Last Updated: November 1, 2019
TABLE OF CONTENTS:
1. INTRODUCTION
Thank you for using Private Island! Your trust is important to us and we’re committed to protecting the privacy and security of your personal information. The information that’s shared with us helps us to provide a great experience with Private Island. We have a dedicated privacy team that’s committed to protecting all the personal information we collect and help ensure that personal information is handled properly worldwide.
This Privacy Policy describes how we collect, use, process, and disclose your personal information, in conjunction with your access to and use of the Private Island Platform and the Payment Services. This privacy policy describes our privacy practices for all websites, platforms and services that link to it. Please read the privacy policy on the applicable site.
1.1 Definitions
If you see an undefined term in this Privacy Policy (such as “Listing” or “Private Island Platform”), it has the same definition as in our Terms of Service (“Terms”).
1.2 Data Controller
When this policy mentions “Private Island,” “we,” “us,” or “our,” it refers to the Private Island company that is responsible for your information under this Privacy Policy (the “Data Controller”).
1.3 Applicability to Payments
This Privacy Policy also applies to the Payment Services provided to you by Private Island Payments pursuant to the Payments Terms of Service (“Payments Terms”). When using the Payment Services, you will be also providing your information, including personal information, to one or more Private Island Payments entities, which will also be the Data Controller (the "Payments Data Controller") of your information related to the Payment Services, generally depending on your country of residence.
If you change your country of residence, the Data Controller and/or Payments Data Controller will be determined by your new country of residence as specified above, from the date on which your country of residence changes. To this end the Data Controller and/or Payment Data Controller that originally collected your personal information will need to transfer such personal information to the new applicable Data Controller and/or Payments Data Controller due to the fact that such transfer is necessary for the performance of the contractual relationship with you.
Please see the Contact Us section below for contact details of the Data Controllers and Payments Data Controllers.
2. INFORMATION WE COLLECT
There are three general categories of information we collect.
2.1 Information You Give to Us.
2.1.1 Information that is necessary for the use of the Private Island Platform.
We ask for and collect the following personal information about you when you use the Private Island Platform. This information is necessary for the adequate performance of the contract between you and us and to allow us to comply with our legal obligations. Without it, we may not be able to provide you with all the requested services.
2.1.2 Information you choose to give us.
You may choose to provide us with additional personal information in order to obtain a better user experience when using Private Island Platform. This additional information will be processed based on our legitimate interest or when applicable, your consent.
2.1.3 Information that is necessary for the use of the Payment Services.
The Payments Data Controller needs to collect the following information necessary for the adequate performance of the contract with you and to comply with applicable law (such as anti-money laundering regulations). Without it, you will not be able to use Payment Services:
2.1.4 Information We Automatically Collect from Your Use of the Private Island Platform and Payment Services.
When you use the Private Island Platform and the Payment Services, we automatically collect personal information about the services you use and how you use them. This information is necessary for the adequate performance of the contract between you and us, to enable us to comply with legal obligations and given our legitimate interest in being able to provide and improve the functionalities of the Private Island Platform and Payment Services.
2.1.5 Information We Collect from Third Parties.
Private Island and Private Island Payments may collect information, including personal information, that others provide about you when they use the Private Island Platform and the Payment Services, or obtain information from other sources and combine that with information we collect through the Private Island Platform and the Payment Services. We do not control, supervise or respond to how the third parties providing your information process your Personal Information, and any information request regarding the disclosure of your personal information to us should be directed to such third parties.
2.2 Children’s Data.
Our websites and applications are not directed to children under 16 and we do not knowingly collect any personal information directly from children under 16. If you believe that we are processing the personal information pertaining to a child inappropriately, we take this very seriously and urge you to contact us using the information provided under the “Contact Us” section below.
3. HOW WE USE INFORMATION WE COLLECT
We may use, store, and process personal information to (1) provide, understand, improve, and develop the Private Island Platform, (2) create and maintain a trusted and safer environment (such as to comply with our legal obligations and ensure compliance with Private Island Policies) and (3) provide, personalize, measure, and improve our advertising and marketing.
3.1 Provide, Improve, and Develop the Private Island Platform. We may use the personal information to provide, improve, and develop the Private Island Platform such as to:
We process this personal information for these purposes given our legitimate interest in improving the Private Island Platform and our Members’ experience with it, and where it is necessary for the adequate performance of the contract with you.
3.2 Create and Maintain a Trusted and Safer Environment. We may use the personal information to create and maintain a trusted and safer environment such as to:
We process this personal information for these purposes given our legitimate interest in protecting the Private Island Platform, to measure the adequate performance of our contract with you, and to comply with applicable laws.
3.3 Provide, Personalize, Measure, and Improve our Advertising and Marketing. We may use the personal information to provide, personalize, measure, and improve our advertising and marketing such as to:
We will process your personal information for the purposes listed in this section given our legitimate interest in undertaking marketing activities to offer you products or services that may be of your interest.
3.4 How the Payments Data Controller uses the Personal Information Collected. We may use the personal information as a part of Payment services such as to:
The Payments Data Controller processes this personal information given its legitimate interest in improving the Payment Services and its users’ experience with it, and where it is necessary for the adequate performance of the contract with you and to comply with applicable laws.
3.5 SMS Terms for U.S.
For text messaging in the United States, by requesting, joining, agreeing to, enrolling in, signing up for, acknowledging, or otherwise consenting to receive one or more text messages (“Opting In”) or using a Private Island arrangement in which Private Island sends (or indicates that it may send, or receives a request that it send) one or more text messages (“Text Message Service”), you accept these SMS Terms for U.S. (“SMS Terms”), consent to the handling of your personal information as described in the Private Island Privacy Policy, and agree to resolve disputes with Private Island as described in our Terms of Service. Message and data rates may apply.
Private Island will use reasonable commercial efforts to deliver the automated marketing text messages to the number you provide through compatible wireless carriers. Carriers and Private Island are not liable for delayed or undelivered messages. The short code we use for some Text Message Services may not be supported on all U.S. carriers.
Opting In
By Opting In to a Text Message Service:
After Opting In, in addition to the main messages the service offers, you may receive one or more welcome messages or administrative messages, such as (in some cases) a request to confirm your Opt-In.
About the Text Message Services and Opting Out
Message and data rates may apply. Unless otherwise noted, Text Message Services send multiple, recurring messages. Private Island may terminate any Text Message Service or your participation in it at any time with or without notice, including, for example, before you have received any or all messages that you otherwise would have received, but these SMS Terms still will apply. Text STOP to any promotional message to Opt Out or if applicable update your “Notification” settings on your Private Island account.
For additional help, text HELP in response to a marketing message or contact customer service.
3.6 Your Choices
You have choices on the promotional messages that you choose to receive.
4. SHARING & DISCLOSURE
4.1 Advertising and Social Media; Sharing With Your Consent.
Where you have provided consent, we share your information, including personal information, as described at the time of consent, such as when you authorize a third party application or website to access your Private Island Account or when you participate in promotional activities conducted by Private Island partners or third parties.
Where permissible according to applicable law we may use certain limited personal information about you, such as your email address, to hash it and to share it with social media platforms, such as Facebook or Google, to generate leads, drive traffic to our websites or otherwise promote our products and services or the Private Island Platform. These processing activities are based on our legitimate interest in undertaking marketing activities to offer you products or services that may be of your interest.
The social media platforms with which we may share your personal information are not controlled or supervised by Private Island. Therefore, any questions regarding how your social media platform service provider processes your personal information should be directed to such provider.
Please note that you may, at any time, ask Private Island to cease processing your data for these direct marketing purposes by sending an e-mail to opt-out@Private Island.com.
4.2 Sharing between Members.
To help facilitate bookings or other interactions between Members, we may need to share certain information, including personal information, with other Members, as it is necessary for the adequate performance of the contract between you and us, as follows:
We don’t share your billing and payout information with other Members.
4.3 Profiles, Listings, and other Public Information.
The Private Island Platform lets you publish information, including personal information, that is visible to the general public. For example:
Based on our legitimate interest to promote the Private Island Platform we may display parts of the Private Island Platform (e.g., your Listing page) on sites operated by Private Island’s business partners, using technologies such as widgets or APIs. If your Listings are displayed on a partner’s site, information from your public profile page may also be displayed.
Information you share publicly on the Private Island Platform may be indexed through third party search engines. In some cases, you may opt-out of this feature in your Account settings. If you change your settings or your public-facing content, these search engines may not update their databases. We do not control the practices of third party search engines, and they may use caches containing your outdated information.
4.4 Additional Services by Hosts.
Hosts may need to use third party services available through the Private Island Platform to assist with managing their Accommodation or providing additional services requested by you, such as cleaning services or lock providers. Hosts may use features on the Private Island Platform to share information about the Guest (like check-in and check-out dates, Guest name, Guest phone number) with such third party service providers for the purposes of coordinating the stay, managing the Accommodation, or providing other services. Hosts are responsible for third party service providers they use and ensuring those service providers process Guest information securely and in compliance with applicable law including data privacy and data protection laws.
4.5 Compliance with Law, Responding to Legal Requests, Preventing Harm and Protection of our Rights.
Private Island and Private Island Payments may disclose your information, including personal information, to courts, law enforcement, governmental authorities, tax authorities, or authorized third parties, if and to the extent we are required or permitted to do so by law or if such disclosure is reasonably necessary: (i) to comply with our legal obligations, (ii) to comply with a valid legal request or to respond to claims asserted against Private Island, (iii) to respond to a valid legal request relating to a criminal investigation or alleged or suspected illegal activity or any other activity that may expose us, you, or any other of our users to legal liability (See more information on Private Island’s Law Enforcement Guidelines here), (iv) to enforce and administer our Terms of Service, the Payment Terms or other agreements with Members, or (v) to protect the rights, property or personal safety of Private Island, its employees, its Members, or members of the public. For example, if permitted due to the foregoing circumstances, Host tax information may be shared with tax authorities or other governmental agencies.
These disclosures may be necessary to comply with our legal obligations, for the protection of your or another person's vital interests or for the purposes of our or a third party’s legitimate interest in keeping the Private Island Platform secure, preventing harm or crime, enforcing or defending legal rights, facilitating the collection of taxes and prevention of tax fraud or preventing damage.
Where appropriate, we may notify Members about legal requests unless: (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law, or (ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud upon Private Island’s property, its Members and the Private Island Platform. In instances where we comply with legal requests without notice for these reasons, we may attempt to notify that Member about the request after the fact where appropriate and where we determine in good faith that we are no longer prevented from doing so.
4.6 Service Providers.
Private Island and Private Island Payments uses a variety of third-party service providers to help us provide services related to the Private Island Platform and the Payment Services. Service providers may be located inside or outside of the European Economic Area (“EEA”). In particular, our service providers are based in Europe, India, Asia Pacific and North and South America.
For example, service providers may help us: (i) verify your identity or authenticate your identification documents, (ii) check information against public databases, (iii) conduct background or police checks, fraud prevention, and risk assessment, (iv) perform product development, maintenance and debugging, (v) allow the provision of the Private Island Services through third party platforms and software tools (e.g. through the integration with our APIs), (vi) provide customer service, advertising, or payments services, or (vii) process, handle or assess insurance claims or other similar claims (such as claims under the Private Island Host Guarantee). These providers have limited access to your personal information to perform these tasks on our behalf, and are contractually bound to protect the personal information and only use the personal information in accordance with our instructions .
Private Island and the Private Island Payments will need to share your information, including personal information, in order to ensure the adequate performance of our contract with you.
4.7 Corporate Affiliates.
To enable or support us in providing the Private Island Platform and the Payment Services, we may share your information, including personal information, within our corporate family of companies (both financial and non-financial entities) that are related by common ownership or control.
4.9 Government Registration.
In jurisdictions where Private Island facilitates or requires a registration, notification, permit, or license application of a Host with a local governmental authority through the Private Island Platform in accordance with local law, we may share information of participating Hosts with the relevant authority, both during the application process and, if applicable, periodically thereafter, such as the Host’s full name and contact details, Accommodation address, tax identification number, Listing details, and number of nights booked.
4.10 Information Provided to Enterprise Customers.
If you have linked your Private Island Account to the Private Island Account of a company or other organization (an “Enterprise”), added your work email address, or have a booking facilitated via another party (such as the future employer or other entity) or used a coupon in a similar capacity in connection with an Enterprise (such as using a coupon to pay for an accommodation for an enterprise related event like employment onboarding, orientation, meetings, etc.) through one of our Enterprise products, that Enterprise will have access to your name, contact details, permissions and roles, and other information as required to enable use by you and the Enterprise of such Enterprise products.
4.11 Host Information Provided to Private Island for Work Customers.
If a booking is designated as being for business purposes and made by a Guest affiliated with an Enterprise, and the Enterprise is enrolled in our Private Island for Work , such as a booking made for business purposes using a coupon provided by an Enterprise, we may disclose information related to the booking to the Enterprise, such as the name of the Host, the Accommodation address, booking dates, pricing, Listing details, and other related information, to the extent necessary for the adequate performance of Private Island’s contract with the Enterprise and to provide the services. . At the request of the Enterprise or the Guest, we may also share this information with third parties engaged by the Enterprise to provide travel management, travel planning, financial reporting, personnel management, crisis management, or other services.
4.12 Guest Information Provided to Private Island for Work Customers.
If you have linked your Private Island Account with an Enterprise, and you are included on a booking designated as being for business purposes, we may disclose information related to the booking to the Enterprise to the extent necessary for the adequate performance of Private Island’s contract with the Enterprise. Typically, this includes information related to the booking, such as your name, dates of the booking, number of guests, pricing, Listing details, the Accommodation address, and other related information. At the request of you or your Enterprise, we may also disclose this information to service providers engaged by it, such as companies that provide travel management, financial reporting, personnel management, crisis management, or other services. In the event of a dispute, emergency, or similar situation involving a booking identified as being for business purposes, Private Island may also share additional relevant information it believes is necessary to safely and quickly address the situation.
4.13 Programs with Managers and Owners.
We may share personal information and booking information with landlords, management companies, and/or property owners in order to facilitate programs with these partners. For example, guest booking and personal information may be shared with owners and property managers of the building, complex, or planned community where a host lives and/or the listing is to facilitate hosting services, security, billing, and other services that may be provided.
4.14 Business Transfers.
If Private Island undertakes or is involved in any merger, acquisition, reorganization, sale of assets, bankruptcy, or insolvency event, then we may sell, transfer or share some or all of our assets, including your information in connection with such transaction or in contemplation of such transaction (e.g., due diligence). In this event, we will notify you before your personal information is transferred and becomes subject to a different privacy policy.
4.15 Aggregated Data.
We may also share aggregated information (information about our users that we combine together so that it no longer identifies or references an individual user) and other anonymized information for regulatory compliance, industry and market analysis, research, demographic profiling, marketing and advertising, and other business purposes.
5. OTHER IMPORTANT INFORMATION
5.1 Analyzing your Communications.
We may review, scan, or analyze your communications on the Private Island Platform for fraud prevention, risk assessment, regulatory compliance, investigation, product development, research, analytics, and customer support purposes. For example, as part of our fraud prevention efforts, we scan and analyze messages to mask contact information and references to other websites. In some cases, we may also scan, review, or analyze messages to debug, improve, and expand product offerings. We use automated methods where reasonably possible. However, occasionally we may need to manually review some communications, such as for fraud investigations and customer support, or to assess and improve the functionality of these automated tools. We will not review, scan, or analyze your messaging communications to send third party marketing messages to you, and we will not sell reviews or analyses of these communications.
These activities are carried out based on Private Island's legitimate interest in ensuring compliance with applicable laws and our Terms, preventing fraud, promoting safety, and improving and ensuring the adequate performance of our services.
5.2 Linking Third Party Accounts.
You may link your Private Island Account with your account at a third party social networking service. Your contacts on these third party services are referred to as “Friends.” When you create this link:
We only collect your information from linked third party accounts to the extent necessary to ensure the adequate performance of our contract with you, or to ensure that we comply with applicable laws, or with your consent.
5.3 Third Party Partners & Integrations
The Private Island Platform may contain links to third party websites or services, such as third party integrations, co-branded services, or third party-branded services (“Third Party Partners”). Private Island doesn’t own or control these Third Party Partners and when you interact with them, you may be providing information directly to the Third Party Partner, Private Island, or both. These Third Party Partners will have their own rules about the collection, use, and disclosure of information. We encourage you to review the privacy policies of the other websites you visit.
Parts of the Private Island Platform may use third party services such as Google Maps/Earth services, including the Google Maps API(s), and Citibank for Private Island Payments. Use of these respective services is subject to their privacy policies such as Google Maps/Earth Additional Terms of Use, and the Google Privacy Policy, Citi Privacy Policy.
6. YOUR RIGHTS
Consistent with applicable law, you may exercise any of the rights described in this section before your applicable Private Island Data Controller and Payments Data Controller. See here for information on data subject rights requests and how to submit a request. . Please note that we may ask you to verify your identity and request before taking further action on your request.
6.1 Managing Your Information.
You may access and update some of your information through your Account settings. If you have chosen to connect your Private Island Account to a third-party application, like Facebook or Google, you can change your settings and remove permission for the app by changing your Account settings. You are responsible for keeping your personal information up-to-date.
6.2 Rectification of Inaccurate or Incomplete Information.
You have the right to ask us to correct inaccurate or incomplete personal information about you (and which you cannot update yourself within your Private Island Account).
6.3 Data Access and Portability.
In some jurisdictions, applicable law may entitle you to request certain copies of your personal information held by us. You may also be entitled to request copies of personal information that you have provided to us in a structured, commonly used, and machine-readable format and/or request us to transmit this information to another service provider (where technically feasible).
6.4 Data Retention and Erasure.
We generally retain your personal information for as long as is necessary for the performance of the contract between you and us and to comply with our legal obligations. In certain jurisdictions, you can request to have all your personal information deleted entirely." Please note that if you request the erasure of your personal information:
6.5 Withdrawing Consent and Restriction of Processing.
If we are processing your personal information based on your consent you may withdraw your consent at any time by changing your Account settings or by sending a communication to Private Island specifying which consent you are withdrawing. Please note that the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal. Additionally, in some jurisdictions, applicable law may give you the right to limit the ways in which we use your personal information, in particular where (i) you contest the accuracy of your personal information; (ii) the processing is unlawful and you oppose the erasure of your personal information; (iii) we no longer need your personal information for the purposes of the processing, but you require the information for the establishment, exercise or defence of legal claims; or (iv) you have objected to the processing pursuant to Section 6.6 and pending the verification whether the legitimate grounds of Private Island override your own.
6.6 Objection to Processing.
In some jurisdictions, applicable law may entitle you to require Private Island and Private Island Payments not to process your personal information for certain specific purposes (including profiling) where such processing is based on legitimate interest. If you object to such processing Private Island and/or Private Island Payments will no longer process your personal information for these purposes unless we can demonstrate compelling legitimate grounds for such processing or such processing is required for the establishment, exercise or defence of legal claims.
Where your personal information is processed for direct marketing purposes, you may, at any time, ask Private Island to cease processing your data for these direct marketing purposes by sending an e-mail to opt-out@Private Island.com.
6.7 Lodging Complaints.
You have the right to lodge complaints about our data processing activities by filing a complaint with our Data Protection Officer who can be reached by the “Contact Us” section below or with a supervisory authority.
7. OPERATING GLOBALLY & INTERNATIONAL TRANSFERS
To facilitate our global operations Private Island and Private Island Payments may transfer, store, and process your information within our family of companies, partners, and service providers based in Europe, India, Asia Pacific and North and South America. Laws in these countries may differ from the laws applicable to your country of residence. For example, information collected within the EEA may be transferred, stored, and processed outside of the EEA for the purposes described in this Privacy Policy. Where we transfer, store, and process your personal information outside of the EEA we have ensured that appropriate safeguards are in place to ensure an adequate level of data protection.
7.2 Other Means to Ensure an Adequate Level of Data Protection.
If Private Island Ireland is the Data Controller and your information is shared with corporate affiliates or third party service providers outside the EEA, we have (prior to sharing your information with such a corporate affiliate or third party service provider) established the necessary means to ensure an adequate level of data protection. This may be an adequacy decision of the European Commission confirming an adequate level of data protection in the respective non-EEA country or an agreement on the basis of the EU Model Clauses (a set of clauses issued by the European Commission). We will provide further information on the means to ensure an adequate level of data protection on request.
7.3 California & Vermont Residents.
Private Island Payments will not share information it collects about you with its affiliates or third parties (both financial and non-financial), except as required or permitted by your state’s law.
7.4 California Privacy Rights.
California law permits Members who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those third parties. See the “Contact Us” section for where to send such requests. Private Island and Private Island Payments do not share personal information with third parties for their own direct marketing purposes without your prior consent. Accordingly, you can prevent disclosure of your personal information to third parties for their direct marketing purposes by withholding consent.
Effective January 1, 2020, the California Consumer Privacy Act (CCPA) allows California residents, upon a verifiable consumer request, to request that a business that collects consumers’ personal information to give consumers access, in a portable and (if technically feasible) readily usable form, to the specific pieces and categories of personal information that the business has collected about the consumer, the categories of sources for that information, the business or commercial purposes for collecting the information, and the categories of third parties with which the information was shared. California residents also have the right to submit a request for deletion of information under certain circumstances. Consistent with California law, if you choose to exercise your rights, we won’t charge you different prices or provide different quality of services unless those differences are related to your information. See here for information on data subject rights requests and how to submit a request. Please note that you must verify your identity and request before further action is taken. As a part of this process, government identification may be required. Consistent with California law, you may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government issued identification, and the authorized agent’s valid government issued identification.
We do not sell personal information to third parties. We do allow third parties to collect personal information through our Service and share personal information with third parties for the business purposes described in this Privacy Policy, including without limitation advertising and marketing on our Service and elsewhere based on users’ online activities over time and across different sites, services, and devices.
8. SECURITY
We are continuously implementing and updating administrative, technical, and physical security measures to help protect your information against unauthorized access, loss, destruction, or alteration. Some of the safeguards we use to protect your information are firewalls and data encryption, and information access controls. If you know or have reason to believe that your Private Island Account credentials have been lost, stolen, misappropriated, or otherwise compromised or in case of any actual or suspected unauthorized use of your Private Island Account, please contact us following the instructions in the Contact Us section below.
9. CHANGES TO THIS PRIVACY POLICY
Private Island reserves the right to modify this Privacy Policy at any time in accordance with this provision. If we make changes to this Privacy Policy, we will post the revised Privacy Policy on the Private Island Platform and update the “Last Updated” date at the top of this Privacy Policy. We will also provide you with notice of the modification by email at least thirty (30) days before the date they become effective. If you disagree with the revised Privacy Policy, you may cancel your Account. If you do not cancel your Account before the date the revised Privacy Policy becomes effective, your continued access to or use of the Private Island Platform will be subject to the revised Privacy Policy.
10. CONTACT US
If you have any questions or complaints about this Privacy Policy or Private Island’s information handling practices, you may email us at the email addresses provided in the relevant sections above or contact us via mail at:
Private Island 1 Blackfield Drive, Tiburon CA 94920
Apple Pay & Privacy
Apple Pay is designed to protect your information and enable you to choose what you share.
Apple Pay allows you to make secure purchases in stores, in apps, and on the web, using your debit, credit, and prepaid cards.
Adding Cards to Apple Pay
When you are adding a payment card like store, credit, debit, and prepaid cards to Apple Pay, information you provide about your card, and whether certain device settings are enabled may be sent to Apple in order to determine your eligibility to enable Apple Pay. Your device may also evaluate device use patterns (for example, percent time device is in motion, approximate number of calls per week) to help identify fraud. The information evaluated by your device is not shared with Apple in a way that can be linked to you.
Information may also be provided by Apple to your card issuer, payment network, or any providers authorized by your card issuer to enable Apple Pay, in order to determine the eligibility of your card, to set up your card with Apple Pay, and to prevent fraud, including:
• Your credit, debit, or prepaid card number
• The name and billing address associated with your Apple ID, iTunes, or App Store account
• General information about your Apple ID, iTunes, and App Store account activity (for example, whether you have a long history of transactions within iTunes)
• Information about your device and, if using Apple Watch, the paired iOS device (for example, a device identifier, phone number, and the name and model of your device)
• Location at the time you add your card (if you have Location Services enabled)
• Account or device history of adding payment cards
• Aggregated stats relating to the information from payment cards you’ve added or attempted to add to Apple Pay
When you add a card to Apple Pay using a third-party app such as a banking app, the app sends an account or card identifier to your device. This information is used by Apple and your card issuer to determine the eligibility of your card, set up your card with Apple Pay, and to prevent fraud. To help you set up cards that you have, or have recently had, on other devices, Apple stores a card reference with your iCloud account that can be used with the card issuer or payment network to re-add the card after entering the security code. Apple Pay does not store the original credit, debit, or prepaid card number.
Paying with Apple Pay
Information Shared When You Make a Payment
When you begin a payment within an app, on the web, or within Business Chat using Apple Pay, to enable tax and shipping cost calculation your zip code, postal code, or other equivalent information is provided to the app, website, or merchant. After you authorize the payment, other information requested by the merchant, such as a device-specific account number, your shipping address, or email address, is also provided. The card number from your credit, debit, or prepaid card is not provided when you use Apple Pay.
When you make a payment using a QR code pass in Wallet, your device will present a unique code and share that code with the pass provider to prevent fraud. If the device from which payment is made has the pass provider’s app installed, the pass provider may collect and process additional information at the time of payment to prevent fraud, consistent with the app’s privacy policy. The pass provider may also directly contact you for more information to verify the transaction, if needed.
Apps and Websites Can Check if You Have Set up Apple Pay
When using an app or a website that uses Apple Pay in iOS, watchOS, or macOS, the app or website can check if you have Apple Pay enabled on that device. When visiting a website in Safari on an iOS device, or Mac to which a card cannot be added, the website can check if you have Apple Pay set up on an iPhone or Apple Watch using the same iCloud account. You can disable websites you visit from checking if Apple Pay is enabled by changing your settings. On iOS, go to Settings > Safari > Check for Apple Pay. On Mac, go to Safari > Preferences > Privacy and deselect “Allow websites to check for Apple Pay and Apple Card.”
Apple Transmits, but Does Not Store Your Payment Information
In order to securely transmit your payment information within apps, websites, and Business Chat, it is sent to Apple in encrypted form, where it is briefly decrypted and re-encrypted with a merchant-specific key, so that only the merchant, the developer, or their payment processor can decrypt your payment information. When you make a payment on a Mac to which a card cannot be added, the Mac and the authorizing device communicate over an encrypted channel via Apple servers. Apple does not retain any of this information in a form that personally identifies you.
Transit Cards
By adding a transit card to Wallet, information about the transit card will be associated with your iCloud account. So long as your transit card has a positive balance, the card will remain associated with your iCloud account to help ensure you can recover the balance. If you add more than one transit card to Wallet, Apple or its partners may be able to link personal and account information associated between cards, for example personalized travel cards can be linked to non-personalized travel cards. In Japan, aggregate, non-personally identifiable, information about setting up transit cards in Wallet may be shared with mobile device carriers on a periodic basis.
When you use a transit card, information like recently visited stations, transaction history, and additional tickets may be accessed by a contactless card reader. This information can be accessed by any nearby contactless card reader, if the card is set as your Express Transit Card (a setting that allows you to complete transactions without Touch ID, Face ID, or a passcode). You can manage Express Transit on your iOS device by going to Settings > Wallet & Apple Pay or in Apple Watch app by tapping Wallet & Apple Pay, then tapping Express Transit Card and selecting a payment card.
Rewards and Gift Cards
Apple Pay also allows you to use eligible rewards and gift cards that are stored in Wallet to make contactless rewards and gift card transactions in select stores. If you add a rewards or gift card to Wallet, information about your account or card (including an identifier) will be stored on your device and synced via iCloud. You can disable iCloud syncing by going to Settings > [your name] > iCloud, and tapping to turn off Wallet.
When you use Apple Pay in stores, the payment terminal may request the rewards or gift card identifier from its associated rewards or gift card on your device as part of the transaction. You can disable this functionality by selecting the card in Wallet and disabling Automatic Selection in the card details. In select stores, if the payment terminal does not receive a rewards card identifier from your device, when you pay using Apple Pay, it may trigger a notification asking if you would like to add your rewards card to Apple Pay or sign up for the merchant’s rewards program if you are not a member. In the case of rewards sign-up, the merchant may request that you provide information to them such as your name, postal code, email address, and phone number. While Apple will receive notice when you personalize a merchant’s rewards card, the information you share will be sent directly from your device to the merchant and treated in accordance with the merchant’s privacy policy.
Student ID Cards
If you choose to add a supported student ID card to Wallet, information about your student ID card and whether certain device settings are enabled may be provided to Apple. Information may also be provided by Apple to your school and providers authorized by your school to enable your ID card, determine eligibility, to set up your card, and to prevent fraud, including:
• Your student ID card number
• The name and billing address associated with your Apple ID, iTunes, or App Store account
• Information about your device and, if using Apple Watch, the paired iOS device (for example, device identifier and model of your device)
Apple Receives and Stores Your Student ID Photo and Stores It with Your iCloud Account
When you use a student ID card, contactless card readers can access your ID card number if the card is set to operate in Express Mode (a setting that allows you to complete transactions without Touch ID, Face ID, or a passcode). You can manage Express Mode on your iPhone in Settings > Wallet & Apple Pay or in Apple Watch app by tapping Wallet & Apple Pay.
Other Information
If you have Location Services turned on, the location of your device at the time you use it to make purchases in stores may be sent anonymously to Apple and will be used to help Apple Pay improve the accuracy of business names in the Wallet card transaction history and may be retained in aggregate to improve Apple Maps, Apple Pay, and Wallet. You can disable this location-based functionality of Apple Pay at any time on your iOS device by going to Settings > Privacy > Location Services > System Services and tapping to turn off Apple Pay Merchant Identification. On Mac, go to System Preferences > Security & Privacy > Privacy, click Location Services, click the lock to make changes and enter your password, then deselect Wallet.
To help you manage your payment methods on the Apple ecosystem, Apple may check whether any Apple Pay payment methods are eligible to be added as a payment method on file to your Apple ID and display those payment methods in Settings > [your name] > Payment & Shipping > Add Payment Method > Found in Wallet. When you conduct a transaction with your Apple ID, Apple may also check whether any Apple ID payment methods on file are eligible for Apple Pay. If so, to help safeguard your payment information, Apple may enable Apple Pay for that payment method. You can modify your Apple ID payment methods at any time by going to Settings > [your name] > Payment & Shipping.
Apple Pay data that has been disassociated from you may be retained for a limited period of time to generally improve Apple Pay and other Apple products and services.
The terms of any cardholder, user, merchant agreement, or other terms and conditions applicable to the use of the features of Apple Pay will continue to govern the use of your cards and their use in connection with Apple Pay, and such terms may have additional privacy policies.
At all times, information collected by Apple will be treated in accordance with Apple’s Privacy Policy, which can be found at www.apple.com/privacy