Visa Privacy Notice

This document is Visa's U.S.-facing Privacy Center notice, governing how Visa collects, uses, shares, and retains personal information in connection with its payment network operations, website interactions, and related services, with stated legal bases including contractual necessity, legitimate interests, consent, and legal obligation depending on jurisdiction. The policy states that Visa collects a broad range of data including transaction data, device and location information, inferred interests, and data from third-party sources, and the terms authorize use of this data for fraud prevention, analytics, marketing, and sale to or sharing with financial institution partners, merchants, service providers, and affiliates. Notably, the policy authorizes collection and use of transaction-level spending data across Visa's global network for analytics and marketing purposes, which is operationally distinct from typical retail website privacy notices given the scale of payment network data; the agreement asserts broad legitimate interest bases for processing that may face scrutiny under GDPR's balancing test and similar frameworks. The policy engages GDPR and UK GDPR for EU and UK residents, CCPA and CPRA for California residents, and various additional state privacy laws, with Visa acknowledging data subject rights including access, deletion, correction, and portability where applicable; enforcement exposure varies significantly by jurisdiction and user category. U.S. financial transaction data processed in connection with Visa's network role may additionally engage Gramm-Leach-Bliley Act obligations, and the CFPB and FTC both maintain oversight authority over practices described in this notice.