Common use of Retention of Card Data Clause in Contracts

Retention of Card Data. Unless you receive and record the express consent of the cardholder, you may not retain, track, monitor or store any Card Data. You must completely and securely destroy all Card Data that you retain or hold within 24 hours after you receive an authorisation decision from the issuer relevant to that Card Data. If, with the cardholder’s consent, you briefly retain Card Data, you may do so only to the extent that the Card Data are necessary for processing payment transactions with the cardholder’s authorisation. You must never give or disclose the retained Card Data to anyone, not even as part of the sale of your business. Moreover, and regardless of anything to the contrary, you must never retain or disclose the card verification and identification data printed in the signature stripe on the back of the card (i.e. the CVV2 Data), not even with the cardholder’s consent.

Retention of Card Data. Unless you receive and record the express consent of the cardholder, you may not retain, track, monitor or store any Card Data. You must completely and securely destroy all Card Data that you retain or hold within 24 hours after you receive an authorisation authorization decision from the issuer relevant to that Card Data. If, with the cardholder’s consent, you briefly retain Card Data, you may do so only to the extent that the Card Data are necessary for processing payment transactions with the cardholder’s authorisationauthorization. You must never give or disclose the retained Card Data to anyone, not even as part of the sale of your business. Moreover, and regardless of anything to the contrary, you must never retain or disclose the card verification and identification data printed in the signature stripe on the back of the card (i.e. the CVV2 Data), not even with the cardholder’s consent.