Visa Global Privacy Notice

Effective date: May 14, 2026

This Global Privacy Notice explains how Visa and its Affiliates¹ collect, use, and share Personal Information when you use our, or our clients’, products, services, offers, and promotions.

As a global payments technology company, Visa fulfills many roles. When we act on behalf of our Visa clients, we only collect, use, and share Personal Information as authorized by our contracts with our clients. If you have questions about how these companies handle your Personal Information, or wish to exercise your rights, please contact them directly. For example, if you have questions about your Visa card transactions, please contact the institution that issued your card for more information.

Where Visa acts a controller under applicable laws and collects information directly from an individual, the controller is the Visa entity listed on the terms and conditions you sign when enrolling in a Visa service, product, or offer. Some Visa companies and services have different privacy notices that are provided when you use them. We also have supplemental privacy notices that provide additional information as required by law.

You can learn more and exercise your privacy choices under relevant laws at our Privacy Rights Portal.

1. Visa’s Affiliates are companies that are directly or indirectly controlled by Visa U.S.A. Inc. or its parent company Visa Inc. through ownership — for example, Visa International Service Association, Visa Worldwide Pte. Limited, Visa Canada Corporation, Visa International Servicios de Pago España, S.R.L., Visa Europe Limited, Visa do Brasil Empreendimentos Ltda, CardinalCommerce Corporation, CyberSource Corporation, and Verifi, Inc.

Personal Information

“Personal Information” refers to information that (alone or when used in combination with other information) is capable of being associated with or could reasonably be associated with an individual. Personal Information, sometimes referred to as “personal data”, may also have specific meanings under different privacy laws. The Personal Information we collect varies depending on our relationship and interactions with you.

Categories of Personal Information

Depending on our relationship and interactions with you, the categories of Personal Information we collect may include:

• Contact Information: This includes your name, username, mailing address, email address, telephone number, mobile number, emergency contact information, and social medial profile names, along with other personal identifiers. This may also include contact information of sole proprietors and business contact information.
• Transaction and Financial Information: This includes:
  • Information about your card, including your 16-digit payment card number, which is also known as a personal account number or “PAN”; an associated non-financial identifier known as payment account reference or “PAR” token; and expiration date, service code, PIN verification data, and CVV; and
  • Information about your transactions, including the date, time, location, and amount of the transaction and information about the merchant. This also may include item-level data in some instances.
• Relationship Information: This includes information about your shopping and payment preferences and other information that can help us offer you personalized content, such as:
  • Demographic information, such as age range and marital or family status;
  • Likelihood that you may be interested in certain purchases or experiencing life events and other propensity scores; and
  • Data from social media profiles and information about your interests.
• Interaction Information: This includes information about your interactions with Visa, such as:
  • Information collected when you participate in promotions or programs, such as rewards program account information;
  • Card benefits program information, including qualification data and related records;
  • Information collected when you contact us, such as if you contact our customer service;
  • Visitor logs;
  • Information collected when you attend Visa sponsored events, such as travel-related information for you and any companions gathered at the events; and
  • Other information you provide us, such as data collected for consumer authentication (e.g., passwords or account security questions).
• Biometric Identifiers: This may include facial recognition data, fingerprints, keystroke timing, scroll position, and behavioral data or other physical patterns, such as when you elect to use biometric authentication with Visa or its clients.
• Business Customer Data: This includes information about your role within your company, your authorization to use products or services, and your authority to place orders; customer/supplier qualification details; and other data you share with us in connection with the relationship.
• Inferred and Derived Information: We infer and derive data elements by analyzing our relationship and transactional information. For example, we may generate propensities, attributes, and/or scores for marketing, security, or fraud purposes.
• Online and Technical Information: This includes information regarding your interactions with our websites, applications, or advertisements, including IP address, device identifiers, settings, characteristics, advertising ID, browsing history, web server logs, server log records, activity log records, keystroke timing, and other information collected using cookies and similar technologies.
• Audio and Visual Information: This includes audio, electronic, visual, or similar information relating to your interactions with us, including photographs, video images, CCTV recordings, call center recordings, call monitoring records, and voicemails.
• Government Issued Identification Numbers: This includes social security number, driver’s license number, passport number, and other government issued identifiers as may be needed for compliance or given the nature of the relationship.
• Geolocation Information: This may include precise geolocation information, which we may collect automatically from your mobile device if you opt-in to allow us to collect it.
• Professional and Employment Information: This includes professional or employment-related information for employees and prospective employees, including applicant and resume data, such as education and work history; information about qualifications for the position, such as skills and credentials; professional interests and goals; information collected for employee qualifications, such as right to work documentation; and references.
• Compliance Data: This includes records maintained to demonstrate compliance with applicable laws; records related to consumer preferences, such as your opt-ins and opt-outs of marketing programs; and records related to data subject rights requests.

Some of the Personal Information in these categories may be considered sensitive Personal Information in some jurisdictions.

Sources of Personal Information

We may collect Personal Information about you from various sources, depending on our relationship and interaction with you. These sources may include:

• Your financial institutions, payment card issuer, merchants, acquirers, and other partners when you use a Visa-branded payment product or when we’re acting on their behalf, such as when you tap your Visa card;
• You, such as when you enroll in card link offer programs from Visa or a co-promotion partner, enroll in a Visa click-to-pay solution, or provide survey responses to us;
• Your computer or devices when you interact with our platforms, websites, and applications or through other automatic technologies, such as when we record calls to our call center and use CCTV cameras in our facilities; and
• Other third parties, including data aggregators, social media companies, and other publicly available sources. In addition, Professional and Employment Information may be collected from your references and third parties that help us conduct internal investigations and background screenings, and Business Customer Data may be collected from your employer, trade show and conference organizers, and professional services companies.

Why We Collect Personal Information and How We Use It

Where applicable, we also may process Personal Information with your consent. For example, we may rely on your consent, where required by law, to provide you with marketing communications and personalized experiences offered through our partners.

* “Everyday Business Purposes” encompasses these business purposes and related purposes for which Personal Information may be used:

• To provide the information, product, or service requested by the individual or as reasonably expected given the context in which with the Personal Information was collected (such as customer credentialing, providing customer service, negotiation and contracting, personalization and preference management, providing product updates, bug fixes or recalls, and dispute resolution);
• For identity and credential management, including identity verification and authentication, and system and technology administration;
• To protect the security and integrity of systems, networks, applications, and data, including detecting, analyzing, and resolving security threats, and collaborating with cybersecurity centers, consortia, and law enforcement about imminent threats;
• For fraud detection and prevention;
• For legal and regulatory compliance, including all uses and disclosures of Personal Information that are required by law or reasonably needed for compliance with company policies and procedures, such as anti-money laundering programs, security and incident response programs, intellectual property protection programs, and corporate ethics and compliance hotlines;
• For corporate audit, management, finance and accounting analysis, and reporting;
• To enforce our contracts and to protect against injury, theft, legal liability, fraud, or abuse, and to protect people or property, including physical security programs;
• To de-identify, depersonalize, or anonymize the data or create aggregated datasets, such as for consolidating reporting, research, or analytics;
• To make back-up copies for business continuity and disaster recovery purposes; and
• For corporate governance, including mergers, acquisitions, and divestitures.

Categories of Third Parties and Our Disclosure of Personal Information

We may disclose your Personal Information to:

• Our Affiliates;
• Our service providers, for the purposes of providing services to us;
• Financial institutions, merchants, payment processors, and other third parties that are subject to appropriate confidentiality and use restrictions, for the purposes of enabling your payments, managing fraud and risk, providing and developing products and services, and supporting our Everyday Business Purposes;
• Third parties who help us to detect and prevent fraudulent transactions. These third party fraud service providers that we use to help us detect and prevent fraudulent transactions; and they are responsible for their use of your personal data and will use it for the purposes set out in their own notices;
• Third parties, such as third-party advertising partners, who may use data collected by cookies and similar means to help us with our online advertising programs;
• Government agencies;
• Recruiting agencies and your references (for Professional and Employment Information); and
• Your company and its affiliates (for Business Customer Data).

We may also disclose personal information when required to do so by law, such as to law enforcement agencies, regulators, or courts, or as permitted by law, such as when we sell or transfer business assets, enforce our contracts, protect our property or the rights, property or safety of others, or as needed for audits, compliance, and corporate governance.

Click to Pay

In certain countries, Visa enables easy, consistent and secure online checkout with Click to Pay. This may be offered to you by Visa directly, or by your Issuer as a feature of your card.

If your issuing bank provides this service to you under their terms and conditions, please see their privacy notice for more information.

If Visa provides you with this service, you will have received Visa’s terms of service. You can also access your profile at any time on the Visa Click to Pay Consumer Portal.

Online Privacy

When you visit our website, use our mobile applications, or engage with our emails and online ads, we may collect information by automated means, using technologies such as cookies, pixel tags, browser analysis tools, server logs, and web beacons.

In some cases, the information we collect is only used in a non-identifiable way. For example, we use information we collect about all website users to optimize our websites and to understand website traffic patterns. We do not use this information to profile you or target our ads.

In other cases, we may use the information in an identifiable way. For example, we may authenticate you or your device, deliver personalized content or use the information for analytics, fraud detection, and security. We may also use the information for online ad targeting. Our Cookie Notice provides more information about our online data collection technologies and your choices.

As described in our Cookie Notice, we have relationships with third-party advertising companies. These third parties may track you, your browser or your device across different websites and applications.

Subject to your settings, we may place cookies or tags on your computer when you visit our website so that they can display targeted advertisements to you on other websites. The use of your data by these companies is subject to their own privacy policies.

Many Visa websites only place marketing, personalization, and advertising cookies if you explicitly accept these cookies by clicking “Accept All Cookies” when you first visit the website. Our Cookie Notice explains how to manage your preferences and how to disable previously accepted cookies.

Our websites may enable you to interact with us and others via social media platforms. We collect information from these platforms as permitted by the sites’ legal terms. We may also display interest-based ads to you when you are using these platforms. The platforms allow us to personalize the ads that we display to you, and they may gain insights about individuals who respond to the ads we serve.

Mobile Applications

When you download our mobile applications, you may allow us to obtain your precise location from your mobile device. We use this information to deliver personalized content and for analytics. We may also offer automatic ("push") notifications. We will provide push notifications only if you opt-in to receive them. You do not have to provide location information or enable push notifications to use our mobile apps.

Certain mobile applications controlled by Visa may allow us to share data with advertising platforms for purposes of showing you interest-based ads. We rely on the mobile network operators’ settings to allow you to opt into this type of sharing when you download our applications. However, where able, we will also provide you choices within the account profile section of the application.

We collect device identifiers and other device-related information, including your device’s advertising ID, if available. This information is used to identify your device and authenticate you. We may also use device-related information to associate you with different devices that you may use, including for fraud-protection purposes and to better target advertising. In many cases, you can reset your device’s advertising ID. Both Android and iOS devices enable you to reset your device identifier under the “settings” menu.

Your Privacy Rights

We respect your rights to access, correct and delete your information in accordance with applicable laws. If you have an online account with Visa, you can log into your account to access, update, and delete your information. You can also submit requests under relevant laws to us via the Privacy Rights Portal.

For security reasons and to prevent unauthorized disclosure of Personal Information, cardholders should contact their payment card issuers to access their relevant information. This helps ensure that access to the information is only provided to the authorized individuals, subject to the issuer’s verification processes. Additionally, if you have questions about how your issuer, merchants, or rewards networks handle your Personal Information, please check the privacy notices provided by these companies and contact them directly for assistance with any privacy requests. When Visa acts as a service provider (also called a data processor) for our clients, we only process your information as instructed by our client to provide the services and for other appropriate purposes, such as recordkeeping and compliance. We rely on our clients to provide you with appropriate privacy notices and to manage your privacy rights.

Supplemental Privacy Notices: Residents of some states and countries have additional privacy rights. Information on these rights is provided in the supplemental privacy notices posted at the bottom of this Global Privacy Notice.

International Transfers

Visa is based in the United States and has Affiliates and service providers around the world. Visa may transfer your Personal Information between countries, including to countries which may not have similar privacy or data protection laws as your country of origin. We may transfer your Personal Information to our main data centers in the United States, as well as our other data centers, such as our data center in Europe or a local data center in your country where applicable. However, we will always protect your information as described in the relevant privacy notice(s), no matter where it is stored, and transfer it in accordance with any applicable legal requirements for cross-border transfer of Personal Information.

Information Security and Data Retention

We use physical, technical, organizational, and administrative safeguards to help protect your Personal Information from unauthorized access or loss. For example, we use encryption and other tools to protect sensitive information. We retain your Personal Information as needed for the purposes listed above and as permitted by law.

Privacy Policies of Third Parties

This Privacy Notice explains how Visa Inc. and its Affiliates handle your Personal Information. Please also read the privacy notice provided by your Visa card issuer and other applicable clients to learn how each of those companies handle your information. Additionally, if you are participating in offers or promotions, please read the privacy notices provided by the merchant or the rewards network before you sign up.

Social media platforms and other websites that may be accessed through Visa’s websites also have their own privacy policies. We encourage you to read the privacy notices provided by these sites before you give them your information.

Job Applicants

If you have applied for a job at Visa, the Personal Information in your application will be used and retained for recruiting, compliance, and other customary human resources purposes. This includes, where permitted, processing information to monitor our pathways for employee recruitment.

Children's Data

In general, Visa’s platforms are not directed to, likely to be accessed by, or intended for children, and Visa only collects information from children as permitted by applicable law. If a Visa platform is intended to be used by children, it may have a separate privacy notice. If you believe that we are processing a child’s information inappropriately, please Contact Us.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time. We will post an alert online if the changes are material. If the changes will materially affect the way we use Personal Information that we have already collected, we will notify you.

How to Contact the Visa Privacy Office

If you would like to exercise your privacy rights under relevant laws, please reach out us via the Privacy Rights Portal.

For any other assistance you may contact us, including any queries to the applicable Data Protection Officers within Visa, at the information below:

• Email us at [email protected]. Please do not include sensitive information, such as your account number, in emails.
• Mail us a letter: Visa Global Privacy Office 900 Metro Center Blvd. Foster City, CA, 94404 USA

Supplemental Privacy Notices

This Global Privacy Notice is supplemented by these additional notices, depending on how you interact with us and where:

• Candidate Privacy Notice
• For Argentina (Spanish)
• For Australia (English)
• For Brazil (Portuguese)
• For Canada (English)
• For China Mainland (Simplified Chinese)
• For Colombia (Spanish)
• For European Economic Area (EEA)/Switzerland/UK (English)
• For Japan (Japanese)
• For South Korea (Korean)
• For New Zealand (English)
• For Taiwan (Traditional Chinese)
• For Turkey (Turkish)
• For Vietnam (English)
• For Vietnam (Vietnamese)
• Open Banking Privacy Notice (Please note open banking is only available in certain countries. If open banking is not available in your region, you will be redirected to the Visa Global Privacy Notice.)
• U.S. - State Privacy Laws Supplementary Notice (English) — see below
• U.S. - Social Security Number Policy and Sensitive Personal Information Statement (English)

Our Cookie Notice explains our practices regarding cookies, tags, and similar types of online data that we collect.

US State Privacy Laws Supplementary Notice

Effective Date: July 01, 2026

This supplementary notice only applies to residents of certain U.S. States whose information is processed pursuant to applicable U.S. State law privacy requirements, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”) and other applicable U.S. state consumer privacy laws (together with CCPA, “State Privacy Laws”).

At Visa, we are committed to safeguarding the privacy and security of all Personal Information that is entrusted to us. Visa has a Global Privacy Program to help ensure your information is handled properly, and your Personal Information is protected. It also reflects the requirements of the privacy laws in all countries and states where Visa operates.

In the United States, payment transaction and other information Visa processes in connection with operating its electronic payments networks often is regulated by existing federal financial privacy laws. State Privacy Laws recognize that, where such financial information is already protected by federal privacy law, these State Privacy Laws do not apply to this information. Visa’s privacy program reflects the sensitivity of the financial and other information we handle. If you have questions about how we handle your data, please review the Visa Global Privacy Notice.

Visa also processes certain information that is subject to State Privacy Laws. State Privacy Laws may apply to (1) information we collect when individuals sign up for marketing and personalization from Visa, attend Visa-sponsored events, participate in surveys, or interact with our websites and apps, and (2) information collected from individuals who use our Visa-branded products, for example Click-to-Pay or Visa Payment Passkey Services. This supplemental privacy notice explains our practices for information subject to State Privacy Laws.

For information that Visa collects subject to State Privacy Laws, the Visa Global Privacy Notice describes the categories of Personal Information that we may have collected or disclosed for business purposes in the past 12 months, the sources of the Personal Information, the business or commercial purposes for which we use or disclose the information, and the categories of third parties to whom we disclose the information for business purposes. Visa does not authorize the use of such Personal Information to train large language models.1 Visa retains the Personal Information it has collected as long as the information is needed for the purposes set forth in the Visa Global Privacy Notice and this U.S. State Privacy Laws Supplementary Notice, and for any additional period that may be required or permitted by law. The length of time your Personal Information is retained depends on the purpose(s) for which it was collected, how it is used, and the requirements to comply with applicable laws.

State Privacy Laws provide their residents with specific privacy rights, including the right to correct inaccurate Personal Information, delete Personal Information, and access Personal Information and other information about our Personal Information processing practices, including in a portable format. Some State Privacy Laws may also give their residents the right to appeal our decisions with respect to your privacy rights requests. As described further in the sections below, State Privacy Laws may also give their residents the right to opt-out of having their Personal Information sold, processed for targeted advertising purposes2, or used for profiling in certain contexts, as well as certain rights in relation to the processing of their sensitive Personal Information. Finally, State Privacy Laws may give their residents the right not to receive discriminatory treatment for the exercise of any of these privacy rights.

1. Large language models refer to artificial intelligence models that have certain characteristics, including that they are designed to process, generate, summarize, transform or predict natural language text (and, where applicable, code or other language inputs) and are capable of producing open-ended or context-aware text outputs, such as conversational responses.

2.Personal Information of children under 16 cannot be sold or processed for targeted or cross-context behavioral advertising purposes without affirmative consent. Visa does not knowingly sell or process children’s information for these purposes.

The right to opt out of sale of Personal Information

Some State Privacy Laws provide you with the right to opt out of the “sale” of your Personal Information. Visa does not sell Personal Information for money, although our websites and applications may use cookies or similar technologies as described below. Our Global Privacy Notice describes how we disclose information to third parties, such as when we process payments, provide services to your card issuer, prevent fraud, or otherwise share your Personal Information with your consent.

The right to opt out of the processing of Personal Information for certain advertising purposes

Some State Privacy Laws provide you with the right to opt out of the processing of your Personal Information for purposes of serving you advertisements that are relevant to you based on your activity across our services and other sites (“targeted advertising” or “cross-contextual behavioral advertising”), including the sharing of your Personal Information for these targeted advertising purposes.

Like many companies, we use services that help deliver personalized and interest-based ads to you, and our websites and applications may use cookies or similar technologies that allow advertising partners to collect your Personal Information for their use. On most Visa websites, Visa only permits advertising partners to collect your Personal Information in this manner with your consent. To request to opt-in (or to change your mind after opting-in), please click the Cookie Preferences link on the bottom of the Visa website you are interacting with or visit the Visa Cookie Notice.

For US Visa websites, Visa detects and honors Global Privacy Control (GPC) signals sent by your browser. When we detect a valid GPC signal, we treat it as a request to opt-out of the sharing of your Personal Information for personalized marketing and ad-tracking. This means only strictly necessary cookies will be enabled. Please note that this setting applies only to the browser where the GPC signal is enabled. If you clear your cookies or use a different browser or device, you will need to re-enable GPC.

Please note that some transfers of your Personal Information may not be for purposes of personalized marketing or targeted advertising, and certain exemptions may apply under applicable State Privacy Laws. Your choices do not affect other disclosures of your information, as outlined in our Global Privacy Notice, such as when we process payments, provide services to your card issuer, or prevent fraud.

Sensitive Personal Information rights

In the United States, the payment transaction and certain other information that Visa collects when it operates its payment networks is regulated by existing federal financial privacy laws. Further, any sensitive Personal Information subject to applicable State Privacy Law is only processed for purposes under the applicable law which do not require your consent or for which you do not have a right to limit.

Access, correction, deletion, and appeal rights

You may exercise your rights, authorize another person to act on your behalf, or appeal a denial of a request by:

• Visiting our Privacy Rights Portal
• Calling Visa at 1-844-909-1620
• Emailing us at [email protected]. Please do not include sensitive information, such as your account number, in emails.
• Mailing us a letter: Visa Global Privacy Office 900 Metro Center Blvd. Foster City, CA, 94404

Please note that we will need to verify your identity before we can fulfill your State Privacy Law-related request. Because the information that we maintain that is subject to State Privacy Laws generally consists of marketing information, we will generally verify your identity using your email address. Where possible, we will respond to requests using the email address that is associated with the information we maintain.

If you would like to designate an agent, please send an email from your own email address to [email protected] indicating the name and email address of your agent. We will respond to that’s person’s requests using both your email address and the agent’s email address.

Please understand that your rights are subject to some limitations, such as:

• For security reasons and to prevent unauthorized disclosure of Personal Information, cardholders should contact their payment card issuers to access their information. This helps ensure that access to the information is only provided to the authorized individuals, subject to the issuer’s verification processes.
• State Privacy Laws contemplate that service providers should refer access and deletion requests to the companies with whom the individual has the direct relationship. In many cases, we act as a service provider for card issuers and merchants, including rewards networks. If you have questions about how your issuer or a rewards network handles your Personal Information, please check the privacy notices provided by these companies and contact them directly for assistance with your relevant privacy requests.
• Some State Privacy Laws may also prohibit companies from including certain elements of sensitive Personal Information, such as payment card number, in their access reports, even if you have provided those data elements to use for marketing.
• If you request that we delete your Personal Information, we will do so except in those situations where our retention is permitted by the applicable State Privacy Laws (such as for fraud prevention or legal compliance, or where reasonably necessary to provide the services requested by the consumer or for our internal business purposes). In these situations, we will retain your information in accordance with our records retention program and securely delete it at the end of the retention period.

If you have any other questions or requests, please contact us at [email protected].

Financial Incentives

Additional Disclosures for Large Businesses

The CCPA requires certain businesses to compile and disclose information each year regarding their compliance with the CCPA for the previous twelve-month period. Visa has selected to provide these reports annually for the preceding calendar year 2025.

* Requests which could not be validated due to insufficient location information or individuals failed to verify their identity in the OneTrust tool. These requests are not included in the totals above. ** Data retained in accordance with CCPA. *** Visa does not sell Personal Information.