Privacy Policy for Professional Partners

September 2023

This privacy policy (" Privacy Policy ") explains how we process your personal data (" Personal Data ") while you browse our website or mobile application (" Website/App ") and when you apply or become a Ria representative and/or interact with us as a professional partner (" Professional Partner ").

We recommend you read this privacy policy regularly and check the Website/App for any updates. Updates to this privacy policy will be published on our Website/App. If you continue to work with us, you agree to this privacy policy and all future changes.

If local law requires additional details to be included in this privacy policy, that information has been listed in the "Regional Privacy Policies" section below.

1. What personal data do we collect, how do we collect it, and why?

The categories, sources, and reasons for collecting personal data are listed below. If the collection of personal data is based on your consent, you can withdraw your consent at any time. RIA does not "sell" or "share" personal data as defined by these terms in applicable laws, and will not do so in the future. We retain personal data as long as necessary to provide services and fulfill our legal obligations.

If you have questions or concerns about how we process your personal data, you can contact us at any time at dpo@euronetworldwide.com .

Identifiers or identification data

Personal data we collect from you may include name, email address, phone and/or fax number, home and/or business address, and other contact information ("Contact Data"), title, date of birth, gender, images, videos, and signature.

Where required, identification data is used only for the purposes described.

Contractual obligation

Financial details and professional or employment-related information

We collect your personal financial data when you register to use our services. We collect financial data such as bank account information, financial reports, reason for transfer, profession (professional or employment-related information), or other documents to verify the source of funds you wish to transfer (similar to pay stubs) in order to provide you with our services.

Behavioral and technical information

IP address, Internet or other similar network, browsing or search activities, behavioral information (to understand how you behave when using our products and services), browser type and version, time zone setting, screen resolution settings, browser plug-in types and versions, operating system and platform.

See our cookie policy

Audio and video surveillance

Image, video, and audio/voice recording.

The personal data we collect may vary depending on the country where our services are offered. Not all data categories described above may apply to you. If you have questions about how we process your personal data, you can contact us at dpo@euronetworldwide.com .

Non-identifiable data

Whenever possible, we use data where you cannot be directly identified (such as anonymous demographic data and usage data) and non-personal data ("non-identifiable data"). This non-identifiable data may be used without further notice to you to improve our internal processes or provide services.

We may use aggregated data for various purposes, including analysis, evaluation, and improvement of our services.

Device features

When using the app, we may need access to certain additional information and features of your device, such as your contact list. Before we access such information, we will ask for your permission. All data collected through the use of these device features is stored only on your device, never on our server or elsewhere.

2. Accuracy of personal data

We are committed to keeping your personal data correct and current. We take appropriate measures to ensure the accuracy of your personal data by ensuring that the most recent personal data we receive is recorded correctly. When we deem it necessary, we conduct regular reviews and ask you to update your personal data. From time to time, we may send you an email asking you to confirm and/or update your personal data. This communication is based on our legitimate interest and legal obligation to provide accurate and current information.

If you find that your personal data is not accurate, you can request a correction or update of your data by sending an email to dpo@euronetworldwide.com .

3. Legitimate interest

When we use your personal data to pursue our legitimate interests, we will make all efforts to align our interests with yours, so that your personal data is used only in accordance with applicable law or does not impair your rights. Upon request, customers can request information about any processing based on a legitimate interest.

4. How long does Ria keep personal data?

Personal data is retained as long as necessary to provide the requested services and comply with applicable legal, accounting, or reporting obligations. The retention period depends on applicable requirements and obligations, which may include:

• Legal and regulatory requirements : Your personal data will be retained as long as necessary to fulfill all our legal obligations, particularly commercial, tax, and anti-money laundering laws and regulations. While we store your personal data only to fulfill legal obligations, your personal data will be restricted so it cannot be used for other purposes. Access to your personal data is restricted, but only when needed. If we receive a deletion request, we will also retain your personal data as part of our legal obligations.

• Customer service and contractual relationship (managing customer relationships, handling complaints, etc.) : We will retain your personal data as long as you remain our customer. Once we determine that our contractual relationship has ended, we will restrict your data so it is only available to fulfill the legal obligations mentioned above.

• Marketing : We will process your personal data for marketing purposes as long as you have not asked us to unsubscribe in accordance with Section 11 of this privacy policy or until we determine that you no longer have an interest or that your data is no longer accurate.

5. Does Ria share my personal data with third parties?

Euronet group

Third-party providers*

*The legal meaning and list of "third-party providers" may vary depending on the country where you reside. For more information about which providers have access and why they have access to your personal data, contact us at dpo@euronetworldwide.com .

Legal and regulatory authorities

Strategic partners

Professional partners

6. Minors

We do not provide services directly to children under 18 years of age and do not proactively collect their personal data. If you are under 18 years old, please do not use the Website/App or offers and do not provide personal data to us. If you learn that someone under 18 years old has unlawfully provided us with personal data, please contact us at dpo@euronetworldwide.com .

7. Data security

We are committed to protecting your personal data and have implemented economically reasonable and appropriate security measures to prevent loss, misuse, and alteration of the information you entrust to us. At RIA, we are always committed to ensuring that your personal data is well protected in accordance with international best practices. We uphold this commitment to data security by implementing appropriate physical, electronic, and administrative measures to protect and secure your personal data.

To protect our systems from illegal access, we use secure, state-of-the-art physical and organizational security measures that are continuously updated to ensure maximum security in accordance with international best practices and cost efficiency. All personal data is stored in a secure location protected by firewalls and other sophisticated security mechanisms with restricted administrative access.

Personnel who have access to your personal data and to processing activities related to your personal data are contractually obligated to keep your data confidential and comply with the data protection policies we have implemented in our organization.

Our goal is to achieve the highest data protection standard by implementing industry-standard measures to protect your privacy.

8. Marketing and advertising

Third-party advertisers provide advertising that is displayed on our website, app, or elsewhere in our services. Third-party advertisers do not have access to information that our customers have provided directly to us. Typically, advertisers rely on cookies or other web/app-based mechanisms to determine which advertising might be of interest to you. Without your consent, we do not place "targeting cookies" and do not enable "targeting" or "location" on your system.

If you have given your consent by accepting targeting cookies on the website or enabling targeting in the app, we may use third parties for this purpose (remarketing and similar audience features). You can disable advertising by changing your cookie settings here .

Third parties are not bound by our privacy policy. To understand the privacy policies of their communications, you should visit the third-party website. All third parties that can use cookies for targeting can be found in our cookie policy .

We may contact you from time to time (as needed and according to your specific instructions via email, SMS, letter, or phone) and, if you have given us your consent, provide targeted marketing for our services and/or our products.

Why should you receive electronic messages?

Depending on the country where you reside, you will receive marketing messages if you have permitted us to process your personal data for these purposes. This means you chose to do so during the registration process or at any time in the "Settings" section of your profile.

We may also send you electronic messages for marketing purposes if you have a contractual obligation with us, that is, if you are currently using our services or if you have not explicitly asked us not to receive these marketing messages.

You will always be informed and we ensure that you have all necessary information during the use of our services or even during the registration process so you know that your personal data can be used for this specific purpose and you will receive the opportunity during the registration process or during the use of our services to explicitly state that you are not interested in receiving such marketing messages. In these cases, we will remove you from our list and you will not receive updates that could be of interest to you regarding our services and products. You can opt back in at any time.

How can you unsubscribe?

You can withdraw your consent at any time through one of the following mechanisms:

• Go to your profile and update your marketing preferences.

• Use the opt-out link you receive in each of our messages.

• By email to dpo@euronetworldwide.com .

If you have further questions about the use of your personal data for marketing purposes and/or wish to receive marketing messages, you can also send an email to dpo@euronetworldwide.com .

9. Description of rights regarding personal data

Depending on where you live, your rights regarding personal data under applicable law may include:

1. Right to know : the right to know what personal data is collected, sold, or shared and with whom.

2. Right of access : the right to request access to a copy of your personal data.

3. Right to correction of inaccuracies : the right to request correction of inaccuracies in your personal data.

4. Right to deletion : the right to request deletion of your personal data if certain conditions are met.

5. Opt-out rights :

   1. the right to object to the processing of personal data for the purpose of targeted advertising.

   2. the right to object to the processing of sensitive personal data.

   3. the right to object to the processing of personal data for profiling to support decisions that have legal or similarly significant effects on the data subject.

6. the right to restrict the use and disclosure of sensitive personal data to explicitly permitted purposes.

7. Right to restrict processing : the right to restrict processing if certain conditions are met.

8. Right to data portability : the right to receive personal data in a structured, commonly used, and machine-readable format and, under certain conditions, the right to have personal data transmitted to another controller.

9. Right to object : the right to object to the processing of personal data (e.g., for direct marketing purposes).

10. Rights related to automated individual decision-making : the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on the data subject.

11. Right to non-retaliation : a company may not discriminate against a person for exercising their rights regarding personal data.

We will respond to your request as quickly as possible and within the timeframe set out in applicable law.

Information about applicable rights can be found in the "Regional Privacy Policy" section below. To exercise any of your rights, you must send an email to dpo@euronetworldwide.com . To protect your privacy and maintain security, we will take the necessary steps to verify your identity and may ask you to provide additional details before we grant you access to your personal data or make changes to personal data. If we do not have a copy of your ID or a legally valid document to prove your identity when needed, we cannot respond to your request.

Please note that some rights may not be enforceable due to business necessities or legal obligations in providing the service. Your rights may be limited to comply with other legal obligations such as anti-money laundering, contract and compliance obligations. Regardless, you will always receive a response when you exercise any of the above rights and/or any additional right you may have depending on your jurisdiction. If your right cannot be enforced, you will always receive a proper explanation.

10. Data protection complaint procedure

Affected individuals have the right to file a complaint with a data protection authority or the courts if they believe we have not fulfilled our obligations under this privacy notice or applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner Officer (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Ministry of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Ministry for Personal Data Protection

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Privacy Division of the Attorney General's Office

• USA: FTC

• Canada: Office of the Canadian Privacy Commissioner

• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

• Chile: Consejo para la Transparencia

Ria reserves the right to change this privacy notice at any time and will REGIONAL PRIVACY NOTICES notify you

11. Notice for consumers in the United States

This notice is provided to consumers and customers in the United States (including former customers) to comply, as applicable, with the requirements of the federal Gramm-Leach-Bliley Act ("GLBA") regarding the collection, disclosure, and protection of "nonpublic personal information" ("NPI") as defined under the GLBA. For purposes of this notice, NPI means personally identifiable information about an individual that is collected by RIA as a financial institution under the GLBA in connection with providing a financial product or financial service by RIA, unless the information is lawfully made publicly available. NPI collected by RIA may include:

• Information that an individual provides to RIA to obtain a financial product or financial service.

• Information that RIA receives about an individual from a transaction with RIA's financial products or services (such as the fact that the individual is a RIA customer/consumer, account numbers, etc.); or

The categories of NPI that may be collected by RIA are listed in Section 1 of this privacy notice.

The categories of NPI that may be disclosed by RIA are listed in Section 9 of this privacy notice.

The categories of affiliates and nonaffiliated third parties to whom NPI is disclosed or may be disclosed in this privacy notice. When RIA discloses NPI to nonaffiliated third parties pursuant to the exceptions under GLBA, all such disclosures are made within the scope permitted by law. A "nonaffiliated third party" is any person, except a person affiliated with a financial institution or a person employed jointly by a financial institution and an entity that is not affiliated with the institution.

The categories of information disclosed and to whom under the joint marketing/service provider exception of the privacy provisions are listed in this privacy notice.

When NPI may be disclosed to nonaffiliated third parties and such disclosure does not fall under one of the exceptions of the privacy provisions of GLBA, consumers and customers have the right to opt out of such disclosure, and an opt-out mechanism will be made available to the consumer or customer.

For notices regarding RIA's sharing of information between the Euronet Group and its affiliates, see Section 9 of this privacy notice as required under the Fair Credit Reporting Act.

RIA's policies and practices regarding the protection of the confidentiality and security of NPI are set forth in this privacy notice.

Consumers in California

Under the California Consumer Privacy Act, California residents can exercise the following rights:

• 1 (Right to Know)

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 5 (Right to Opt Out of Sale or Sharing of Personal Information for Cross-Context Behavioral Advertising Purposes)

• 6 (Right to Limit Use and Disclosure of Sensitive Personal Information to Explicitly Permitted Purposes)

• 11 (Right to No Retaliation Following an Opt-Out or Exercise of Other Rights)

12. Notice for residents of Europe (EEA).

Under the General Data Protection Regulation (GDPR) and in addition to the rights mentioned in Section 15 above, all residents of the European Economic Area (EEA) can exercise the following rights:

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

• 8 (Right to Data Portability)

• 9 (Right to Object)

• 10 (Rights Related to Automated Individual Decision-Making)

To exercise any of the rights listed above, you must comply with the obligations set out in Section 15 of this privacy notice.

From the day we receive your request, we will respond to you within a maximum of 30 days, unless an extension is requested.

In processing your personal data, we must disclose your personal data as follows:

13. Notice for residents of the United Kingdom

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all residents of the United Kingdom can exercise the following rights:

• 1 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

• 8 (Right to Data Portability)

• 9 (Right to Object)

• 10 (Rights Related to Automated Individual Decision-Making)

To exercise any of the rights listed above, you must comply with the obligations set out in Section 15 of this privacy notice.

14. Notice for Argentine residents

Under the Ley de Protección de Datos Personales 25.326, you have the following rights, as defined in Section 15 above:

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

To exercise your rights or your right to withdraw, or to raise any doubts or complaints regarding the processing of your personal data, you can contact us at dpo@euronetworldwide.com as per the instructions in Section 15.

You are hereby informed that you have options available to restrict how we use or disclose your personal data for a particular purpose.

From the day we receive your request, we will respond to you within a maximum of 5 days (for requests regarding deletion and updating of your personal data) or within a maximum of 10 days (for requests regarding access to your personal data).

15. Notice for Mexican residents

Ria México, with address for service and receipt of notices for privacy and personal data protection purposes as per Section 27 and in compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the "Mexican Law"), its regulations, and guidelines, makes this privacy notice available to its users or potential users in their capacity as data subjects prior to the collection of personal data under strict compliance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability as per Mexican law.

For the purpose of providing services in its capacity as a money transmitter as defined in Article 81-A Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, Ria México collects personal data as applicable in accordance with the legal bases mentioned in Section 1 and in connection with the following purposes:

• Ensure that personal data contained in voter identification documents submitted to Ria México matches personal data contained in the Instituto Nacional Electoral registry.

• Ensure that CURP data submitted to Ria México matches data registered in the Registro Nacional de Población.

Additionally, and as needed to comply with Articles 4 and 4 Bis of the General Provisions as per Article 95 Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, which apply to money transmitters as per Article 81-A Bis of the same law (the "Provisions"), Ria México is legally required to obtain information about your location as well as records of your voice and facial image to identify its users or potential users in a non-personal manner, and to obtain other relevant data detailed in the specific form available in the application as prescribed under the Provisions. We will always process this information based on your consent.

You have the following rights (the "ARCO Rights"):

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 9 (Right to Object)

Likewise, you have the right at any time to restrict or withdraw your consent to the processing of your personal data to the extent permitted by law. To exercise your ARCO Rights, withdraw your consent, or submit any questions or complaints regarding the processing of your personal data, you can contact us at dpo@euronetworldwide.com following the instructions in Section 15.

We will respond to you no later than 20 days after receipt of your request, and the response will become effective no later than 15 business days after notification of our response.

16. Notice for Chilean residents

Under the law, you have the following rights (the "ARCO Rights"):

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 9 (Right to Object)

Likewise, you have the right to withdraw the consent you have given for the processing of your personal data at any time, to the extent permitted by law. To exercise your ARCO Rights or your right to withdraw, or to submit any questions or complaints regarding the processing of your personal data, you can contact us at dpo@euronetworldwide.com following the instructions in Section 15.

You are hereby informed that you have options available to restrict how we use or disclose your personal data for a particular purpose.

From the day we receive your request, we will respond to you within a maximum of 2 days.

17. Notice for Malaysian residents

Under the Personal Data Protection Act 2010 (the "PDPA"), customers can provide us with their personal data for any of the purposes mentioned in Section 1 of this privacy notice. Should we process your personal data for a further purpose, we will inform you beforehand or obtain your express consent.

You can exercise the rights mentioned in Section 15 at any time. You can also withdraw your consent, unless the processing activity is required to fulfill a legal obligation or to provide our services. You can also object to processing if you believe such processing activity could cause you harm or suffering.

From the day we receive your request, we will respond to you within a maximum of 21 days.

Under the provisions of the PDPA, RIA has the right to charge a fee for processing any data access requests.

18. Notice for New Zealand residents

For all individuals residing in New Zealand, the following rights apply regarding the processing of your personal data:

• 1 (Right to Know)

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

To exercise any of the rights listed above, you must comply with the obligations set out in Section 15 of this privacy notice.

From the day we receive your request, we will respond to you within a maximum of 20 days.

19. Notice for Australian residents

For all individuals residing in Australia, the following rights apply regarding the processing of your personal data:

• 1 (Right to Know)

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

You can also ask us to explain our data policies and practices in accordance with applicable law.

From the day we receive your request, we will respond to you within a maximum of 30 days.

In processing your personal data, we must disclose your personal data as follows:

20. Notice for Indian residents

To all residents of India: The rights you can exercise regarding the processing of your personal data are those listed in Section 15. Please note that to exercise your rights, you must follow the instructions set out in Section 15.

You can exercise your right to data portability and the right not to be subject to automated decision-making with legal effects such as profiling, when such profiling is not required to provide you with one of our services.

From the day we receive your request, we will respond to you within a maximum of 30 days.

21. Our companies by service

The controller is RIA, represented by the companies listed below, depending on the country and service:

Money transfer services

22. Our companies by service

The controller is Ria, represented by the companies listed below, depending on the country and service:

You can submit a request to our Data Protection Officer at any time by sending an email to the following address: dpo@euronetworldwide.com .

*The countries within the EEA region (European Economic Area): Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.