Privacy Policy
Masterpass Privacy Notice
Mastercard Middle East Africa FZ-LLC (“Mastercard”) gives utmost importance to data subjects’ privacy and data protection. Accordingly, this Masterpass Privacy Notice (“Privacy Notice”) provides detailed information on the processing of personal data of data subjects who benefit from the Masterpass card storage service (“Masterpass”).
This Privacy Notice only covers the personal data processing activities carried out by Mastercard as the data controller within the scope of the Masterpass service and does not cover the processes (e.g. payment routing) in which Mastercard acts as a data processor on behalf of and in accordance with the instructions of its business partners (merchants, acquirer or issuer).
Collection Method and Processing of Your Personal Data
Within the scope of the Masterpass service, your personal data may be collected as explained below and processed for the following purposes, based on the respective legal basis for processing:
• Personal data provided by you: Your personal data may be collected directly from you when you visit our Masterpass platforms, use our support request channels, and verify your one-time password via text message.
• Collection through contracted merchants or banks: Your personal data may be collected through contracted merchants or banks when you visit the e-commerce platforms of Masterpass contracted merchants or banks and sign the Masterpass Terms of Use in order to use the Masterpass service.
|
Purpose of Personal Data Processing |
Personal Data |
Legal Basis for Processing |
|
Creating the Masterpass profile, performing security verification and providing the card storage service |
• 16-digit card number (PAN) • Card expiration date • Mobile phone number • One-time password • Masterpass platform password • Secret Question answer • Device identifier information of the data subject’s device accessing the mobile Masterpass platforms and the security-verification result provided by the device operating system |
Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract. |
|
Routing the transaction to the acceptance point on behalf of the merchant where the data subject registered in Masterpass prefers to make the payment with their card registered in Masterpass |
• 16-digit card number (PAN) • Card expiration date • Transaction information regarding the payment transaction (payment date, time, installment information, points information in case of payment with points, payment amount) • Transaction security information |
|
|
Providing support services to the data subject who requests support |
• Support request • Contact information (mobile phone number and/or e-mail depending on the contact channel) • Transaction information regarding the payment transaction |
|
|
Providing ancillary services used in integration with Masterpass services (e.g. “Instant digital credit,” “ABU” and similar additional services defined in the Masterpass Terms of Use) |
• 16-digit card number (PAN) • Card expiration date • Mobile phone number • One-time password • Transaction information relating to the payment transaction of the ancillary service used |
|
|
Querying whether the data subject visiting the merchant platform is a Masterpass user, so that the payment alternative with the card registered in Masterpass can be offered on the contracted merchant’s payment page |
• Mobile phone number |
Processing is necessary for the legitimate interests pursued by the data controller, provided that this processing does not violate the fundamental rights and freedoms of the data subject. |
|
Fraud prevention and risk management |
• 16-digit card number (PAN) • Card expiration date • Transaction security information • Mobile phone number |
|
|
Conducting security verification within the scope of taking relevant data security measures |
• Mobile phone number • Card information • Transaction security information |
|
|
Management of relations with data subjects and merchants |
• Mobile phone number • Transaction security information • Transaction information |
|
|
Conducting internal research, reporting and analysis processes |
• Aggregated and consolidated transaction information |
|
|
Ensuring that the data is accurate and up to date |
• 16-digit card number (PAN) • Card expiration date |
|
|
Fulfilling the requests of official authorities, providing information to competent authorities pursuant to legislation, ensuring compliance with retention obligations, responding to data subject requests in accordance with legislation, and taking necessary actions |
• 16-digit card number (PAN) • Card expiration date • Mobile phone number • One-time password • Transaction information regarding the payment transaction (payment date, time, installment information, points information in case of payment with points, payment amount) • Transaction security information |
Processing is expressly provided for by law and is necessary for fulfilment of the legal obligation to which the data controller is subject. |
Data Transfers
We would like to initially state that, in accordance with the relevant legislation, your personal data is stored within the Republic of Türkiye. Additionally, solely for the purpose of providing the Masterpass service and provided that all necessary security measures are taken, your personal data may be shared with the relevant parties as detailed below:
|
Data Transfer Purpose |
Transferred Personal Data |
Recipient |
Legal Basis for Transferring |
|
Storing personal data while ensuring the security of the data subject’s personal data |
• 16-digit card number (PAN) • Card expiration date • Mobile phone number • Transaction information • Masterpass platform password • Secret Question answer |
Kartek Kart ve Bilişim Teknolojileri Ticaret A.Ş. |
Processing is necessary for the legitimate interests pursued by the data controller, provided that this processing does not violate the fundamental rights and freedoms of the data subject. |
|
Providing support services to data subjects who request support |
• Support request • Contact information (mobile phone number and/or e-mail depending on the contact channel) • Transaction date information |
Complaint-management support service provider (supplier firm) |
|
|
Conducting the process related to the verification of card information |
• 16-digit card number (PAN) • Card expiration date • Mobile phone number |
Payment service providers and banks |
|
|
Offering the payment alternative with the card registered in Masterpass on the contracted merchant’s payment page |
• Whether the data subject is a Masterpass user |
Contracted merchant |
|
|
Sending electronic messages via SMS |
• Phone |
Message dispatch support service provider (supplier firm) |
|
|
Sending e-mail |
|
E-mail dispatch support service provider (supplier firm) |
|
When a Masterpass user visits a contracted merchant platform, it is checked whether the person is a Masterpass user so that the payment alternative with the card registered in Masterpass can be offered on the merchant’s payment page. Where the person is determined to be a Masterpass user, the information that they are a Masterpass user is shared with the visited contracted merchant, solely for the purpose of offering the payment option with the card registered in Masterpass.
Retention Period
Your personal data is retained for as long as necessary for the purposes for which it is processed, and for the retention and limitation periods set out in applicable legislation; once these periods expire, it is securely deleted, destroyed or anonymised in the manner prescribed by the Law and applicable legislation.
Your Rights
In accordance with the applicable legislation, you may have the right to:
• Learn whether your personal data is being processed or not,
• Request information regarding your personal data if it is being processed,
• Learn the purpose of processing of your personal data and whether they are used in accordance with such purpose,
• Learn the third parties to whom personal data are transferred domestically or abroad,
• Request correction of your personal data if it is incomplete or processed incorrectly,
• Request deletion or destruction of your personal data in accordance with the applicable legislation,
• Request notification of the third parties to whom your personal data are transferred regarding the correction of your incomplete or incorrectly processed personal data,
• Request notification of the third parties to whom your personal data are transferred regarding the deletion or destruction of your personal data,
• Object to a negative decision regarding yourself that would occur due to data processing conducted solely by automated means,
• Claim compensation for the damage arising from the unlawful processing of your personal data.
You may submit your requests by emailing us at privacyanddataprotection@mastercard.com.
Data Controller:
Mastercard Middle East & Africa FZ-LLC
Mastercard Building, Al Falak Street, Dubai Internet City,
Dubai, UAE
Please click here to see information regarding the Data Controller Representative.