Visa Candidate Privacy Notice

“Personal Information” refers to information that (alone or when used in combination with other information) is capable of being associated with or could reasonably be associated with an individual. Personal Information is also sometimes referred to as “personal data”.

Depending on our relationship and interactions with you, the categories of Personal Information we collect may include:

• Contact Information – This includes your name, username, postal address, email address, phone number, and professional social media profile names, and other information you provide to allow us to contact you.
• Relationship Information – This includes information that you voluntarily provide to offer you personalized content if you choose to join our talent communities, such as data from professional social media profiles and information about your interests.
• Interaction Information – this includes information about your interactions with Visa, such as:
  • Information collected when you participate in Visa programs such as the Visa talent community;
  • Information collected when you contact Visa Privacy, such as if you contact our talent acquisition team;
  • Visitor logs when you visit one or more of our Visa facilities;
  • Other information you provide to us, such as data collected for authentication of your account profile (e.g., passwords or account security questions);
• Audio and Visual Information – This includes audio, electronic, visual, or similar information relating to your interactions with us, including photographs (e.g. in your CV or as published on your professional social media profiles), video images, CCTV recordings, call recordings, and voicemails.
• Online and Technical Information – This includes information regarding your interactions with our websites, applications or advertisements, including IP address, device identifiers, settings, characteristics, advertising ID, browsing history, web server logs, server log records, activity log records, keystroke timing and other information collected using cookies and similar technologies.
• Government Issued Identification Numbers – This includes National Insurance Number, driving licence number, passport number, national I.D., and other government issued identifiers, as permitted by applicable law.
• Geolocation Information – This may include precise geolocation information, which we may collect when you apply for a position with Visa via our website or mobile app, if you opt in to allow us to collect it via our preference management tools.
• Professional and Employment Information – This includes professional or employment-related information for applicants and candidates, including applicant and resume data, such as education and work history; information about qualifications for the position, such as skills and credentials; professional interests and goals; information collected for employee qualifications, such as right to work documentation; certifications, skills and skills assessments relevant to a position, and references. Please note this may include criminal conviction or offence information – This includes information regarding prior convictions or offences and statements from you regarding such convictions or offences, as permitted by applicable law.
• Compliance Information – This includes records maintained to demonstrate compliance with applicable laws in certain jurisdictions; which may include records related to data subject rights requests.

Some of the Personal Information in these categories may be considered sensitive Personal Information or “special category data” in some jurisdictions. Such Personal Information will only be processed to the extent permitted by law (see the section entitled “Why We Collect Personal Information and How We Use It” for more information).

We may collect Personal Information about you from various sources, depending on our relationship and interaction with you. These sources may include:

• You, such as when you apply for a job at Visa, enrol in Visa talent management programs, enrol in a talent community, attend a networking or on-campus recruiting event, or provide survey responses to us;
• Your computer or devices when you interact with our platforms, websites, and applications or through other automatic technologies, such as when we record interviews (including where we use artificial intelligence-assisted transcription of interviews) and use CCTV cameras in our facilities;
• Job recruitment agencies;
• Service providers and third parties that provide verification and vetting services for us (such as your references and third parties that help us conduct background checks, screenings, and internal investigations when required and in accordance with applicable law); and
• Publicly available sources, including professional social media platforms.

Visa processes the Personal Information of candidates lawfully and to the extent necessary for the purposes detailed in the following table:

In some jurisdictions, Visa processes special category data, also sometimes called sensitive personal information as defined in applicable data privacy laws (such as information about racial or ethnic origin, religious or philosophical beliefs, health data), only for specific purposes (such as in connection with our diversity and social governance program) and as otherwise authorized by you (such as if you participate in our talent community groups), justified by an appropriate legal basis, as set out in the table above, and by one of the following additional conditions:

• You have given explicit consent to the processing of such special categories of personal data and sensitive personal information;
• The processing is necessary for the purposes of carrying out Visa’s obligations and protecting your rights in the field of employment law, social security and social protection law;
• The processing is necessary for Visa as an employer for the purposes of protecting your vital interests, of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services; or
• The processing is necessary for the establishment, exercise or defence of legal claims.

Visa may also process data about any prior criminal convictions and offences as part of background checks, if permitted for specific roles or by applicable law.

No employment decision will be based solely on automated decision-making. While Visa may use automated tools including artificial intelligence (AI Tools), every decision to review, interview, offer to hire, or reject a candidate for a specific role, and all related employment decisions, are made involving human judgment and intervention. Additional details about how Visa uses automated tools including artificial intelligence are described in this section and the section entitled “Why We Collect Personal Information and How We Use It.”

You may contact Visa Privacy using the details in the “How to Contact Visa Privacy” section to request further information about how our recruiters make decisions about your job application. You may also exercise your Privacy Rights regarding your Personal Information at any time, as outlined in the Section entitled “Your Privacy Rights” below.

Notice Regarding Use of AI Tools in Recruiting

To support our recruiters and enhance efficiency, we may use certain AI-powered tools to assist with administrative and productivity-related tasks during recruitment. These tools are designed to help streamline processes and improve the candidate experience. As stated above, all hiring decisions will involve meaningful human review and judgment.

How AI Tools May Be Used:

• To assist recruiters in identifying candidates whose experience and qualifications align with the requirements of a role;
• To suggest potential role matches based on candidate-provided information (skills, experience, and stated interests);
• To suggest skills that may apply to candidates based on candidate-provided information; and/or
• To improve recruiter productivity and candidate experience by streamlining administrative tasks.

Information AI Tools May Use:

• Details provided by candidates during the application process (e.g., resume/CV content, responses to application questions, and information about skills, experience, and qualifications), including education and professional experience, certifications or credentials identified in job posting, and role‑specific requirements described in the requisition.
• AI tools do not use sensitive Personal Information or protected characteristics.

Due to the global nature of Visa’s operations, Visa may disclose Personal Information to recipients in other countries, as listed below:

• To other Visa Affiliates, which will handle your Personal Information for the purposes defined in this Notice;
• To our third party service providers (including background check vendors), data processors and contractors. Visa enters into contractual obligations with third parties to ensure appropriate protection for Personal Information.
• When required to do so by law, such as to law enforcement agencies, government agencies, regulators, and courts in countries where we operate;
• When permitted by law, such as when we sell or transfer business assets, enforce our contracts, protect our property or the rights, property or safety of others;
• On a need-to-know basis to Visa personnel and external counsel for audits, compliance and corporate governance; and
• To recruiting agencies and your references.

Visa uses different online tools to engage with applicants and candidates. To review more about our online privacy practices, please review the Visa Global Privacy Notice and the Visa Cookie Notice.

We respect your privacy rights in accordance with applicable data privacy laws. Depending on your jurisdiction, you may have the following rights:

• Right to access: You may have the right to obtain confirmation of the existence or non-existence of the processing of your Personal Information and receive copies of such Personal Information.
• Right to rectify: You may have the right to request that we rectify inaccuracies in your Personal Information or that we complete it.
• Right to deletion: You may have the right to ask us to delete your Personal Information in the following cases:
  • when they are no longer necessary for the purposes for which they were collected;
  • you have revoked your consent;
  • following the exercise of your right to object;
  • your Personal Information has been processed unlawfully; or
  • to comply with a legal obligation.

• Right to restrict: You may have the right to ask us to restrict the processing of your Personal Information (i.e., to retain it without using it) when:
  • its accuracy is disputed;
  • its processing is unlawful, but you do not want it deleted;
  • it is still necessary for the establishment, exercise or defence of legal claims;
  • we need to verify the existence of compelling reasons in connection with the exercise of your right to object.

We may continue to use your Personal Information following a request for restriction (i) with your consent, or (ii) for the establishment, exercise, or defence of legal claims; or (iii) to protect the rights of any other natural or legal person.

Visa does not “sell” or “share” candidate Personal Information as those terms are defined under California law (including the California Consumer Privacy Act as amended by the California Privacy Rights Act). “Share” includes disclosure for cross‑context behavioural advertising. Visa also does not use candidate Personal Information for cross‑context behavioural advertising.

Because Visa does not sell or share candidate Personal Information, the right to opt out of sale or sharing does not apply to candidate Personal Information.

You can learn more and exercise your privacy rights under relevant laws by accessing your account profile in our applicant tracking system, or by accessing our Privacy Rights Portal.

Supplemental Privacy Notices: Residents of some states and countries may have additional privacy rights. Information on these rights is provided in the supplemental privacy notices posted at the bottom of the Visa Global Privacy Notice.

Visa is based in the United States and has Affiliates and service providers around the world. Visa may transfer your Personal Information between countries, including to countries which may not have similar privacy or data protection laws as your country of origin. We may transfer your Personal Information to our main data centres in the United States, as well as our other data centres, such as our data centre in Europe or a local data centre in your country where applicable. However, we will always protect your Personal Information as described in this Notice, no matter where it is stored, and transfer it in accordance with any applicable legal requirements for cross-border transfer of Personal Information.

Whenever we transfer your Personal Information out of the EEA, Switzerland or the UK, we take steps to ensure that such transfers are carried out in accordance with applicable laws and regulations. Your Personal Information may be transferred to a country which benefits from an adequacy decision (i.e. countries that have been recognized by the European Commission as providing an appropriate level of protection for Personal Information). If your Personal Information is transferred to a country which does not benefit from an adequacy decision (example: to the United States) and which is considered as not providing the same level of protection as the EEA, Switzerland or the UK, Visa will ensure that such transfers are made subject to appropriate safeguards as required by applicable data privacy laws, in particular the Standard Contractual Clauses approved by the European Commission, and that these appropriate safeguards are supplemented by additional contractual, technical and organizational measures as necessary.

Please contact Visa Privacy using the details in the last Section if you would like more information about cross-border transfers or to obtain a copy of the Standard Contractual Clauses.

We use physical, technical, organisational, and administrative safeguards to help protect your Personal Information from unauthorised access or loss. For example, we use encryption and other tools to protect sensitive information.

We retain your Personal Information for as long as necessary to fulfil the purposes outlined in this Notice unless a longer retention period is required or permitted by law. When determining the retention period, Visa considers criteria such as the purpose for processing your Personal Information, legal and regulatory requirements, business needs or as needed in the management of legal claims or proceedings. Such retention periods may vary depending on your jurisdiction and are included in Visa’s retention policies which reflect local legal requirements. For further information on applicable retention periods, please submit a query to [email protected].

This Notice explains how Visa and its Affiliates handle your Personal Information. Social media platforms and other websites that may be accessed through Visa’s websites, or that may display Visa job postings, also have their own privacy policies. We encourage you to read the privacy notices provided by these sites before you give them your information.

We may update this Notice from time to time. Therefore, we encourage you to check this Notice regularly so that you are fully aware of any changes or updates. We will post an alert online if the changes are material. If the changes will materially affect the way we use Personal Information that we have already collected, we will also notify you.

Questions regarding this Notice, or how it applies to you, should be directed to the applicable Data Protection Officers within Visa by submitting a query to [email protected].