For the purpose of this Privacy Notice, unless otherwise specified, “Personal Information” means any information relating to an identified or identifiable individual. In connection with your participation in Mastercard’s Talent Community, we obtain Personal Information relating to you from various sources, as described below.

“Processing” means any operation or set of operations performed upon Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing will be carried out on paper and by electronic means.

Where applicable, we indicate whether your Personal Information is required, as well as the impact if you fail to provide it. If You do not provide Personal Information when required, you may not be able to participate in the Mastercard Talent Community and we may not be able to contact you in relation to events and future career opportunities.

The following types of Personal Information may be collected and Processed by the Company or on behalf of the Company, in so far as permitted under applicable law:

a.   Personal Information Provided by You

When you subscribe to Mastercard’s Talent Community and provide your consent to receive personalized communications and alerts regarding job opportunities and recruiting events at Mastercard, we ask you to provide certain Personal Information, such as your name, email address, phone number, location, area of interest, LinkedIn profile URL, sector experience, CV/resume and any other additional information you decide to provide (such as information included in your CV/resume).

We may keep your Personal Information for as long as permitted under applicable law and in accordance with our data retention policies (as described further below in the section “How We Protect Your Personal Information”).

If you provide additional information to us at a job or career fair, recruiting or professional event, conference or other in-person or virtual occasion, we may contact you and ask your consent to join our Talent Community so that we can send you personalized communications and job opportunities.

b.   Personal Information Provided by Third Parties

You may provide information to recruiters, associations, professional organizations, schools or universities, or job boards.

You may also provide information on third party job websites and/or social media websites, including posts, articles, comments, reviews, photos, which you allow to be shared with prospective employers and/or make publicly available. Mastercard does not control the collection, use, disclosure or transfer of personal information on such third-party websites or the privacy settings available to you on those third-party websites related to the sharing of your personal information with prospective employers.

c.   Personal Information Obtained from Your Interactions with the Mastercard Talent Community Website

When you visit our websites, we may collect certain information via automated means such as cookies and similar technologies. This includes your IP address, information on actions you have taken on the website, dates and times of those actions, and methods of accessing the website. We use this information to improve the website by assessing how many users access or use our website, which content, products, and features of our website most interest our visitors and how our service performs from a technical point of view.

We ask for your consent to place cookies and similar technologies that aren’t strictly necessary for making the website work. You can manage your cookie preferences at any time using the ‘Manage Cookies’ tool located at the bottom of the webpage. Your browser may also tell you how to be notified or and opt out of having certain types of cookies placed on your device. Please note, however, that without certain cookies you may not be able to use all the features of our websites, apps or online services.

We use personal Information we obtain about you for the purposes set out below. Depending on the country in which you are located, we will only process your Personal Information when we have a legal basis for the processing as identified in the table below.

Where required under applicable law, we have carried out balancing tests for the data processing based on our or a third party’s legitimate interests to ensure that such legitimate interest is not overridden by your interests, fundamental rights or freedoms. For more information on our balancing tests, you may contact us as described in the “How to Contact Us” section below.

You have certain rights regarding the Personal Information we maintain about you and certain choices about what Personal Information we collect from you, how we use it, and how we communicate with you.

Depending on the country in which you are located, you may have the following rights:

• Right of access: You have the right to access your Personal Information and request a copy of it. Mastercard may choose to limit access to Personal Information where: the disclosure would violate the rights of other Individuals; it relates to an ongoing investigation of wrongdoing and disclosure could compromise the investigation; or Mastercard is otherwise authorized to limit or deny such access under applicable law.

• Right to rectification: You have the right to rectify your Personal Information that is inaccurate or incomplete.

• Right to object: You may object to certain types of Processing of your Personal Information. We will reasonably accommodate such objections, as appropriate, and if granted, Mastercard will no longer Process your Personal Information unless we have compelling legitimate and lawful grounds to Process it. Mastercard will not subject Individuals to any disciplinary action for objecting to the Processing of Personal Information.

• Right to deletion: You may ask us to delete your Personal Information in specific cases such as when: we no longer need that information; You withdraw your consent to the Processing and we do not have any other legal ground for the Processing; your Personal Information has been Processed unlawfully; or when deletion is required by law.

• Right to restriction: You may request that we limit the way in which we Process your Personal Information where (i) You contest the accuracy of your Personal Information; (ii) the Processing is unlawful and You do not want your Personal Information deleted; (iii) we no longer need your Personal Information for the Processing, but You request we retain it in anticipation of a potential legal claim; or (iv) You objected to the Processing and we are reviewing whether we have an overriding interest to keep Processing the Personal Information.

• Right to withdraw consent: Where Mastercard relies on consent to Process Personal Information, You have the right to withdraw consent at any time, without affecting the lawfulness of Processing before the consent withdrawal.

• Right to data portability: You may also have the right to data portability, which means the ability to easily transfer your Personal Information to another company, when You provided your Personal Information directly to us, and where the Processing is based on your consent or is necessary for the performance of a contract.

• Right to lodge a complaint: You have the right to lodge a complaint with the supervisory authority of your habitual residence, of where Your place of work is located or where the alleged infringement took place.

Please be aware, that if You exercise your right to object or your rights of restriction or deletion, or if You decline to share certain information with us, we may not be able to assess your suitability for future job opportunities. Also, some of these rights may be limited in certain circumstances by local law.

You can exercise your rights by contacting us, as described in the “How To Contact Us” section below.

Mastercard does not intend to or knowingly collect information from persons younger than the age of sixteen (16). If we learn that we have inadvertently collected information from a person younger than the age of 16, we will take commercially reasonable efforts to delete that information.

Mastercard maintains appropriate administrative, technical, and physical safeguards to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information transmitted, stored or otherwise Processed. More information about our security policies is available upon request.

Your Personal Information is not kept for longer than necessary for the original purposes for which it was collected. We take measures to delete your Personal Information or keep it in a form that does not permit identifying You when such information is no longer necessary for the purposes for which we Process it, unless we are required by law to keep this information for a longer period.

When determining the retention period, we take into account various criteria such as the nature and length of our relationship with You, business needs, statutory retention periods and any retention necessary to anticipate legal actions in accordance with any applicable statute of limitations. The periods are set forth in Mastercard retention policies per country which reflect local legal requirements.

For further guidance on the applicable retention periods, please contact us as described in the “How To Contact Us” section below.

Mastercard is a global business. We may transfer the Personal Information we collect about you to recipients in countries other than your country, including the United States, where we are headquartered. These countries may not have in place the same data protection laws as the country in which you initially provided the information. When we transfer your Personal Information to other countries, we will protect that information as described in this Privacy Notice or as disclosed to you at the time of data collection.

We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located. In particular, we have established and implemented BCRs that have been recognized by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally. We equally rely on UK BCRs to transfer Personal Information outside of the United Kingdom. A copy of our BCRs are available here.

We may also transfer Personal Information to countries for which adequacy decisions have been issued (see list of countries for which the European Commission has issued an adequacy decision here), use contractual protections for the transfer of Personal Information to third parties, such as the European Commission’s Standard Contractual Clauses or their equivalent under applicable law, or rely on other data transfer mechanisms where applicable. Depending on your country, you may contact us as specified in the “How To Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of your jurisdiction.

If you are located in mainland China, you understand that we may transfer the Personal Information we collect about you to recipients in countries or regions other than mainland China, including Mastercard International Incorporated in the United States, Mastercard Asia/Pacific Pte. Limited in Singapore and to other affiliates as listed here. When we conduct international transfers of Personal Information, we will comply with requirements stipulated under applicable laws. By participating in the Talent Community, you will be deemed as having consented to our cross-border sharing of your Personal Information to recipients in countries or regions other than mainland China in accordance with this Privacy Notice.

You may choose to use certain features available via the Talent Community that are owned and operated independently by some of our partners, or You may click on links to third party websites for your convenience and information. These features, which may include social networking services, geographic location tools, and other apps and websites, may operate independently from Mastercard. They may have their own privacy notices or policies, which we strongly suggest you review. To the extent any features or linked websites you visit are not owned or operated by Mastercard, we are not responsible for these websites’ content, use, or privacy practices.

Mastercard may from time to time make changes to this Privacy Notice to reflect changes in its legal or regulatory obligations, or to reflect changes in the manner in which we Process your Personal Information or for any other reason we deem appropriate. We will notify you of any significant or substantial changes to our Privacy Notice.

If you have any questions, comments or complaints about this Privacy Notice and our privacy practices, or would like to update your privacy preferences, please email us at: privacyanddataprotection@mastercard.com or write to us at:

Global Privacy Office
Mastercard International Incorporated
2000 Purchase Street
Purchase, New York 10577
USA

If you are located in California, to exercise your rights under the CCPA, you may submit your request by emailing us at: privacyanddataprotection@mastercard.com, or call our toll-free number: 1-833-244-4084.

If you are located in the EEA, Mastercard Europe SA is the entity responsible for the processing of your Personal Information (or data controller). You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com, or write to us at:

Europe Data Protection Officer
Mastercard Europe SA
Chaussée de Tervuren 198A
B-1410 Waterloo
Belgium

If you are located in Brazil, Mastercard Brasil Soluções de Pagamento Ltda. is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com or write to us at:

Brazil Data Protection Officer
Mastercard Brasil Soluções de Pagamento Ltda.
Avenida das Nações Unidas, 14.171, 20º andar, Crystal Tower
São Paulo/SP
Brasil
CEP 04794-000

If you are located in Asia Pacific (excluding mainland China), Middle East or Africa, Mastercard Asia Pacific Pte. Ltd. is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com or write to us at:

Asia Pacific, Middle East and Africa Data Protection Officer
Mastercard Asia/Pacific Pte Ltd
3 Fraser Street, DUO Tower, Level 17
Singapore 189352

If you are located in mainland China, Mastercard Shanghai Business Consulting Ltd. is the entity responsible for the processing of your Personal Information. You may submit your request to exercise your rights to your Personal Information by emailing us at: privacyanddataprotection@mastercard.com or writing to us at:

China Data Protection Officer
Room 2907-14, Part of 29/F Tower 2
Shanghai IFC, 8 Century Avenue
China (Shanghai) Pilot Free Trade Zone

LAST UPDATED: March 16, 2023

Application

This U.S. Privacy Addendum supplements the information contained in the Global Mastercard Talent Community Privacy Notice for California residents, as indicated below.

Additional disclosures for California residents

If you are a California resident from whom we collect Personal Information as a business under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) (“CCPA”), you may rely on the Global Mastercard Talent Community Privacy Notice and the additional information below.

For the purpose of this section for California residents, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the CCPA. Personal Information does not include information that is publicly available, deidentified, or aggregated (as those terms are defined in the CCPA) or otherwise excluded from the scope of the CCPA.

1. Categories of Personal Information about you that we Collect and Disclose

The chart below provides the categories of Personal Information (as defined by the CCPA) we have collected and disclosed for a business purpose.

Category	We Collect	We Disclose
A. Identifiers. Examples: contact information (e.g., name, postal address, telephone number), unique personal identifiers or numbers, online identifier, device identifier(s), internet protocol address, email address, and similar identifiers. We may also associate information that you submit to us, such as content on our social media pages, with your identifiers.	Yes	Yes
B. Categories of Personal Information in Cal. Civ. Code Section 1798.80(e). Examples: Name, address, telephone number, email address and IP address.	Yes	Yes
C. Internet or Other Electronic Network Activity Information. Examples: Cookie and web beacon data, IP address, and pages viewed and actions you take on our online properties and apps.	Yes	Yes
D. Sensory Information. Examples: Photographs (if you include them in your CV/resume or LinkedIn profile).	Yes	Yes
E. Professional or Employment-Related Information. Examples: Professional information such as job title, department, and business unit. Additionally, information you provide as part of your enrollment in the Talent Community, e.g., contact information and employment history.	Yes	Yes
F. Inferences Drawn from Personal Information. Examples: Personal characteristics and interests.	Yes	Yes




2. Sources of Collection of Personal Information

We have collected Personal Information from the following categories of sources:

• You/Your Devices: You or your devices directly.
• Social Networks, such as LinkedIn.
• Third Parties: such as former employers, educational institutions, background check agencies, credit reporting agencies, and independent service providers acting as a business (always in compliance with applicable law).
• Public: Publicly accessible sources.



3. Use of your Personal Information

We collect, use, and disclose your Personal Information in accordance with the specific business and commercial purposes described in Section 2 of the Global Mastercard Talent Community Privacy Notice, entitled “How We May Use Your Personal Information”.

4. Disclosure of your Personal Information to Third Parties

With respect to the categories of Personal Information identified above in Section 1, we disclose your Personal Information to the following categories of third parties:

• Mastercard Personnel: members of our internal departments to the extent that they are involved in the Talent Community. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Internet or Other Electronic Network Activity Information; Sensory Information, Professional or other Employment-related Information, or Inferences Drawn from Personal Information.
• Affiliates: Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Internet or Other Electronic Network Activity Information; Sensory Information, Professional or other Employment-related Information, or Inferences Drawn from Personal Information.
• Vendors: Vendors and service providers. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Internet or Other Electronic Network Activity Information; Sensory Information, Professional or other Employment-related Information, or Inferences Drawn from Personal Information.
• Third Parties as Legally Required: Third parties as required by law and similar disclosures. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); or Professional or other Employment-related Information.
• Third Parties in Merger/Acquisition: Third parties in connection with a merger, sale, or asset transfer. Personal Information we disclose: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); or Professional or other Employment-related Information.



We do not have actual knowledge that we sell Personal Information of consumers under 16 years of age or that we share Personal Information of consumers under 16 years of age for CCBA.

We do not sell your Personal Information or “share” Personal Information with third parties for “cross-context behavioral advertising”.

We do not collect, use or discloses sensitive personal information for purposes other than those permitted by the CCPA.

Retention

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as, the nature and length of our relationship with you, the impact on your application if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

5. Your Privacy Rights

If you are a California resident, you have the rights as set out in this section and may exercise them by following this guidance.

Your rights:

Right to Know and Access. You may submit a verifiable request for (as applicable to you as a member of the Mastercard Talent Community) information regarding the: (1) categories of Personal Information collected, or disclosed by us; (2) purposes for which categories of Personal Information are collected by us; (3) categories of sources from which we collect Personal Information; (4) categories of third parties with whom we disclosed Personal Information; and (5) specific pieces of Personal Information we have collected about you.

Right to Delete. Subject to certain exceptions, you may submit a verifiable request that we delete Personal Information about you that we have collected from you.

Right to Correct. You have the right to correct inaccurate Personal Information that we maintain about you.

Verification. Requests for access, deletion, or correction of Personal Information are subject to our ability to reasonably verify your identity in light of the information requested pursuant to relevant CCPA requirements, limitations, and regulations. Mastercard is committed to secure personal information. When data subjects exercise their privacy rights via email, we verify their identity by using their contact information (email and/or name and surname).




Right to Not Receive Discriminatory Treatment. You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations. We will not retaliate against you for exercising your CCPA privacy rights.

How to Submit Data Subject Rights Requests as a Talent Community member:

To exercise your rights under the CCPA, please submit your request to privacyanddataprotection@mastercard.com, or call our toll-free number: 1-833-244-4084.

Authorizing an Agent. If you are acting as an authorized agent to make a request to know, delete, correct, or opt out on behalf of a California resident, you may email us at privacyanddataprotection@mastercard.com, or call our toll-free number: 1-833-244-4084. Please note that we will require you to attach a written authorization signed by the resident whose Personal Information will be subject to the request.