Privacy Notice for Professional Partners

September 2023

This privacy notice (" Privacy Notice ") explains how we process your personal data (" Personal Data ") when you browse our website or mobile application (" Website/Application ") and when you apply or become Ria and/or an agent to communicate with us as a professional partner (" Professional Partner ").

We recommend you review this privacy notice regularly and check the website/application for updates. Updates to this privacy notice will be posted on our website/application, and by continuing to communicate with us you agree to this privacy notice and all future changes.

If local laws require additional information to be added to this privacy notice, such information has been added in the regional privacy notices section below.

1. What Personal Data do we collect, how do we collect it, and why?

The categories, sources, and reasons for collecting personal data are listed below. If personal data collection is based on your consent, you may withdraw your consent at any time. Ria does not "sell" or "share" Personal Data as those terms are defined under applicable laws, and does not intend to do so. We retain personal data as long as reasonably necessary to provide services and fulfill our legal obligations.

If you have questions or concerns about how your personal data is processed, you can contact us at any time at dpo@euronetworldwide.com

Identifiers or identification data

Personal data we collect from you may include your name, email address, phone and/or fax number, home and/or business address and other contact information ("Contact Data"), title, date of birth, gender, photos, videos, or signature.

Where necessary, identification data is used only for the purposes described.

Contractual obligation

Financial data and professional or work-related information

We collect your personal financial data when you register to use our services. We collect financial data such as bank account information, financial statements, reason for transfer, occupation (professional or work-related information), or other documents showing the source of funds you wish to transfer (similar to salary certificates) to provide you with our services.

Behavioral and technical information

IP address, internet or other similar network, browsing or search activity, behavioral information (to understand how you behave using our products and services), browser type and version, time zone settings, screen resolution settings, browser plugin types and versions, operating system and platform.

See our cookie policy

Audio and video surveillance

Image, video, and audio/voice recording.

The personal data collected from you may vary depending on the country where our services are provided. Not all data categories described above may apply to you. If you have questions about how your personal data is processed, you can contact us at dpo@euronetworldwide.com

De-identified data

Where possible, we use data that cannot directly identify you ("de-identified data") instead of personal data (such as anonymous demographic and usage data). This de-identified data may be used to improve our internal processes or service delivery without further notice to you.

We may use aggregated data for various purposes, including analyzing, evaluating, and improving our services.

Device features

When using the application, we may need access to certain additional information and features on your device, such as your contacts list. Before accessing such information, we will ask for your permission. All data obtained through the use of these device features is stored only on your device, never on our servers or elsewhere.

2. Accuracy of personal data

We are committed to keeping your personal data accurate and up-to-date. We take reasonable steps to ensure the accuracy of your personal data by ensuring that the latest Personal Data we receive is recorded accurately, and where we deem it necessary, we conduct periodic checks and ask you to update your personal data. From time to time, we may send you an email asking you to confirm and/or update your personal data. This communication is based on our legitimate interest and legal obligation to maintain accurate and current information.

If you notice that your personal data is not accurate, you can request correction or update of the data by emailing dpo@euronetworldwide.com .

3. Legitimate interest

When we use your personal data to pursue our legitimate interests, we do everything we can to align our interests with yours, so that your personal data is used only in a manner permitted by applicable law or in a way that does not harm your rights. Upon request, clients may ask for information about any processing based on legitimate interest.

4. How long does Ria retain Personal Data?

Personal Data is retained as long as necessary to provide the requested services and to fulfill applicable legal, accounting, or reporting obligations. The retention period is determined based on applicable requirements and obligations, which may include the following:

• Legal and regulatory requirements : your personal data is retained as long as necessary to fulfill all our legal obligations, including without limitation commercial, tax, and anti-money laundering laws and regulations. While we retain your personal data only to fulfill legal obligations, your personal data is restricted so that it cannot be used for other purposes. For a limited time, your personal data is accessed only when necessary. If we receive a deletion request, we will retain your personal data in accordance with our legal obligations.

• Customer service and contractual relationships (customer relationship management, complaint handling, etc.) : we retain your personal data as long as you remain our customer. Once we determine that our contractual relationship has ended, we restrict your data to make it available only for fulfilling the legal obligations described above.

• Marketing : we process your personal data for marketing purposes until you request to opt out in accordance with section 11 of this privacy notice or until we learn that you are no longer interested or your data is not accurate.

5. Does Ria share my personal data with third parties?

Euronet Group

Third-party service providers*

* The legal meaning and list of "third-party service providers" may vary depending on your country of residence. For more information about which providers have access to your personal data and why they have access to your personal data, you can contact us at dpo@euronetworldwide.com .

Legal and regulatory authorities

Strategic partners

Professional partners

6. Minors

We do not offer services directly to children under 18 years of age and do not proactively collect their personal data. If you are under 18, do not use the website/application or offers or share personal data with us. If you become aware that someone under 18 has unlawfully submitted personal data to us, please contact us at dpo@euronetworldwide.com .

7. Data security

We are committed to protecting your personal data and have implemented commercially reasonable and appropriate safeguards to prevent loss, misuse, and alteration of the information entrusted to us. At Ria, we always strive to ensure that your personal data is well protected in accordance with international best practices. We maintain a data security obligation by implementing appropriate physical, electronic, and administrative measures to protect your personal data.

To protect our systems from unauthorized access, we use secure, state-of-the-art physical and organizational security measures that are continuously improved to ensure the highest level of security in line with international best practices and cost-effectiveness. All personal data is kept in a secure location protected by firewalls and other sophisticated security mechanisms with limited administrative access.

Employees who have access to your personal data and processing operations related to your personal data are contractually obligated to keep your data confidential and comply with the privacy policies implemented in our organization.

Our goal is to achieve the highest data protection standard by implementing measures that comply with industry standards to protect your privacy.

8. Marketing and advertising

Third-party advertisers provide ads displayed on our website, application, or elsewhere in our services. Third-party advertisers do not have access to information that our customers have provided directly to us. Typically, advertisers use cookies or some other web/application-based mechanism to assess which ads may interest you. We do not place "targeting cookies" in your system or allow "targeting" and "location" without your consent.

If you have given your consent by agreeing to targeting cookies on the website or allowing targeting in the application, we may use third parties for this purpose (retargeting and similar audience functions). You can opt out of advertising by changing your cookie settings here .

Third parties are not bound by our privacy notice. To understand their privacy policies, you should visit the third party's website. You can find all third parties who may use targeting cookies in our cookie policy .

We may contact you from time to time (if necessary by email, SMS, mail, or phone and in accordance with your specific instructions) when you have given us consent to provide targeted marketing about our services and/or products.

Why should you accept electronic communications?

Depending on the country where you are located, you may receive marketing messages if you have authorized us to process your personal data for these purposes. This means you have consented during registration or at any time in your profile settings section.

We may also send you electronic messages for marketing purposes if you have a contractual obligation with us, meaning you are currently using our services or if you have not explicitly requested not to receive such marketing messages.

You will always be informed and we ensure that during the use of our services or even during the registration process you have all the necessary information to be aware that your personal data may be used for this specific purpose and during your registration process or use of our services you are given the opportunity to clearly state that you are not interested in receiving such marketing messages. In such cases, we will remove you from our list and you will not receive updates about our services and products that may interest you. You can opt back in at any time.

How can you opt out?

You can withdraw your consent at any time using one of the following mechanisms:

• Go to your profile and update your marketing preferences.

• Use the opt-out link you receive in each of our communications.

• By sending an email to dpo@euronetworldwide.com .

If you have additional questions about the use of your Personal Data for marketing purposes and/or wish to start receiving marketing messages, you can also send an email to dpo@euronetworldwide.com .

9. Description of personal data rights

Depending on where you live, your rights regarding your personal data under applicable law may include the following:

1. Right to know : the right to know what Personal Data is collected, sold, or shared and with whom.

2. Right of access : the right to request access to a copy of your personal data.

3. Right to correct inaccuracies : the right to request correction of inaccuracies in your personal data.

4. Right to deletion : the right to request deletion of your personal data if certain conditions are met.

5. Rights to opt out :

   1. Right to opt out of processing of personal data for targeted advertising purposes.

   2. Right to opt out of processing of sensitive personal data.

   3. Right to opt out of processing of personal data for profiling for decisions that have legal or similarly significant effect on the data subject.

6. Right to restrict the use and disclosure of sensitive personal data to specifically authorized purposes.

7. Right to restrict processing : the right to restrict processing if certain conditions are met.

8. Right to data portability : the right to receive Personal Data in a structured, commonly used, and machine-readable format and the right to transmit Personal Data to another responsible processor under certain conditions.

9. Right to object : the right to object to processing of Personal Data (i.e., for direct marketing purposes).

10. Rights related to automated individual decision-making : the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effect on the individual.

11. Right to freedom from retaliation : the controller shall not discriminate against an individual for exercising rights related to their personal data.

We will respond to your inquiry as quickly as possible and within the time period specified in applicable law.

For information about applicable rights, see the regional privacy notice below. To exercise your rights, you must send an email to dpo@euronetworldwide.com . To protect your privacy and maintain security, we take necessary steps to verify your identity and may ask you to provide additional details before allowing access to your personal data or initiating any changes to your personal data. If we do not have a copy of a document proving your identity or a legally valid document proving your identity, we cannot respond to your request.

Please note that some rights may not be enforceable during service delivery due to business needs or legal obligations. Your rights may be limited to meet other legal obligations, such as anti-money laundering, contractual, and compliance obligations. Nevertheless, you will always receive a response whenever you exercise any of the above rights and/or any additional right you may have depending on your jurisdiction. If your right cannot be enforced, you will always receive a proper explanation.

10. Privacy complaint handling

Data subjects have the right to file a complaint with a data protection authority or court if they believe we have violated obligations arising from this privacy notice or applicable law:

• Europe (EEA): members |European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner's Office (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Personal Data Protection Department

• New Zealand: Privacy Commissioner's Office

• Australia: Australian Information Commissioner's Office

• California: Attorney General's Privacy Unit

• USA: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

• Chile: Consejo para la Transparencia

Ria reserves the right to change this privacy notice at any time and will notify you of such REGIONAL PRIVACY NOTICES

11. Notice to United States Consumers

This notice is provided to consumers and clients of the United States of America (including former clients) to comply with the requirements of the federal Gramm-Leach-Bliley Act ("GLBA"), which relates to "the collection, disclosure and protection of nonpublic personal information" ("NPI"), as defined in the GLBA. For purposes of this notice, NPI means personally identifiable information that RIA, as a financial institution, collects under the GLBA in connection with offering a financial product or service, except to the extent the information is lawfully publicly available. NPI collected by RIA may include any of the following:

• information that an individual provides to RIA to obtain a financial product or service.

• information that RIA obtains about an individual from a transaction involving RIA financial products or services (i.e., the fact that a person is a RIA customer/consumer, account numbers, etc.); or

NPI categories that RIA may collect, are listed in Section 1 of this privacy notice.

Categories of NPI that RIA may disclose, are listed in Section 9 of this privacy notice.

Categories of affiliates and nonaffiliated third parties to whom NPI is or may be disclosed are set forth in this privacy notice. When RIA discloses NPI to nonaffiliated third parties in accordance with exceptions set forth in the GLBA, all such disclosures are made in a manner permitted by law. A nonaffiliated third party is any person other than a financial institution's affiliate or a person acting on behalf of the financial institution and in a company that is not an affiliate of the institution.

This privacy notice lists categories of information disclosed and to whom the privacy rule exception for joint marketing/service provider applies.

If NPI may be disclosed to nonaffiliated third parties and such disclosure is not covered by any exception under the GLBA privacy rule, consumers and clients have the right to opt out of such disclosures, and an opt-out mechanism is provided to the consumer or client.

Notice regarding RIA's sharing of information between Euronet Group and its affiliates is provided in Section 9 of this privacy notice in accordance with the Fair Credit Reporting Act.

RIA's policies and practices regarding the protection of NPI confidentiality and security are set forth in this privacy notice.

California Consumers

Under the California Consumer Privacy Act, California residents may exercise the following rights:

• 1 (Right to Know)

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 5 (Right to Opt Out of Sale or Sharing of Personal Information for Cross-Context Behavioral Advertising Purposes)

• 6 (Right to Limit Use and Disclosure of Sensitive Personal Information to Specific Permitted Purposes)

• 11 (Right Not to Receive Discriminatory Treatment After Opting Out or Exercising Other Rights)

12. Notice to European Economic Area (EEA) Residents

Under the General Data Protection Regulation (GDPR) and in addition to the rights set forth in Section 15 above, all residents of the European Economic Area (EEA) may exercise the following rights:

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

• 8 (Right to Data Portability)

• 9 (Right to Object)

• 10 (Rights Related to Automated Individual Decision Making)

To exercise the rights listed above, you must comply with the obligations set forth in Section 15 of this privacy notice.

From the date we receive your request, we will respond to you within a maximum of 30 days, unless an extension of time is requested.

During the processing of your personal data, we must share your personal data as follows:

13. Notice to United Kingdom Residents

Under the United Kingdom Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all residents of the United Kingdom may exercise the following rights:

• 1 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

• 8 (Right to Data Portability)

• 9 (Right to Object)

• 10 (Rights Related to Automated Individual Decision Making)

To exercise the rights listed above, you must comply with the obligations set forth in Section 15 of this privacy notice.

14. Notice to Argentina Residents

Under the Law on Protection of Personal Data 25.326, you have the following rights as defined in Section 15 above:

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

To exercise your rights, to use your right to object, or to submit any questions or complaints about the processing of your personal data, you may contact us at dpo@euronetworldwide.com , following the instructions provided in Section 15.

You are hereby informed that you have the ability to limit how we use or disclose your personal data for a specific treatment purpose.

From the date we receive your request, we will respond to you within a maximum of 5 days (for requests related to deletion and updating of your personal data) or within a maximum of 10 days (for requests for access to your personal data).

15. Notice to Mexico Residents

Ria México, with its permanent address mentioned in Section 27, for the purpose of listening to and receiving notices regarding the protection of privacy and personal data, and in accordance with the Federal Law for the Protection of Personal Data Held by Individuals ("Mexico Law") and its regulations, and guidelines, makes this privacy notice available to its users or potential users as data subjects before collecting personal data, strictly adhering to the principles of legality, consent, information, quality, purpose, loyalty, proportionality and accountability required by Mexican laws.

To provide services as a money transmitter in accordance with Article 81-A Bis of the General Law of Credit-Related Organizations and Activities, Ria México collects personal data, where applicable, in accordance with the legal bases mentioned in Section 1 and for the following purposes:

• To verify that the personal data contained in the voting proxy submitted to Ria México matches the data contained in the registry of the National Electoral Institute.

• To verify that the CURP data transmitted to Ria México matches the data registered in the National Population Registry.

Additionally, and where necessary, in order to comply with the general provisions referred to in Articles 4 and 4a of Article 95 bis of the General Law of Credit-Related Organizations and Activities Activities referred to in Article 81-A bis of the same law ("Provisions"), Ria México is legally required to obtain information about your geographic location and recordings of your voice and facial image in order to identify its users or potential users in a non-face-to-face manner, and to obtain other relevant data, which will be detailed in the form contained in the request required by the Provisions. We always process such information based on your consent.

You have the following rights ("ARCO Rights"):

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 9 (Right to Object)

You also have the right at any time to limit or withdraw your consent given for the processing of your Personal Data to the extent permitted by law. To exercise any of your ARCO rights, to withdraw your consent, or to submit any questions or complaints about the processing of your personal data, you may contact us at: dpo@euronetworldwide.com , following the instructions provided in Section 15.

We will respond to you within a maximum of 20 days after receiving your request, and it will take effect within a maximum of 15 business days after we have notified you of our response.

16. Notice to Chile Residents

Under the law, you have the following rights ("ARCO Rights"):

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 9 (Right to Object)

You also have the right at any time to withdraw your consent given for the processing of your Personal Data to the extent permitted by law. To exercise your ARCO rights, to use your right to object, or to submit any questions or complaints about the processing of your personal data, you may contact us at dpo@euronetworldwide.com , following the instructions provided in Section 15.

You are hereby informed that you have the ability to limit how we use or disclose your personal data for a specific treatment purpose.

From the date we receive your inquiry, we will respond to you within a maximum of 2 days.

17. Notice to Malaysia Residents

Under the Personal Data Protection Act 2010 (hereinafter "PDPA"), customers may provide us with their personal data for any of the purposes set forth in Section 1 of this privacy notice. If we were to process your personal data for any additional purpose, we will inform you of this in advance or request your explicit consent.

You may exercise the rights set forth in Section 15 at any time. You may also withdraw your consent at any time, except where processing is necessary to fulfill any legal obligation or to provide you with our service. You may also object to processing if you believe such processing activity may cause you harm or suffering.

From the date we receive your request, we will respond to you within a maximum of 21 days.

Under the terms of the PDPA, RIA has the right to charge a fee for processing any request for access to data.

18. Notice to New Zealand Residents

All rights that New Zealand residents may exercise regarding the processing of their personal data are as follows:

• 1 (Right to Know)

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

To exercise the rights listed above, you must comply with the obligations set forth in Section 15 of this privacy notice.

From the date we receive your inquiry, we will respond to you within a maximum of 20 days.

19. Notice to Australia Residents

All rights that Australian residents may exercise regarding the processing of their personal data are as follows:

• 1 (Right to Know)

• 2 (Right of Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

You may also request that we explain our data policy and practices in accordance with applicable law.

From the date we receive your request, we will respond to you within a maximum of 30 days.

During the processing of your personal data, we must share your personal data as follows:

20. Notice to India Residents

All rights that Indian residents may exercise regarding the processing of their personal data are the rights listed in Section 15. Please note that to exercise any of your rights, you must follow the instructions set forth in Section 15.

You may exercise your right to data portability and your right not to be subject to automated decision-making that has legal consequences, such as profiling, unless such profiling is necessary for us to provide you with any of our services.

From the date we receive your request, we will respond to you within a maximum of 30 days.

21. Our Companies by Service

The responsible controller is RIA, represented by the companies listed below, depending on the country and service:

Money Transfer Services

22. Our Companies by Service

The responsible controller is Ria, represented by the companies listed below, depending on the country and service:

You may always submit a request to our Data Protection Officer by sending an email to: dpo@euronetworldwide.com .

*EEA region (European Economic Area) countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.