For the purpose of this Privacy Notice, “Personal Information” means any information relating to an identified or identifiable individual. In connection with priceless™, we obtain Personal Information relating to you from various sources described below.

Where applicable, we indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so. If you do not provide Personal Information when requested, you may not be able to benefit from priceless™ if that information is necessary to provide you with the service or if we are legally required to collect it.

a. Personal Information Provided by You

We may collect certain Personal Information when you register on priceless™, such as your first and last name, country of residence, email address, postal code, and your credit or debit card number (the 16 digit payment card number).

If you make a purchase through priceless™, you may be required to provide us or our service provider with additional Personal Information, such as your full street address and your contact number, in order to receive or use that purchase.

b. Personal Information Provided by Third Parties

We may obtain Personal Information about you from third parties which may be located outside of the EU. For example, another priceless™ user may provide us with the contact information of a gift recipient, another individual who will share a priceless™ experience with the purchaser, or a person who the user wishes to invite to use priceless™. We may also obtain data from service providers that provide us with publicly available data.

c. Personal Information Automatically Obtained from Your Interaction with priceless™

When you use priceless™, we may collect certain information by automated means. This information may include browser type, operating system, referring URL, IP address, device ID, location data, information on actions taken on the priceless™ website, dates and times of actions, and may be collected via a variety of mechanisms, including cookies, web beacons, and other trackers. A “cookie” is a text file placed on a computer’s hard drive by a web server. A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, is used to transmit information back to a web server. We use this information to improve priceless™, for instance, by assessing how many users access or use our service, which content, products, and features of our service most interest our visitors, what types of offers our customers like to see, and how our service performs from a technical point of view. For more information, please view our Cookie Consent Tool.

We, our service providers, and our partners may also collect information about your activities on our website for use in providing you with content and advertising tailored to your individual interests. The information collected for these purposes may include details about things like the particular pages or advertisements you view on our website and the actions you take on our website, and may be collected via a variety of mechanisms, including cookies, web beacons, and other trackers. Some of these service providers and partners may also collect information about your online activities over time and across third-party websites. Please see the “Your Rights and Choices” section of this Privacy Notice to learn about your ability, at any time, to opt out or limit the use of your browsing behaviour for online behavioural advertising purposes.

d. Personal Information Obtained from Your Interaction with Social Media Tools

Priceless offers you the possibility to share, link to, or mention on social media outlets anything you may find of interest. For example, you may “like” an offer via your Facebook account or “tweet” an offer using Twitter. Social media providers such as Facebook or Twitter are independent from Mastercard and do not necessarily share the same policy as Mastercard with regard to the protection of privacy. Please verify their privacy policies if you decide to use their services. Mastercard cannot be held liable for any of these social websites’ or apps’ content, use, or privacy practices.

We may use the Personal Information we obtain about you to:

• Determine eligibility to register for priceless™ and to receive certain offers in connection with your card type.
• Create and manage your priceless™ account, provide our services, communicate with you and respond to your inquiries.
• Protect against and prevent fraud, unauthorised transactions, claims and other liabilities. 
• Send you marketing communications and deliver advertisements to you about our products, services, offers, programmes and promotions of Mastercard, its issuers, acquirers, retailers and partners (including contests, sweepstakes and any other marketing activities).
• If you sign up to priceless™ communications, we may use your Personal Information such as email address and your interaction with the website, to analyse your preferences, spending patterns, interests and behaviour in order to provide you with personalised content and the most relevant offers, recommendations and email communications about priceless™ from Mastercard, its issuers, acquirers, retailers and partners linked to priceless™.
• Facilitate your interaction with us through social media.
• Process and fulfil purchases made on or through priceless™. 
• Operate, evaluate and improve our business, and provide you with information and services (including by developing new products and services, such as new programmes designed to make it easier for cardholders to make payments with a Mastercard Card based on information indicating what features would appeal to you and our customers, or products designed to improve the security of payment transactions; managing our communications; determining the effectiveness of our advertising; analysing our products, services and websites; facilitating the functionality of our websites).
• Perform data analyses (including anonymisation of Personal Information).
• Enforce our Terms of Use and our other legal rights.
• Comply with applicable legal requirements and industry standards and our policies;
• Perform auditing, research and analysis in order to maintain, protect and improve our services.

We may process your Personal Information for the above purposes when: 

• You have consented to the use of your Personal Information;
• We need your Personal Information to provide you with the priceless™ Programme, services and products requested by you, or to respond to your inquiries;
• We have a legal obligation to use your Personal Information such as to prevent fraud in payment transactions;
• We or a third party, have a legitimate interest in using your Personal Information to ensure and improve the safety, security and performance of our products and services, and to protect against and prevent fraud. 

If you provide us with any information or material relating to another individual, you should make sure that the sharing with us and our further use as described to you from time to time is in line with applicable laws, so for example you should duly inform that individual about the processing of her/his Personal Information and obtain her/his consent, as may be necessary under applicable laws.

We do not sell or otherwise disclose Personal Information we collect about you, except as described in this Privacy Notice or otherwise disclosed to you at the time the data is collected.

We may share the Personal Information we collect with our subsidiaries, and affiliates, such as other Mastercard companies, for the purposes described in this Privacy Notice.

We also may share Personal Information with our service providers who perform services on our behalf and in relation to the purposes described in this Privacy Notice. Examples of our service providers include our operating platform provider, website hosting company, order fulfilment providers, and customer service providers. We require these service providers by contract to only process Personal Information in accordance with our instructions and as necessary to perform services on our behalf or comply with legal requirements. We also require them to have safeguards designed to protect the security and confidentiality of the Personal Information they process on our behalf.

We also may disclose data about you: (i) if we are required to do so by law or legal process, (ii) in response to a request from a court, law enforcement authorities, or government officials, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

We also reserve the right to transfer Personal Information we have about you in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use Personal Information you have provided to us in a manner that is consistent with this Privacy Notice.

You have certain rights and choices regarding what Personal Information we collect from you, how we use that information, and how we communicate with you. Your rights and choices may vary depending on your country.

In particular, you can make the following choices:

• Marketing opt-out: You may ask us not to send you marketing emails by using the unsubscribe link inserted in those emails or in the preferences section of your account profile. You may also ask Mastercard not to send you marketing emails for any of its products or services by clicking here. You may also contact us as indicated below.
• Cookies: You can exercise your choice regarding the use of cookies and similar technologies via the Cookie Consent Tool (or Ad Choices) displayed in the bottom right corner of our websites. Your browser may tell you how to be notified of and opt out of having certain types of cookies placed on your device.
• Behavioural advertising opt-out: You may opt out of the collection and use of your browsing behaviour via automated means for online behavioural advertising purposes (i) on priceless™ websites and apps, or (ii) on third party websites and apps which serve ads on our behalf. Mastercard ads are sometimes delivered with icons that help consumers learn more about how their data is being used and exercise choices they may have regarding the use of their data. Please click here or, where applicable, on the icon in our targeted ads to learn about your ability to opt out or limit the use of your browsing behaviour for online behavioural advertising purposes. You can opt out of, or limit the use of, your browsing behaviour being used for online behavioural advertising purposes through members of the Network Advertising Initiative by clicking here or the Digital Advertising Alliance by clicking here. European users may opt out of receiving targeted advertising through members of the European Interactive Digital Advertising Alliance by clicking here, selecting your country, and then clicking “Choices” (or similarly-titled link).

Subject to applicable law and, in particular, if you are located in the EEA or Switzerland, you may have the right to: 

• Request access to and receive information about the Personal Information we maintain about you, to update and correct inaccuracies in your Personal Information, to restrict or to object to the processing of your Personal Information, to have the information anonymised or deleted, as appropriate, or to exercise your right to data portability to easily transfer your Personal Information to another company. In addition, you may also have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work or where an incident took place.
• Withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.
• You may opt out from certain processing of your Personal Information, e.g. via our opt-out webpage.

Those rights may be limited in some circumstances by local law requirements.

Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, we do not respond to web browser-based DNT signals at this time.

If we fall short of your expectations in processing your Personal Information or you wish to make a complaint about our privacy practices, please tell us because it gives us an opportunity to fix the problem. To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time and as required under applicable law.

You may contact us by using the contact details provided in the "How To Contact Us" section below. If you are located in the EEA or Switzerland, you can use Mastercard’s “My Data Center” Portal as of 25th May 2018 to easily exercise your rights in relation to your Personal Information.

We maintain appropriate administrative, technical and physical safeguards to protect Personal Information against accidental or unlawful destruction, accidental loss, unauthorised alteration, unauthorised disclosure or access, misuse, and any other unlawful form of processing of the Personal Information in our possession. We restrict access to Personal Information about you to personnel who need to know that information to provide products or services to you.

We also take measures to delete your personal information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it in the context of priceless™ or when you request their deletion, unless we are required by law to keep the information for a longer period. We have established specific time limits for data deletion in our data retention policies and complete periodic review of our databases, taking into account the type of services provided in the context of priceless™, the length of the customer relationship, possible re-enrolment with priceless™, mandatory retention periods and the statute of limitations.

In particular, when you provide Personal Information online, we use the industry standard for encryption on the Internet – Secure Socket Layer (SSL) technology – to help protect the information that you provide. This Internet encryption standard scrambles data as it travels from your device to our server. You will know that you are in a secure area of the Site when a lock icon appears on your screen that the “http” prefix of our URL address changes to “https.” The “s” represents “secure”. We also use digital certificates to ensure that you are connected to the authentic Site.

Mastercard is a global business. We may transfer or disclose Personal Information to recipients in countries other than your country. These countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer or disclose your Personal Information to other countries, we will protect that information as described in this Privacy Notice.

To offer priceless™, we may need to transfer your Personal Information to the United States, where our global headquarters are located. We comply with applicable legal requirements providing adequate safeguards for the transfer of Personal Information to countries outside of the European Economic Area (“EEA”) and Switzerland.

In particular, we have established and implemented a set of Binding Corporate Rules (“BCRs”) that have been recognised by EEA data protection authorities as providing an adequate level of protection to the Personal Information we process globally. A copy of our BCRs is available here. We may also transfer Personal Information to countries for which the EU Commission has issued an adequacy decision, or use contractual protections for the transfer of Personal Information to third parties, such as the European Commission’s Standard Contractual Clauses, or rely on third parties’ certification to the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks where applicable. You may contact us as specified in the “How to Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Information outside of the EEA.

You may choose to use certain features for which we partner with other entities or participating merchants, or click on links to other websites for your convenience and information. These features, which may include social networking sites or apps, such as Facebook or Twitter, may operate independently from Mastercard. They may have their own privacy notices or policies, which we strongly suggest you review.

In some cases, we may link to an offer from a commercial partner, where any purchase of the offer must be completed directly with the commercial partner, rather than via the priceless™ website. You will be asked to provide your personal data directly to the commercial partner and you will be governed by the privacy policy of their website. For more information on each commercial partner’s privacy practices, we invite you to consult their respective privacy notice accessible on their redemption sites.

To the extent any features or linked websites you visit are not owned or operated by Mastercard, we are not responsible for the sites’ content, any use of the sites, or the privacy practices of the sites.

This Privacy Notice may be updated periodically to reflect changes in our privacy practices pertaining to Personal Information. We will post a prominent notice on our websites to notify you of any significant changes to our Privacy Notice and indicate at the top of the notice when it was most recently updated. If we update this Privacy Notice, in certain circumstances, we may seek your consent.

You can e-mail us at privacyanddataprotection@mastercard.com. If you are located in the EEA or Switzerland, you may submit your request to exercise your rights to your Personal Information on Mastercard’s “My Data Center” Portal.

Mastercard International Inc. is the entity responsible for the processing of your Personal Information; however, if you are located in the EEA or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information.

If are located outside of the EEA or Switzerland and you have any questions, comments, or complaints about this Privacy Notice or our privacy practices, or if you would like to exercise your rights and choices, please e-mail us at privacyanddataprotection@mastercard.com, or write to us at:

Global Privacy Officer
Mastercard International Incorporated
2000 Purchase Street
Purchase, New York 10577
USA

If you are located in the EEA or Switzerland, you may submit your request to exercise your rights to your Personal Information on Mastercard’s “My Data Center” Portal as of 25th May 2018, or e-mail us at: privacyanddataprotection@mastercard.com; or write to us at:
Data Protection Officer
Mastercard Europe SA
Chaussée de Tervuren 198A
B-1410 Waterloo
Belgium

For more information on Mastercard’s privacy practices in other contexts, including how to withdraw from certain processing activities, please refer to our Global Privacy Notice available at https://www.mastercard.co.uk/en-gb/about-mastercard/what-we-do/privacy.html.

For questions about your Mastercard card, you must contact your issuing bank. More information about how to contact them can be found either on the back of your card or their respective websites.