Global Payments
Merchant Privacy Notice

Effective Date: November 25, 2025

This Privacy Notice (“Notice”) describes how Global Payments, Inc., together with its affiliates and subsidiaries (collectively “Global Payments,” “we,” “us,” or “our”), processes your personal information in the course of developing and maintaining a business relationship with you, as or on behalf of our Merchant. This Notice does not cover the processing of personal information through our websites, which are governed by the privacy notices available on those websites, and it does not cover our processing of personal information relating to the consumers whose personal information we process in the course of providing services to our Merchants. In addition, depending on the nature of the services or applications you purchase from us, this Notice may not cover all of our processing of your personal information through those services or applications. If our processing of your personal information within a particular service or application differs from what is set forth herein, you will have access to an additional privacy notice in connection with that service or application.

Please note that our products and services may be sold and/or licensed by a variety of different legal entities within the Global Payments corporate family. The Global Payments entity identified in the relevant contract is the entity providing you with this notice. If the Global Payments entity identified in your contract employs one or more additional Global Payments entities as data processors or service providers, it does so pursuant to an intracompany agreement that includes appropriate provisions for the protection of personal information.

This Notice covers the following topics:

1. Scope and Other Important Information
2. Personal Information We Collect About You
3. Sources of Personal Information
4. Business Purposes for Which We Collect Personal Information
5. Disclosures of Personal Information
6. Necessary Transfers of Personal Information within the Payments Ecosystem
7. Managing Your Preferences
8. Our Relationship with Affiliate Companies
9. Login Details and Your Responsibility
10. Information for California Residents
11. Contact Us
12. Children
13. Changes and Updates

1. Scope and Other Important Information

When we process personal information about you as set forth in this Notice, we do so as a “business,” or “controller,” under applicable privacy laws. For purposes of this Notice, the term “personal information” includes any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. It does not include anonymized or aggregated data that is not linkable to you. We may disclose anonymized or aggregated data, including anonymized or aggregated data derived from personal information, to our affiliates and with third parties without reference to this Notice, and this Notice does not restrict any such disclosures.

As stated above, this Notice describes how we process personal information about you in the course of our business relationship with you, which includes the processing that occurs before you are boarded as a Merchant or otherwise enter into a contract with us.

In addition to the copy you receive during your application process, we make this Notice available at https://www.globalpayments.com/merchant-privacy-notice.

Our business relationship with you, including your access to and use of our products and services, may also be governed by other agreements that set out supplementary or more specific terms regarding the collection, use and protection of personal information, such as a master services agreement or data processing addendum. To the extent those agreements differ from or add to this Notice, their terms will apply in conjunction with, and may supersede, the provisions set out in this Notice.

2. Personal Information We Collect About You

We collect, store, or otherwise process the following categories of personal information in connection with our development and maintenance of a business relationship with you:

• Basic Identifying Information, including your full name, business address, e-mail address, phone number, date of birth, username, or other similar identifiers.
• Government-Issued Identifiers, including your driver’s license number, Social Security number, tax identification number, or other similar government identifiers.
• Demographic Data, including citizenship, primary language, and other similar demographic data.
• Device Information and Other Unique Identifiers, including device identifier, internet protocol (IP) address, cookies, or similar unique identifiers.
• Internet or Other Network Activity, including information regarding your interactions with and use of our marketing content, products, and services, including communication contents and metadata, as well as information generated automatically.
• Geolocation Data, including information regarding your business location(s), as well as usage information—such as IP address and device information—that can reveal your location to us.
• Payment Information, including financial account numbers.
• Commercial Information, including information about your business, your prior commercial relationship or transactions with us, and your preferences regarding products and related services which are of interest to you (see “Managing Your Preferences” below).
• Professional and Employment-Related Information, including your employment with and/or ownership of a business.
• Information You Provide, including your communications with us, survey responses or other feedback on our products and services, information provided to us in the context of customer support requests, and any other content you provide to us.
• Audio and Visual Information, including photographs, images, videos, and recordings of your voice (such as when we record calls or videos for quality assurance or other business activities).
• Inferences drawn from or created based on any of the information identified above to reflect and make predictions about your preferences, characteristics, behavior and choices.

We retain each category of personal information described above only for so long as necessary to accomplish our business purposes, as set forth in Section 4 below.

3. Sources of Personal Information

We collect personal information about you in three ways: (1) when you provide it to us directly; (2) when we collect personal information from third parties; and (3) when we gather personal information about you through your use of our products or services.

Information that you provide to us: You provide personal information to us when you apply for or use our products or services, or when you otherwise communicate with us. For example, when you submit a Merchant Application, we collect personal information that is relevant to evaluating your suitability for our products or services and onboarding your business to those products or services. Providing us with that information is voluntary, and you can choose not to do it, but then we may be unable to provide you with the product or service you have requested.

Information collected from third parties: We may collect information about you from third parties in the course of marketing and providing our services to you. For example, we may collect personal information from a referral partner or other third party in order to contact you about the services we provide, and we may also receive business-related information about you from third-party companies that supplement our business customer records with contact information from their own databases. Moreover, providing our products and services to you in a lawful, effective, and compliant manner sometimes requires transferring information back and forth with certain third parties within the payments ecosystem, such as card brands, fraud prevention services, and issuing and acquiring banks, and in the course of providing our products and services to you, we may collect personal information about you from those third-party sources (see “Necessary Transfers of Personal Information within the Payments Ecosystem,” below, for more about these types of transfers).

Information collected through technology: When you use our products or services or otherwise interact with a communication that we send to you, we collect certain personal information automatically, such as IP address, device identifiers, geolocation data, and information about the features you interact with most, the frequency and duration of your use of the product or service, the manner in which our product or service is performing for you, and other information about how you use the product or service.

4. Business Purposes for Which We Collect Personal Information

Subject to your consent if required by law, we may use your personal information for the following business and commercial purposes:

• Marketing and Commercial Purposes: We collect and process personal information for the purpose of marketing our products and services to Merchants who may be interested in purchasing those products and services. This may include processing personal information about you for the purpose of contacting you directly for marketing purposes.
• Processing Applications to Use a Product or Service: When you inquire about or apply for one of our products or services, we collect and process personal information about you in order to evaluate your creditworthiness and otherwise assess your fitness for that product or service.
• Merchant Onboarding: Once you enter into a contract with us for our products or services, we collect and process personal information about you in order to onboard your business to those products and services.
• Providing Requested Information, Products, and Services to You: When you request information from us (including via chatbot) or use our products and services, we collect and process personal information as necessary to provide that information, product, or service to you and to provide customer service.
• Contacting You Regarding the Products and Services: We collect and process personal information to send you messages related to our products and services. For example, we may let you know about temporary or permanent changes to the products and services, like planned outages, new features, version updates, releases, abuse warnings, and changes to our privacy notices. We may also contact you to request your participation in a survey or feedback about the products and services.
• Product Maintenance and Improvement: We collect and process personal information as necessary to maintain, repair, update, and improve our products and services.
• User Experience Personalization: We collect and process personal information in order to personalize your experience when you use our products and services and in order to track and record our interactions with you.
• Business Operations: We collect and process personal information to conduct our operations and for other general business purposes.
• Fraud Prevention and Security: We collect and process personal information as necessary to detect security events and to prevent deceptive, fraudulent, illegal or unethical behavior in the use of our products and services, and as necessary to verify and maintain the security of our products and services.
• Audit and Internal Recordkeeping: We collect and process personal information for audit and internal recordkeeping and administrative purposes.
• Compliance with Laws: We collect and process personal information as necessary to comply with legal obligations to which we are subject, including laws which may from time to time require disclosure of personal information to regulators and other third parties.
• Legal Claims: We collect and process personal information as necessary to analyze, establish, preserve, and defend against legal claims and allegations.

5. Disclosures of Personal Information

We are a multinational business headquartered in the United States. We have employees, subsidiaries and affiliates located in other countries around the world. We may disclose personal information about you to recipients located outside of your country, including to our global subsidiaries and affiliates (see “Our Relationship with Affiliate Companies,” below). We may also disclose personal information to service providers that we hire to provide all or a portion of our services, to our third-party partners, to other third-party entities within the payments ecosystem as necessary to provide our products and services, and with regulatory authorities and other parties when and as required by law.

As of the effective date of this Notice, we disclose personal information relating to Merchants in the manner and for the purposes described below:

• To service providers and other companies engaged to help us run our business, subject to your consent if required by law. These types of companies may include distributors of our products and services; service providers retained to perform functions on our behalf or to provide services to us, including (without limitation) legal, accounting, audit, consulting and other professional service providers; and providers of other services related to our business. Portions of our services may be provided by organizations with which we have a contractual relationship, including subcontractors, and personal information about you may be disclosed to them;
• To non-affiliated entities with whom you have a relationship, such as a financial institution or independent sales organization who referred you to us for services;
• To logistics service providers to enable the delivery of packages to your business, or to individuals who interact with your business;
• To other non-affiliated entities, including partners and other referral recipients who provide products or services that may be appealing to you, subject to your consent where required by law;
• To data brokers and/or data aggregators, subject to your consent if required by law;
• To regulators and other entities with the authority to examine our business practices, including state and federal agencies, card brands, financial networks, issuing banks and other parties, to enable compliance with laws, regulations and industry standards related to transaction processing and in order to obtain commercial and credit information to establish, maintain or renew a Merchant’s contract(s), as may be required to provide any of the services for which a Merchant has subscribed, or to comply with the rules and regulations of any credit or debit card payment network or otherwise in accordance with this Notice;
• In response to a court order or a request for cooperation from a regulatory, law enforcement or other government agency, to establish or exercise our legal rights, to defend legal claims, or as otherwise required or permitted by applicable laws and/or regulations;
• When we believe that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity or other wrongdoing, or to protect and defend our rights, property or safety or the rights, property or safety of our customers, staff, suppliers, employees or others; and
• To third parties in connection with any proposed or actual reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our and/or our global affiliate companies’ assets or stock (including in connection with any bankruptcy or similar proceedings).

6. Necessary Transfers of Personal Information within the Payments Ecosystem

You are receiving this Notice because your business has hired us or is seeking to hire us to perform payment processing services, among other things. The provision of such services necessarily involves the transfer of personal information between and among various entities within the payment processing ecosystem, including but not limited to card brands, issuing banks, acquiring banks, identity verification and fraud prevention services, and certain payment gateway services. In order to provide our products and services to you, we must from time to time transfer personal information about you to these third-party entities, and these third-party entities must from time to time transfer personal information about you to us and to other entities within the payment processing ecosystem. In most cases, these necessary third parties within the payment processing ecosystem process personal information about you pursuant to their own privacy notices, which govern their collection of personal information and the ways in which they make that information available to others. If you want to understand how these third parties collect, process, and disclose personal information about you, we encourage you to consult their privacy notices.

7. Managing Your Preferences

Subject to your consent if required by law, we may use personal information about you to provide you with direct marketing information about our products and services, as well as those of our affiliate companies. Our direct marketing communications may occur through email, telephone, post or SMS or such other method(s) as may become relevant. If you provide a cellular telephone number to us in connection with an application, or in connection with your use of any of our products and services, you are consenting to receive SMS messages from us at that cellular telephone number. In addition, subject to your consent if required by law, we may provide direct marketing information to third parties, and permit others to do the same, as permitted by our contract(s) with you or the relevant Merchant.

We will take steps to ensure that any direct marketing from us will provide a simple means for you to stop further communications, in accordance with applicable law. For example, in email, we may provide you with an “unsubscribe” link, or an email address to which you can send an opt-out request. In addition, if we need your consent for direct marketing communications under applicable law, and if you provide your consent, you will be able to change your mind at any time. Please note that if you opt out of receiving marketing-related communications from us, we may still send you administrative, transactional, or information messages, from which you cannot opt out.

8. Our Relationship with Affiliate Companies

We may appoint an affiliate company to process personal information about you in a service provider role. We typically will remain responsible for that company’s processing of personal information pursuant to applicable data privacy laws. Because our affiliate companies are located around the globe, personal information about you may be transferred to and stored in the United States or in another country outside of the country in which you reside, which may be subject to different standards of data protection than your country of residence. We take appropriate steps to transfer personal information in accordance with applicable law, such as transferring personal information to countries that are recognized as providing an adequate level of legal protection or where alternative adequate arrangements are in place to protect your privacy rights.

9. Login Details and Your Responsibility

If you use our products and services, we will create login credentials for you or give you the ability to create your own login credentials, and it is your responsibility to keep those login credentials secure, including by adhering to the security procedures we establish in the documentation we provide you as part of the services. Please remember that we will never ask you for your password in an unsolicited email, message or phone call.

10. Information for California Residents

This section supplements the above Notice and further describes how we collect, use, and disclose the personal information we collect about residents of California.

Categories of Personal Information We Collect and Our Purposes for Collection and Use

You can find a list of the categories of personal information that we collect in the “Personal Information We Collect About You” section above. For details regarding the sources from which we obtain personal information, please see the “Sources of Personal Information” section above. We collect and use personal information for the business or commercial purposes described in the “Business Purposes for Which We Collect Personal Information” section above.

Unless otherwise disclosed in a separate notice, and subject to your consent where required by applicable law, we do not sell your personal information to third parties for monetary compensation.

Categories of Personal Information Disclosed and Categories of Recipients

Our disclosures of personal information are described in the “Disclosures of Personal Information” and “Necessary Transfers of Personal Information within the Payments Ecosystem” sections above. To further clarify the content of those sections, we disclose the following categories of personal information for business or commercial purposes to the categories of recipients listed below:

• We disclose Basic Identifying Information to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Government-Issued Identifiers to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Demographic Data to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Device Information and Other Unique Identifiers to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Internet or Other Network Activity to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Geolocation Data to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Payment Data to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Commercial Information to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Professional and Employment-Related Information to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Information You Provide to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Audio and Visual Information to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.
• We disclose Inferences to service providers, affiliates, third-party partners, and other necessary participants within the payment processing ecosystem.

Collection, Processing, and Disclosure of Sensitive Personal Information

Subject to your consent where required by applicable law, we collect, process, and disclose sensitive personal information for purposes of: providing goods or services as requested; ensuring safety, security, and integrity; countering wrongful or unlawful actions; short term transient use such as displaying first party, non-personalized advertising; performing services for our business, including maintaining and servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of our business; activities relating to quality and safety control or product improvement; and other collection and processing that is not for the purpose of inferring characteristics about an individual. We do not use sensitive personal information beyond these purposes.

Rights and Requests

As a California resident, you have rights with regard to your personal information. You can contact us using the information provided in the “Contact Us” section of this Notice with regard to the following rights:

California Shine the Light

If you are a resident of California, you may request information concerning the categories of personal information (if any) that we share with third parties or affiliates for their direct marketing purposes. If you would like more information, please submit a written request to us using the information provided in the “Contact Us” section of this Notice.

11. Contact Us

If you have questions about this Notice, or if you want to exercise your rights as described in this Notice, you can submit a request by completing this form. You may also contact us as follows:

Global Payments, Inc.

3550 Lenox Rd NE, Suite 3000

Atlanta, GA 30326

[email protected]

800-367-2638

If you make a request to exercise a privacy right, we will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request. We may decline to honor your request where an exception applies. In order to honor any access or deletion request, we will require you to provide enough information for us to verify your identity. For example, we may ask you for information associated with your relationship with us, including your contact information or other identifying information. If you would like your agent to make a request on your behalf, if permitted under applicable law, the agent may exercise those rights as noted above. We will process the agent’s request consistent with applicable law. As part of our verification process, we may request that the agent provide, as applicable, proof concerning their status as an authorized agent. In addition, we may require that you verify your identity as described in this section or confirm that you provided the agent permission to submit the request.

12. Children

Our products and services are not directed to children or intended for use by children. We do not solicit or knowingly accept any personal information from persons under the age of 18. Please do not apply for or use any of our products or services if you are under the age of 18.

13. Changes and Updates

We reserve the right, in our sole discretion, to modify, update, add to, discontinue, remove or otherwise change any portion of this Notice, in whole or in part, at any time. The “Effective Date” legend at the top of this Notice indicates when this Notice was last revised.