Last Updated: October 30, 2026

 

Table of Contents

1. The personal data we collect
2. How we use your personal data
3. How we disclose your personal data
4. Your rights and choices
5. International transfers
6. How we retain your Personal Data
7. How we keep your data safe
8. This Website May Link to Other Websites
9. Additional Information for European, UK, and Brazilian Users
10. Information for Certain U.S. Residents
11. Changes to this Privacy Notice
12. Contact Us

1. The personal data we collect

We collect personal data about individuals from various sources as described below.

We may collect personal data directly from individuals and the parties with which we do business, including prospects. These may include parties that interact with us directly (such as individuals who download our mobile applications), parties to whom we provide goods or services (such as clients, banks or financial institutions, merchants, individuals) (collectively, “clients”), parties that provide services to us (such as vendors) (collectively, “service providers”), and other parties with whom we offer or provide products and services or who are participants in a transaction processing chain (such as independent sales organizations, card associations, debit network operators and their members, payment aggregators or alternative payment method providers) (collectively, “partners”).

Personal data that we collect directly from individuals

We may collect personal data from individuals in a variety of contexts, such as when completing one of our online forms, making an application for one of our products or services, interacting with us in person, on the phone, by post or email, through chat, or on social media. The types of personal data we obtain include:

• Contact information of those who interact with us, such as name, job title, address, telephone number, and email address
• Information about cardholders, such as name, financial account information, email address, and transaction details
• Information about merchants, such as merchant name, merchant ID and category code, merchant location where a transaction occurred, and information about transactions processed by the merchant, including transaction volume, velocity, amounts, types of goods or services sold, and chargeback ratio
• Profile information, such as username and password that an individual may establish on one of our websites or mobile applications, along with any other information that an individual enters into their account profile
• Demographic details, such as date of birth, country of citizenship and/or country of residence
• Information about individuals’ affiliation with a legal entity, such as an individual’s role, and whether he or she is a beneficial owner or authorized signatory
• Photographs, video footage, audio recordings, electronic, visual, or similar information relating to your interactions with us, written statements, such as those provided or captured during a Fiserv event or when giving a testimonial, CCTV recordings, call center recordings, call monitoring records, and voicemails
• Details of the individual's consent to and release of media and image rights to Fiserv
• Government-issued identification numbers (to the extent permitted under applicable law), such as a national identification number (e.g., a Social Security Number, tax identification number, or passport number), state or local identification number (e.g., a Driver’s License or other government-issued identification number), and a copy of your government-issued identification card
• Usage and interaction data, such as keystroke timing, scroll position, mouse movement, and similar patterns showing how you use our websites and applications
• Feedback and correspondence, such as information you provide when you request information from us, receive customer support, or otherwise correspond with us, including by interacting with our pages on social networking online sites or services, or when we record calls.
• Financial account information, such as payment card or bank account details
• Information related to the use of Fiserv products or services, such as account information, spending thresholds, spending activity and patterns, and information about the transactions we process
• Precise geolocation information, if you authorize us to collect it or if the collection is in compliance with law.
• Marketing information, such as your preferences for receiving marketing communications and details about how you engage with our marketing communications
• The content of your communications with us, including interactions with customer support and contacts through social media channels

Personal data that we collect about individuals from clients, service providers, and partners

We may receive personal data about individuals who do not interact with us directly. For example, our clients, service providers, and partners may provide us with information about individuals other than themselves when using our products or services. If you are providing us with personal data of another individual, please ensure you have brought this Privacy Notice to their attention. The types of information we receive about third parties includes:

• Information about the personnel of our clients, service providers, or partners, such as their business contact information
• Information about customers of our clients that our clients send to us or allow us to collect in the context of the services that Fiserv performs, such as information related to financial transactions initiated by the customer, account registrations, and in some cases information needed to verify a customer’s identity and details of products or services purchased. Where our technology is incorporated into a merchant’s mobile application or website, we also may automatically collect certain information of the type described in the section below titled “Information collected via automated means.”
• Information obtained when processing transactions, such as information about payment transactions
• Information shared by our clients relating to their co-applicants, sureties, guarantors and co-guarantors for the purposes of the assessment or enforcement of a guarantee and indemnity or security.

Personal data we collect from other private and publicly accessible sources

We and our service providers may collect information about individuals that is publicly available, including by searching publicly accessible government lists of restricted or sanctioned persons (such as the Specially Designated Nationals and Blocked Persons List), public records databases (such as company registries and regulatory filings), and by searching media and the internet. We and / or our vendors or partners may also collect information from private or commercially available sources, such as by requesting reports or information from credit reference and fraud prevention agencies, to the extent permitted under applicable law.

We may also maintain pages for our company and our products and services on a variety of third-party platforms, such as LinkedIn, Facebook, X, YouTube, Instagram, and other online platforms. When you interact with our pages on those third-party platforms, the third-party’s privacy policy will govern your interactions on the relevant platform. If the third-party platform provides us with information about our pages on those platforms or your interactions with them (e.g. for lead generation purposes), we will treat that information in accordance with this Privacy Notice.

Information collected via automated means

When you access our websites. use our mobile applications, or interact with our call centers and other digital properties, we, our service providers, and / or our partners may automatically collect information about you, your computer or mobile device, and activity on our websites or mobile applications. Typically, this information includes your computer or mobile device operating system type and version number, manufacturer and model, device identifier, browser type, screen resolution, IP address, the website you visited before browsing to our website, general location information such as city, state or geographic area; and information about your use of and actions on or in our websites or mobile applications, such as pages or screens you accessed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access, and may also include other information about you, including your voiceprint and sentiment.

Our service providers and partners may collect this type of information over time and across third-party websites. This information is collected via various mechanisms, such as via cookies, pixels, tags, web beacons, embedded scripts, through our mobile applications, and similar technologies. This type of information may also be collected when you read our HTML-enabled emails. Please see our Cookie Notice for more detail. Where the law requires your consent before we use non-essential cookies and similar technologies, we ask for it through our cookie banner, and you can change or withdraw your choices at any time using the cookie preferences link on our websites. You can also opt out of the use of your browsing behavior for targeted advertising as described under “Targeted online advertising” in the “Your rights and choices” section below.

In addition, certain products or services that we provide or which clients may incorporate into their websites or mobile applications may automatically collect additional information. If that is the case, that collection maybe further described in a separate privacy notice provided in connection with that website or mobile application.

Sensitive personal data

In limited circumstances, and only where permitted by law and with your consent where consent is required, we may collect and use biometric identifiers — such as a fingerprint or face scan — to confirm your identity when you choose biometric authentication. We use biometric identifiers only to verify identity and prevent fraud. We do not sell biometric identifiers, and we do not disclose them except to service providers acting for us or where the law requires it. In some cases we may also receive information that can reveal health or medical details, such as when we process a transaction at a health care provider or a pharmacy.

We keep biometric identifiers only as long as we need them for the purpose we collected them for, and in no event longer than three years after your last interaction with us, unless a longer period is required by law. When that period ends, we permanently destroy them.

Outside of these contexts or otherwise as we specifically request, we ask that you not provide us with any sensitive personal data (meaning information revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, genetic, health, or biometric information, information about sex life or sexual orientation, or criminal convictions or offenses) through our websites or mobile applications, or otherwise to us. 

2. How we use your personal data

We use your personal data for the purposes of:

Providing our products and services, which includes:

• Operating, evaluating, analyzing, maintaining, improving, and providing the features and functionality of our products and services and usage of those products and services. For these processing activities, we may use techniques such as artificial intelligence and machine learning to process and analyze data
• Fulfilling a payment transaction initiated by you (either with us or our client)
• Managing our relationship with you or your business
• Carrying out our obligations, and exercising our rights, under our agreement with you or your business

• Communicating with you regarding your account or relationship with us, if you have one, or our clients, including by sending you service-related emails or messages (e.g., messages regarding account verification, changes or updates to the functionality of our products or services, technical and security notices and alerts, and support and administrative messages)
• Personalizing the manner in which we provide our products and services
• Checking for fraud or money laundering and/or managing either our or our clients’ risk
• Administering and protecting our business, including responding to civil, criminal, or regulatory lawsuits, subpoenas, or investigations, exercising our rights or defending against legal claims, and resolving complaints and disputes
• Providing support and maintenance for our products and services, including responding to your service-related requests, questions, and feedback

For research and development

We use the information we collect for our own research and development purposes, which include:

• Developing or improving our products and services, which may include training or fine-turning machine learning or other AI models
• Developing and creating analytics and related reporting, such as regarding industry and fraud trends

Marketing

We may use your personal data to form a view on what products or services we think you may want or need, or what may be of interest to you.

We may contact you with marketing communications using the personal data you have provided to us if you have actively expressed your interest in making a purchase or have made a purchase from us and, in any case, you have not opted out of receiving that marketing, to the extent permitted by applicable law.

Where required by law, we will get your express opt-in consent before we disclose your personal data with any company outside of Fiserv for marketing purposes.

We may use the personal data we collect during events or from your testimonials to produce promotional, marketing, and educational materials. This can include photographs, videos, or audio recordings featuring your image or voice, as well as any statements you provide. 

Advertising

We may use your personal data to show you advertising, including advertising that is personalized to you and your interests based on personal data obtained or inferred over time from your activities across nonaffiliated websites, applications, or online services.

Complying with law and regulations

We use your personal data as we believe necessary or appropriate to comply with applicable laws and regulations, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities.

Compliance, fraud prevention and safety

We use your personal data as we believe necessary or appropriate to (a) enforce the terms and conditions that govern our products and services; (b) protect our rights, privacy, safety or property, and/or that of you or others; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

Automated Decisions, Credit Reference Agencies and Fraud Prevention Agencies

We sometimes make automated decisions about you, or use profiling techniques, based on personal data you give us or that we get from others, including credit reference and fraud prevention agencies. We use these decisions for risk assessment, fraud detection, transaction authorization, and product eligibility. In general, our systems compare your information and transaction activity against rules, risk scores, and patterns associated with fraud or credit risk. Depending on the result, a transaction may be declined or held for review, or an application may be declined or sent for manual review. Where the law gives you the right, you can ask us to explain a decision, ask a person to review it, and contest the outcome. See “Your rights and choices” below.

With your consent

We may use your personal data for other reasons with your consent. In some jurisdictions, applicable law may require us to request your consent to use your personal data in certain contexts, such as when we use certain cookies or similar technologies or would like to send you certain marketing messages.  If we request your consent to use your personal data, you may withdraw your consent any time in the manner indicated when we requested the consent or by contacting us. If you have consented to receive marketing communications from our partners, you may withdraw your consent by contacting those partners directly.

To create anonymous, deidentified or aggregate data

We may create anonymous, deidentified, or aggregate data from your personal data and other individuals whose personal data we collect.  We make personal data into anonymous, deidentified, or aggregate data by excluding information that makes the data personally identifiable to you, and use that data for our lawful business purposes.  When we deidentify data, we take reasonable measures to prevent this data from being reidentified.

3. How we disclose your personal data

Companies within Fiserv

We may disclose your personal data to our subsidiaries and corporate affiliates for purposes consistent with this Privacy Notice. 

Service providers

We may employ third party companies and individuals to administer and provide services on our behalf (such as companies that provide customer support, companies that we engage to host, manage, maintain, and develop our website, mobile applications, IT systems, chatbots and other AI tools, and companies that help us process payments). These third parties may use your information for the purposes set out in the section entitled “How we use your personal data” but only as directed by Fiserv and in a manner consistent with this Privacy Notice, and are prohibited from using or disclosing your information for any other purpose.

Our clients

When Fiserv performs services for its clients, it may disclose personal data with those entities. For example, Fiserv may collect information about a client’s customers from or on behalf of the client, such as when Fiserv processes payment transactions, and Fiserv may provide personal data about those customers back to the client. We are not responsible for the privacy practices of our clients.

Your connected parties

We may share information with your co-applicants, sureties, guarantors and co-guarantors for the purposes of the assessment of an application, servicing of your relationship or enforcement of a guarantee and indemnity or security.

Participants in the transaction processing chain

Fiserv discloses personal data with companies in the transaction processing chain in connection with processing a payment transaction, including our partners.

Credit reference, fraud protection, risk management, and identity and verification agencies

Fiserv discloses personal data with credit reference, fraud protection, risk management, and identity verification agencies to help guard against, detect, and respond to fraud or money laundering, and/or manage our or our clients’ risk, as in accordance with law, and to ensure we comply with contractual, legal, or regulatory requirements.

Professional advisors

We may disclose your personal data to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.

Marketing

We may share testimonials or images from events, which may include your personal data in physical or digital media channels as part of our marketing and promotional activities.

Advertising

We may disclose personal data about you, including through cookies, pixels, and other technologies, to enable our advertising, including targeted advertising.

Compliance with Laws and Law Enforcement; Protection and Safety

Fiserv may disclose information about you to government or law enforcement officials (including tax authorities) or private parties as required by law, and disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal process, such as to respond to subpoenas or requests from government authorities; (b) enforce the terms and conditions that govern our products and services; (d) protect our rights, privacy, safety or property, and/or that of you or others; and (e) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

Business Transfers

Fiserv may sell or transfer some or all of its business or assets, including your personal data, in connection with a business transaction (or potential business transaction) such as a merger, consolidation, acquisition, reorganization or sale of assets or in the event of bankruptcy, in which case we will make reasonable efforts to require the recipient to honor this Privacy Notice.

To Other Parties with Your Permission or to Fulfill a Contract They Have With You

Fiserv may transfer your personal data to any third party who is not otherwise covered by the other listed categories above where you have given us permission to do so, or with whom you have entered into a contract when we need to transfer your personal data to that party in order to fulfil that contract. 

4. Your rights and choices

In this section, we describe the rights and choices available to all users. Users who are located in Europe, UK,  Brazil, and certain U.S. states may read additional information about their rights below.

Marketing communications

You can ask us to stop sending you marketing messages at any time by contacting us or clicking on the opt-out link included in each marketing message. You may continue to receive service-related and other non-marketing messages.

Targeted online advertising

Some of our service providers that collect information about users’ activities on our websites or in our mobile applications may be members of organizations or programs that provide choices to individuals regarding the use of their browsing behavior or mobile application usage for purposes of targeted advertising.

Users may opt out of receiving targeted advertising on websites through participating members of the following organizations or programs:

• Network Advertising Initiative (USA)
• Digital Advertising Alliance (USA)
• European Interactive Digital Advertising Alliance (Europe)
• Digital Advertising Alliance of Canada (Canada)
• Australian Digital Advertising Alliance (Australia)
• Data Driven Advertising Initiative (Japan)

Users of mobile applications may opt out of receiving targeted advertising in mobile applications through participating members of the Digital Advertising Alliance by installing the AppChoices mobile application, available here, and selecting the user’s choices. In addition, your mobile device settings may provide functionality to limit our, or our service providers’, ability to engage in ad tracking or targeted advertising using the Google Advertising ID or Apple ID for Advertising associated with your mobile device.

Please note that we also may work with companies that offer their own opt-out mechanisms and may not participate in the opt-out mechanisms that we linked above.

If you choose to opt-out of targeted advertisements, you will still see advertisements online but they may not be relevant to you. Even if you do choose to opt out, not all companies that serve online behavioural advertising are included in this list, and so you may still receive some cookies and tailored advertisements from companies that are not listed.

Do Not Track Signals

Some browsers can be set to send "Do Not Track" signals. Do Not Track is not a uniform standard and we do not respond to it. We do respond to the Global Privacy Control and other opt-out preference signals, as described in the “Information for Certain U.S. Residents” section below. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Choosing not to provide your personal data

Where we request personal data directly from you, you do not have to provide it to us. If you decide not to provide the requested information, in some circumstances we, or our clients, may be unable to provide products or services to you. For example, we may be unable to process your transaction.

Accessing, modifying or deleting your information

In some jurisdictions, applicable law gives individuals the right to access their personal data, correct inaccurate personal data, or delete their personal data in some circumstances. You may contact us to request access to, or correction or deletion of, your information in accordance with the law where you live. We cannot always provide access to, correct, or delete your information. Please see the “Information for Certain U.S. Residents” and “Additional Information for European, UK and Brazilian Users” sections below for detail on how to exercise these rights.

Complaints

If you have a complaint about our handling of your personal data, you may contact our data protection officer using the contact information below. We request that a complaint be made in writing. Please provide details about your concern or complaint so that our data protection officer can investigate it. We will take appropriate action in response to your complaint, which may include conducting internal discussions with relevant business representatives. We may contact you for additional details or clarification about your concern or complaint. We will contact you to inform you of our response to your complaint. You also may have a right to file a complaint with a national or local regulatory agency.

5. International transfers

Fiserv is headquartered in the United States, and it maintains offices and has service providers in other countries, such as the countries listed here. Your personal data may be transferred to the United States or other locations outside of your state, province, country or other governmental jurisdiction where we or our service providers maintain offices and where privacy laws may not be as protective as those in your jurisdiction. If we make such a transfer, we will require that the recipients of your personal data provide data security and protection in accordance with applicable law.

Users should read the important information provided here about transfer of personal data outside of your region / country.

6. How we retain your Personal Data

We keep your personal data only as long as we need it for the purposes described in this Privacy Notice. How long that is depends on the type of data and why we hold it. In deciding, we look at how long we need the data to provide the product or service and manage our relationship with you; how long we must keep it under laws that apply to us, including anti-money laundering, tax, accounting, payment network, and recordkeeping rules; how long we may need it to detect or investigate fraud or to defend legal claims; and how sensitive the data is. For example, we keep transaction records after the transaction to meet financial recordkeeping requirements, and we keep your marketing preferences until you ask us to stop contacting you. When we no longer need personal data, we delete it or make it anonymous.

7. How we keep your data safe

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions or are otherwise subject to appropriate restrictions and they are subject to a duty of confidentiality.

We maintain annual compliance with global Payment Card Industry Data Security Standard (PCI DSS) adopted by the payment card brands for all companies that process, store or transmit cardholder data. 

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. This Website May Link to Other Websites

We may also link to third-party websites, mobile applications, and other content. Fiserv is not responsible for the privacy practices of any third party, and this privacy notice does not apply to such third party’s websites, mobile applications, or other content. Fiserv does not guarantee, approve, or endorse any information, material, services, or products contained on or available through any linked third-party website, mobile application, or other content. Fiserv is not responsible for any content on third-party properties to which we link. Fiserv provides links to third-party properties or content as a convenience, and visiting or using linked third-party properties or content is at your own risk. 

9. Additional Information for European, UK, and Brazilian Users

Controller and Data Protection Officer

Fiserv is made up of different legal entities. References to "Fiserv", "we", "us" or "our" in this Privacy Notice should be read to refer to the relevant company in the Fiserv group responsible for handling your data. We will let you know which member of the Fiserv group is the controller of your data, either in the contract we sign with you or in a privacy notice that relates specifically to our relationship with you. If you are not sure which Fiserv entity is the controller of your data, contact our Data Protection Officer using the details below and we will tell you.

We have appointed a data protection officer (“DPO”) who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice or any privacy related queries, please contact the DPO using the details set out below:

Data Protection Officer, Fiserv

Email address: dpo@fiserv.com

Postal address:

Janus House
Endeavour Drive
Basildon, Essex
SS14 3WF
United Kingdom

Legal bases for processing (EU and UK)

If you are based in Europe or the UK, we are required to inform you of the legal bases of our processing of your personal data, which are described in the table below.  If you have questions about the legal basis of how we process your personal data, Contact Us.

Processing purpose (click link for details) Details regarding each processing purpose listed below are provided in the section above titled “How we use your personal data”.	Legal basis
Providing our products and services	Processing is necessary to perform the contract governing our provision of the products or services or to take steps that you request prior to signing up for the Services.
Marketing and promotion For research and development For compliance, fraud prevention and safety To create anonymous data	These processing activities constitute our legitimate interests.  We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
To comply with law	Processing is necessary to comply with our legal obligations
With your consent	Processing is based on your consent. Where we rely on your consent you have the right to withdraw it anytime in the manner indicated at the time we collect your information or by contacting us via the following link here

 

 

Use for new purposes

We may use your personal data for reasons not described in this Privacy Notice where permitted by law and the reason is compatible with the purpose for which we collected it.

Automated Decisions, Credit Reference Agencies and Fraud Prevention Agencies

We will not make automated decisions or conduct profiling that will significantly affect you, unless it is necessary for a contract, authorized by law, or based on your explicit consent.

How long will you use my personal data?

We will use your personal data for as long as necessary based on why we collected it and what we use it for. This may include our need to satisfy a legal, regulatory, accounting, or reporting requirement.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In general terms, we will retain your personal data for the duration of your involvement/engagement with us and for as long as reasonably necessary afterwards; however, we may maintain different retention periods for different products and services. There are also certain types of information which are required to be retained for a certain period by law.

Your individual legal rights

Under certain circumstances, individuals in Europe, the UK and Brazil have rights under data protection laws in relation to their personal data. If you are located in Europe, UK or Brazil, you may ask us to take the following actions regarding personal data that we hold:

• Access. You are entitled to ask us if we are processing your personal data and, if so, for a copy of the personal data we hold about you, as well as obtain certain other information about our processing activities.
• Correction. If any personal data we hold about you is incomplete or inaccurate, you can require us to correct it, though we may need to verify the accuracy of the new data you provide to us.
• Erasure. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.  If you are in Brazil, you may also ask us to anonymize or block personal data that is excessive, unnecessary or where we may have processed your information unlawfully.
• Object. Where our reason for processing your personal data is legitimate interest you may object to processing as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Restriction. You may ask us to suspend our use of your personal data in the following scenarios:
  • if you want us to establish the data's accuracy;
  • where our use of your personal data is unlawful but you do not want us to erase it;
  • where you need us to hold your data for a longer period than we usually would, because you need it to establish, exercise or defend legal claims; or
  • you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Transfer / Portability. Where it is possible, we will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to personal data provided by you which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent. Where our reason for processing is based on your consent, you may withdraw that consent at any time. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Automated decision making. You have the right not to be subject to automated decision making (e.g., profiling) that significantly affects you. The exercise of this right is not available to you in the following cases:
  • The automated decision is required to enter into, or perform, a contract with you.
  • We have your explicit consent to make such a decision.
  • The automated decision is authorised by local law of an EU member state.

However, in the first two cases set out above, you still have the right to obtain human intervention in respect of the decision, to express your point of view and to contest the decision.

You can submit requests to exercise these rights by contacting the Fiserv Privacy Office using the following link here. We may need to request specific information from you to help us confirm your identity and ensure you are entitled to exercise a right in respect of your personal data, for example, a merchant identification number or account number. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

There may be legal or other reasons why we cannot, or are not obliged to, fulfil a request to exercise your rights. We will use available lawful exemptions to your individual rights to the extent appropriate. If we decline your request, we will tell you why, subject to legal restrictions.

You will not have to pay a fee to exercise any of your rights relating to your personal data. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We will respond to all legitimate requests promptly and, in any event, within any timeframes prescribed by applicable law. In general, we must respond to queries within one month from the receipt of the request, so it is important that requests are identified and submitted using the following link here as soon as possible. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. Any transmission of your personal data will be handled in a secure manner.

If you are located in Europe, you also have the right to make a complaint at any time to a supervisory authority (for more information go to https://www.edpb.europa.eu/about-edpb/our-members_en). If you are located in the UK, you also have a right to make a complaint to the ICO. If you are located in Brazil, you also have a right to make a complaint to the Brazilian National Data Protection Authority (ANPD).

Cross-border data transfer

We transfer your personal data within the Fiserv group, including outside of Europe or the UK. Sometimes we transfer your personal data out of Europe within the Fiserv group to countries not deemed by the European Commission or ICO to provide an adequate level of protection for personal data, the transfer will be based on our Binding Corporate Rules, a copy of which can be found here. FDR LLC is the group company responsible for compliance with our Binding Corporate Rules.

When we transfer personal data outside of Europe, within the group where the Binding Corporate Rules do not apply, or to third parties in countries not deemed by the European Commission to provide an adequate level of protection for personal data, the transfer will be made pursuant to:

• A contract approved by the European Commission (called “Standard Contractual Clauses”);
• The recipient’s Binding Corporate Rules;
• The consent of the individual to whom the personal data relates; or
• Other mechanisms or legal grounds as may be permitted under applicable European law

Please contact us if you would like to receive further information on the specific mechanism used by us when transferring your personal data out of Europe.

10. Information for Certain U.S. Residents

Some U.S. states require us to explain to residents how we collect, use, and disclose their personal data and what rights and choices we offer them. This section applies to you only if you live in one of these states, which as of the date of this Privacy Notice include California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. This section does not apply to data about you that is regulated by U.S. financial privacy laws, such as the Gramm-Leach-Bliley Act or the Fair Credit Reporting Act. For example, it does not apply to information we obtain about you in connection with providing a financial product or service for your personal, family, or household purposes.

This section also does not apply to personal data of individuals acting in a commercial or employment context other than individuals in California or other states which expressly define those individuals as consumers.

Your Rights

Depending on the state you live in, you may have some or all of the following rights over the personal data we collect, process, and disclose:

• To access personal data we maintain about you, including in a readily usable format that allows you to easily transfer the data;
• To correct personal data we maintain about you if it is inaccurate;
• To delete personal data we maintain about you; and
• To obtain information about how we process your personal data, including the parties to whom we have disclosed your personal data;
• To opt out of the sale or sharing of your personal data and of the use of your personal data for targeted advertising;
• To limit our use and disclosure of your sensitive personal data; and
• To opt out of profiling used to make decisions that have a legal or similarly significant effect on you, such as decisions about credit or account eligibility.
  
  

You may request to exercise these rights by visiting www.fiserv.com/privacyrequests  or, if you are a resident of California, by calling 1-888-999-1114. 

You are entitled to exercise these rights free from discrimination. We will not deny you goods or services, charge you a different price or rate, give you a lower quality of service, or suggest that we will do any of those things because you exercised your rights.

Identify verification. Applicable Laws require us to verify the identity of the individual submitting the request before providing a substantive response to the request. A request must be provided with sufficient detail to allow us to understand, evaluate and respond. The requester must provide sufficient information to allow us to reasonably verify that the individual is the person about whom we collected information. In accordance with some states’ laws, a request may also be made on behalf of your child.

Authorized agents. You can authorize someone else to submit a request for you. We will ask that person for written proof that you gave them permission, and we may contact you to confirm it.

These rights are not absolute, and we may decline your request where the law permits. Depending on the state you live in, you may appeal a denial through the requests portal or by email to dpo@fiserv.com. We will respond to an appeal within the time your state’s law requires, generally 45 or 60 days, and we will tell you how to contact your state attorney general if you disagree with our decision.

Sale or Sharing of Personal Information

You have the right to opt-out of our sale or sharing of your personal data or the use of your personal data for targeted advertising purposes by taking the following steps:

• Opt out of disclosures via cookies, pixels, and other technologies. Our websites and online services may use analytics and advertising tools that let us and our analytics and marketing service providers engage in targeted advertising or cross-context behavioral advertising, as those terms are defined under relevant laws. This may include collecting and disclosing internet or other electronic network activity information based on your activity across our services and sites, including to analyze how you use our services and to show you advertisements that are relevant to you. To opt out, click the “Do Not Sell or Share My Personal Information” link at the bottom of this page and turn off advertising and analytics cookies.

We also support the Global Privacy Control, which is a browser-based opt-out preference signal that communicates your privacy preferences to the websites you visit. For more information on the Global Privacy Control, please visit its website here. Note that because the Global Privacy Control and other choices available to you may be a browser-based mechanism, your opt-out preferences will apply only to the browser from which you exercised that choice. You are welcome, however, to enable the Global Privacy Control on all of your browsers and devices.

• Opt out of other ways in which we may sell or share your personal data. To the extent that we otherwise sell or share personal information outside our use of these technologies, you may request to opt out by visiting www.fiserv.com/privacyrequests. For example, please use this form to request to opt out of the sale of California merchant personal information subject to applicable laws to credit reference and other companies engaged in data collection and analysis, such as in the context of personal information that is sold for business credit purposes.

Fiserv’s services are intended for adults. We do not knowingly collect personal data from anyone under 16. We do not sell or share the personal data of consumers under 16, and we do not use or disclose their sensitive personal data for any purpose that requires consent. If you believe a minor has given us personal data, please contact us and we will delete it.

Sensitive Personal Information

We collect some sensitive personal data, such as government-issued identification numbers, financial account information, precise geolocation if you allow it, biometric identifiers used for authentication, and information that can reveal health or medical details. We use and disclose sensitive personal data only for the purposes described in this Privacy Notice, such as verifying your identity, providing the products and services you ask for, processing transactions, preventing fraud, and complying with law. We do not use sensitive personal data to infer characteristics about you, we do not sell it, and we do not share it for cross-context behavioral advertising. Some states give you the right to limit our use and disclosure of sensitive personal data. You can exercise that right at www.fiserv.com/privacyrequests or, if you are a resident of California, by calling 1-888-999-1114. Some states also require your consent before we process sensitive personal data. Where that is the case, we will ask for your consent and you may withdraw it at any time.

Consumer Health Data (Washington, Nevada, and Connecticut)

Because we process payments, we may receive information that suggests you visited a health care provider or bought health-related goods — for example, the name and category of the merchant and the amount you paid. If you live in Washington, Nevada, or Connecticut, the laws of those states treat this as consumer health data. We use it only to process and support your transaction, prevent fraud, and comply with law. We do not sell such consumer health data and we do not use it for advertising. You can ask us to access or delete your consumer health data at www.fiserv.com/privacyrequests or by calling 1-888-999-1114.

Additional Information for California residents: Personal information that we collect, use and disclose

The chart below summarizes our collection, use and disclosure of California Personal Information during the last 12 months. We describe the sources through which we collect your California Personal Information in section above titled The Personal Data We Collect, and describe the purposes for which we collect, use, and disclose this California information in section above titled How We Use Your Personal Data and How We Share Your Personal Data.

Categories of Information We Collect (California only)	Do we collect this information?	Do we disclose this information for business purposes?	Do we sell or share this information, or use it for targeted advertising?
Identifiers	Yes	Yes	Yes
Online	Yes	Yes	Yes
Protected	Age possible	Yes	No
Commercial	Yes	Yes	Yes
Biometric Information	Possible for authentication	Yes	No
Internet or Network Information	Yes	Yes	Yes
Geolocation Data	Yes, if you authorize	Yes	No
Professional or Employment Information	Possible	Yes	Yes
Education Information	Possible	Yes	No
Inferences	Yes	Yes	Yes
Financial Information	Yes	Yes	Merchant information only, for business credit purposes
Medical Information	Possible	Yes	No
Sensitive Personal Data (including government-issued ID numbers, financial account information, precise geolocation, biometric identifiers, and information that can reveal health details)	Yes	Yes	No

 

Please note that we may also disclose California personal information for our Everyday Business Purpose and to comply with law, and for compliance, fraud prevention, and safety purposes; in the event of business transfers; and to our professional advisors, and as further described above in Section 3 of this Privacy Notice.

We will retain your California Personal Information as set forth above.

 

Glossary
Categories of California Personal Information	Examples of Elements Within the Category
Biometric Information	An individual’s physiological, biological or behavioral characteristics, including information pertaining to an individual’s DNA, that is used or is intended to be used, singly or in combination with each other or with other identifying data, to establish an individual’s identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a face print, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
Commercial Information	Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Transaction History	Products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Financial Information	Bank account number, debit or credit card numbers, insurance policy number, and other financial information.
Geolocation Data	Precise location, e.g., derived from GPS coordinates or telemetry data.
Identifiers	Real name, alias, postal address, unique personal identifier, customer number, email address, account name other similar identifiers.
Inferences	Inferences drawn from any personal information collected to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Government-issued ID	Social security number, driver’s license, passport, or other government-issued ID, including an ID number or image.
Medical Information	Personal information about an individual’s health or healthcare, including health insurance information.
Internet or Network Information	Browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement.
Online Identifiers	An online identifier or other persistent identifier that can be used to recognize a person, family or device, over time and across different services, including but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers (i.e., the identification of a person or a device to a degree of certainty of more probable than not) that can be used to identify a particular person or device.
Physical Description	An individual’s physical characteristics or description (e.g., hair color, eye color, height, weight).
Professional or Employment Information	Information relating to a person's current, past or prospective employment or professional experience (e.g., job history, performance evaluations), and educational background.
Protected Classification Characteristics	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). Racial or ethnic origin, religious or philosophical beliefs, genetic data, and personal information collected and analyzed concerning a consumer’s sex life or sexual orientation are considered to be sensitive personal information under the CCPA.
Sensory Information	Audio, electronic, visual, thermal, olfactory, or similar information.
Every-day Business Purposes	This means the use of personal information for our operational purposes, or other notified purposes, which may include: (1) auditing relating to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards, (2) helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes, (3) debugging to identify and repair errors that impair existing intended functionality, (4) short-term transient use  including, but not limited to, nonpersonalized advertising shown as part of a consumer’s current interaction with us, (5) performing services on behalf of a business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business, (6) providing advertising and marketing services (other than cross-contextual behavioral advertising), (7) undertaking internal research for technological development and demonstration, and (8) undertaking activities to verify or maintain the quality or safety of our products and services and to improve, upgrade, or enhance our products and services.

11. Changes to this Privacy Notice

We reserve the right to modify this Privacy Notice at any time. We encourage you to periodically review this page for the latest information on our privacy practices. If we make material changes to this Privacy Notice, we will notify you by updating the date of this Privacy Notice and posting it on our website and in app stores where our mobile applications covered by this Privacy Notice are available for download. We may (and, where required by law, will) also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via e-mail (if you have an account where we have your contact information) or another manner through our website or mobile applications.

Any modifications to this Privacy Notice will be effective upon our posting of the new terms and/or upon implementation of the new changes (or as otherwise indicated at the time of posting). In all cases, your continued use of our products or services after the posting of any modified Privacy Notice indicates your acceptance of the terms of the modified Privacy Notice.

12. Contact Us

You may contact our Data Protection Officer at dpo@fiserv.com with any questions about this Privacy Notice. If you want to exercise your privacy rights, please use www.fiserv.com/privacyrequests.

We also maintain a Data Privacy Hotline, which is available 24 hours per day from the United States, at +1 800-368-1000. The Hotline is the most appropriate contact for an urgent concern, such as to report a suspected data breach regarding your personal data; or, if you are a merchant, data of your customers.

For questions about your credit or debit card or your purchase, please contact the financial institution that issued your card or the merchant.