Effective: May 23, 2018
CardinalCommerce (“Cardinal”) is committed to protecting the privacy and security of your Personal Information. The information you share with us allows us to provide the best experience with our products and services. We have a Global Privacy Program that protects all the Personal Information we collect and helps ensure that Personal Information is handled properly worldwide. Please read below to learn how we collect, use and disclose Personal Information.
This Privacy Notice explains the privacy practices of Cardinal and those Affiliates1 whose websites, platforms or services link to it.
In some places, this Privacy Notice is supplemented with additional information that may be required by law. Please see below for links to additional information provided to residents of certain countries such as for the European Economic Area (EEA).
- What Personal Information Is Collected
- How We Collect Personal Information
- How We Use Personal Information
- Why Personal Information Is Disclosed to Others
- Cookies and Other Data Collection Technologies
- Third Party Advertising Companies and Browser Tracking Information
- Social Media Interactions and Interest-based Ads
- Your Choices
- Access and Correction
- International Transfers
- Information Security and Data Retention
- Privacy Policies of Third Parties
- Job Applicants
- Children’s Data
- Changes to this Privacy Notice
- How to Contact our Global Privacy Office
1. What Personal Information Is Collected
Personal Information is any information that we can use to identify, locate or contact you. It also includes other information that may be associated with your Personal Information, such as demographic data. We may collect the following types of Personal Information:
- Contact Information that allows us to communicate with you, such as your name, username, mailing address, telephone number, email address or other addresses that allow us to send you messages.
- Card Transaction Data about your purchases or other transactions using your payment cards, such as your payment card number, the location of the transaction, the time and date of the transaction, enhanced transaction information, and the amount of the transaction.
- Information about your Interactions with us, such as data collected when you:
- Use our products, services, websites or apps (including information collected using Cookies and Other Data Collection Technologies described below).
- Visit our webpage to request information about our products and services.
- Opt-in or out of marketing or offers, and other activities.
2. How We Collect Personal Information
We collect Personal Information from you and from other sources.
- In many cases, we collect Personal Information directly from you. You may choose to share Personal Information with us when you register on our website, or sign up to receive messages from us. We also collect Personal Information from you when you contact us, such as for customer service purposes, or interact with us online.
- We receive Personal Information (including Card Transaction Data) from your payment card issuer, merchants, acquirers, payment processors, service providers, and other third parties.
- We may collect information from publicly-available sources, such as social media sites, when permitted by the site’s terms of service. For example, if you communicate with us using Facebook or Twitter, we may receive additional information about you from your profile. We may also obtain information from third party data suppliers who help us enhance our records.
- We collect information about your interactions with us when you visit our website, engage with our online advertisements, or call us. For example, when you use our website, we and our service providers may collect information by setting and accessing cookies and using similar tracking technologies on your computer or device, as described in the Cookies and Other Data Collection Technologies section below. We treat this information as Personal Information when it is associated with other data elements that allow us to identify, locate or contact you.
3. How We Use Personal Information
We may use your Personal Information to:
- Enable authentication of your payment card transactions, including for related purposes, such as authentication and fraud prevention.
- Operate our authentication products and services (such as fraud solution services).
- Provide you with additional information that may be of interest, such as news and announcements.
- Where appropriate, provide you with marketing communications for products and services from us, including personalized offers and content based on your interactions with us and usage of our products.
- Generate anonymized and aggregated datasets, which can be used for modeling, reporting, and analytics, such as to analyze payment, transaction or similar trends.
- Manage our everyday business needs, such as for our internal account management, client reporting, contract management, website administration, business continuity and disaster recovery, security and fraud prevention, corporate governance, reporting and legal compliance.
Please note that we may also use and disclose information about you that is not personally identifiable. For example, we may publish reports and provide products that contain non-personally identifiable statistical data, such as reports showing general payment card usage trends. These reports do not contain any Personal Information.
4. Why Personal Information Is Disclosed to Others
We disclose your Personal Information as follows:
- We may share your Personal Information with the financial institution (or other entity) that issued your payment card (or other payment mechanism) and with merchants, other financial institutions and third parties as needed to process transactions, for risk and fraud management, to provide services to such entities, and for similar purposes and to comply with applicable law.
- We may share your Personal Information with our Affiliates, which may only use your Personal Information for the purposes listed herein.
- We may share your Personal Information with our service providers, who are bound by law or contract to protect your Personal Information and only use your Personal Information in accordance with our instructions.
5. Cookies and Other Data Collection Technologies
When you visit our website, use our mobile applications, or engage with our online ads or email communications, we may collect certain information by automated means, using technologies such as cookies, pixel tags, browser analysis tools, server logs and web beacons.
In many cases, the information we collect using cookies and other tools is only used in a non-identifiable way, without any reference to Personal Information. For example, we use information we collect about all website users to optimize our websites and to understand website traffic patterns.
In some cases, we do associate the information we collect using cookies and other technology with your Personal Information. This Privacy Notice describes how we use that information when we associate it with your Personal Information.
When you visit our websites, we place cookies on your computer. Cookies are small text files that websites send to your computer or other Internet-connected device to uniquely identify your browser or to store information or settings in your browser. Cookies allow us to recognize you when you return. They also help us provide a customized experience and can enable us to detect certain kinds of fraud.
In many cases, you can manage cookie preferences and opt-out of having cookies and other data collection technologies used by adjusting the settings on your browser. All browsers are different, so visit the “help” section of your browser to learn about cookie preferences and other privacy settings that may be available. Please note that if you choose to remove or reject cookies or clear local storage, this could affect the features, availability, and functionality of our websites.
We may use Flash Cookies (also known as Local Stored Objects) and similar technologies to personalize and enhance your online experience. A Flash cookie is a small data file placed on a computer using Adobe Flash technology. The Adobe Flash Player is an application that allows rapid development of dynamic content, such as video clips and animation.
We use Flash cookies to personalize and enhance your online experience and to deliver content for Flash players. We may also use Flash cookies for security purposes, to gather certain website metrics and to help remember settings and preferences. Flash cookies are managed through a different interface than the one provided by your web browser. To manage Flash cookies, please visit Adobe’s website at http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html.
If you disable Flash cookies or other similar technologies, please be aware that you may not have access to certain content and product features.
Pixel Tags and Web Beacons
Pixel tags and web beacons are tiny graphic images and small blocks of code placed on website pages, ads, or in our emails that allow us to determine whether you have performed a specific action. When you access these pages, or when you open an email, the pixel tags and web beacons let us know you have accessed the web page or opened the email. These tools allow us to measure response to our communications and improve our web pages and promotions.
Server Logs and Other Technologies
We collect many different types of information from server logs and other technologies. For example, we collect information about the device you use to access our website, your operating system type, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone where your device is located. Our server logs also record the IP address of the device you use to connect to the Internet. An IP address is a unique identifier that devices require to identify and communicate with each other on the Internet. We may also collect information about the website you were visiting before you came to us and the website you visit after you leave our site. These tools help us better user experience and deliver our services.
We may use device-related information to authenticate users. For example, we may use your IP address, browser information, or other data provided by your browser or device to identify the device being used to access our service. We may also use these device-related techniques for associating you with different devices that you may use to access our content, including for fraud-protection purposes and to better target advertising.
6. Third Party Advertising Companies and Browser Tracking Information
We have relationships with third party advertising companies that place advertisements on and perform tracking and reporting functions for our website and other websites. Although we do not share any Personal Information with these third party advertising companies, they may place cookies on your computer when you visit our website or other websites so that they can display targeted advertisements to you. However, this Privacy Notice does not cover the collection methods or use of the information collected by these companies.
For more information about third party advertising, please visit the Network Advertising Initiative (NAI) at www.networkadvertising.org. To opt out of being targeted by many third party advertising companies by visiting www.networkadvertising.org/consumer/opt_out.asp.
On some our websites, you may see an AdChoices icon, which may appear on certain targeted ads. You may click on this AdChoices icon to learn more information about the collection and use of your information or to opt-out of such collection in the future. Please note that the opt-out is linked to your browser, so if you use different browsers or different devices, you will need to opt-out on each one. Even if you opt-out, you may still receive ads that are not customized for you. To learn more about the Digital Advertising Alliance Consumer Choice tool, please visit http://optout.aboutads.info.
Additional information from the third party advertising companies that we work with:
- Google: For information on how Google Analytics uses data please visit “How Google uses data when you use our partners’ sites or apps”, located at www.google.com/policies/privacy/partners/.
Although our websites currently do not have a mechanism to recognize the various web browser Do Not Track signals, we do offer our customers choices to manage their cookie preferences as described in the previous section. To learn more about browser tracking signals and Do Not Track please visit http://www.allaboutdnt.org/.
7. Social Media Interactions and Interest-based Ads
Our websites may enable you to interact with us and others via social media platforms, such as Facebook, Twitter, and LinkedIn. We may also collect information from publicly-available sources, such as social media sites, as permitted by the site’s terms of service. Please read the social media platform’s privacy statement to understand your privacy and data sharing choices.
We may display interest-based ads to you when you are using platforms such as Facebook and Google when you engage with us as described herein. These platforms allow us to personalize the ads that we display to you. We do not share any of your Personal Information with these platforms for ad-targeting, although we may convert your email address into a unique number that can be matched by the platform with its user to allow delivery of the advertising. Additionally, although we do not provide any Personal Information to these platforms, they may gain insights about individuals who respond to the ads we serve.
8. Your Choices
We offer you different choices about how we communicate with you and use your information.
- You can limit the information you provide to us. Participation in promotions and programs is voluntary.
- You can limit the communications that we send to you. To opt-out of marketing emails, simply click the link labeled “unsubscribe” at the bottom of any marketing email we send you.
Please note that even if you opt-out of marketing emails, we may still need to contact you with important transactional information about your account. For example, even if you opt-out of emails, we may still send you activity confirmations or fraud alerts.
We respect the rights you may have under any applicable privacy laws. If you have any questions about your choices or if you need any assistance with opting-out, please see the contact us section below.
9. Access and Correction
You can contact us to update the information you have provided to us. Additionally, we comply with all applicable laws regarding access and correction. If you need assistance accessing or updating your Personal Information, please see the contact us section below.
10. International Transfers
We are based in the United States and operate a global network with Affiliates and service providers located around the world. As a result, your Personal Information may be transferred to, stored at or processed in other countries, including the United States, which may not have equivalent privacy or data protection laws. However, regardless of where your Personal Information is transferred, we will protect it in accordance with this Privacy Notice and applicable law.
11. Information Security and Data Retention
We use physical, technical, organizational, and administrative safeguards to help protect your Personal Information from unauthorized access or loss. For example, we use technology like encryption to protect sensitive Personal Information (such as your account number) during transmission. We will retain your Personal Information for as long as the information is needed for the purposes listed above and for any additional period that may be required or permitted by law.
12. Privacy Policies of Third Parties
This Privacy Notice only addresses the use and disclosure of information by us and our Affiliates. If you are interacting with us through a social media platform or other site, you should read the privacy notice given to you by that company or site owner. Other websites that may be accessible through this website have their own privacy policies and data collection, use and disclosure practices. We encourage you to familiarize yourself with the privacy statements provided by all third parties prior to providing them with information.
13. Job Applicants
If you have applied for employment with us, the Personal Information submitted with your job application will be used only for recruitment and other customary human resources purposes including any required government reporting and recordkeeping obligations. For more information, please contact us using the information provided under the contact us section below.
14. Children’s Data
Our websites and applications are not directed to children under 16 and we do not knowingly collect any Personal Information directly from children under 16.
15. Changes to this Privacy Notice
From time to time, we may update this Privacy Notice to reflect new or different privacy practices. We will place a notice online when we make material changes to this the Privacy Notice. Additionally, if the changes will materially affect the way we use or disclose previously-collected Personal Information, we will notify you about the change.
16. How to Contact Our Global Privacy Office
If you have questions or comments about our privacy practices, or would like help exercising your rights in accordance with this Privacy Notice, please contact us at [email protected] or [email protected], or by writing to one of the addresses below:
- CardinalCommerce Corporation Global Privacy Office
8100 Tyler Blvd #100
Mentor, OH 44060
- Visa Global Privacy Office
900 Metro Center Boulevard
Forest City, CA 94494
Important Information for:
We are providing the following supplemental information for individuals whose personal information is collected or held by us or any of its Affiliates at a time when the collecting or holding entity has an 'Australian link' within the meaning of the Australian Privacy Law.
Where you are such an individual, you may make a complaint to us about a breach of the Australian Privacy Principles by using the contract details in Part 18 of the Visa Privacy Notice. We will investigate your complaint and endeavor to resolve any issue to your satisfaction. If we do not adequately answer your concerns, you will have the right to make a complaint in writing to the Office of the Australian Information Commissioner.
We collect, uses and discloses Personal Information for the purposes identified in the Privacy Notice, and for any additional purposes, as required by law, with notice to you and your express or implied consent.
2. Opting Out of Third Party Advertising
You may be able to take advantage of the tool developed by the Digital Advertising Alliance of Canada to opt out of third party advertising. Where available, this tool provides a list of parties that may target advertisements based on your online web-browsing activities and the ability to opt out of their use of your information for that purpose. To access the tool, visit https://youradchoices.ca/.
European Economic Area (EEA)
We are providing this supplemental privacy notice to give individuals in the European Economic Area (EEA) the additional information required by the EU General Data Protection Regulation. These provisions, together with the statements in the Privacy Notice above explain our practices regarding EEA personal data.
1. Information about Us
CardinalCommerce Corporation is an Affiliate of Visa, Inc. This information is being provided by us and our Affiliates:
900 Metro Center Boulevard
Foster City, CA 94404
We are based in the United States. Our representative in the EEA is:
Visa Europe Limited
1 Sheldon Square
London, W2 6TT
Registration Number: Z8657396
You can contact the CardinalCommerce Corporation Global Privacy Office by emailing [email protected] or writing to:
CardinalCommerce Corporation Global Privacy Office
8100 Tyler Blvd. #100
Mentor, OH 44060
You can contact the Visa Global Privacy Office by emailing [email protected] or writing to us at:
Visa Global Privacy Office
900 Metro Center Boulevard
Foster City, CA 94404
2. The Purposes and Legal Basis for Processing, including Legitimate Interests
Our Privacy Notice explains the reasons why we process your Personal Information (as defined in our Privacy Notice). We only process Personal Information when we have a legal basis for the processing, as follows:
- To fulfill a contract with you, or as needed to fulfill a contract between you and a merchant or between you and the financial institution or other entity that issued your card, where we are providing payment services or acting as a data processor,
- For closely-related purposes, such as payment processing and financial account management, contract management, website administration, business continuity and disaster recovery, security and fraud prevention, corporate governance, reporting and legal compliance,
- With your consent (or provided you have not objected, or opted-out, as may be appropriate under applicable law), to provide you with marketing communications, or,
- To comply with the laws that are applicable to us around the world.
We may also process your Personal Information for the purposes of our own legitimate interests or for the legitimate interests of others, provided that processing does not and shall not outweigh your rights and freedoms. In particular, we will process your Personal Information as needed to:
- Protect you, us or others from threats (such as security threats or fraud),
- Enable or administer our business, such as for quality control, consolidated reporting, and customer service,
- Manage corporate transactions, such as mergers or acquisitions, and
- Understand and improve our business or customer relationships generally.
3. Automated Decision-Making and Profiling
We use profiling and analytics to understand how individuals use their payment cards and other products, for product development purposes and business intelligence purposes. These analytics help us understand and improve our products and better serve our clients and consumers. We also use analytics for security and anti-fraud purposes, such as to identify unauthorized use of payment cards.
We will not make automated-decisions about you that may significantly affect you, unless (1) the decision is necessary as part of a contract that we have with you, (2) we have your explicit consent, or (3) we are required by law to use the technology.
4. When You are Required to Provide Personal Information to Us
You are not required by law to provide any Personal Information to us. For example, you always decide whether to participate in our promotions or to use our services. You are required to provide certain Personal Information to enable us to enter into a contract with you so that you can use our products and services or participate in promotions. Our registration forms indicate which data elements are required for our contracts.
When we provide payment processing services or acts as a data processor, we receive your Personal Information from third parties as needed to provide services or operate the payment network.
5. Your Rights
You have choices about how we use your Personal Information. You always have the right to object to our marketing communications. You can also object to having your Personal Information used to create anonymized and aggregated marketing reports.
We also respect the rights of EEA residents to access, correct and request erasure or restriction of their Personal Information as required by law. Where we are a data controller, this means:
- You generally have a right to know if we are storing your Personal Information. If we are, you have the right to request that we provide you with a copy of that Personal Information, or in some cases, provide the information to another data controller. If your information is incorrect or incomplete, you have the right to ask us to update it.
- You have the right to object to our processing of your Personal Information. If we are processing your Personal Information based on your consent, you have the right to withdraw your consent at any time.
- You may also ask us to delete or restrict your Personal Information.
To exercise these rights, please contact us via email to [email protected] or write to the Global Privacy Office at the address above and a member of our Privacy Team will assist you. Please understand that we may need to verify your identity before we can process your request.
If we are processing your Personal Information as a data processor, we will refer you to our client (such as to your payment card issuer) for assistance with these requests. We support our clients in responding to requests as required by law.
If you believe that we have processed your Personal Information in violation of applicable law, you may also file a complaint with our Data Protection Officer, who can be reached by contacting the Visa Global Privacy Office, or with a supervisory authority.
6. International Transfers
As noted in the Privacy Notice, your Personal Information may be transferred to, stored at or processed in the United States and other countries that may not have equivalent privacy or data protection laws.
We generally use approved Standard Contractual Clauses to assure that Personal Information is adequately protected when it is transferred out of the European Economic Area or Switzerland, but we may also make transfers to recipients with approved Binding Corporate Rules or to recipients in the United States who have certified to the EU-US and/or Swiss-US Privacy Shield Framework.
Please contact us via email to [email protected] if you would like more information about cross-border transfers or to obtain a copy of the Standard Contractual Clauses.
7. Data Retention
We will retain your Personal Information for as long as the information is needed for the purposes set forth above and for any additional period that may be required or permitted by law. The length of time your Personal Information is retained depends on the purpose(s) for which it was collected, how it’s used, and the requirements to comply with applicable laws. You may request that we delete your Personal Information by contacting us via email to [email protected] or writing to the Global Privacy Office at the address above. If we do not have a legal basis for retaining your information, we will delete it as required by applicable law.
U.S. - Your California Privacy Rights
California Civil Code Section 1798 allows California residents to ask companies with whom they have an established business relationship to provide certain information about the companies’ sharing of Personal Information with third parties for direct marketing purposes. We do not share any California consumer Personal Information with third parties for marketing purposes without consent.
California customers who wish to request further information about our compliance with this law or have questions or concerns about our privacy practices may contact us at [email protected] or [email protected], or by writing to one of the addresses below:
CardinalCommerce Corporation Global Privacy Office
8100 Tyler Blvd, #100
Mentor, OH 44060
Visa Global Privacy Office
900 Metro Center Boulevard
Foster City, CA 94494
1 Our Affiliates are companies that are directly or indirectly controlled by Visa U.S.A. Inc. or its parent company Visa Inc. through ownership—for example, Visa International Service Association, Visa Worldwide Pte. Limited, Visa Canada Corporation, Visa International Servicios de Pago España, S.R.L., Visa Europe Limited, Visa do Brasil Empreendimentos Ltda.