Privacy Notice for Professional Partners

September 2023

This Privacy Notice (hereinafter referred to as the “Privacy Notice”) explains how we process your personal data (hereinafter referred to as “Personal Data”) when you browse our website or mobile application (hereinafter referred to as the “Website / Application”) and when you apply for employment, become a representative of Ria, or cooperate with us as a professional partner (hereinafter referred to as a “Professional Partner”).

We recommend that you regularly review this Privacy Notice and check the Website / Application for updates. Updates to this Privacy Notice will be published on our Website / Application. By continuing to cooperate with us, you agree to this Privacy Notice and any future amendments to it.

Where local laws require additional details to be included in this Privacy Notice, such information has been incorporated into the “Regional Privacy Notices” section below.

Who are we?

We are RIA, part of the Euronet group of companies.

You can find all our contact details here.

What type of Personal Data is collected?

We collect only the Personal Data necessary to provide our services and comply with applicable laws.

With your consent, we also collect data for additional purposes.

Why do we collect Personal Data?

We collect Personal Data for specific contractual and legal purposes.

How long does RIA retain Personal Data?

We retain Personal Data only for as long as necessary or as required by applicable laws and regulations.

To whom do we disclose Personal Data?

We disclose Personal Data to other companies within the Euronet Group, legal authorities, and partners where necessary to fulfill regulatory obligations or contractual commitments.

Where does RIA store Personal Data?

We store Personal Data in secure locations where strict security measures are implemented.

If we need to transfer Personal Data to other locations, we will take all necessary measures to comply with our legal obligations and ensure an adequate level of security.

What are your rights regarding Personal Data?

Depending on where you live, you may have certain rights regarding your Personal Data under applicable regulations. A description of common rights related to Personal Data is provided in Article 15 below. To submit a request, you may contact us by email at dpo@euronetworldwide.com or by phone (local phone numbers are available here).

Internal appeals process

If you receive notice from us that your request to exercise rights related to Personal Data has been denied, you may appeal the denial within a reasonable period after receiving the notice by sending an email to dpo@euronetworldwide.com.

1. What Personal Data do we collect, how do we collect it, and why?

The categories, sources, and reasons for collecting Personal Data are listed below. If the collection of Personal Data is based on your consent, you may withdraw your consent at any time. RIA does not sell and will not “share” Personal Data as those terms are defined under applicable regulations. We retain Personal Data for as long as reasonably necessary to provide our services and fulfill our legal obligations.

If you have any questions or concerns regarding the processing of your Personal Data, you may contact us at any time at dpo@euronetworldwide.com.

Identifiers or Identification Data

The Personal Data we collect from you may include your name, email, telephone or fax number, residential or business address, and other contact information (“Contact Data”), title, date of birth, gender, images, videos, or signature.

Identification data is used only where necessary for the stated purposes.

Financial Data and Information Related to Profession or Employment

We collect your personal financial information when you register to use our services. To provide our services, we collect financial data such as bank account information, financial statements, transfer purpose, occupation (professional or employment information), or other documents proving the source of funds you intend to transfer (such as payslips).

Behavioral and Technical Information

IP address, internet or other network activity, browsing or search activity, behavioral information, browser type and version, time zone settings, screen resolution settings, browser plug-in types and versions, operating system, and platform.

Please review our Cookie Policy.

Audio and Security Camera Recordings

Image, video, and audio/voice recordings.

The Personal Data collected may vary depending on the country where our services are offered. Not all categories described above may apply to you.

Non-Personally Identifiable Data

Whenever possible, we use data that cannot directly identify you (such as anonymous demographic and usage data) instead of Personal Data (“Non-Personally Identifiable Data”). Such data may be used to improve our internal processes or services without further notice to you.

We may use aggregated data for analytics, evaluation, and service improvement purposes.

Device Features

When using the Application, we may require access to additional device information and functions, such as your contact list. We will request your consent before accessing such information. Any data obtained through these device features will be stored only on your device and never on our servers or elsewhere.

2. Accuracy of Personal Data

We are committed to maintaining accurate and up-to-date Personal Data. We ensure accuracy by recording the latest Personal Data received and conducting periodic reviews where necessary. From time to time, we may send you an email requesting confirmation or updates of your Personal Data. Such communications are based on our legitimate interest and legal obligation to maintain accurate records.

If you discover that your Personal Data is inaccurate, you may request correction or updating by emailing dpo@euronetworldwide.com.

3. Legitimate Interest

Where we process your Personal Data based on legitimate interests, we will make every effort to balance our interests with yours so that your Personal Data is used only in accordance with applicable laws and without adversely affecting your rights.

Customers may request information regarding any processing based on legitimate interest.

4. How long does Ria retain Personal Data?

We retain Personal Data for as long as necessary to provide requested services and fulfill applicable legal, accounting, or reporting obligations.

Retention periods are determined based on relevant legal requirements and obligations, including:

• Legal and regulatory obligations

• Customer service and contractual relationships

• Marketing purposes until you opt out or data becomes inaccurate

5. Does Ria disclose my Personal Data to third parties?

Euronet Group

We disclose your Personal Data to Euronet and affiliated companies for ordinary business purposes and fulfillment of group obligations.

In the event of a sale, acquisition, merger, or reorganization, customer Personal Data may be transferred to a third party, subject to appropriate safeguards.

We also share Personal Data within the group to provide continuous customer support.

Legal basis: Legal obligation / Contractual obligation

Third-Party Service Providers

We may disclose Personal Data to:

• Data analytics and identity verification providers

• Fraud prevention services

• Advertisers and social media service providers for personalized advertising

Legal basis: Legal obligation / Consent / Contractual obligation

Administrative and Regulatory Authorities

We may disclose Personal Data if requested by authorities or where necessary to enforce our contractual terms or legal obligations.

Legal basis: Legal obligation / Contractual obligation

Strategic Partners

We may disclose Personal Data to strategic partners when necessary to provide our services.

Legal basis: Legal obligation

Professional Partners

We may disclose Personal Data to advisors, lawyers, consultants, auditors, or accountants in order to fulfill legal obligations and apply best practices.

Legal basis: Legitimate interest

6. Minors

We do not provide services directly to children under 18 years of age or knowingly collect their Personal Data. If you are under 18, please do not use the Website / Application or provide Personal Data.

7. Data Security

We are committed to protecting your Personal Data and have implemented commercially reasonable safeguards against loss, misuse, and alteration.

We use advanced physical and organizational security measures, including firewalls and restricted administrative access.

Employees with access to Personal Data are contractually obligated to maintain confidentiality.

8. Marketing and Advertising

Third-party advertisers may display advertisements on our Website / Application. These advertisers do not have access to information directly provided by our customers.

We do not place targeted cookies or enable targeting without your consent.

You may opt out of advertising by adjusting your cookie settings.

You may also withdraw consent by:

• Updating your profile preferences

• Using unsubscribe links

• Emailing dpo@euronetworldwide.com

9. Description of Your Rights Regarding Personal Data

Depending on applicable law, your rights may include:

• Right to information

• Right of access

• Right to correction

• Right to deletion

• Right to object

• Right to restrict processing

• Right to data portability

• Rights regarding automated decision-making

• Right against retaliation

To exercise your rights, contact: dpo@euronetworldwide.com.

10. Privacy Complaint Procedure

You have the right to file a complaint with a supervisory authority or court if you believe we failed to comply with applicable laws.

Relevant authorities include:

• European Data Protection Board

• UK ICO

• Swiss FDPIC

• FTC (USA)

• Privacy authorities in Canada, Mexico, Chile, Australia, etc.

Ria reserves the right to amend this Privacy Notice at any time.

11. Notice for United States Consumers

This notice complies with the Gramm-Leach-Bliley Act (GLBA) regarding collection, disclosure, and protection of non-public personal information (“NPI”).

NPI may include:

• Information provided to obtain financial services

• Transaction-related information

• Account information

California residents may exercise rights under the California Consumer Privacy Act (CCPA), including:

• Right to know

• Right to access

• Right to correct

• Right to delete

• Right to opt out of sale/sharing

• Right to limit use of sensitive information

• Right against retaliation

12. Notice for European Residents (EEA)

Under GDPR, EEA residents may exercise rights including:

• Access

• Rectification

• Erasure

• Restriction of processing

• Data portability

• Objection

• Rights regarding automated decisions

We will respond within 30 days unless an extension is required.

13. Notice for UK Residents

Under UK GDPR and the Data Protection Act 2018, UK residents have rights equivalent to those listed for EEA residents.

14. Notice for Residents of Argentina

Under Law 25.326, Argentine residents have rights of:

• Access

• Rectification

• Deletion

We will respond within:

• 5 days for deletion/update requests

• 10 days for access requests

15. Notice for Residents of Mexico

Under Mexican data protection law, users may exercise ARCO rights:

• Access

• Rectification

• Cancellation (Deletion)

• Objection

Responses will be provided within 20 days.

16. Notice for Residents of Chile

Residents of Chile may exercise ARCO rights:

• Access

• Rectification

• Deletion

• Objection

Responses will be provided within 2 days.

17. Notice for Residents of Malaysia

Under the Personal Data Protection Act 2010 (PDPA), users may exercise rights described in Article 15 and withdraw consent where permitted.

Responses will be provided within 21 days.

18. Notice for Residents of New Zealand

Residents of New Zealand may exercise:

• Right to information

• Access

• Correction

• Deletion

• Restriction of processing

Responses will be provided within 20 days.

19. Notice for Residents of Australia

Australian residents may exercise:

• Right to information

• Access

• Correction

• Deletion

• Restriction of processing

Responses will be provided within 30 days.

20. Notice for Residents of India

Indian residents may exercise rights described in Article 15, including:

• Data portability

• Rights against automated decision-making

Responses will be provided within 30 days.

21–22. Our Companies by Service

The data controller is RIA represented by the following companies depending on country and service:

You may contact the Data Protection Officer at any time via: dpo@euronetworldwide.com