Privacy Notice for Professional Partners

This privacy notice (“ Privacy Notice ”) explains how we process your personal data (“ Personal Data ”) when you browse our website or mobile application (“ Website/App ”) and when you apply for or become a Ria and/or agent. interact with us as a professional partner (“ Professional Partner ”).

We encourage you to review this Privacy Notice regularly and check the website/app for updates. Updates to this Privacy Notice will be posted on our website/app, and by continuing to interact with us, you agree to this Privacy Notice and any future changes.

Where local laws require additional information to be included in this Privacy Notice, such information is included in the Regional Privacy Notices section below.

1. What Personal Data do we collect, how do we collect it and why?

The categories, sources and reasons for collecting Personal Data are listed below. If the collection of Personal Data is based on your consent, you may withdraw your consent at any time. RIA does not, and does not intend to, “sell” or “share” Personal Data, as those terms are defined by applicable law. We will retain Personal Data for as long as reasonably necessary to provide the Services and comply with our legal obligations.

If you have any questions or concerns regarding the processing of your personal data, you can contact us at any time at dpo@euronetworldwide.com

Identifiers or identification data

The personal information we collect from you may include name, email address, telephone and/or fax number, home and/or business address and other contact information ("Contact Information"), title, date of birth, gender, images, videos or signature.

Where necessary, identification data will only be used for the purposes described.

Contractual obligation

Financial data and professional or employment information

We collect your personal financial information when you register to use our services. We collect financial information, such as bank account information, financial statements, reason for transfer, occupation (professional or work-related information), or other documents that indicate the source of the funds you wish to transfer (similar to pay stubs) in order to provide you with our services.

Behavioral and technical information

IP address, internet or similar network, browsing or search activity, behavioral information (to understand how you behave when using our products and services), browser type and version, time zone settings, screen resolution settings, browser plug-in types and versions, operating system and platform.

View our cookie policy

Audio and video surveillance

Image, video and audio/voice recording.

The personal data we collect from you may vary depending on the country in which our services are provided. Not all of the data categories described above may apply to you. If you have any questions about the processing of your personal data, you can contact us at dpo@euronetworldwide.com

De-identified data

Where possible, we use data that does not directly identify you (such as anonymous demographic and usage data) instead of personal information ("non-identifying information"). This non-identifying information may be used to improve our internal processes or the delivery of our services without further notice to you.

We may use aggregate data for various purposes, including to analyze, evaluate, and improve our services.

Device features

When you use the app, we may need to access certain additional information and features on your device, such as your contact list. We will ask you for permission before accessing such information. Any data obtained by using these features on your device is stored only on your device, never on our servers or anywhere else.

2. Accuracy of personal data

We are committed to keeping your personal information accurate and up to date. We take reasonable steps to ensure the accuracy of your personal information by ensuring that the most recent Personal Information we have is accurately recorded and, where we consider it necessary, we will conduct periodic checks and ask you to update your personal information. From time to time, we may send you an email asking you to confirm and/or update your personal information. This communication is based on our legitimate interest and legal obligation to keep information accurate and up to date.

If you notice that your personal data is inaccurate, you can request that it be corrected or updated by sending an email to dpo@euronetworldwide.com .

3. Legitimate interest

Where we use your personal data to fulfil our legitimate interests, we will do our utmost to align our interests with yours, so that your personal data is only used in a way that is permitted by applicable law or where it does not prejudice your rights. Upon request, customers may request information about any processing based on legitimate interests.

4. How long does Ria retain Personal Data?

Personal data will be retained for as long as necessary to provide the requested services and to comply with applicable legal, accounting or reporting obligations. The retention period will be determined based on applicable requirements and obligations, which may include:

• Legal and Regulatory Requirements : Your personal data will be retained for as long as necessary to comply with all of our legal obligations, including without limitation trade, tax and anti-money laundering laws and regulations. While we will retain your personal data only to comply with our legal obligations, your personal data will be restricted so that it cannot be used for any other purpose. During the limited time, your personal data will only be accessed on a need-to-know basis. If we receive a request to delete, we will retain your personal data in accordance with our legal obligations.

• Customer service and contractual relationships (customer relationship management, complaint handling, etc.) : We will retain your personal data for as long as you remain our customer. If we consider that our contractual relationship has ended, we will restrict your data to make it available only to fulfill the legal obligations described above.

• Marketing : We will process your personal data for marketing purposes until you have asked us to opt out in accordance with Section 11 of this Privacy Notice or until we learn that you are no longer interested or your data is inaccurate.

5. Does Ria share my personal data with third parties?

Euronet Group

Third-party service providers*

* The legal meaning and list of "third party service providers" may vary depending on your country of residence. For more information about which providers have access to your personal data and why they have access to your personal data, you can contact us at dpo@euronetworldwide.com .

Legal and regulatory authorities

Strategic partners

Professional partners

6. Minors

We do not provide services directly to children under the age of 18 and do not proactively collect their personal data. If you are under the age of 18, please do not use the Website/App or the Offerings or share any personal data with us. If you become aware that someone under the age of 18 has unlawfully provided us with personal data, please contact us at dpo@euronetworldwide.com .

7. Data security

We are committed to protecting your personal information and have put in place commercially reasonable and appropriate safeguards to prevent the loss, misuse and alteration of the information entrusted to us. At RIA, we always strive to ensure that your personal information is well protected in accordance with international best practices. We maintain a commitment to data security by implementing appropriate physical, electronic and managerial measures to protect your personal information.

To protect our systems from unauthorized access, we use secure, state-of-the-art physical and organizational security measures that are continuously improved to ensure the highest level of security in line with international best practices and cost-effectiveness. All personal data is stored in a secure location protected by firewalls and other sophisticated security mechanisms with limited administrative access.

Employees who have access to your personal data and processing operations related to your personal data are contractually obligated to keep your data private and to comply with the privacy policy implemented within our organization.

We aim to achieve the highest standard of data protection by implementing industry-standard measures to protect your privacy.

8. Marketing and advertising

Third-party advertisers serve ads that appear on our website, app, or elsewhere on our services. Third-party advertisers do not have access to information that our customers have provided to us directly. Advertisers typically use cookies or other web/app-based mechanisms to assess which ads may be of interest to you. We do not place "targeting cookies" on your system and do not allow "targeting" and "location" without your consent.

If you have given your consent by accepting targeting cookies on the website or by enabling targeting in the app, we may use third parties for this purpose (remarketing and similar audience features). You can opt out of advertising by changing your cookie settings here .

Third parties are not bound by our privacy notice. You should visit the third party's website to understand the privacy policies of these notices. All third parties who may use cookies for targeting can be found in our cookie policy .

We may contact you from time to time (by email, SMS, letter or telephone as appropriate and in accordance with your specific instructions) and where you have given us consent to provide targeted marketing about our services and/or products.

Why should you accept electronic communications?

Depending on the country you are located in, you may receive marketing communications if you have authorized us to process your personal data for these purposes. This means that you have opted in during registration or at any time in your profile settings.

We may also send you electronic communications for marketing purposes if you have a contractual obligation with us, i.e. if you are currently using our services or if you have not expressly requested not to receive such marketing communications.

You will always be informed and we will make sure that you have all the necessary information during the use of our services or even during the registration process so that you are aware that your personal data may be used for this specific purpose and during your registration process or use of our services you will be given the opportunity to clearly state that you are not interested in receiving such marketing communications. In such cases, we will remove you from our list and you will not receive updates about our services and products that may be of interest to you. You can opt out at any time.

How can you give up?

You can withdraw your consent at any time using one of the following mechanisms:

• Go to your profile and update your marketing preferences.

• Please use the opt-out link you receive in each of our communications.

• By sending an email to dpo@euronetworldwide.com .

If you have any further questions about the use of your Personal Data for marketing purposes and/or would like to opt out of receiving marketing communications, you can also send an email to dpo@euronetworldwide.com .

9. Description of personal data rights

Depending on where you live, your rights regarding your personal data may include, under applicable law, the following:

1. Right to know : the right to know what Personal Data is collected, sold or shared and to whom.

2. Right of access : the right to request access to a copy of your personal data.

3. Right to rectification of inaccuracies : the right to request correction of inaccuracies in your personal data.

4. Right to erasure : the right to request the erasure of your personal data, subject to certain conditions.

5. Withdrawal rights :

   1. The right to opt out of the processing of personal data for the purpose of targeted advertising.

   2. The right to opt out of the processing of sensitive personal data.

   3. The right to object to the processing of personal data for profiling purposes for the purpose of implementing decisions which have legal or similar significant effects on the data subject.

6. The right to limit the use and disclosure of sensitive personal information to specifically permitted purposes.

7. Right to restriction of processing : the right to restrict processing where certain conditions apply.

8. Right to data portability : the right to receive Personal Data in a structured, commonly used and machine-readable format and the right to transmit Personal Data to another controller under certain conditions.

9. Right to object : the right to object to the processing of Personal Data (i.e. for direct marketing purposes).

10. Rights relating to automated individual decision-making : the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similar significant effects concerning the individual.

11. Right to non-retaliation : A business will not discriminate against an individual for exercising their rights related to their personal data.

We will respond to your request as quickly as possible and within the time period provided for by applicable law.

Please see the regional privacy notice below for the rights that apply to you. To exercise your rights, you must send an email to dpo@euronetworldwide.com . To protect your privacy and maintain security, we will take reasonable steps to verify your identity and may ask you to provide other details before providing access to your personal data or initiating any changes to your personal data. If we do not have a copy of your identification document or a legally valid document that proves your identity, we will not be able to respond to your request.

Please note that some rights may not be enforceable at the time of providing you with the service due to business needs or legal obligations. Your rights may be limited to comply with other legal obligations, such as anti-money laundering, contractual and compliance obligations. Notwithstanding the above, you will always be subject to a response if you exercise any of the above rights and/or any additional rights you may have depending on your jurisdiction. If your right cannot be enforced, you will always receive a proper explanation.

10. Privacy complaints procedure

Data subjects have the right to lodge a complaint with a data protection authority or a court if they believe that we have breached their obligations under this Privacy Notice or applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Department of Personal Data Protection

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice Privacy Unit

• US: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

• Chile: Consejo para la Transparencia

Ria reserves the right to change this Privacy Notice at any time and will notify you of such REGIONAL PRIVACY NOTICES

11. Notice to United States Consumers

This notice is provided to consumers and customers (including former customers) in the United States to comply with the requirements of the federal Gramm-Leach-Bliley Act (“GLBA”) relating to the collection, disclosure, and protection of “nonpublic personal information” (“NPI”), as defined in the GLBA. For purposes of this notice, NPI means personally identifiable information that an RIA, as a financial institution, collects under the GLBA in connection with the provision of a financial product or service, except to the extent that the information is lawfully publicly available. NPI collected by an RIA may include any of the following:

• information that an individual provides to an RIA in order to obtain a financial product or service.

• information that an RIA receives about an individual from a transaction involving RIA's financial products or services (i.e. the fact that the individual is a client/consumer of RIA, account numbers, etc.); or

The categories of NPI that RIA may collect are listed in Section 1 of this Privacy Notice.

The categories of non-profit organizations to which RIA may disclose information are listed in Section 9 of this Privacy Notice.

Categories of Affiliates and Unaffiliated Third Parties to Whom NPI is or may be disclosed in this Privacy Notice. When RIA discloses NPI to unaffiliated third parties pursuant to the exceptions set forth in the GLBA, all such disclosures will be made in a manner permitted by law. An unaffiliated third party is any person other than an affiliate of a financial institution or a person who works jointly with a financial institution and a business that is not an affiliate of the institution.

This Privacy Notice lists the categories of information disclosed and to whom the co-marketing/service provider for which the Privacy Rule is exempt .

Where NPI may be disclosed to unrelated third parties and this disclosure does not fall under any of the GLBA privacy rule exceptions, consumers and customers have the right to opt out of these disclosures and an opt-out mechanism is available to the consumer or customer.

Notice of the sharing of RIA information between Euronet Group and its affiliates is set out in Section 9 of this Privacy Notice in accordance with the Fair Credit Reporting Act.

RIA's policies and practices regarding protecting the confidentiality and security of NPI are set forth in this Privacy Notice.

California consumers

Under the California Consumer Privacy Act, California residents may exercise the following rights:

• 1 (right to know)

• 2 (access right)

• 3 (right to correction of inaccuracies)

• 4 (Right to erasure)

• 5 (right to opt out of the sale or sharing of personal information for the purpose of contextual behavioral advertising)

• 6 (Right to limit the use and disclosure of sensitive personal data to specifically permitted purposes)

• 11 (Right not to take countermeasures after waiver or exercise of other rights)

12. Notice to European (EEA) Residents

In accordance with the General Data Protection Regulation (GDPR), and in addition to the rights set out in Section 15 above, all residents of the European Economic Area (EEA) may exercise the following rights:

• 2 (access right)

• 3 (right to correction of inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restriction of processing)

• 8 (right to data portability)

• 9 (right to object)

• 10 (Rights related to automated individual decision-making)

To exercise the rights listed above, you must comply with the obligations set out in Section 15 of this Privacy Notice.

We will respond to you within a maximum of 30 days from the date of receipt of your request, unless an extension is requested.

During the processing of your personal data, we need to share your personal data as follows:

13. Notice to residents of the United Kingdom

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all UK residents have the following rights:

• 1 (access right)

• 3 (right to correction of inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restriction of processing)

• 8 (right to data portability)

• 9 (right to object)

• 10 (Rights related to automated individual decision-making)

To exercise the rights listed above, you must comply with the obligations set out in Section 15 of this Privacy Notice.

14. Notice to the people of Argentina

In accordance with the Ley de Protección de Datos Personales 25.326, you have the following rights, as defined in section 15 above:

• 2 (access right)

• 3 (right to correction of inaccuracies)

• 4 (Right to erasure)

To exercise your rights or exercise your right of withdrawal or to raise a concern or complaint about the processing of your personal data, you can contact us at dpo@euronetworldwide.com , following the instructions in Section 15.

You are hereby informed that you have the ability to restrict how we use or disclose your personal information for a specific treatment purpose.

From the date of receipt of your request, we will respond to you within a maximum of 5 days (for requests related to the deletion and updating of your personal data) or within a maximum of 10 days (for requests for access to your personal data). ).

15. Notice to Mexican residents

Ria México, with its permanent address for hearing and receiving communications for the purposes of privacy and personal data protection referred to in Section 27, and in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares ("Mexican Law") and its regulations, and guidelines, makes this Privacy Notice available to its users or potential users as data subjects before collecting personal data, strictly adhering to the principles of legality, consent, information, quality, purpose, loyalty, proportionality and accountability required by Mexican law.

In order to provide services as a money transmitter in accordance with article 81-A Bis of the General Credit Organizations and Auxiliary Activities Act, Ria México collects personal data, where applicable, in accordance with the legal bases referred to in article 1, section 1 and in connection with the following purposes:

• Make sure that the personal information included in the voting authorization submitted to Ria México matches the information contained in the registry of the Instituto Nacional Electoral.

• Make sure that the CURP data provided to Ria México matches the data registered in the Registro Nacional de Población.

In addition, and where necessary, in order to comply with Articles 4 and 4a of the General Provisions referred to in Article 95 bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito applicable to the money transmission devices referred to in Article 81-A bis of the Agreement. In accordance with the same law (the "Provisions"), Ria México is legally required to obtain information on your geographical location and recordings of your voice and facial image in order to identify its users or potential users in a non-face-to-face manner, and to obtain other relevant data, which will be explained in detail in the form included in the request required by the Provisions. We will always process such information based on your consent.

You have the following rights ("ARCO Rights"):

• 2 (access right)

• 3 (right to correction of inaccuracies)

• 4 (Right to erasure)

• 9 (right to object)

You also have the right to restrict or withdraw your consent to the processing of your Personal Data at any time to the extent permitted by law. To exercise any of your ARCO rights, withdraw your consent or raise any questions or complaints about the processing of your Personal Data, you may contact us at: dpo@euronetworldwide.com , following the instructions set out in Section 15.

We will respond to you no later than 20 days after receiving your request and it will take effect no later than 15 business days after we have notified you of our response.

16. Notice to the people of Chile

Under the law, you have the following rights ("ARCO Rights"):

• 2 (access right)

• 3 (right to correction of inaccuracies)

• 4 (Right to erasure)

• 9 (right to object)

You also have the right to withdraw your consent to the processing of your Personal Data at any time to the extent permitted by law. To exercise your ARCO rights or to exercise your right of withdrawal, or to raise any questions or complaints regarding the processing of your Personal Data, you may contact us at dpo@euronetworldwide.com , following the instructions set out in Section 15.

You are hereby informed that you have the ability to restrict how we use or disclose your personal information for a specific treatment purpose.

We will respond to you within a maximum of 2 days from the date of receipt of your request.

17. Notice to Malaysian residents

In accordance with the Personal Data Protection Act 2010 (hereinafter referred to as the “PDPA”), customers may provide us with their personal data for any of the purposes set out in Section 1 of this Privacy Notice. If we process your personal data for any additional purposes, we will inform you in advance or seek your explicit consent.

You may exercise your rights under Section 15 at any time. You may also withdraw your consent, unless the processing is necessary for compliance with any legal obligation or to provide you with our service. You may also object to processing if you believe that such processing activity may cause you harm or distress.

We will respond to you within a maximum of 21 days from the date of receipt of your request.

Under the terms of the PDPA, the RIA has the right to charge a fee for processing any data access request.

18. Notice to New Zealanders

The rights that all New Zealand residents have when we process your personal information are as follows:

• 1 (right to know)

• 2 (access right)

• 3 (right to correction of inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restriction of processing)

To exercise the rights listed above, you must comply with the obligations set out in Section 15 of this Privacy Notice.

We will respond to you within a maximum of 20 days from the day we receive your request.

19. Notice to Australian residents

The rights of all Australian residents that you can exercise when your personal information is processed include:

• 1 (right to know)

• 2 (access right)

• 3 (right to correction of inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restriction of processing)

You may also ask us to explain our data policies and practices in accordance with applicable law.

We will respond to you within a maximum of 30 days from the date of receipt of your request.

During the processing of your personal data, we need to share your personal data as follows:

20. Notice to the people of India

The rights that all residents of India can exercise in relation to the processing of your personal data are those listed in Section 15. Please note that to exercise any of your rights, you must follow the instructions set out in Section 15.

You may exercise your right to data portability and the right not to be subject to automated decision-making that produces legal effects, such as profiling, unless such profiling is necessary to provide you with one of our services.

We will respond to you within a maximum of 30 days from the date of receipt of your request.

21. Our companies by service

The controller is RIA, represented by the following companies, depending on the country and service:

Money transfer services

22. Our companies by service

The controller is Ria, represented by the following companies, depending on the country and service:

You can always submit a request to our Data Protection Officer by sending an email to the following address: dpo@euronetworldwide.com .

*EEA (European Economic Area) countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.