International Privacy Policy

April 2022

This Privacy Policy on data protection (the "Privacy Policy") explains how we process personal data (the "Personal Data") relating to your use of our services, whether as a customer, visitor and/or user of our websites or mobile applications, or in any other way. In this Privacy Policy, we also explain whether your Personal Data is shared with other parties and the privacy measures we have in place to protect your data.

We encourage you to review the Website and Application regularly to stay informed of any updates to this Privacy Policy. We will publish any updated version of this policy on it; by continuing to use our Services, you accept the Privacy Policy and its modifications.

Table of Contents

1. What personal data do we collect, how do we do it and why do we do it?

2. Accuracy of Your Personal Data

3. Electronic Customer Identity Verification (e-KYC)

4. Legitimate Interests

5. How long does RIA retain Personal Data?

6. Does RIA share my Personal Data with other parties?

7. Minors

8. Data Security

9. Profiling and Automated Decision-Making

10. Marketing and Advertising

11. Email Evaluation

12. What are my rights?

13. Procedure for Filing Privacy Complaints

14. Notice to California Residents

15. Notice to European Residents

16. Notice to Argentine Residents

17. Notice to Mexican Residents

18. Notice to Chilean Residents

19. Notice to Malaysian Residents

20. Notice to New Zealand Residents

21. Notice to Australian Residents

22. Notice to Indian Residents

23. Our Company by Service

What are your rights?

You own your Personal Data and have the right to maintain control over it. You can request to exercise any of your rights at any time by emailing dpo@euronetworldwide.com . Additional rights may be available depending on your country. Click here for more information.

• Access and electronic copy of your data

• Correction of your data

• Deletion of your data (when the law permits)

• Limitation of the purpose of processing.

1. What Personal Data do we collect, how do we do it and why do we do it?

Identification Data

This data may include name, title, personal or business address, email address, phone or fax number and other contact information, date of birth, gender, images, signature, information present on passports and visas, voice recordings and official identification information. We will only use identification data that is strictly necessary for the purposes described.

Financial Data

We collect your personal financial data when you register as a customer. We collect financial data such as bank accounts, account statements, the purpose of the transfer, profession or other documents to demonstrate the source of funds you wish to transfer (similar to a pay stub), in order to provide you with our services.

Behavioral and Technical Information

The IP address of visitors, behavioral information (to analyze your behavior when using our products and services), browser type and version, time zone setting, screen resolution settings, browser plug-in type and version, operating system and platform.

See our Cookie Policy here .

Location.

We are likely to collect data about your location when you use our services.

Video Surveillance.

Image, video and voice recordings.

Biometric Data.

Image, video recording and facial scan. If we ever process additional biometric data, you will be informed in advance, and in no case will we process this Personal Data without your consent.

Transactional Data.

We collect personal data such as beneficiary contact information, bank account information, contact details, destination of funds and your banking preferences. Depending on locally applicable legislation, we may collect other data such as profession, relationship with the beneficiary, reason for transfer and additional documents to demonstrate the source of funds.

Sensitive Personal Data.

We may collect and process sensitive personal data (or other "special categories of personal data"), such as data concerning your health or physical or mental condition, in order to meet applicable legal or regulatory obligations.

Non-Identifiable Data.

To the extent possible, we use data from which you cannot be directly identified (such as anonymous demographic and usage data) rather than Personal Data. This non-identifiable data may be used to improve our internal processes or the provision of our services, without further notice.

We are likely to use aggregated data for various purposes, including to evaluate and improve services, and analyze traffic to the services.

2. Accuracy of Your Personal Data

We are committed to ensuring that your Personal Data is accurate and up to date. To do this, we take reasonable steps to ensure the accuracy of your Personal Data, by ensuring that the latest Personal Data we have received is recorded accurately and, if necessary, we perform periodic checks to keep all your Personal Data up to date.

If you notice that your Personal Data is not accurate, you can exercise your right to correction by emailing dpo@euronetworldwide.com .

3. Electronic Customer Identity Verification (e-KYC)

To use our Services, you must be registered. As part of this registration, we use a process called e-KYC.

As stated in section 1, we may use biometric data (when the law permits) to identify you and validate any documentation you may have imported into our system to create your account. We also use this system to comply with all our legal obligations.

If you wish to register without using the e-KYC process, contact our customer service.

4. Legitimate Interests

When we use a customer's Personal Data in the context of our legitimate interests, we do our best to align our interests with yours, so that your Personal Data is only used to the extent permitted by applicable law or without infringing your rights. Customers have the opportunity to request information about any processing arising from a legitimate interest

5. How long does RIA retain Personal Data?

Personal Data is used for various purposes and is governed by various laws and regulations. It is retained as long as necessary to provide customers with the services they have requested, and to comply with applicable legal, accounting or reporting obligations. For example:

• Legal and Regulatory Obligations: your Personal Data is retained as long as necessary to comply with all our legal obligations.

• Customer Service (customer relationship management, complaint handling, etc.): we will retain your Personal Data as long as you remain our customer.

• Marketing: we will process your Personal Data for marketing purposes as long as you have not asked us to unsubscribe, in accordance with section 8 of this privacy policy.

• Contractual Obligation: we will retain Personal Data for the duration of the contractual agreement. Customers can contact our Euronet group data protection officer to obtain a copy of our Retention Policy, which may vary depending on applicable law and specific business need by country.

6. Does RIA share my Personal Data with other parties?

Euronet Group

Service Providers

Legal and Regulatory Authorities

Strategic Partners

Professional Partners

7. Minors

We do not provide services directly to children under 18 years of age nor do we proactively collect their personal information. If you are under 18 years of age, please do not use the sites or offers and do not communicate your personal data to us. If you learn that a person under 18 years of age has illegally provided us with personal data, please contact us at: dpo@euronetworldwide.com .

8. Data Security

We are committed to protecting our customers' Personal Data and have implemented commercially reasonable and appropriate protective measures to prevent any loss, misuse and alteration of the information you have entrusted to us. At Ria, we do everything we can to ensure your Personal Data is well protected, in accordance with international best practices. We fulfill this commitment to data security by deploying appropriate physical, electronic and management measures to protect and secure your personal data.

To protect our systems against illegal access, we use sophisticated and state-of-the-art physical and organizational security measures that we continuously improve to ensure the highest level of security in accordance with international best practices, as well as optimal cost-effectiveness based on the personal data processed. All Personal Data is stored on a secure medium protected by firewalls and other sophisticated security mechanisms, and access to this data is limited.

Personnel with access to your data and how it is processed are contractually required to protect its confidentiality and comply with the privacy policy we have implemented within our organization.

Although we aim to achieve the highest level of data protection by adopting measures in line with industry standards to protect your privacy, no security system is flawless or impenetrable. Therefore, we cannot guarantee (and do not guarantee) that Personal Data is completely secure.

9. Profiling and Automated Decision-Making

If you have expressly authorized us to do so, we provide you with customized information and advice about our products and services. We conduct data analysis using third parties in order to be able to present you with appropriate communications and advertisements, including invitations to events reserved for our customers that we believe may interest you, as well as product and service recommendations that we believe may suit you.

In some cases, we will use automated decision-making and profiling, if these operations are permitted by law and necessary to perform a contract. For example, automatic authorization for money transfer services. The legal basis for profiling and automated decision-making is legitimate interest.

We also make automated decisions as part of processes such as transaction monitoring to combat fraud, in accordance with legal requirements relating to the prevention of money laundering, terrorism financing and the provision of financial services. You have the right to request not to be subject to fully automated decision-making, including profiling, if this process has legal consequences or affects you in a similar manner. This right does not apply if the decision is necessary to conclude or perform an agreement with you and is permitted by applicable data protection laws, or if we have received your explicit consent.

10. Marketing and Advertising

Third-party advertisers provide advertisements that appear on our website, application or elsewhere in our services. They do not have access to information our customers have provided directly to us. Generally, these advertisers rely on cookies or other web or application mechanisms to assess which advertisements are likely to interest you. We do not place "targeting cookies" and do not allow "targeting" and "localization" on your system without your consent.

If you have given your consent by accepting targeting cookies on the website or by enabling targeting on the application, we may use third-party services for this purpose (remarketing and features targeting a similar audience). You can change your cookie settings here.

Third parties are not subject to our Privacy Policy. We invite you to visit their website to learn about their own privacy policy. You can find all third parties likely to use cookies for targeting in our Cookie Policy .

We may contact you from time to time (by email, SMS, mail or phone if necessary and according to your specific instructions) and, if necessary, when you have expressly authorized us to send you targeted marketing messages about our services. You can withdraw your consent at any time by emailing dpo@euronetworldwide.com or by following the instructions contained in the marketing email we sent you.

11. Email Evaluation

We may use invisible pixels in our marketing emails to tell us whether our emails are opened, how often they are opened, and to verify any clicks on links or advertisements contained in the email. We may use this information for the following purposes:

• Learn which of our emails users find most interesting;

• Determine user activity and engagement with our products and services;

• Inform our advertisers (in aggregate form) of the number of users who clicked on advertisements;

• Know the region where our audience is located.

What are my rights?

Customers can request to view, update, modify or delete their Personal Data. Depending on your country, you may have different rights. However, regardless of your country, you can exercise the following actions at any time:

• Request access to your Personal Data ("Request for access to personal data"). In exercising your right of access, you can ask us what Personal Data we hold about you, the processing activities we perform with your Personal Data, the recipients of your Personal Data, the different categories of Personal Data, the duration of processing of your Personal Data and the existence of any automated decision concerning your Personal Data;

• Request correction of any inaccurate personal data we may hold about you. If you have changed your email address, or if you notice a spelling error in any of your personal data, you can exercise your right to modify.

• Request deletion of all Personal Data we hold about you. If you no longer wish to hear from us or continue to use our services, you can ask us to delete all Personal Data we hold about you. Please note that we may retain your Personal Data to fulfill our legal obligations. However, your Personal Data will not be used for other purposes.

Customers also have the right to file a complaint with a competent data protection authority or courts if they believe we have not complied with our obligations under this Privacy Policy or applicable law. We encourage our customers to notify us of any complaints they may have, even if this is not required. We will respond to them in accordance with our Complaint Handling Procedure.

We will respond to requests as soon as possible and always within the time limit set by applicable law.

For any applicable right, and to determine the exact time limit we have to respond to your request, please see the specific sections below.

To exercise your rights, you must send an email to dpo@euronetworldwide.com . In order to protect your privacy and preserve your security, we will take steps to verify your identity and/or we may ask you to provide additional information before granting you access to your Personal Data or modifying it. If applicable, if we do not have a copy of your ID or a valid legal document proving your identity, we will not be able to respond to your request.

13. Procedure for Filing Privacy Complaints

Customers also have the right to file a complaint with a data protection authority or courts if they believe we have not complied with our obligations under this Privacy Policy or applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner Officer (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Department of Personal Data Protection

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice's Privacy Unit

• United States: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: National Institute of Transparency, Access to Information and Protection of Personal Data

• Chile: Council for Transparency

Ria reserves the right to modify this Privacy Policy at any time and will post notice of these modifications on Ria's website or through any other means that Ria deems appropriate.

14. Notice to California Residents

This additional information is intended to address the requirements of California's Consumer Privacy Act ("CCPA") and should be read together with the Privacy Policy.

Customers residing in California will have the right to:

• request and receive details of our personal information collection practices over the past 12 months, including the categories of personal information we collect, the categories of sources of that information, our business purpose for collecting or disclosing that information, and the categories of third parties to whom we disclose that information;

• request and receive a copy of the personal information we have collected about you over the past 12 months;

• request and receive details of our information disclosure practices over the past 12 months, including a list of categories of personal information sold with the category of third-party recipients and a list of categories of personal information we have disclosed for business purposes;

• request that we do not sell your personal information (we do not sell your personal information);

• ask us to delete (and ask our service providers to delete) your personal information, subject to certain exceptions.

For purposes of the CCPA, personal information means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to a particular California resident or household, whether directly or indirectly.

To make a disclosure request, California residents can contact us by one of the following methods:

1. Toll-free number: 1 877 932-6640

2. Email: dpo@euronetworldwide.com

We may ask you to submit a declaration under penalty of perjury stating that you are the person you claim to be. We will acknowledge receipt of your request within ten (10) days and will make a good faith effort to respond to your request within forty-five (45) days of receipt, but if we need more time (up to forty-five additional days), we will let you know. We will not be able to respond to your request or provide you with personal information if we are unable to verify your identity and confirm that the personal information relates to you.

You may request details of our collection practices, data we have collected about you, or our disclosure practices up to 2 times within a 12-month period.

For requests for a copy of the personal information we have collected over the 12 months preceding your request, we will make a good faith effort to provide the information in an easily usable format, including by sending you a paper copy or providing an electronic copy to your registered account, if you have created an account with us. For requests to delete your information, California law allows us to retain certain information and not delete it in certain circumstances (information related to a transaction, security incidents, fraud, etc.). As an example, we are not required to respond to a deletion request for information if that information is necessary for us to complete a transaction for you or perform a contract; to detect, protect against, or prosecute security incidents, fraud, or illegal activity; to use the information solely internally in a manner reasonably aligned with your expectations as a customer (such as maintaining sales records); and to comply with legal obligations. If we receive such a request from you, we will inform all service providers we have engaged to ask them to also delete your information.

We will not discriminate against you for exercising any of these rights.

We do not sell your information for monetary consideration, and we do not disclose your information for other valuable consideration. If in the future we enter into agreements that fall within the definition of a "sale" under the CCPA, we will update this privacy policy and our CCPA compliance.

You may submit a request through an authorized agent. You also have the option to submit a request to us through an authorized representative, but only if (1) you give the authorized representative written permission to make a request on your behalf and (2) you verify your own identity directly with us. We will ask the authorized representative to provide us with proof that they have been authorized to make requests on your behalf.

Over the past 12 months, we have collected the following categories of information from the sources listed, used them for the business purposes listed, and disclosed them to third parties in the categories listed. The information categories include information we collect from visitors to our website, registered users, employees, vendors, suppliers, and anyone else who interacts with us online or offline. Not all information is collected from all individuals. For example, we may collect different information from job applicants, suppliers, or customers.

* More specifically, business use includes:

1. Performing services for you:

   • to administer or otherwise perform our obligations under any agreement to which we are a party;

   • to help you complete a transaction or order;

   • to authorize shipment tracking;

   • to prepare and process invoices;

   • to respond to questions or requests, and to provide services and support;

   • to manage after-sales customer relationships;

   • to create and manage our customer accounts;

   • to inform you of changes to our products and services;

   • to manage promotions, contests, surveys, or competitions;

   • to provide you with information about our products and services;

   • to offer our products and services to you in a personalized way, for example by providing suggestions based on your previous requests to help you determine more quickly the appropriate products and services.

2. Conducting transaction-related audits and internal research and development:

   • to ensure internal business administration and operations, including troubleshooting, customization, improvement or development of the site, testing, research, administration and operation of our sites, and data analysis;

   • to create products or services that may meet your needs;

   • to measure the performance of marketing initiatives, advertisements, and websites "presented by" another company acting on our behalf.

3. Managing security detection, protection and enforcement, feature debugging, and error correction:

   • as part of our efforts to ensure the security of the Website;

   • to ensure the security of your account and our business, prevent or detect fraud, malicious activity, or abuse of our Sites, for example by requesting verification information to reset your account password (if applicable);

   • to ensure the physical security of our premises through surveillance image monitoring;

   • to resolve disputes, protect the rights, safety, and interests of ourselves, our users, or others, and to comply with our legal obligations.

4. Quality control:

   • to monitor quality control and ensure compliance with our legal obligations, codes and ordinances, and our policies and procedures;

   • to develop and improve our products and services, for example by reviewing visits to sites and different sub-pages, demand for specific products and services, and user feedback.

Contact for more information. For any questions or concerns about our Privacy Policy and practices, please contact us using the contact information provided in the "Who are we?" section of this Privacy Policy.

15. Notice to European Economic Area Residents

In accordance with the General Data Protection Regulation (GDPR), all residents of the European Economic Area (EEA) may exercise the following rights:

• Right to information

• Right of access

• Right to rectification

• Right to erasure

• Right to restrict processing

• Right to data portability

• Right to object

• Right to avoid automated decision-making

To exercise any of the rights listed above, you must comply with the obligations set out in section 12 of this Privacy Policy.

From the day we receive your request, we will respond to you within a maximum of 30 days, unless an extension of this period is requested.

16. Notice to Argentina Residents

In accordance with the Personal Data Protection Law 25,326, you have the right to access, rectify, update, and delete your data. To exercise your rights or your right of revocation, or to raise any doubt or complaint regarding the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com following the instructions indicated in section 12.

You are hereby notified that there are options available to you to limit how we use or disclose your personal data for a particular processing activity.

We will respond to you within a maximum of 5 days following receipt of your request (for deletion and update requests for your Personal Data) or within a maximum of 10 days (for your request to access your Personal Data).

17. Notice to Mexico Residents.

Ria México (term defined below), domiciled to hear and receive notifications for privacy and personal data protection purposes indicated in article 22, and in accordance with the Federal Law for the Protection of Personal Data Held by Private Parties (the "Mexican Law"), its regulations and guidelines, makes available to its users or potential users in their capacity as data subjects, this Privacy Policy, prior to the collection of Personal Data, in strict compliance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability required by Mexican Law.

In order to provide services in its capacity as a money transmitter within the meaning of article 81-A Bis of the General Law of Credit Organizations and Auxiliary Activities, Ria México will collect Personal Data, as applicable, in accordance with the legal bases mentioned in section 1, and with regard to the following objectives:

1. To verify that the Personal Data contained in the voting information submitted to Ria México corresponds to that contained in the National Electoral Institute registry.

2. To verify that the CURP data provided to Ria México corresponds to that registered in the National Population Registry.

Furthermore, and when necessary, in order to comply with articles 4 and 4 bis of the general provisions referred to in article 95 bis of the General Law of Credit Organizations and Auxiliary Activities applicable to money transmitters referred to in article 81-A bis of the same law (the "Provisions"), Ria México is legally required to obtain information about your geolocation as well as recordings of your voice and physiognomic characteristics of your face in order to identify its users or potential users in a manner other than in person, and to obtain other relevant data that will be explained in detail in the form for this purpose available in the application required by the Provisions. We will always process this information based on your consent.

You have Access, Rectification, Cancellation, and Opposition to Processing rights (the "ARCO rights"); likewise, you have the right to revoke at any time the consent given for the processing of your Personal Data, to the extent permitted by Law. To exercise your ARCO rights or your right of revocation or to raise any doubt or complaint regarding the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com following the instructions indicated in section 12.

We will respond to you no later than 20 days after the date of receipt of your request, for implementation no later than 15 business days after we have informed you of our response.

18. Notice to Chile Residents

In accordance with the Law, you have Access, Rectification, Cancellation, and Opposition to Processing rights (the "ARCO rights"); likewise, you have the right to revoke at any time the consent given for the processing of your Personal Data, to the extent permitted by Law. To exercise your ARCO rights or your right of revocation or to raise any doubt or complaint regarding the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com following the instructions indicated in section 12.

You are hereby notified that there are options available to you to limit how we use or disclose your personal data for a particular processing activity.

We will respond to any request within a maximum of 2 days following its date of receipt.

19. Notice to Malaysia Residents

In accordance with the Personal Data Protection Act of 2010, customers may provide us with their Personal Data for the purposes established in section 2 of this Privacy Policy. If we were to process your Personal Data for other purposes, we would notify you or request your explicit consent.

You may exercise the rights set out in section 10 at any time. You may also withdraw your consent, unless the processing activity is necessary to fulfill a legal obligation or to provide you with one of our services. You may also object to processing if you believe such activity may cause you harm or distress.

We will respond to any request within a maximum of 21 days following its date of receipt.

In accordance with the conditions of the PDPA, RIA has the right to charge fees for processing any request for access to data.

20. Notice to New Zealand Residents

The rights of New Zealand residents regarding the processing of their Personal Data are listed in section 12. Please note that to exercise any of your rights, you must follow the instructions in section 12 above.

We will respond to any request within a maximum of 20 days following its date of receipt.

21. Notice to Australia Residents

The rights of Australian residents regarding the processing of their Personal Data are listed in section 12. Please note that to exercise any of your rights, you must follow the instructions in section 12 above.

You may also ask us to explain our data policies and practices in accordance with applicable law.

We will respond to any request within a maximum of 30 days following its date of receipt.

22. Notice to India Residents

The rights of India residents regarding the processing of their Personal Data are listed in section 12. Please note that to exercise any of your rights, you must follow the instructions in section 12 above.

Furthermore, you may exercise your right to data portability and the right not to be subject to automated decision-making producing legal effects, such as profiling, if such profiling is not necessary to provide you with one of our services.

We will respond to any request within a maximum of 30 days following its date of receipt.

23. Our Company by Service

The data controller is Ria, represented by the companies below, depending on the country and service:

Money Transfer Service

Ria branches and currency exchange services

You can submit a request to our data protection officer at any time by sending an email to: dpo@euronetworldwide.com .