Your Privacy Rights

Effective date: October 7, 2024

U.S. State Privacy Laws Supplementary Notice

This supplemental privacy notice only applies to residents of certain U.S. States whose information is processed pursuant to applicable U.S. State law privacy requirements, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”) and the Oregon Consumer Privacy Rights Act (“OCPA”) (collectively, “State Privacy Laws”).

At Visa, we are committed to safeguarding the privacy and security of all the Personal Information that is entrusted to us. Visa has a Global Privacy Program to help ensure your information is handled properly, and your Personal Information is protected. It also reflects the requirements of the privacy laws in all the countries and states where Visa operates.

In the United States, payment transaction and other information Visa processes in connection with operating its electronic payments networks often is regulated by existing federal financial privacy laws. State Privacy Laws recognize that, where such financial information is already protected by federal privacy law, these State Privacy Laws do not apply to this information. Visa’s privacy program reflects the sensitivity of the financial and other information we handle. If you have questions about how we handle your data, please review the Visa Global Privacy Notice. 

Visa also processes certain information that is subject to State Privacy Laws. State Privacy Laws may apply (1) to our marketing data, which we collect when consumers sign up for marketing from Visa, attend Visa-sponsored events, participate in surveys, or interact with our websites and apps, and (2) to information collected from individuals who use our Visa-branded products, for example click-to-pay or Visa Payment Passkey Services. This supplemental privacy notice explains our practices for this State Privacy Law-covered information.

For information that Visa collects subject to State Privacy Laws, the Visa Global Privacy Notice describes the categories of Personal Information that we may have collected or disclosed for business purposes in the past 12 months, the sources of the Personal Information, the business or commercial purposes for which we use or disclose the information, and the categories of third parties to whom we disclose the information for business purposes.  

Visa retains the Personal Information it has collected as long as the information is needed for the purposes set for in the Visa Global Privacy Notice and this U.S. State Privacy Laws supplement, and for any additional period that may be required or permitted by law. The length of time your Personal Information is retained depends on the purpose(s) for which it was collected, how it is used, and the requirements to comply with applicable laws.

State Privacy Laws provide their residents with specific privacy rights, including the right to correct inaccurate Personal Information, delete Personal Information, and access Personal Information and other information about our Personal Information processing practices, including in a portable format. Some State Privacy Laws may also give their residents the right to appeal our decisions with respect to your privacy rights requests. As described further in the sections below, State Privacy Laws may also give their residents the right to opt-out of having their Personal Information sold, processed for targeted advertising purposes¹, or used for profiling in certain contexts, as well as certain rights in relation to the processing of their sensitive Personal Information. Finally, State Privacy Laws may give their residents the right not to receive discriminatory treatment for the exercise of any of these privacy rights.

¹ Personal Information of children under 16 cannot be sold or processed for targeted or cross-context behavioral advertising purposes without affirmative consent. Visa does not knowingly sell or process children’s information for these purposes.