Privacy Notice for Professional Partners

September 2023

This Privacy Notice (" Privacy Notice ") explains how we handle your personal data (" Personal Data ") while you browse our website or mobile application (" Website/App ") and when you register or become an agent of Ria and/or interact with us as a professional partner (" Professional Partner ").

We encourage you to review this Privacy Notice regularly and check the Website/App for any updates. Updates to this Privacy Notice will be posted on our Website/App and by continuing to do business with us, you agree to this Privacy Notice and any future modifications.

When local law requires additional details to be included in this Privacy Notice, that information has been added to the Regional Privacy Notice section below.

1. What Personal Data do we collect, how do we collect it, and why?

The categories, sources, and reasons for collecting Personal Data are listed below. When collection of Personal Data is based on your consent, you may withdraw your consent at any time. RIA does not and will not "sell" or "share" Personal Data as those terms are defined under applicable law. We retain Personal Data as long as reasonably necessary to provide the Service and meet our legal obligations.

If you have questions or concerns about how we process your Personal Data, you can contact us at any time at dpo@euronetworldwide.com

Identification or Identifying Data

Personal Data we collect from you may include your name, email, phone and/or fax number, residential and/or business address and other contact data ("Contact Details"), title, date of birth, gender, image, video or signature.

When necessary, Identifying Data is used only for the purposes described.

Contractual Obligation

Financial details and information related to profession or employment

We collect your personal financial data when you register to use our Service. We collect financial data such as bank account information, financial statements, reason for transfer, profession (professional or employment-related information) or other documents to prove the source of funds you wish to transfer (similar to payslips), in order to provide you with our Service.

Technical and behavioral information

IP address, internet network or other similar network, web browsing or search activity, behavioral information (to understand how you behave when using our products and services), browser type and version, timezone settings, screen resolution settings, browser plugin type and versions, operating system and platform.

See our Cookie Policy

Audio and video monitoring

Recording of images, video and audio/voice.

Personal Data collected from you may vary depending on the country in which our Service is being provided. Not all types of data described above may apply to you. If you have any questions about how we process your Personal Data, you can contact us at dpo@euronetworldwide.com

Non-identifiable data

Whenever possible, we use data from which you cannot be directly identified (such as anonymized usage and demographic data) instead of Personal Data ("non-identifiable data"). This non-identifiable data may be used to improve our internal processes or provide services without further notice to you.

We may use aggregated data for various purposes, including analysis, evaluation and improvement of our Service.

Device features

When using the application, we may need access to certain additional information and functions on your device, such as your contact list. Before accessing that information, we will ask for your permission. Any data obtained by using these device features will only be stored on your device, never stored on our servers or elsewhere.

2. Accuracy of Personal Data

We are committed to keeping your Personal Data accurate and up to date. We take reasonable steps to ensure the accuracy of your Personal Data by ensuring that the most recent Personal Data we receive is recorded accurately and when we deem it necessary, we will conduct periodic reviews and ask you to update your Personal Data. Sometimes, we may send you an email asking you to confirm and/or update your Personal Data. This communication is based on our legitimate interest and legal obligation to maintain accurate and up-to-date information.

If you notice that your Personal Data is inaccurate, you can request correction or update of your information by emailing dpo@euronetworldwide.com .

3. Legitimate interest

When we use your Personal Data to pursue our legitimate interests, we will do our best to balance our interests with yours so that your Personal Data will only be used as permitted by applicable law or when it does not adversely affect your rights. When requested, customers may request information about any processing based on legitimate interest.

4. How long does Ria retain Personal Data?

Personal Data is retained as long as necessary to provide the requested Service and comply with current legal, accounting or reporting obligations. The retention period is determined based on current requirements and obligations, which may include:

• Legal and regulatory requirements : Your personal data is retained as long as necessary to comply with all of our legal obligations, including but not limited to, trade, tax and anti-money laundering laws and regulations. Although we only store your Personal Data for the purpose of complying with legal obligations, your Personal Data will be restricted from being used for any other purpose. Although restricted, your Personal Data will only be accessed when necessary. Whenever we receive a deletion request, we will also maintain your Personal Data according to our legal obligations.

• Customer service and Contractual relationship (customer relationship management, complaint handling, etc.) : We will retain your personal data as long as you remain our customer. When we consider our contractual relationship to have ended, we will proceed to restrict your data to provide that data only to comply with legal obligations as presented above.

• Marketing : We will process your Personal Data for marketing purposes as long as you have not requested us to opt out, according to section 11 of this Privacy Notice or until we know that you are no longer interested or your data is no longer accurate.

5. Does Ria share my personal data with third parties?

Euronet Group

Third-party service providers*

*The legal meaning and list of "third-party service providers" may vary depending on the country you live in. For more information about which providers have access and why they have access to your Personal Data, you can contact us at dpo@euronetworldwide.com .

Legal and regulatory authorities

Strategic partners

Professional partners

6. Minors

We do not directly provide Services to children under 18 or actively collect personal information from them. If you are under 18, please do not use the Website/App or Offer or share Personal Data with us. If you know that anyone under 18 has unlawfully provided Personal Data to us, please contact us at dpo@euronetworldwide.com .

7. Data security

We are committed to protecting your Personal Data and have implemented appropriate and commercially reasonable protective measures to prevent any loss, misuse and alteration of information you have entrusted to us. At RIA, we will always strive to ensure your Personal Data is well protected, in line with international best practices. We maintain this data security commitment by implementing appropriate physical, electronic and administrative measures to protect and secure your personal information.

To protect our systems from unauthorized access, we use advanced organizational and physical security measures, secure, continuously strengthened to ensure the highest level of security according to international best practices and cost-effective. All Personal Data is held in a secure location protected by firewalls and other sophisticated security mechanisms with restricted administrative access.

Employees with access to your Personal Data as well as processing activities surrounding your Personal Data are contractually bound to keep your data private and comply with the Privacy Policy we have implemented in our organization.

We aim to achieve the highest data protection standards by applying industry-standard measures to protect your privacy.

8. Marketing and Advertising

Third-party advertisers provide advertisements displayed on our website, App or elsewhere in our service. Third-party advertisers do not have access to any information that our customers have provided directly to us. Typically, advertisers rely on cookies or some other web/app-based mechanism to assess which ads might interest you. We do not place "Targeting Cookies" or enable "Targeting" and "Location" on your system without your consent.

If you have consented by accepting Targeting Cookies on the Website or enabled Targeting on the app, we may use third parties to do so (retargeting features and Similar Audiences). You can opt out of advertising by modifying your cookie settings here .

Third parties are not bound by our Privacy Notice. To understand their privacy policy notice, you should visit the third-party website. You can find all third parties that may use Cookies for targeting in our Cookie Policy .

Occasionally, we may contact you (via email, SMS, mail or phone when necessary and according to your specific instructions) and when you have consented to us providing targeted marketing about our Service and/or products.

Why will you receive electronic communications?

Depending on the country you live in, you will receive marketing information if you have authorized us to process your Personal Data for those purposes. This means you have opted in during registration or at any time in the settings section of your profile.

We may also send you electronic communications for marketing purposes when you have a contractual obligation with us, meaning when you are currently using our Service or when you do not explicitly request not to receive the above marketing information.

You will always be notified and we will ensure that during the use of our Service or even during registration, you have all the necessary information so you know that your Personal Data may be used for that specific purpose and you during registration or during the use of our Service will have the opportunity to clearly state that you are not interested in receiving such marketing information. In these cases, we will remove you from our list and you will not receive any updates that you may be interested in about our Service and products. You will be able to opt back in at any time.

How can you opt out?

You will be able to withdraw your consent at any time by using one of the following mechanisms:

• Go to your profile and update your marketing preferences.

• Use the unsubscribe link you will receive in any of our communications.

• By emailing dpo@euronetworldwide.com .

If you have any further questions regarding the use of your Personal Data for marketing purposes and/or would like to start receiving marketing information, you can also email dpo@euronetworldwide.com .

9. Description of Personal Data Rights

Depending on where you live, your Personal Data Rights under applicable law may include:

1. Right to know : the right to know what personal data is being collected, sold or shared and with whom.

2. Right of access : the right to request access to a copy of your personal data.

3. Right to correct inaccuracies : the right to request correction of inaccuracies in your personal data.

4. Right to delete : the right to request deletion of your personal data when certain conditions apply.

5. Right to object :

   1. Right to object to processing of Personal Data for targeted advertising purposes.

   2. Right to object to processing of Sensitive Personal Data.

   3. Right to object to processing of personal data for profiling to make decisions that produce legal or similarly significant effects on the data subject.

6. Right to restrict use and disclosure of sensitive personal data to specific permitted purposes.

7. Right to restrict processing : the right to restrict processing when certain conditions apply.

8. Right to data portability : the right to receive personal data in a structured, commonly used and machine-readable format and the right to transmit personal data to another controller under certain conditions.

9. Right to object : the right to object to processing of personal data (i.e. for direct marketing purposes).

10. Rights related to automated individual decision-making : the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on an individual.

11. Right of Non-Retaliation : a business shall not discriminate against an individual for exercising their Personal Data rights.

We will respond to your request as soon as possible and within the timeframe specified in applicable law.

To see which rights apply, please refer to the Regional Privacy Notice section below. To exercise any of your rights, you must email dpo@euronetworldwide.com . To help protect your privacy and maintain security, we will take necessary steps to verify your identity and may ask you to provide additional details before granting you access to your Personal Data or beginning to modify any Personal Data. When requested, if we do not have a copy of your ID or any legal document proving your identity, we will not be able to respond to your request.

Please note that some rights may not be enforceable due to business needs or legal obligations while providing the Service to you. Your rights may be limited to comply with other legal obligations such as anti-money laundering, contractual obligations and compliance. Nevertheless, you will always be accommodated when exercising any of the rights mentioned above and/or any additional rights you may have depending on your jurisdiction. If your rights cannot be enforced, you will always receive an appropriate explanation.

10. Privacy complaint procedure

The data subject has the right to file a complaint with the Data Protection Authority or court if they believe we have failed to comply with our obligations under this Privacy Notice or applicable law:

• Europe (EEA): Member |European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner's Office (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Personal Data Protection Authority

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Privacy Unit of the Department of Justice

• United States: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: National Institute of Transparency, Access to Information and Protection of Personal Data

• Chile: Council for Transparency

Ria has the right to modify this Privacy Notice at any time and will post notice of REGIONAL PRIVACY NOTICE such changes.

11. Notice to U.S. Consumers

This Notice is provided to consumers and customers in the United States (including former customers) to comply with the requirements of the federal Gramm-Leach-Bliley Act ("GLBA"), if applicable, regarding the collection, disclosure, and protection of "nonpublic personal information" ("NPI") as defined by the GLBA. For purposes of this Notice, NPI means personally identifiable information about an individual collected by RIA as a financial institution under the GLBA relating to RIA's provision of financial products or services, unless the information is lawfully made public. NPI collected by RIA may include any of the following:

• information that an individual provides to RIA to obtain a financial product or service.

• information RIA obtains about an individual from a transaction relating to RIA's financial products or services (meaning that individual is a customer/consumer of RIA, account number, etc.); or

The categories of NPI that RIA may collect are listed in Section 1 of this Privacy Notice.

The categories of NPI that may be disclosed by RIA are listed in Section 9 of this Privacy Notice.

The categories of affiliates and unaffiliated third parties to whom NPI is disclosed or may be disclosed are set forth in this Privacy Notice. When RIA discloses NPI to unaffiliated third parties under the exceptions under GLBA, all such disclosures are made in accordance with the permission of law. "Unaffiliated third party" means any person other than an affiliate of a financial institution or a person employed jointly by a financial institution and a company that is not an affiliate of the institution.

The categories of information disclosed and the persons who fall within the service provider/joint marketing exceptions of the Privacy Rule are listed in this Privacy Notice.

If NPI may be disclosed to unaffiliated third parties and such disclosure does not fall within any exception of the Privacy Rule under GLBA, then consumers and customers have the right to opt out of such disclosures and an opt-out mechanism will be provided to the consumer or customer.

Notice regarding RIA's sharing of information among Euronet Group and its affiliates is provided in Section 9 of this Privacy Notice under the Fair Credit Reporting Act.

RIA's policies and practices relating to the protection of the confidentiality and security of NPI are set forth in this Privacy Notice.

California Consumers

Under the California Consumer Privacy Act, California residents may exercise the following rights:

• 1 (Right to Know)

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 5 (Right to Opt Out of Sale or Sharing of Personal Data for Purposes of Contextual Advertising)

• 6 (Right to Limit Use and Disclosure of Sensitive Personal Data to Specific Permitted Purposes)

• 11 (Right Not to Be Retaliated Against for Opting Out or Exercising Other Rights)

12. Notice to European Economic Area (EEA) Residents

Under the General Data Protection Regulation (GDPR) and in addition to the rights status in Section 15 above, all residents of the European Economic Area (EEA) may exercise the following rights:

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

• 8 (Right to Data Portability)

• 9 (Right to Object)

• 10 (Rights Related to Automated Individual Decision-Making)

To exercise any of the rights listed above, you must comply with the obligations set forth in Section 15 of this Privacy Notice.

From the date we receive your request, we will respond to you within a maximum of 30 days, unless an extension is requested.

While processing your Personal Data, we need to share your Personal Data as follows:

13. Notice to United Kingdom Residents

Under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all residents of the United Kingdom may exercise the following rights:

• 1 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

• 8 (Right to Data Portability)

• 9 (Right to Object)

• 10 (Rights Related to Automated Individual Decision-Making)

To exercise any of the rights listed above, you must comply with the obligations set forth in Section 15 of this Privacy Notice.

14. Notice to Argentine Residents

Under the Ley de Protección de Datos Personales 25.326, you have the following rights, as defined above in Section 15:

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

To exercise your Rights or to revoke or raise any doubt or complaint regarding the processing of your Personal Data, you may contact us at dpo@euronetworldwide.com in accordance with the instructions set forth in Section 15.

You are informed that there are options available to you to limit how we use or disclose your personal information for specific processing.

From the date we receive your request, we will respond to you within a maximum of 5 days (for requests related to deletion and updating of your Personal Data) or within a maximum of 10 days (for requests related to access to your Personal Data).

15. Notice to Mexico Residents

Ria Mexico, with a place of residence to hear and receive notices for purposes of privacy protection and Personal Data as set forth in Section 27, and in compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares ("Mexico Law"), its Regulations, and Principles, provides users or potential users as data subjects with this Privacy Notice, prior to the collection of Personal Data, strictly complying with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability as required by Mexico Law.

For the purpose of providing services as a money remitter under Article 81-A Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, Ria Mexico will collect Personal Data, if any, under the legal bases mentioned in Section 1, and related to the following purposes:

• To verify that the Personal Data contained in the voting authentication information sent to Ria Mexico matches the data contained in the registry of the National Electoral Authority.

• To verify that the CURP data provided to Ria Mexico matches the data registered in the National Population Registry.

Additionally, and when necessary, to comply with Articles 4 and 4 Bis of the General Regulations mentioned in Article 95 bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito applicable to money remitters mentioned in Article 81-A Bis of the same law ("Regulations"), Ria Mexico has a legal obligation to collect information about your geographic location as well as voice recordings and facial images of you to identify you or potential users in a non-face-to-face manner, and to obtain other related data that will be explained in detail in the specific form available in the application as required by the Regulations. We will always process that information based on your consent.

You have the following rights ("ARCO Rights"):

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 9 (Right to Object)

Similarly, you also have the right to limit or revoke at any time the consent granted for the processing of your Personal Data, to the extent permitted by law. To exercise any of your ARCO Rights, to revoke your consent, or to submit any questions or complaints regarding the processing of your Personal Data, you may contact us at: dpo@euronetworldwide.com in accordance with the instructions in Section 15.

We will respond to you within 20 days from the date we receive your request and it will take effect within 15 business days after we notify you of our response.

16. Notice to Chile Residents

Under the Law, you have the following rights ("ARCO Rights"):

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 9 (Right to Object)

Similarly, you have the right to revoke at any time the consent granted for the processing of your Personal Data to the extent permitted by Law. To exercise your ARCO Rights or revoke rights or raise any questions or complaints regarding the processing of your Personal Data, you may contact us at dpo@euronetworldwide.com in accordance with the instructions in Section 15.

Hereby, you are informed that there are options available to you to limit how we use or disclose your Personal Information for specific processing.

From the date we receive your request, we will respond to you within a maximum of 2 days.

17. Notice to Malaysia Residents

Under the Personal Data Protection Act 2010 ("PDPA"), customers may provide us with their Personal Data for any purpose established in Section 1 of this Privacy Notice. If we process your Personal Data for any additional purpose, we will first notify you or request your explicit consent.

At any time, you may exercise the rights set forth in Section 15. You may also withdraw your consent unless the processing activity is necessary to fulfill any legal obligation or to provide you with any of our Services. You may also object to processing if you believe that processing activity may cause any harm or suffering to you.

From the date we receive your request, we will respond to you within a maximum of 21 days.

Under the terms of the PDPA, RIA has the right to charge a fee for processing any data access request.

18. Notice to New Zealand Residents

For all residents in New Zealand, the rights you may exercise regarding the processing of your Personal Data are as follows:

• 1 (Right to Know)

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

To exercise any of the rights listed above, you must comply with the obligations set forth in Section 15 of this Privacy Notice.

From the date we receive your request, we will respond to you within a maximum of 20 days.

19. Notice to Australia Residents

For all residents in Australia, the rights you may exercise regarding the processing of your Personal Data are as follows:

• 1 (Right to Know)

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

You may also request that we explain our data policies and practices under current law.

From the date we receive your request, we will respond to you within a maximum of 30 days.

While processing your Personal Data, we need to share your Personal Data as follows:

20. Notice to India Residents

For all residents in India, the rights you may exercise regarding the processing of your Personal Data are the rights listed in Section 15. Please note that to exercise any of your rights, you need to follow the guidelines set forth in Section 15.

You may exercise your right regarding data portability and the right not to be subject to legal effects resulting from automated decision-making, such as profiling, if such profiling is not necessary to provide you with any of our Services.

From the date we receive your request, we will respond to you within a maximum of 30 days.

21. Our Companies by Service

The controller is RIA represented by the companies below, depending on the country and service:

Money Transfer Service

22. Our Companies by Service

The controller is Ria represented by the companies below, depending on the country and service:

You can always send a request to our Data Protection Officer by sending an email to the following address: dpo@euronetworldwide.com .

*Countries in the EEA region (European Economic Area): Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.