Mastercard Privacy Notice (Mascot Experiences)

This notice supplements the Priceless Global Privacy Notice and explains how Mastercard Europe SA (“Mastercard”) processes personal data once a child’s participation in a mascot experience taking place in Europe, such as an experience organised with UEFA or London City Lionesses, has been arranged (the “Mascot Experience”).

It applies to Mascot Experiences that take place in Europe, whether they are purchased, awarded through a promotion or prize draw, or made available in another way. It does not cover personal data processing that happens earlier to make an offer, arrange a booking or purchase, or run a promotion or prize draw. For information about that earlier processing, please see the Priceless Global Privacy Notice or any other privacy notice provided for the relevant booking, purchase, promotion or prize draw.

1. What this notice covers

This notice explains how Mastercard uses personal data for Mascot Experiences that take place in Europe. What we use, and how we use it, may depend on the particular experience.

• Some experiences include photos or filming by or for Mastercard. Others do not. Children may also appear in live broadcasts or official event photos taken by other organisations, for example during a player walk-on, anthem line-up or handshakes.
• Photos or filming by other organisations are not taken by or for Mastercard. Those organisations use personal data for their own purposes, and their own privacy information applies.

If Mastercard plans to take or arrange photos, video or audio, or otherwise use Images for its own purposes, we explain this below. We will also provide any extra information, consent form or acknowledgement needed for that use.

2. What information Mastercard may use

• Information about the child, such as their name, age, height, event allocation and other details needed for the Mascot Experience.
• Information about the child’s parent or guardian, such as their name, email address and booking or prize details.
• Photos, video or audio of the child (“Images”), together with basic event details such as the match, date and venue, where Mastercard takes, receives or uses Images for a Mascot Experience.
• A record of any acknowledgement, permission or consent given for Mastercard’s use of Images, including when and how it was given and what information was provided at the time.

Mastercard does not use children’s personal data for profiling or automated decision-making in this context.

3. How Mastercard uses personal data

Mastercard uses participation, contact and booking information to:

• arrange and manage the Mascot Experience, including checking eligibility, helping with access, communicating with parents or guardians and responding to questions or requests;
• work with event organisers, venues and trusted suppliers to deliver the Mascot Experience; and
• meet legal, safety, safeguarding, security, audit and compliance requirements.

Where Mastercard takes, receives or uses Images:

• Mastercard may use Images to help deliver the Mascot Experience and, where applicable, to provide related content or viewing access to the child’s parent or guardian.
• Mastercard may also use Images to communicate about the Mascot Experience and Mastercard’s related sponsorship or activities, including in internal communications, press or PR materials, presentations, sponsorship reporting, websites, social media or other marketing content.
• Mastercard may also re-share publicly available event content originally captured or published by third parties, such as public broadcast or media footage. This is separate from Mastercard taking or arranging Images itself.
• Mastercard does not use Images from every Mascot Experience. Before Mastercard takes or uses Images for marketing or promotional purposes, we will tell the parent or guardian what we plan to do and provide any additional information needed.
• Where Mastercard relies on consent, we will ask the parent or guardian to provide consent separately, for example through a consent form. Where an acknowledgement or permission is appropriate instead, we may ask the parent or guardian to complete a separate form.
• If consent is optional, saying no will not affect the child’s ability to take part in the Mascot Experience. If a particular type of photography or filming is part of the experience itself, we will make this clear before participation and explain how Mastercard uses the Images.
• Images used in communications may be seen internationally. Once content has been published or shared, other people may copy or redistribute it.
• Copyright and other intellectual property rights in Images belong to the party that creates them or its licensors. This notice does not transfer ownership of intellectual property rights.

Mastercard relies on the following lawful bases, depending on the processing:

• Legitimate interests to arrange and manage the Mascot Experience, communicate with parents or guardians, keep appropriate records, and support safety, safeguarding, security and audit activities. We balance these interests against the rights of children and parents or guardians.
• Consent where Mastercard asks for consent to take or use Images for a particular purpose, such as optional marketing or promotional use.
• Legal obligation where Mastercard must keep certain records or respond to lawful requests.
• Vital interests where information is needed to protect someone’s safety in an emergency.

4. Who Mastercard shares personal data with

• event organisers, host clubs, local organisers or venues where needed to arrange and deliver the Mascot Experience;
• trusted suppliers that support booking, communications, event delivery, security, safeguarding, image handling, content delivery or consent and acknowledgement management; and
• public authorities, regulators, courts or other parties where disclosure is required by law or needed to establish, exercise or defend legal claims.

Where Mastercard uses suppliers, they may process personal data only for the agreed services and must protect it appropriately.

5. Your choices and rights

You and your child have privacy rights in relation to the personal data Mastercard uses for the Mascot Experience. Parents or guardians may exercise rights on behalf of their child where applicable.

Where Mastercard relies on consent, consent may be withdrawn at any time by contacting us. This will not affect anything Mastercard did before consent was withdrawn. We may not be able to remove content that has already been printed, distributed or copied by others.

These rights include the right to access, correct, delete or restrict personal data, object to certain uses of personal data, and request portability where applicable. To make a request, contact us using the details in Section 7.

• Access: ask for a copy of the personal data we hold.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete data in certain cases.
• Restriction: ask us to limit how we use data in certain cases.
• Objection: object to certain uses where we rely on legitimate interests. We will assess the objection and respond in line with applicable law.
• Portability: request a copy of data in a usable format where applicable.

We may need to verify your identity and confirm your authority to act for your child before responding.

This notice only applies to personal data for which Mastercard is responsible. If another organisation is responsible for personal data, requests about that data should be sent to that organisation.

You also have the right to lodge a complaint with a data protection authority in Europe, for example in the country where the Mascot Experience takes place or where you live, work or believe your rights have been affected.

6. Where personal data may be used and how long we keep it

Mastercard may store personal data, or allow it to be accessed, outside the country where the Mascot Experience takes place. Where Mastercard uses Images in published communications, those Images may also be viewed internationally.

When required by law, Mastercard uses appropriate safeguards for international transfers. These may include the UK International Data Transfer Agreement, the EU Standard Contractual Clauses or another legally recognised transfer mechanism. You can contact us for more information.

Mastercard keeps personal data only for as long as needed for the purposes described in this notice and in accordance with applicable retention requirements.

• Participation, contact, booking, consent and acknowledgement records may be kept for as long as needed to administer the Mascot Experience, handle questions or claims, and meet legal, safeguarding, security, insurance, contractual, audit and compliance requirements.
• Where Mastercard uses Images, any additional information or consent form provided for the particular use may explain the relevant retention period.

If you contact us with a question or request, we will review it and respond in line with applicable law.

7. How to contact us

For Mascot Experiences covered by this notice, Mastercard Europe SA is the controller for Mastercard’s processing described in this notice. To ask questions or exercise rights, email privacyanddataprotection@mastercard.com or use Mastercard’s “My Data” portal where available.

Data Protection Officer
Mastercard Europe SA
Chaussée de Tervuren 198A
B-1410 Waterloo
Belgium