In Control for Commercial Payments (ICCP).
Please refer to your Mastercard agreement.
On MasterCard ICCP's Privacy Page you can request and collect all the privacy and GDPR related information that MasterCard ICCP is providing.
The basis for MasterCard sharing, adding, uploading, hosting, accessing or sending personal data out of Europe. Vendors can also add a description of their own impact assessment for data transfers.