For the purpose of this Privacy Notice, unless otherwise specified, “Personal Information” means any information relating to an identified or identifiable individual. In connection with your participation in Mastercard’s Talent Community, we obtain Personal Information relating to you from various sources, as described below.

“Processing” means any operation or set of operations performed upon Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing will be carried out on paper and by electronic means.

Where applicable, we indicate whether your Personal Information is required, as well as the impact if you fail to provide it. If You do not provide Personal Information when required, you may not be able to participate in the Talent Community and we may not be able to contact you in relation to events and future career opportunities.

The following types of Personal Information may be collected and Processed by the Company or on behalf of the Company, in so far as permitted under applicable law:

a.   Personal Information Provided by You

When you register for the Talent Community and provide your consent to receive personalized communications and alerts regarding job opportunities and recruiting events at Mastercard, we ask you to provide certain Personal Information, such as your name, email address, phone number, location, area(s) of interest, LinkedIn profile URL, sector experience, CV/resume, and any other additional information you decide to provide (such as information included in your CV/resume).

We may keep your Personal Information for as long as permitted under applicable law and in accordance with our data retention policies (as described further below in the section “How We Protect Your Personal Information”).

If you provide additional information to us at a job or career fair, recruiting or professional event, conference or other in-person or virtual occasion, we may contact you and ask your consent to join our Talent Community so that we can send you personalized communications and job opportunities.

b.   Personal Information Provided by Third Parties

You may provide information to recruiters, associations, professional organizations, schools or universities, or job boards.

You may also provide information on third party job websites and/or social media websites, including posts, articles, comments, reviews, photos, which you allow to be shared with prospective employers and/or make publicly available. Mastercard does not control the collection, use, disclosure or transfer of personal information on such third-party websites or the privacy settings available to you on those third-party websites related to the sharing of your personal information with prospective employers.

c.   Personal Information Obtained from Your Interactions with the Mastercard Careers Website

When you visit our Careers site, we, our service providers and partners may collect certain information about you via automated means such as Internet or other electronic network activity information, cookies, and web beacons. The Internet and/or Device Information we collect in this manner may include: IP address, browser type, operating system, mobile device identifier, geographical area, referring URLs and information on actions taken or interaction with our digital assets. A “cookie” is a text file placed on a computer’s hard drive by a web server. A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, is a technology that helps us identify when content has been accessed or visited.

We, our service providers and partners use essential cookies to make the site work properly. These cookies cannot be disabled because they are needed for core functions like login, security, fraud prevention, network management, and accessibility. Essential cookies do not always involve personal data processing. When they do, the legal basis is that they are necessary for the site to function so you can view it. You can block these cookies in your browser, but doing so may affect how the site works.

In addition, based on your choices in the cookie banner and (where required by law) with your consent, we may drop non-essential cookies for analytics, performance, or marketing purposes. Where we do, we use this information to improve our website by assessing how many users access or use our website, which content most interests our visitors, and how our sites perform from a technical point of view. For instance, we may use third-party web analytics services on our websites and mobile apps, such as those of Adobe Analytics. The analytics providers that administer these services use technologies such as cookies and web beacons to help us analyze how visitors use our websites and apps.

We, our service providers and partners may also collect information about you to provide you with content and advertising tailored to your individual interests based on inferences drawn from Personal Information. The information collected for these purposes may include Internet or other electronic network activity information, such as details about things like the particular pages or ads you view on our websites and apps and the actions you take on our websites and apps.

We, our service providers and partners may collect certain information about you via automated means such as, social media tools, widgets or plug-ins to connect you to your social media accounts. These features may allow you to sign in through your social media account, share a link or post directly to your social media account. When you visit a website that contains such tools or plugins, the social media or other service provider may learn of your visit. However, your interactions with these tools are governed by the privacy policies of the corresponding social media platforms. As we do not control these third-parties’ data handling practices, we recommend that you review their privacy policies, terms of use, and license agreements (if any).

We use personal Information we obtain about you for the purposes set out below. Depending on the country in which you are located, we will only process your Personal Information when we have a legal basis for the processing as identified in the table below.

Where required under applicable law, we have carried out balancing tests for the data processing based on our or a third party’s legitimate interests to ensure that such legitimate interest is not overridden by your interests, fundamental rights or freedoms. For more information on our balancing tests, you may contact us as described in the “How to Contact Us” section below.

You have certain rights regarding the Personal Information we maintain about you and certain choices about what Personal Information we collect from you, how we use it, and how we communicate with you.

Depending on the country in which you are located, you may have the following rights:

• Opt out of the collection and use of certain information, which we collect about you by automated means, when you visit our website. In certain jurisdictions, you can exercise your choice regarding the use of cookies and similar technologies by clicking on the ‘Manage cookies’ banner displayed in the bottom right corner of Mastercard Careers websites. Your browser may tell you how to be notified of and opt out of having certain types of cookies placed on your device. Note that without certain cookies you may not be able to use all of the features of our websites, apps or online services.

• Right of access: You have the right to access your Personal Information and request a copy of it. Mastercard may choose to limit access to Personal Information where: the disclosure would violate the rights of other Individuals; it relates to an ongoing investigation of wrongdoing and disclosure could compromise the investigation; or Mastercard is otherwise authorized to limit or deny such access under applicable law.

• Right to rectification: You have the right to rectify your Personal Information that is inaccurate or incomplete.

• Right to object: You may object to certain types of Processing of your Personal Information. We will reasonably accommodate such objections, as appropriate, and if granted, Mastercard will no longer Process your Personal Information unless we have compelling legitimate and lawful grounds to Process it. Mastercard will not subject Individuals to any disciplinary action for objecting to the Processing of Personal Information.

• Right to deletion: You may ask us to delete your Personal Information in specific cases such as when: we no longer need that information; You withdraw your consent to the Processing and we do not have any other legal ground for the Processing; your Personal Information has been Processed unlawfully; or when deletion is required by law.

• Right to restriction: You may request that we limit the way in which we Process your Personal Information where (i) You contest the accuracy of your Personal Information; (ii) the Processing is unlawful and You do not want your Personal Information deleted; (iii) we no longer need your Personal Information for the Processing, but You request we retain it in anticipation of a potential legal claim; or (iv) You objected to the Processing and we are reviewing whether we have an overriding interest to keep Processing the Personal Information.

• Right to withdraw consent: Where Mastercard relies on consent to Process Personal Information, You have the right to withdraw consent at any time, without affecting the lawfulness of Processing before the consent withdrawal.

• Right to data portability: You may also have the right to data portability, which means the ability to easily transfer your Personal Information to another company, when You provided your Personal Information directly to us, and where the Processing is based on your consent or is necessary for the performance of a contract.

• Right to lodge a complaint: You have the right to lodge a complaint with your relevant supervisory authority or regulator of your habitual residence, where Your place of work is located, or where the alleged infringement took place.

If you reside in the United States, you may have additional rights as described in our U.S. Privacy Addendum.

Please be aware, that if You exercise your right to object or your rights of restriction or deletion, or if You decline to share certain information with us, we may not be able to assess your suitability for future job opportunities. Also, some of these rights may be limited in certain circumstances by local law.

You can exercise your rights by contacting us, as described in the “How To Contact Us” section below.

Mastercard does not intend to or knowingly collect information from persons younger than the age of eighteen (18) or the age of majority to the extent it differs under applicable law. If we learn that we have inadvertently collected information from a person younger than the age of majority, we will take commercially reasonable efforts to delete that information.

The security of your Personal Information is important to Mastercard. We are committed to protecting the information we collect. We maintain reasonable administrative, technical and physical safeguards designed to protect the Personal Information you provide or we collect against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. We use SSL encryption on a number of our websites from which we transfer certain Personal Information.

In the event of a breach of our security safeguards, we will assess the extent of harm (if any) to individuals, and comply with reporting and notification obligations in accordance with the applicable law.

We also take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period.

When determining the retention period, we take into account various criteria such as the nature and length of our relationship with You, business needs, statutory retention periods and any retention necessary to anticipate legal actions in accordance with any applicable statute of limitations. The periods are set forth in Mastercard retention policies per country which reflect local legal requirements.

Mastercard is a global business. We may transfer the Personal Information we collect about you to recipients in countries other than your country, including the United States, where we are headquartered. These countries may not have in place the same data protection laws as the country in which you initially provided the information. When we transfer your Personal Information to other countries, we will protect that information as described in this Privacy Notice or as disclosed to you at the time of data collection.

We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located. In particular, we have established and implemented BCRs that have been recognized by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally. A copy of our EEA BCRs is available here. We equally rely on UK BCRs to transfer Personal Information outside of the United Kingdom. A copy of our UK BCRs is available here.

We may also transfer Personal Information to countries for which adequacy decisions have been issued (see list of countries for which the European Commission has issued an adequacy decision here, see list of countries which the Swiss Federal Council has determined to provide for adequate data protection legislation here), use contractual protections for the transfer of Personal Information to third parties, such as the European Commission’s Standard Contractual Clauses or their equivalent under applicable law, or rely on other data transfer mechanisms where applicable. Depending on your country, you may contact us as specified in the “How To Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of your jurisdiction.

Additionally, Mastercard’s privacy practices, described in this Global Privacy Notice, comply with the APEC Cross Border Privacy Rules System and the Global CBPR Forum. These systems provide a framework for organizations to ensure protection of Personal Information transferred among participating APEC economies. More information is available on the APEC framework can be found here and on the Global CBPR Forum here.

If you are located in mainland China, you understand that we may transfer the Personal Information we collect about you to recipients in countries or regions other than mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and to other affiliates as listed here. When we conduct international transfers of Personal Information, we will comply with requirements stipulated under applicable laws. By participating in the Talent Community, you will be deemed as having consented to our cross-border sharing of your Personal Information to recipients in countries or regions other than mainland China in accordance with this Privacy Notice.

You may choose to use certain features available via the Talent Community that are owned and operated independently by some of our partners, or You may click on links to third party websites for your convenience and information. These features, which may include social networking services, geographic location tools, and other apps and websites, may operate independently from Mastercard. They may have their own privacy notices or policies, which we strongly suggest you review. To the extent any features or linked websites you visit are not owned or operated by Mastercard, we are not responsible for these websites’ content, use, or privacy practices.

Mastercard may from time to time make changes to this Privacy Notice to reflect changes in its legal or regulatory obligations, or to reflect changes in the manner in which we Process your Personal Information or for any other reason we deem appropriate. We will notify you of any significant or substantial changes to our Privacy Notice.

If you have any questions, comments or complaints about this Privacy Notice and our privacy practices, or would like to update your privacy preferences, please email us at: privacyanddataprotection@mastercard.com or write to us at:

Global Privacy Office
Mastercard International Incorporated
2000 Purchase Street
Purchase, New York 10577
USA

If you are located in California, to exercise your rights under the CCPA, you may submit your request by emailing us at: privacyanddataprotection@mastercard.com, or call our toll-free number: 1-833-244-4084. For more information on exercising these rights, please see our U.S. Privacy Addendum.

If you are located in Quebec, Canada, you may contact our Data Protection Officer at privacyanddataprotection@mastercard.com. For inquiries about your Mastercard card and your purchase, you should contact your financial institution or merchant. More information about how to contact them can be found on their respective websites.

If you are located in the EEA, the UK, or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information (or data controller). You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com, or write to us at:

Europe Data Protection Officer
Mastercard Europe SA
Chaussée de Tervuren 198A
B-1410 Waterloo
Belgium

If you are located in Brazil, Mastercard Brasil Soluções de Pagamento Ltda. is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com or write to us at:

Brazil Data Protection Officer
Mastercard Brasil Soluções de Pagamento Ltda.
Avenida das Nações Unidas, 14.171, 20º andar, Crystal Tower
São Paulo/SP
Brasil
CEP 04794-000

If you are located in Asia Pacific (excluding mainland China and South Korea), Middle East or Africa, Mastercard Asia Pacific Pte. Ltd. is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com, calling our toll-free number listed here, or write to us at:

Asia Pacific, Middle East and Africa Data Protection Officer
Mastercard Asia/Pacific Pte Ltd
3 Fraser Street, DUO Tower, Level 17
Singapore 189352

If you are located in South Africa, you may also send your complaint to the South African Information Regulator at the following:

Email: complaints.IR@justice.gov.za

Post: PO Box 31533, Braamfontein, Johannesburg, 2017

Website: https://www.justice.gov.za/inforeg/

If you are located in mainland China, Mastercard Shanghai Business Consulting Ltd. is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com or writing to us at:

China Data Protection Officer
Room 2907-14, Part of 29/F Tower 2
Shanghai IFC, 8 Century Avenue
China (Shanghai) Pilot Free Trade Zone

If you are located in South Korea, Mastercard International Korea Co., Ltd. is designated as our domestic representative for the processing of your Personal Information. The entity is led by the Korea Division President, with the Korea business address here. You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com, or calling our toll-free number listed here.

LAST UPDATED: August 26, 2026

Application

This U.S. Privacy Addendum supplements the information contained in the Global Mastercard Talent Community Privacy Notice for California residents, as indicated below.

Additional disclosures for California residents

If you are a California resident from whom we collect Personal Information as a business under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) (“CCPA”), you may rely on the Global Mastercard Talent Community Privacy Notice and the additional information below.

For the purpose of this section for California residents, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the CCPA. Personal Information does not include information that is publicly available, deidentified, or aggregated (as those terms are defined in the CCPA) or otherwise excluded from the scope of the CCPA.

1. Categories of Personal Information about you that we Collect and Disclose

Below are the categories of Personal Information (as defined by the CCPA) we have collected and disclosed for a business purpose in the preceding 12 months.

A. Identifiers. Examples: contact information (e.g., name, postal address, telephone number), unique personal identifiers or numbers, online identifier, device identifier(s), internet protocol address, email address, and similar identifiers. We may also associate information that you submit to us, such as content on our social media pages, with your identifiers.

B. Categories of Personal Information in Cal. Civ. Code Section 1798.80(e). Examples: Name, address, telephone number, education, employment, employment history, email address and IP address.

F. Internet or Other Electronic Network Activity Information. Examples: Cookie and web beacon data, IP address, and pages viewed and actions you take on our online properties and apps.

H. Sensory Information. Examples: Photographs (if you include them in your CV/resume or LinkedIn profile).

I. Professional or Employment-Related Information. Examples: Professional information such as job title, department, and business unit. Additionally, information you provide as part of your enrollment in the Talent Community, e.g., contact information and employment history.

K. Inferences Drawn from Personal Information. Examples: Personal characteristics and interests.

2. Sources of Collection of Personal Information

We have collected Personal Information from the following categories of sources:

• You/Your Devices: You or your devices directly, such as when you enroll in the Talent Community in person (such as at a career fair) or online, or when you interact with our Careers site.
• Social Networks, such as LinkedIn.
• Third Parties: such as recruitment agencies, organizers of recruitment events, professional organizations, schools or universities, or job boards.
• Public: Publicly accessible sources.


3. Use of your Personal Information

We collect, use, and disclose your Personal Information in accordance with the specific business and commercial purposes described in Section 2 of the Global Mastercard Talent Community Privacy Notice, entitled “How We May Use Your Personal Information”.

4. Disclosure of your Personal Information to Service Providers, Contractors, and Third Parties

With respect to the categories of Personal Information identified above in Section 1, we disclose your Personal Information to the following categories of service providers, contractors, or third parties:

• Advertising Providers: Advertising technology companies, such as advertising networks. Personal Information we disclose: Identifiers; Internet or Other Electronic Network Activity; Geolocation Data.
• Analytics Providers: Companies that help us analyze and improve our online properties. Personal Information we disclose: Identifiers; Internet or Other Electronic Network Activity; Geolocation Data.
• Mastercard Personnel: members of our internal departments to the extent that they are involved in the Talent Community. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Internet or Other Electronic Network Activity Information; Sensory Information, Professional or other Employment-related Information, or Inferences Drawn from Personal Information.
• Affiliates. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Internet or Other Electronic Network Activity Information; Sensory Information, Professional or other Employment-related Information, or Inferences Drawn from Personal Information.
• Vendors: Vendors and service providers. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Internet or Other Electronic Network Activity Information; Sensory Information, Professional or other Employment-related Information, or Inferences Drawn from Personal Information.
• Third Parties as Legally Required: Third parties as required by law and similar disclosures. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); or Professional or other Employment-related Information.
• Third Parties in Merger/Acquisition: Third parties in connection with a merger, sale, or asset transfer. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); or Professional or other Employment-related Information.



We do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit under the CCPA.

5. Sale and Sharing of your Personal Information with Other Parties

Mastercard does not sell your Personal Information for monetary consideration. However, some of the cookies and other technologies used on this website, which may include pixel tags, SDKs and web beacons (collectively “Cookies”), may disclose information in a way that is considered a “sale” or “share” (for cross-context behavioral advertising (“CCBA”)) as those terms are defined under the CCPA. These Cookies may use or share Personal Information with third parties to provide you with a personalized marketing experience and serve targeted advertisements based on your browsing habits and activity across other sites.

We may sell or share, and have sold and shared in the preceding 12 months, the following categories of Personal Information for cross-context behavioral advertising purposes:

• Identifiers
• Internet or Other Electronic Network Activity Information, and
• Geolocation Data (e.g. your city, state or country or your IP address)



(each, as those categories are described in section 1 above (Categories of Personal Information about you that we Collect and Disclose)). The categories of Personal Information above are sold and shared, and have been sold and shared in the preceding 12 months, with third parties including Advertising Providers and Analytics Providers.

We do not have actual knowledge that we sell or share Personal Information of consumers under 16 years of age.

Retention

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as, the nature and length of our relationship with you, the impact on your application if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

6. Your Privacy Rights

If you are a California resident, you have the rights as set out in this section and may exercise them by following this guidance.

Your rights:

Right to Know and Access. You may submit a verifiable request for (as applicable to you as a member of the Mastercard Talent Community) information regarding the:

• what categories of Personal Information we have collected about you;
• the categories of sources from which Personal Information is collected;
• the business or commercial purpose for collecting, selling, or sharing Personal Information;
• the categories of third parties to whom we disclose Personal Information; and
• the specific pieces of Personal Information we have collected about you.

Right to Delete. Subject to certain exceptions, you may submit a verifiable request that we delete Personal Information about you that we have collected from you. We maintain a record of such requests as required by the CCPA.

Right to Correct. You have the right to correct inaccurate Personal Information that we maintain about you.

Verification. Requests for access, deletion, or correction of Personal Information are subject to our ability to reasonably verify your identity in light of the information requested pursuant to relevant CCPA requirements, limitations, and regulations. Mastercard is committed to secure personal information. When consumers exercise their privacy rights via email, we verify their identity by using their contact information (email and/or name and surname).

Right to Not be Retaliated Against. You have the right not to be retaliated against for the exercise of your CCPA privacy rights, subject to certain limitations. We will not retaliate against you for exercising your CCPA privacy rights.

Right to Opt Out. You have the right to opt out of the sale and sharing of your Personal Information for purposes of CCBA. To opt out, please click the “Your Privacy Choices” link located here or in the footer of our website and follow the instructions provided.

California requires businesses to process Global Privacy Control (“GPC”) signals, which may also be referred to as opt-out preference signals. To use the GPC signal, you can download an internet browser or a plugin to use on your current internet browser and follow applicable instructions to enable the GPC. Find more information on how to do this at https://globalprivacycontrol.org/. If we receive a GPC signal, we will treat it as a request to opt out of any sale and sharing of your Personal Information for CCBA purposes for the specific device and browser you use to transmit the GPC signal. We will store a preference cookie on your browser to honor this choice; if you or your browser clear or expire cookies, you will need to opt out again for the device and browser, such as by transmitting a GPC signal on your visit.

How to Submit Data Subject Rights Requests as a Talent Community member:

To exercise your rights under the CCPA, please submit your request to privacyanddataprotection@mastercard.com, or call our toll-free number: 1-833-244-4084.

Authorizing an Agent. If you are acting as an authorized agent to make a request to know, delete, correct, or opt out on behalf of a California resident, you may email us at privacyanddataprotection@mastercard.com, or call our toll-free number: 1-833-244-4084. Please note that we will require you to attach a written authorization signed by the resident whose Personal Information will be subject to the request.