1410 Waterloo

Belgium