Global Privacy Notice

April 2022

This privacy notice ("Privacy Notice") explains how we handle personal data ("personal data") related to your use of our services, whether you are a customer, visitor, and/or user of our websites or mobile applications, or otherwise interacting with us. This Privacy Notice also tells you whether your personal data is shared with other parties and what data protection practices we use to protect your information.

We encourage you to check our website or application regularly to see if this Privacy Notice has been updated. We publish the updated version on the website/application, and by continuing to do business with us, you accept this Privacy Notice as it applies from time to time.

Table of Contents

1. What personal data do we collect, how do we collect it, and why?

2. Accuracy of your personal data

3. e-KYC

4. Legitimate interest

5. How long does Ria retain personal data?

6. Does Ria share my personal data with other parties?

7. Minors

8. Data security

9. Profiling and automated decision-making

10. Marketing and advertising

11. Email evaluation

12. What are your rights?

13. Data protection complaint procedure

14. Notice for residents of California

15. Notice for residents of Europe (EEA)

16. Notice for residents of Argentina

17. Notice for residents of Mexico

18. Notice for residents of Chile

19. Notice for residents of Malaysia

20. Notice for residents of New Zealand

21. Notice for residents of Australia

22. Notice for residents of India

23. Our company by service

What are your rights?

You are the owner of your personal data and have the legal right to decide how it is used. You can request the exercise of any of your rights at any time by emailing dpo@euronetworldwide.com . Additional rights may be available depending on your country. You can find more information by clicking here.

• Access to your data and an electronic copy of it

• Correction of your data

• Deletion of your data (where the law permits)

• Restriction of processing purposes

1. What personal data do we collect, how do we collect it, and why?

Identification data

Such data may include, for example, name, title or professional title, residential and/or business address, email address, phone and/or fax numbers, and other contact information, date of birth, gender, images, signature, passport/visa information, audio recording, and official login credentials. We use only the absolutely necessary identification data for the purposes described.

Financial data

We collect your personal financial information when you register as a customer. We collect financial data such as bank account information, account statements, reasons for transfer, professional information, or other documents that can demonstrate the origin of funds to be transferred (such as pay stubs), so we can provide you with our services.

Behavioral and technical data

Visitor IP address, behavioral data (which helps us understand how you use our products and services), browser type and version, time zone setting, screen resolution settings, browser extension types and versions, operating system, and platform.

Learn about our cookie policy here .

Location

We may collect information related to your location when you use our services.

Video surveillance

Image, video, and audio recordings.

Biometric data

Image, video recording, and facial image. If we ever process other biometric data, you will be notified in advance, and we will not process such personal data without your prior consent in any case.

Transaction-related data

We collect personal data such as recipient information, bank account details, contact information, destination of funds, and bank settings. We may also collect other information as required by local law, such as occupation, relationship to recipient, reason for transfer, and additional documents demonstrating the origin of funds.

Sensitive personal data

We may collect and process sensitive personal data (or other special categories of personal data), such as information about your physical or mental health or condition, to fulfill applicable legal or regulatory obligations.

Non-identifiable information

Where possible, we use information from which you cannot be directly identified (such as anonymous demographic and usage data) instead of personal data. This non-identifiable information can be used to improve our internal processes or enhance the delivery of our services without notifying you separately.

We can use aggregated data for many different purposes, such as evaluating and improving services and analyzing traffic to our services.

2. Accuracy of your personal data

We are committed to keeping your personal data accurate and up to date. To do this, we take reasonable steps to ensure the accuracy of your personal data by recording the most recent personal data we receive accurately. We also conduct regular reviews as needed to keep all your personal data current.

If you notice that your personal data is inaccurate, you can exercise your right to correct the data by emailing dpo@euronetworldwide.com .

3. e-KYC

To use our services, you must register. Registration uses the e-KYC method (electronic Know Your Customer).

As mentioned in section 1, we may use biometric data (where permitted by law) to identify you and verify any documents you may have uploaded to our system to create your account. We also use this system to comply with all our legal obligations.

If you want to register but don't want to use the e-KYC solution, you can contact our customer service, which can support you in becoming a customer.

4. Legitimate interest

When we use customer personal data to pursue our legitimate interests, we strive to balance our interests with yours so that your personal data is used only in ways permitted by applicable law or in ways that do not adversely affect your rights. Customers can request information about any processing based on legitimate interest.

5. How long does Ria retain personal data?

Personal data is used for many different purposes and is governed by many different rules and regulations. Data is retained as long as necessary to provide the services requested by customers and to comply with applicable legal, accounting, or reporting obligations. These include:

• Legal and regulatory requirements: your personal data is retained as long as necessary to comply with all our legal obligations.

• Customer service (customer relationship management, complaint handling, etc.): we retain your personal data as long as you are our customer.

• Marketing: we process your personal data for marketing purposes until you request that it be stopped in accordance with section 8 of this Privacy Notice.

• Contractual obligation: We retain personal data for the duration of the contractual relationship. Customers can contact the Euronet group's data protection officer and request a copy of our retention policy, which may vary depending on applicable law and specific business requirements by country.

6. Does Ria share my personal data with other parties?

Euronet group

Third-party service providers

Legal and regulatory authorities

Strategic partners

Expert partners

7. Minors

We do not offer services directly to children under 18 or proactively collect their personal information. If you are under 18, do not use the websites or offers or share personal information with us. If you notice that a minor under 18 has unlawfully provided us with personal information, please contact us at dpo@euronetworldwide.com .

8. Data security

We are committed to protecting customer personal data and have implemented commercially reasonable and appropriate safeguards to prevent loss, misuse, and alteration of information you provide to us. Ria always seeks to ensure that your personal data is well protected in accordance with international best practices. We maintain our commitment to data security by using appropriate physical, electronic, and administrative measures to secure and protect your personal data.

We protect our systems from unauthorized use by leveraging secure, advanced, and high-quality physical and organizational security measures that are continuously improved. These enable us to ensure the highest possible level of security in accordance with international best practices and cost-effectiveness based on the personal data being processed. Additionally, all personal data is stored in a secure location protected by firewalls and other advanced security systems with access limited to administrator credentials only.

Personnel with access to information and its processing are contractually obligated to keep your information confidential and comply with the data protection policy adopted in our organization.

While we strive to achieve the highest possible level of data protection by implementing measures in accordance with industry standards to protect your privacy, no security system is completely error-free or impenetrable. Therefore, we cannot guarantee (nor do we warrant) that personal data is completely secure.

9. Profiling and automated decision-making

If you give us your explicit consent, we provide you with customized information and advice about our products and services. We analyze data with the help of third parties to target you with appropriate communications and advertising, including invitations to unique customer events that we believe will interest you, as well as recommendations for products and services that we believe will suit you.

In some cases, we use automated decision-making and profiling where permitted by law and necessary to fulfill a contract. One example of this is automatic approval of payment services. The legal basis for profiling and automated decision-making is legitimate interest.

We also make automated decisions, for example, in monitoring payment transactions to prevent fraud in accordance with legal requirements related to preventing money laundering, terrorism financing, and financial services. You have the right to request that you not be subject to fully automated decision-making, including profiling, if such decision-making has legal effects or affects you in a similarly significant manner. This right does not apply if the decision-making is necessary to enter into or fulfill a contract with you, if the decision-making is permitted under applicable data protection law, or if we have obtained your explicit consent.

10. Marketing and advertising

Third-party advertisers provide advertisements displayed on our website, application, or elsewhere in our services. Third-party advertisers do not have access to any information that our customers have provided directly to us. Generally, advertisers use cookies or other web or application-based mechanisms to evaluate which advertisements interest you. We do not place targeted cookies or use targeting and location in your system without your consent.

If you have given your consent by selecting the Targeting Cookies option on the website or enabling the Targeting option in the application, we can use third parties for this purpose (remarketing and similar audience targeting activities). You can modify your cookie settings here.

Our Privacy Notice does not bind third parties. If you want to learn about third-party privacy practices, visit their websites. All third parties that may use cookies for targeting are visible in the Cookie Policy .

We may contact you from time to time (by email, text message, letter, or phone as needed and according to your specific instructions) and as necessary when you have given us your explicit consent to provide you with targeted marketing of our services. You can withdraw your consent at any time by emailing dpo@euronetworldwide.com or by following the instructions in the marketing emails we send you.

11. Email evaluation

We may use pixels in our marketing emails to learn whether our email has been opened and how many times, and to confirm the clicks received by links and advertisements in the email. This information can be used for the following purposes:

• to learn which emails users found most interesting

• to determine user activity and engagement related to our products and services

• to provide information (in aggregate) to our advertisers about how many users clicked on their advertisements

• the region where our target audience is located.

What are your rights?

Customers can request access to their personal data or request that it be updated, corrected, or deleted. Depending on your country, you may have different rights. Regardless of your country, you can, however, do the following at any time:

• You can request access to any personal data ("request for access to registered data"). Within the scope of the right of access, you can request information from us about what personal data about you we hold, how we process your personal data, who we disclose your personal data to, what different types of personal data we have, and how long we process your personal data, as well as information about automated decision-making related to your personal data.

• You can request correction of any inaccurate personal data we hold. If you have changed your email address or if you notice a typo in your personal data, you can exercise your right to request data modification.

• You can request deletion of personal data we hold. If you no longer want to receive communications from us and do not wish to continue using our services, you can ask us to delete the personal data about you that we hold. Please note that we may, however, retain your personal data to fulfill our legal obligations. In this case, your personal data will not be used for any other purpose.

As a customer, you also have the right to file a complaint with the competent data protection authority or court if you believe we have not complied with our obligations under this Privacy Notice or applicable law. We recommend that customers notify us of any potential complaints, although this is not mandatory, and we will respond in accordance with our complaint procedure.

We will respond to your request as soon as possible and always within the timeframe required by applicable law.

The applicable rights and the exact response times required from us for your requests are provided in more detail later in this document in the section covering residents of different regions.

To exercise any of these rights, you must send us an email at dpo@euronetworldwide.com . To better protect your privacy and maintain security, we verify your identity through various measures and/or may ask you to provide additional information before granting access or correcting personal data. If we do not have a copy of your required identity document or other legally valid document proving your identity, we cannot respond to your request.

13. Data protection complaint procedure

Customers have the right to file a complaint with the data protection authority or court if they believe we have not complied with our obligations under this Privacy Notice or applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner Officer (ICO)

• Switzerland: Federal Data Protection and Public Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Department of Personal Data Protection

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice's Privacy Unit

• United States: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: National Institute of Transparency, Access to Information and Protection of Personal Data

• Chile: Council for Transparency

Ria reserves the right to change this privacy notice at any time and will notify you of such changes on Ria's website or in any other manner Ria deems appropriate.

14. Notice for Customers Living in California

This supplemental notice is intended to satisfy the requirements of the California Consumer Privacy Act (CCPA) and should be read together with the privacy notice.

Customers living in California have the right to

• request and obtain information about our personal information collection practices during the preceding 12 months, including the categories of personal information we collected, the categories of sources of such information, our business purposes for collecting or sharing information, and the categories of third parties with whom we share such information

• request and obtain a copy of the personal information we collected about you during the preceding 12 months

• request and obtain a disclosure of our information sharing practices during the preceding 12 months, including a list of categories of personal information sold and the categories of third-party recipients, as well as a list of categories of personal information disclosed for a business purpose

• request that we do not sell your personal information (we do not sell your personal information)

• request that we delete (and direct our service providers to delete) your personal information, subject to certain exceptions.

Under the CCPA, personal information means information that relates to, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, to a particular California resident or household, or that identifies or describes them.

Customers living in California may contact us regarding data requests as follows:

1. Toll-free phone: 1-877-932-6640

2. Email: dpo@euronetworldwide.com

We may request that you provide a signed declaration under penalty of perjury that you are the person you claim to be. We will acknowledge receipt of your request within ten (10) days and will strive to respond within forty-five (45) days of receipt of your request, but if we need more time (up to an additional forty-five days), we will notify you of the need for the extension. We cannot respond to your request or provide you with personal information if we cannot verify your identity and confirm that the personal information relates to you.

You may request disclosure of our collection practices, information we collected about you, or our sharing practices no more than twice in a 12-month period.

For requests to obtain a copy of personal information we collected about you in the 12 months preceding your request, we will strive to provide the information in an easily usable format, including by mailing you a paper copy or providing an electronic copy to a registered account with us, if you have registered an account with us. With respect to requests to delete your information, California law permits us to retain certain information and not delete it under certain circumstances (information related to money transfers, security breaches, fraud, etc.). For example, we are not required to honor a request to delete information if the information is necessary for us to complete a transaction for you or otherwise perform under a contract with you, detect or prevent security breaches, fraud, or illegal activity or bring proceedings related to them, use the information only internally in ways reasonably connected to your expectations as our customer (such as maintaining sales records), and comply with legal obligations. If we receive such a request from you, we will notify all service providers we use so they also delete your information.

We will not discriminate against you for exercising these rights.

We do not sell your information for monetary consideration and do not disclose your information for other valuable consideration. If we enter into arrangements in the future that fall within the CCPA's definition of sale, we will update this privacy policy and our CCPA compliance.

You may submit a request through an authorized agent with a power of attorney. Otherwise, you may submit a request through an authorized representative only if (1) you provide the authorized representative with written permission to make the request on your behalf and (2) you verify your own identity directly with us. We require that the representative provide us with proof that they are authorized to make requests on your behalf.

During the past 12 months, we have collected the following categories of information from the listed sources, used it for the listed business purposes, and shared it with the listed third parties. These categories of information include information we collect from website visitors, registered users, employees, sellers, suppliers, and all other individuals with whom we interact either online or offline. Not all information is collected from all individuals. For example, we may collect different information from job applicants, sellers, and customers.

*Business purposes include, more specifically, the following:

1. Service delivery to customers for the following purposes:

   • managing or fulfilling our contractual obligations

   • assisting customers in completing a transaction or order

   • enabling shipment tracking

   • preparing and processing invoices

   • responding to inquiries and requests and providing service and support

   • managing customer relationships after the sale

   • creating and managing customer accounts

   • notifying customers of changes to our services and products

   • administering any campaign, contest, survey, or competition

   • providing customers with information about our products and services

   • providing our products and services to customers in a personalized manner, for example, by offering suggestions based on a customer's prior requests so the customer can identify suitable products and services more quickly.

2. Transaction-related auditing, internal research and development:

   • enabling internal business administration and operations, including troubleshooting, site customization, improvement or development, testing, research, site management and operation, and data analytics

   • creating products or services designed to meet customer needs

   • measuring the effectiveness of marketing initiatives, advertisements, and other websites operated on our behalf.

3. Security-related detection, protection, and enforcement; functionality troubleshooting and error correction:

   • as part of our efforts to keep our website secure

   • ensuring the security of customer accounts and our business and preventing or detecting fraud, harmful activity, or misuse of our sites, for example, by requesting verification information to reset your account password (if needed)

   • ensuring the physical security of our facilities through security camera monitoring

   • resolving disputes; protecting the rights, safety, and interests of ourselves, our users, and others, and complying with our legal obligations.

4. Quality assurance:

   • monitoring quality assurance and ensuring compliance with legal obligations, rules and regulations, and policies and procedures

   • developing and improving our products and services, for example, by reviewing visits to our sites and various subsites, demand for specific products and services, and user comments.

Get in touch if you need more information. If you have any questions or concerns about our privacy notice and practices, please contact us using the contact information provided in the Who We Are section of this privacy notice.

15. Notice for Customers Living in Europe (EEA)

Under the General Data Protection Regulation, all residents of the European Economic Area (EEA) may exercise the following rights:

• right to be informed about the processing of your personal information

• right to access information

• right to correct information

• right to delete information

• right to restrict the processing of information

• right to transfer information from one system to another

• right to object to the processing of information

• right not to be subject to automated decision-making

If you wish to exercise any of the rights mentioned above, you must comply with the obligations set out in section 12 of this privacy notice.

We will respond to your request within 30 days of receipt, unless an extension is requested.

16. Notice for Customers Living in Argentina

Under the Personal Data Protection Law (Ley de Protección de Datos Personales 25.326), you have the right to access, correct, update, and delete your information. If you wish to exercise your rights or your right to withdraw, or if you have any doubts or complaints about the processing of your personal information, you may contact us at dpo@euronetworldwide.com in accordance with the instructions provided in section 12.

We hereby inform you that there are different ways you can limit how we use or disclose your personal information for a specific purpose.

From the date we receive your request, we will respond to you within a maximum of 5 days (for requests to delete and update your personal information) or within a maximum of 10 days (for requests to access your personal information).

17. Notice for Customers Living in Mexico

Ria México (as defined below), with an address for hearing and receiving notices for privacy and personal data protection purposes as mentioned in section 22, and which in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares ("Mexico Law"), its regulations and guidelines, makes available to its users or potential users registered in this privacy notice before collecting personal information, strictly adhering to the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability required by Mexican law.

To provide services as a money transmitter under Article 81-A Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, Ria México collects personal information as necessary in accordance with the legal bases mentioned in section 1 and for the following purposes:

1. to verify that the personal information contained in the voting certificate provided to Ria México matches the information registered with the Instituto Nacional Electoral

2. to verify that the CURP information provided to Ria México matches the information registered with the Registro Nacional de Población.

Additionally, and as necessary to comply with the provisions of Articles 4 and 4 Bis of the general regulations referred to in Article 95 bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, which apply to money transfers referred to in Article 81-A Bis of the same law ("Regulations"), Ria México is legally required to obtain information about your geographic location and voice recording and facial image to identify its users or potential users other than in person and to obtain other essential information as detailed in the form contained in the application required by the Regulations. We process such information always based on your consent.

You have the right to access, correct, cancel, and object to the processing of your information ("ARCO rights"); likewise, you also have the right to limit or withdraw at any time the consent given for the processing of your personal information within the limits permitted by law. If you wish to exercise your ARCO rights, withdraw your consent, or have questions or complaints about the processing of your personal information, you may contact us at dpo@euronetworldwide.com in accordance with the instructions provided in section 12.

We will respond to you no later than 20 days after receiving your request, and it will take effect no later than 15 business days after we have notified you of our response.

18. Notice for Customers Living in Chile

You have the statutory right to access, obtain correction of, request deletion of, and object to the processing of your information ("ARCO rights"), as well as the right to withdraw the consent you have given for the processing of your personal information at any time within the limits permitted by law. If you wish to exercise your ARCO rights or your right to withdraw, or if you have any doubts or complaints about the processing of your personal information, you may contact us at dpo@euronetworldwide.com in accordance with the instructions provided in section 12.

We hereby inform you that there are different ways you can limit how we use or disclose your personal information for a specific purpose.

We will respond to you no later than 2 days from the date we receive your request.

19. Notice for Customers Living in Malaysia

Under the Personal Data Protection Act 2010 ("PDPA"), customers may provide us with personal information for any purpose defined in section 2 of this privacy notice. If we intend to process your personal information for any other purpose, we will notify you in advance or request your express consent.

You may exercise the rights disclosed in section 10 at any time. You may also withdraw your consent at any time, unless the processing is necessary to fulfill any legal obligation or to provide our services. You may also object to the processing of information if you believe that such processing may cause you harm or distress.

We will respond to you no later than 21 days from the date we receive your request.

Under the terms of the PDPA, RIA has the right to charge a fee for processing any request for access to information.

20. Notice for Customers Living in New Zealand

All residents of New Zealand have the rights listed in section 12 regarding the processing of their personal information. Please note that if you wish to exercise any of these rights, you must comply with the instructions provided in section 12 above.

We will respond to you no later than 20 days from the date we receive your request.

21. Notice for Customers Living in Australia

All residents of Australia have the rights listed in section 12 regarding the processing of their personal information. Please note that if you wish to exercise any of these rights, you must comply with the instructions provided in section 12 above.

Under applicable law, you may also request additional information from us about our information practices and procedures.

From the date we receive your request, we will respond to you within a maximum of 30 days.

22. Notice for Customers Living in India

All residents of India have the rights listed in section 12 regarding the processing of their personal information. Please note that if you wish to exercise any of these rights, you must comply with the instructions provided in section 12 above.

Additionally, you may exercise your right to data portability and your right not to be subject to legal-effect automated decision-making, such as profiling, unless such profiling is necessary to provide any of our services.

From the date we receive your request, we will respond to you within a maximum of 30 days.

23. Our Companies by Service

The data controller is Ria, represented by the companies below by country and service:

Money Transfer Services

Ria locations and currency exchange services

You can always submit a request to the Data Protection Officer by sending an email to dpo@euronetworldwide.com .