For the purpose of this Privacy Notice, “Personal Information” means any information relating to an identified or identifiable individual. In connection with the provision of the Open Banking Solutions, we obtain Personal Information relating to you from the various sources described below.

a. Personal Information Provided by You

• Personal and/or Business Contact Information and Credentials: such as, name, user ID, email address and phone number, and log-in credentials.
• User Profile Information: such as e-mail address and password, and depending on the Open Banking Solution, any other information that you may be able to add to your profile, such as name, date of birth, address, social security number, Politically Exposed Person (“PEP”)-role, company shares, phone number, occupation, marital status, the number of people in your household, age or gender or third-party services with whom you wish to share your Personal Information.
• Authorisations that you grant us to manage your Personal Information in specific ways (e.g., to access, retrieve and display your financial information or transaction information through our Open Banking Solutions, to update your profile based on recent transactions or to transfer financial information to third party services of your choice).
• General Communication Information which we may receive when you contact us (e.g., via email, phone, or online web forms), such as your first and last name, telephone number, email address, physical address, as well as any other content that you provide. If you do not provide such information, we may not be able to answer your requests or queries.

b. Personal Information provided by third parties

• Financial Information: such as, information relating to a bank account that is enrolled in one of the Open Banking Solutions (e.g., account name or reference, unique account reference ID, balance, and transactions), refund account details (account number, sort code and financial institution servicing the refund account), payment receipts, payment card details and billing address.
• Third Party Provider (“TPP”) Request Information: such as, payment initiation service requests, account information service requests, request reference number, and response status.
• Transaction Information: such as, account provider and account number, date / time of payment, payment recipient and data needed for communication with your account provider, information about disputed transactions, fraud-related information (e.g., failed logins).

c. Personal Information automatically obtained from your interaction with the Open Banking Solutions

• Device-related Information: such as information which we obtain by automated means such as cookies, web beacons, and embedded scripts. This may include information from a web browser (such as browser type and browser language), an IP address, device identifier numbers, and the actions taken on a website (such as how a visitor interacts with the web pages and the links clicked, mouse location and keystroke timing). For detailed information about the use of cookies and similar technologies, please see the cookie notices and consent tools that are provided in our Open Banking Solutions.
• Fraud Prevention Information that we may need to collect when you use the Open Banking Solutions to initiate payments (e.g., to comply with anti-money laundering legislation). This includes account holder name, address, and date of birth, and name, address, and date of birth of the beneficial owners, senior management, or authorized signatories, including copies of documents, if necessary, as well as device-related information and logs of your use of the Open Banking Solutions.
• Logs of your use of the Open Banking Solutions, such as information on which profile is logged into or whether it concerns a one-time user, the IP-address used, the time and date, which action has been performed and device information, i.e., information on operating system, browser information and settings. Further, whenever a third-party service accesses the Open Banking Solutions, a similar log is created. We also monitor payments initiations for anomalies such as unusually high frequency of failed initiations, unusually high frequency of successful initiations, unusually high value of initiated payments or if payments are initiated from an unusual geographical location.

We may use Personal Information we obtain about you for the purposes set out below. Depending on the country in which you are located, we will only process your Personal Information when we have a legal basis for the processing as identified in the table below.

We may disclose Personal Information we collect about you to the following third parties, for the purposes described below:

a. Other permitted users, depending on the Open Banking Solution used

You may allow other users to access and view your Personal Information in the Open Banking Solutions. If you choose to do this, you agree that Mastercard, in order to comply with this agreement with you, may disclose your Personal Information to the person concerned. You can revoke this access at any time in the Open Banking Solutions’ settings.

b. Financial institutions, business customers, partners and service providers acting on our behalf

We may share the Personal Information we collect with financial institutions, business customers (where you permit us to do so) and partners (such as disclosing Transaction Information to a third-party provider to enable the payment transaction), as well as service providers acting on our behalf, such as hosting and infrastructure providers, and providers of monitoring, security, and IT support services.

c. Public authorities

We may share the Personal Information we collect with public authorities (i) if we are required to do so by law or legal process, (ii) in response to a request from a court, law enforcement authorities, or government officials, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

d. Potential transactional partners

We may share the Personal Information we collect with potential transactional partners or other third parties in the event of a sale or transfer of our business or assets.

e. Mastercard Group

We may share the Personal Information we collect with Mastercard’s headquarters in the U.S., our affiliates and other entities within the Mastercard group of companies, for the purposes described in this Notice. Please see the “Data Transfers” section in the Global Privacy Notice to understand how we comply with applicable cross-border data transfer rules.