Mastercard Campaign Specific Privacy Notice McLaren Team Priceless – UK, Germany and Bulgaria

1. Personal Information We May Collect

When you enter the Campaign, we collect (depending on your country and how you enter):

• Entry administration information such as your name, social media profile name and handle(s), email address (where collected), and a link/URL to your published entry video. We may also collect the content of messages you send to our social media accounts in connection with the Campaign.
• Assessment information such as eligibility checks (which may include reviewing publicly available information about you), internal judging notes and shortlist status, and the content of your entry (video, caption and hashtags).

If you are selected as a winner (or reserve winner) of the prize experience, we process:

• Contact and logistics information needed to deliver the prize experience in the UK, such as your full name, telephone number, email address and home address, and (where required for travel arrangements, including flights to/from the UK), nationality and/or passport details and travel itinerary information (for example, flights, airport pick up, hotel booking and transfers). We may also collect dietary requirements and/or accessibility requirements if you choose to provide them so we can accommodate your needs during the prize experience.
• Photos and videos captured during the prize experience by photographers and videographers engaged by Mastercard and/or its agencies, which may include your image/likeness and voice.
• Recording and promotional use of this content are an integral part of the prize experience and the Campaign concept. If you are selected as a winner, Mastercard and McLaren may use and publish this content for Campaign-related and promotional purposes (including on websites and social media) as part of delivering the prize experience and documenting the Campaign. Depending on your country, additional personality/image rights rules may apply to the publication of your image. As part of accepting the prize, winners will be asked to sign any required release/permission documentation covering the creation and promotional use of this content. Mastercard may consider reasonable requests to remove specific photos or videos from Mastercard-controlled channels in limited circumstances (for example, where a photo raises a safety concern). However, we may not be able to remove photos or videos in all cases (for example, where they have already been shared, reposted or otherwise distributed by third parties, or where we must keep records for legal, regulatory, audit or evidentiary purposes).
• Photos and videos may also be captured by our Team Priceless Captains (influencers and brand ambassadors) during permitted parts of the prize experience, and they may post content on their social media accounts.
• Please note that, during race weekend events and at certain venues, event organisers, broadcasters, venue operators and other attendees may also capture images or footage independently. Mastercard does not control this independent processing, which is subject to those third parties’ own terms and privacy notices.

If you contact us about the Campaign, we may collect:

• Records of our communications with you and any action we take on that basis.

2. How We May Use Your Personal Information

We may use your Personal Information for the purposes set out below.

3. How We Share Your Personal Information

We may share Personal Information with the categories of recipients below, where necessary to administer the Campaign, select winners and deliver the prize experience (including associated content creation).

• Service providers that act on our behalf (including marketing agencies, prize fulfilment and logistics suppliers, and production crews) – to support Campaign operations (for example, eligibility checks, judging support, winner notification, bookings and logistics, and content production and publication). These recipients act as processors and may only process Personal Information on Mastercard’s instructions. Where necessary for prize delivery, they may share limited winner information with third parties such as hotels, transport providers, restaurants and venues. Those third parties typically act as independent controllers and process Personal Information in accordance with their own privacy notices.
• McLaren Services Limited (“McLaren”) – to help deliver elements of the prize experience (for example, where McLaren hosts parts of the experience at McLaren controlled locations or facilitates access to certain experiences, subject to availability and permissions) and to support McLaren’s use of Campaign related content. McLaren acts as an independent controller when using Personal Information for its own purposes.
• Team Priceless Captains (influencers and brand ambassadors) – to capture and share behind the scenes Campaign content during permitted parts of the prize experience. Depending on the context, Captains may act on Mastercard’s behalf (for example, when capturing content for Mastercard channels) and/or act independently in relation to content they create for their own channels. Where Captains act independently, they act as independent controllers for their own processing.
• Social media platforms (Instagram and TikTok) – because entry content is published on these platforms and, depending on how you enter, we may communicate with you about your entry through these platforms (for example, via comments or direct messages). Instagram and TikTok act as independent controllers for processing Personal Information in connection with their services.
• Mastercard’s headquarters in the U.S., our affiliates and other entities within Mastercard’s group of companies – for internal administration and support purposes (including Campaign operations, compliance and reporting), and consistent with Section 5 (Data Transfers).

We may also disclose your Personal Information: (i) if required by law or legal process; (ii) in response to a request from a court, law enforcement authority, or government official; or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation into suspected or actual fraudulent or illegal activity.

4. Your Rights and Choices

Depending on your country, you may have the right or choice to:

• Opt out of some collection or uses of your Personal Information, including the use of cookies and similar technologies we control (such as on priceless.com), and the use of your Personal Information for marketing purposes in other contexts. This does not apply to Campaign winner Content where filming/photography and promotional use are an integral part of the prize experience.
• Access your Personal Information, obtain a copy of it, rectify it, restrict or object to its processing, or request its deletion, destruction or anonymisation.
• Receive the Personal Information you provided to us to transmit it to another company.
• Withdraw any consent provided, where we rely on consent as the legal basis for a specific processing activity.
• Where applicable, lodge a complaint with your relevant supervisory authority (for example, the UK Information Commissioner’s Office or your EEA supervisory authority).

These rights are not absolute and may be subject to limitations or exceptions under applicable law (for example, where we have compelling legitimate grounds to continue processing or where retention is required by law).

You, or a party authorised to act on your behalf, can exercise your rights on Mastercard’s My Data portal, or by contacting us using the details in Section 7 (email or post).

5. Data Transfers

Mastercard is a global business. We may transfer the Personal Information we collect about you to recipients in countries other than your country, including the United States, where we are headquartered. These countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your Personal Information, we will protect it as described in Mastercard’s Global Privacy Notice and this Privacy Notice.

We comply with applicable legal requirements to provide adequate safeguards for transfers of Personal Information. In particular, we have established and implemented Binding Corporate Rules (“BCRs”) that have been recognised by EEA and UK data protection authorities as providing an adequate level of protection to the Personal Information we process globally. A copy of our BCRs is available here.

We may also use other transfer mechanisms where permitted under applicable law, such as adequacy decisions, the European Commission’s Standard Contractual Clauses (or their equivalent under applicable law), or other legally recognised safeguards. Depending on your country, you may contact us as specified in the “How to Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of your jurisdiction.

6. How We Protect Your Personal Information

The security of your Personal Information is important to Mastercard. We are committed to protecting the information we collect. We maintain reasonable administrative, technical and physical safeguards designed to protect the Personal Information you provide or we collect against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use. We use SSL encryption on a number of our websites from which we transfer certain Personal Information.

In the event of a breach of our security safeguards, we will assess the extent of harm (if any) to individuals, and comply with reporting and notification obligations in accordance with the applicable law.

We also take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

Please note that for this Campaign, Personal Information is retained as follows:

• Entrant lists, judging records and winner fulfilment data are retained for up to 28 days after the prize experience ends and then deleted.
• Photos/videos may be retained for longer where needed for documentation and promotional use (and applicable retention requirements). Content published on third party platforms may remain available under those platforms’ terms.

In all cases, Personal Information will be retained only for as long as necessary for the purposes described above, unless we are required by applicable law to retain information for a longer period.

7. How to Contact Us

Mastercard Europe SA is the entity responsible for the processing of your Personal Information (or data controller). You may submit a request to exercise your rights via Mastercard’s My Data portal, email us at privacyanddataprotection@mastercard.com, or write to us at:

Europe Data Protection Officer
Mastercard Europe SA
Chaussée de Tervuren 198A
B-1410 Waterloo
Belgium