Technical and organizational measures to ensure that Personal Data collected for different purposes can be processed separately include: – Separation of databases; – "Internal client" concept / limitation of use; – Segregation of functions (production/testing); – Procedures for storage, amendment, deletion, transmission of data for different purposes. Covered Programs Privacy and Data Protection Standards Annex 2 to Appendix D: Technical and Organizational Measures Ensure the Security of the Data Security Rules and Procedures—Merchant Edition • 7 February 2023

Appendix E Definitions The following terms as used in this manual have the meanings set forth below. Acceptance Mark................................................................................................................................................176 Acceptor...............................................................................................................................................................176 Access Device......................................................................................................................................................176 Account.................................................................................................................................................................177 Account Enablement System...........................................................................................................................177 Account Holder....................................................................................................................................................177 Account PAN........................................................................................................................................................177 Account PAN Range........................................................................................................................................... 177 Acquirer................................................................................................................................................................177 Activity(ies)..........................................................................................................................................................177 Affiliate Customer, Affiliate..............................................................................................................................178 Applicable Data Protection Law......................................................................................................................178 Area of Use..........................................................................................................................................................178 Association Customer, Association..................................................................................................................178 ATM Access Fee...................................................................................................................................................179 ATM Owner Agreement.....................................................................................................................................179 ATM Terminal.......................................................................................................................................................179 ATM Transaction.................................................................................................................................................179 Authenticating Entity........................................................................................................................................ 179 Automated Teller Machine (ATM)....................................................................................................................179 Bank Branch Terminal........................................................................................................................................180 BIN.........................................................................................................................................................................180 Brand Fee.............................................................................................................................................................180 Brand Mark..........................................................................................................................................................180 Card.......................................................................................................................................................................180 Cardholder...........................................................................................................................................................180 Cardholder Communication............................................................................................................................. 181 Cardholder Verification Method (CVM)..........................................................................................................181 Chip Card (Smart Card, Integrated Circuit Card, IC Card, or ICC)........................................................... 181 Chip-only MPOS Terminal.................................................................................................................................181 Chip Transaction.................................................................................................................................................182 Cirrus Acceptance Mark.................................................................................................................................... 182 Cirrus Access Device...........................................................................................................................................182 Cirrus Account.....................................................................................................................................................182 Definitions Security Rules and Procedures—Merchant Edition • 7 February 2023

Cirrus Brand Mark...............................................................................................................................................182 Cirrus Card...........................................................................................................................................................182 Cirrus Customer..................................................................................................................................................183 Cirrus Payment Application..............................................................................................................................183 Cirrus Word Mark................................................................................................................................................183 Competing ATM Network..................................................................................................................................183 Competing EFT POS Network......................................................................................................................... 183 Competing International ATM Network.........................................................................................................184 Competing North American ATM Network....................................................................................................184 Consumer Device Cardholder Verification Method, Consumer Device CVM, CDCVM...........................184 Contact Chip Transaction.................................................................................................................................184 Contactless Payment Device............................................................................................................................185 Contactless Transaction....................................................................................................................................185 Control, Controlled.............................................................................................................................................185 Corporation..........................................................................................................................................................185 Corporation System...........................................................................................................................................186 Credentials Management System...................................................................................................................186 Cross-border Transaction..................................................................................................................................186 Customer.............................................................................................................................................................186 Customer Report................................................................................................................................................186 Data Storage Entity (DSE)...............................................................................................................................186 Data Subject.......................................................................................................................................................186 Device Binding.....................................................................................................................................................187 Digital Activity(ies).............................................................................................................................................187 Digital Activity Agreement................................................................................................................................187 Digital Activity Customer..................................................................................................................................187 Digital Activity Service Provider (DASP)........................................................................................................ 187 Digital Activity Sponsoring Customer.............................................................................................................188 Digital Goods.......................................................................................................................................................188 Digital Wallet.......................................................................................................................................................188 Digital Wallet Operator (DWO).......................................................................................................................188 Digital Wallet Operator Mark, DWO Mark.................................................................................................... 188 Digital Wallet Operator (DWO) Security Incident, DWO Security Incident............................................ 188 Digitization, Digitize...........................................................................................................................................189 Domestic Transaction........................................................................................................................................189 Dual Interface......................................................................................................................................................189 Electronic Money.................................................................................................................................................189 Electronic Money Institution.............................................................................................................................189 Electronic Money Issuer.....................................................................................................................................189 Definitions Security Rules and Procedures—Merchant Edition • 7 February 2023

EMV Mode Contactless Transaction...............................................................................................................190 End User...............................................................................................................................................................190 Gateway Customer............................................................................................................................................190 Gateway Processing...........................................................................................................................................190 Gateway Transaction.........................................................................................................................................190 Global Collection Only (GCO) Data Collection Program.............................................................................190 Host Card Emulation (HCE).............................................................................................................................191 Hybrid Terminal...................................................................................................................................................191 ICA.........................................................................................................................................................................191 Identification & Verification (ID&V).................................................................................................................191 Independent Sales Organization (ISO)...........................................................................................................191 Installment Lending Agreement...................................................................................................................... 191 Interchange System...........................................................................................................................................192 Interregional Transaction..................................................................................................................................192 Intracountry Transaction...................................................................................................................................192 Intra–European Transaction.............................................................................................................................192 Intra–Non–SEPA Transaction...........................................................................................................................192 Intraregional Transaction..................................................................................................................................193 Issuer.....................................................................................................................................................................193 License, Licensed.................................................................................................................................................193 Licensee................................................................................................................................................................193 Maestro................................................................................................................................................................193 Maestro Acceptance Mark................................................................................................................................193 Maestro Access Device......................................................................................................................................193 Maestro Account.................................................................................................................................................194 Maestro Brand Mark..........................................................................................................................................194 Maestro Card...................................................................................................................................................... 194 Maestro Customer.............................................................................................................................................194 Maestro Payment Application..........................................................................................................................194 Maestro Word Mark...........................................................................................................................................194 Magnetic Stripe Mode Contactless Transaction...........................................................................................195 Manual Cash Disbursement Transaction........................................................................................................195 Marks....................................................................................................................................................................195 Mastercard...........................................................................................................................................................195 Mastercard Acceptance Mark.......................................................................................................................... 195 Mastercard Access Device.................................................................................................................................195 Mastercard Account...........................................................................................................................................196 Mastercard Biometric Card..............................................................................................................................196 Mastercard-branded Application Identifier (AID).........................................................................................196 Definitions Security Rules and Procedures—Merchant Edition • 7 February 2023

Mastercard Brand Mark.....................................................................................................................................196 Mastercard Card.................................................................................................................................................196 Mastercard Cloud-Based Payments............................................................................................................... 196 Mastercard Consumer-Presented QR Transaction.......................................................................................197 Mastercard Customer........................................................................................................................................197 Mastercard Digital Enablement Service.........................................................................................................197 Mastercard Europe.............................................................................................................................................197 Mastercard Incorporated..................................................................................................................................197 Mastercard Payment Application....................................................................................................................197 Mastercard Safety Net......................................................................................................................................198 Mastercard Symbol............................................................................................................................................198 Mastercard Token...............................................................................................................................................198 Mastercard Token Account Range...................................................................................................................198 Mastercard Token Vault.....................................................................................................................................198 Mastercard Word Mark..................................................................................................................................... 199 Member, Membership........................................................................................................................................199 Merchandise Transaction.................................................................................................................................. 199 Merchant..............................................................................................................................................................199 Merchant Agreement.........................................................................................................................................199 Merchant Token Requestor...............................................................................................................................199 Mobile Payment Device.....................................................................................................................................200 Mobile POS (MPOS) Terminal..........................................................................................................................200 MoneySend Payment Transaction...................................................................................................................200 Multi-Account Chip Card...................................................................................................................................200 Multi-Factor Authentication Method, MFA Method.....................................................................................200 Non-Mastercard Funding Source.....................................................................................................................200 Non-Mastercard Receiving Account................................................................................................................201 Non-Mastercard Systems and Networks Standards...................................................................................201 On-behalf Token Requestor..............................................................................................................................201 On-Device Cardholder Verification..................................................................................................................201 Originating Account Holder..............................................................................................................................201 Originating Institution (OI)...............................................................................................................................201 Ownership, Owned.............................................................................................................................................201 Participation........................................................................................................................................................202 Pass-through Digital Wallet............................................................................................................................. 202 Pass-through Digital Wallet Operator (DWO)..............................................................................................202 Payment Account Reference (PAR).................................................................................................................202 Payment Application..........................................................................................................................................202 Payment Facilitator...........................................................................................................................................202 Definitions Security Rules and Procedures—Merchant Edition • 7 February 2023

Payment Transaction.........................................................................................................................................203 Payment Transfer Activity(ies) (PTA)..............................................................................................................203 Personal Data......................................................................................................................................................203 Point of Interaction (POI)..................................................................................................................................203 Point-of-Sale (POS) Terminal...........................................................................................................................203 Point–of–Sale (POS) Transaction....................................................................................................................204 Portfolio................................................................................................................................................................204 Principal Customer, Principal............................................................................................................................204 Processed PTA Transaction...............................................................................................................................204 Processed Transaction.......................................................................................................................................204 Processing of Personal Data.............................................................................................................................205 Program................................................................................................................................................................205 Program Service..................................................................................................................................................205 PTA Account.........................................................................................................................................................205 PTA Account Number.........................................................................................................................................205 PTA Account Portfolio........................................................................................................................................205 PTA Agreement...................................................................................................................................................206 PTA Customer.....................................................................................................................................................206 PTA Originating Account...................................................................................................................................206 PTA Program.......................................................................................................................................................206 PTA Receiving Account.......................................................................................................................................206 PTA Settlement Guarantee Covered Program..............................................................................................206 PTA Settlement Obligation ..............................................................................................................................207 PTA Transaction..................................................................................................................................................207 Quick Response (QR) Code ..............................................................................................................................207 Receiving Account Holder..................................................................................................................................207 Receiving Agent...................................................................................................................................................207 Receiving Customer............................................................................................................................................207 Receiving Institution (RI)....................................................................................................................................207 Region...................................................................................................................................................................207 Remote Electronic Transaction ....................................................................................................................... 208 Service Provider.................................................................................................................................................. 208 Settlement Obligation.......................................................................................................................................208 Shared Deposit Transaction.............................................................................................................................208 Solicitation, Solicit..............................................................................................................................................208 Special Issuer Program......................................................................................................................................209 Sponsor, Sponsorship.........................................................................................................................................209 Sponsored Digital Activity Entity.....................................................................................................................209 Sponsored Merchant..........................................................................................................................................209 Definitions Security Rules and Procedures—Merchant Edition • 7 February 2023

Sponsored Merchant Agreement.....................................................................................................................210 Staged Digital Wallet........................................................................................................................................210 Staged Digital Wallet Operator (DWO).........................................................................................................210 Standards............................................................................................................................................................210 Stand-In Parameters.........................................................................................................................................211 Stand-In Processing Service.............................................................................................................................211 Strong Customer Authentication (SCA)........................................................................................................211 Sub-licensee.........................................................................................................................................................211 Terminal................................................................................................................................................................211 Third Party Processor (TPP)..............................................................................................................................211 Token.....................................................................................................................................................................212 Tokenization, Tokenize........................................................................................................................................212 Token Requestor..................................................................................................................................................212 Token Vault...........................................................................................................................................................212 Transaction..........................................................................................................................................................212 Transaction Data................................................................................................................................................212 Transaction Management System..................................................................................................................213 Trusted Service Manager...................................................................................................................................213 Virtual Account....................................................................................................................................................213 Volume..................................................................................................................................................................213 Wallet Token Requestor.....................................................................................................................................213 Word Mark...........................................................................................................................................................213 Inter-European Transaction..............................................................................................................................214 Definitions Security Rules and Procedures—Merchant Edition • 7 February 2023

Additional and/or revised terms may also be used for purposes of the Rules in a particular chapter or section of this manual. Acceptance Mark Any one of the Corporation’s Marks displayed at a Point of Interaction (POI) to indicate brand acceptance. See Cirrus Acceptance Mark, Maestro Acceptance Mark, Mastercard Acceptance Mark. Acceptor The Merchant, Sponsored Merchant, ATM owner, or other entity that accepts a Card pursuant to a Merchant Agreement, Sponsored Merchant Agreement, or ATM Owner Agreement for purposes of conducting a Transaction. Access Device A device other than a Card that has successfully completed all applicable Mastercard certification and testing requirements, if any, and:

• Uses at least one Payment Application provisioned to the device by or with the approval of a Customer to provide access to an Account;
• Supports the transmission or exchange of data using one or both of the following: – Magnetic stripe or chip data containing a dynamic cryptogram to or with a Terminal, as applicable, by implementing the EMV Contactless Specifications (Book D) to effect Transactions at the Terminal without requiring direct contact of the device to the Terminal – Chip data containing a dynamic cryptogram to or with a Terminal, as applicable, by implementing the Mastercard Cloud-Based Payments (MCBP) documentation to effect Transactions at the Terminal by capture of a QR Code containing the Transaction Data
• May also support the transmission of magnetic stripe data containing a dynamic cryptogram to a Terminal to effect Transactions identified by the Acquirer in Transaction messages as magnetic stripe Transactions. A Cirrus Access Device, Maestro Access Device, and Mastercard Access Device is each an Access Device. Also see Mobile Payment Device. Definitions Acceptance Mark Security Rules and Procedures—Merchant Edition • 7 February 2023 Account An account maintained by or on behalf of a Cardholder by an Issuer for the processing of Transactions, and which is identified with a bank identification number (BIN) or Issuer identification number (IIN) designated by the Corporation in its routing tables for routing to the Interchange System. Also see Cirrus Account, Maestro Account, Mastercard Account. Account Enablement System Performs Account enablement services for Mastercard Cloud-Based Payments, which may include Account and Access Device eligibility checks, Identification & Verification (ID&V), Digitization, and subsequent lifecycle management. Account Holder A user who holds a PTA Account and has agreed to participate in a PTA Transaction. Account PAN The primary account number (PAN) allocated to an Account by an Issuer. Account PAN Range The range of Account PANs designated by an Issuer for Digitization. Acquirer A Customer in its capacity as an acquirer of a Transaction. Activity(ies) The undertaking of any lawful act that can be undertaken only pursuant to a License granted by the Corporation. Payment Transfer Activity is a type of Activity. Also see Digital Activity(ies). Definitions Account Security Rules and Procedures—Merchant Edition • 7 February 2023 Affiliate Customer, Affiliate A Customer that participates indirectly in Activity through the Sponsorship of a Principal or, solely with respect to Mastercard Activity, through the Sponsorship of an Association. An Affiliate may not Sponsor any other Customer. Applicable Data Protection Law All applicable law, statute, declaration, decree, legislation, enactment, order, ordinance, regulation or rule (each as amended and replaced from time to time) which relates to the protection of individuals with regards to the Processing of Personal Data to which the Parties are subject, including but not limited to the EU General Data Protection Regulation 2016/679; the e-Privacy Directive 2002/58/EC and their national implementing legislations the California Consumer Privacy Act; the U.S. Gramm-Leach-Bliley Act; the Brazil General Data Protection Act; the South Africa Protection of Personal Information Act; laws regulating unsolicited email, telephone, and text message communications; security breach notification laws; laws imposing minimum security requirements; laws requiring the secure disposal of records containing certain Personal Data; laws governing the portability and/or cross-border transfer of Personal Data; and all other similar international, federal, state, provincial, and local requirements; each as applicable. Area of Use The country or countries in which a Customer is Licensed to use the Marks and conduct Activity or in which a PTA Customer is permitted to Participate in a PTA Program, and, as a rule, set forth in the License or PTA Agreement or in an exhibit to the License or PTA Agreement. Association Customer, Association A Mastercard Customer that participates directly in Mastercard Activity using its assigned BINs and which may Sponsor one or more Mastercard Affiliates but may not directly issue Mastercard Cards or acquire Mastercard Transactions, or in the case of a PTA Association, may not directly hold PTA Accounts, without the express prior written consent of the Corporation. Definitions Affiliate Customer, Affiliate Security Rules and Procedures—Merchant Edition • 7 February 2023 ATM Access Fee A fee charged by an Acquirer in connection with a cash withdrawal or Shared Deposit Transaction initiated at the Acquirer’s ATM Terminal with a Card, and added to the total Transaction amount transmitted to the Issuer. ATM Owner Agreement An agreement between an ATM owner and a Customer that sets forth the terms pursuant to which the ATM accepts Cards. ATM Terminal An ATM that enables a Cardholder to effect an ATM Transaction with a Card (and if contactless-enabled, an Access Device) in accordance with the Standards. ATM Transaction A cash withdrawal effected at an ATM Terminal with a Card and processed through the Mastercard ATM Network. An ATM Transaction is identified with MCC 6011 (Automated Cash Disbursements—Customer Financial Institution). Authenticating Entity An Authenticating Entity is a Merchant, Service Provider, or Digital Wallet Operator that uses an MFA Method to authenticate a Cardholder when a Token is used to conduct a Card-not-present Transaction of any type (excluding mail order and telephone order [MO/TO] Transactions). Automated Teller Machine (ATM) An unattended self-service device that performs basic banking functions such as accepting deposits, cash withdrawals, ordering transfers among accounts, loan payments and account balance inquiries. Definitions ATM Access Fee Security Rules and Procedures—Merchant Edition • 7 February 2023 Bank Branch Terminal An attended device, located on the premises of a Customer or other financial institution designated as its authorized agent by the Corporation, that facilitates a Manual Cash Disbursement Transaction by a Cardholder. BIN A bank identification number (BIN, sometimes referred to as an Issuer identification number, or IIN) is a unique number assigned by Mastercard for use by a Customer in accordance with the Standards. Brand Fee A fee charged for certain Transactions not routed to the Interchange System. Brand Mark A Word Mark as a custom lettering legend placed within the Corporation’s interlocking circles device. The Mastercard Brand Mark, Maestro Brand Mark, and Cirrus Brand Mark is each a Brand Mark. The Mastercard Symbol is also a Brand Mark. Card A card issued by a Customer pursuant to License and in accordance with the Standards and that provides access to an Account. Unless otherwise stated herein, Standards applicable to the use and acceptance of a Card are also applicable to an Access Device and, in a Card-not-present environment, an Account. A Cirrus Card, Maestro Card, and Mastercard Card is each a Card. Cardholder The authorized user of a Card or Access Device issued by a Customer. Definitions Bank Branch Terminal Security Rules and Procedures—Merchant Edition • 7 February 2023 Cardholder Communication Any communication by or on behalf of an Issuer to a Cardholder or prospective Cardholder. A Solicitation is one kind of Cardholder Communication. Cardholder Verification Method (CVM) A process used to confirm that the person presenting the Card is an authorized Cardholder. The Corporation deems the following to be valid CVMs when used in accordance with the Standards:
• The comparison, by the Merchant or Acquirer accepting the Card, of the signature on the Card’s signature panel with the signature provided on the Transaction receipt by the person presenting the Card;
• The comparison, by the Card Issuer or the EMV chip on the Card, of the value entered on a Terminal’s PIN pad with the personal identification number (PIN) given to or selected by the Cardholder upon Card issuance; and
• The use of a Consumer Device CVM (CDCVM) that Mastercard approved as a valid CVM for Transactions upon the successful completion of the certification and testing procedures set forth in section 3.11 of the Security Rules and Procedures. In certain Card-present environments, a Merchant may complete the Transaction without a CVM (“no CVM” as the CVM), such as in Quick Payment Service (QPS) Transactions, Contactless Transactions less than or equal to the CVM limit, and Transactions at an unattended Point-of-Sale (POS) Terminal identified as Cardholder-activated Terminal (CAT) Level 2 or Level 3. Chip Card (Smart Card, Integrated Circuit Card, IC Card, or ICC) A Card with an embedded EMV-compliant chip containing memory and interactive capabilities used to identify and store additional data about a Cardholder, an Account, or both. Chip-only MPOS Terminal An MPOS Terminal that has a contact chip reader and no magnetic stripe-reading capability and that must: