Privacy Notice for Professional Partners

September 2023

This privacy statement (" Privacy Statement ") explains how we process your personal data (" Personal Data ") when you browse our website or mobile application (" Website/Application ") and when you apply or become a Ria representative or/and interact with us as a professional partner (" Professional Partner ").

We encourage you to review this Privacy Statement regularly and check the Website/Application for any updates. Updates to this Privacy Statement will be published on our Website/Application and by continuing to work with us, you agree to this Privacy Statement and any future modifications.

Where local law requires additional details to be included in this Privacy Statement, that information has been included in the Regional Privacy Notices section below.

1. What Personal Data do we collect, how do we collect it and why?

The categories, sources and reasons for collecting Personal Data are set out below. Where the collection of Personal Data is based on your consent, you may withdraw your consent at any time. Ria does not "sell" and will not "share" Personal Data, as those terms are interpreted under applicable law. We retain Personal Data for as long as reasonably necessary to provide the Services and fulfill our legal obligations.

If you have questions or concerns about how we process your Personal Data, you can contact us at any time at dpo@euronetworldwide.com

Identifiers or identification data

The Personal Data we collect from you may include name, email, phone number or/and fax, home or/and business address and other contact information ("Contact Information"), title, date of birth, gender, images, videos or signature.

Where necessary, Identification Data is used only for the described purposes.

Contractual obligation

Financial information and information related to work or employment

We collect your personal financial data when you register to use our Services. We collect financial data, such as bank account information, financial statements, transfer reasons, profession (professional or employment information) or other documents proving the source of the money you wish to transfer (similar to payroll stubs), so we can provide you with our Services.

Behavioral and technical information

IP address, internet or other similar network, browsing or search activity, behavioral information (so we can understand how you behave when using our products and services), browser type and version, time zone setting, screen resolution settings, browser plug-in types and versions, operating system and platform.

See our Cookie Policy

Audio and video monitoring

Recording of image, video and audio/voice.

The Personal Data we collect from you may vary depending on the country in which our Services are offered. Not all categories of data described above may apply to you. If you have any questions about how we process your Personal Data, you can contact us at dpo@euronetworldwide.com .

Non-identifiable data

Where feasible, we use data that cannot directly identify you (such as anonymous demographic data and usage data) instead of Personal Data ("Non-identifiable Data"). This non-identifiable data may be used to improve our internal processes or provide services, without further notice to you.

We may use aggregated data for various purposes, including analysis, evaluation and improvement of our Services.

Device characteristics

When using the application, we may need access to certain additional information and functions of your device, such as your contact list. Before we access this information, we will ask for your permission. Any data obtained through the use of these device functions will be stored only on your device and never on our server or elsewhere.

2. Accuracy of Personal Data

We are committed to keeping your Personal Data accurate and up to date. We take reasonable measures to ensure the accuracy of your Personal Data, ensuring that the latest Personal Data we have received is recorded accurately and, when necessary, we conduct periodic checks and ask you to update your Personal Data. From time to time, we may send you emails asking you to confirm or/and update your Personal Data. This communication is based on our legitimate interest and our legal obligation to maintain accurate and up-to-date information.

If you notice that your Personal Data is not accurate, you can request correction or update of your information by emailing dpo@euronetworldwide.com .

3. Legitimate interest

When we use Personal Data to pursue our legitimate interests, we will make every effort to balance our interests with yours, so that your Personal Data is used only as permitted by relevant law or when it does not adversely affect your rights. Upon request, customers can request information about any processing based on legitimate interest.

4. How long does Ria retain Personal Data?

Personal Data is retained for as long as necessary to provide the requested Services and to comply with applicable legal, accounting obligations or reporting obligations. The retention period is determined based on applicable requirements and obligations, which may include:

• Legal and regulatory requirements : Your Personal Data is retained for as long as necessary to achieve compliance with all our legal obligations, including, but not limited to, commercial and tax laws and anti-money laundering regulations. Although we store your Personal Data only for purposes of complying with legal obligations, your Personal Data will be restricted so that it cannot be used for other purposes. Access to your Personal Data will only be made when necessary. Whenever we receive a deletion request, we will also retain your Personal Data in accordance with our legal obligations.

• Customer service and contractual relationships (customer relationship management, complaint management, etc.) : We will retain your Personal Data for as long as you remain our customer. Once we determine that our contractual relationship has ended, we will proceed to restrict your data so that we only have it for purposes of complying with legal obligations, as expressed above.

• Marketing : We will process your Personal Data for marketing purposes unless you have asked us to opt out, in accordance with section 11 of this Privacy Statement or until we determine that you are no longer interested or that your data is not accurate.

5. Does Ria share my Personal Data with third parties?

Euronet Group

Third party service providers*

*The legal definition and list of "third party service providers" may vary depending on the country in which you reside. For more information about which providers have access and why they have access to your Personal Data, you can contact us at dpo@euronetworldwide.com .

Legal and regulatory authorities

Strategic partners

Professional partners

6. Minors

We do not provide Services directly to children under 18 years of age, nor do we proactively collect their personal information. If you are under 18 years of age, do not use the Website/Application or the Offers and do not provide us with Personal Data. If you become aware that someone under 18 years of age has unlawfully provided us with Personal Data, contact us at dpo@euronetworldwide.com .

7. Data security

We are committed to protecting your Personal Data and have implemented commercially reasonable and appropriate safeguards to prevent any loss, misuse and alteration of the information you have entrusted to us. At Ria, we will always strive to ensure that your Personal Data is well protected, in accordance with best international practices. We maintain this commitment to data security through the implementation of appropriate physical, electronic and administrative measures to protect and secure your personal information.

To protect our systems from unauthorized access, we use secure, state-of-the-art physical and organizational security measures, which are continuously improved to ensure the highest level of security in accordance with best international practices and cost efficiency. All Personal Data is kept in a secure location which is protected by firewalls and other advanced security mechanisms, with limited administrative access.

Personnel who have access to your Personal Data, as well as processing activities around your Personal Data are contractually bound to keep your data confidential and to comply with the Privacy Policy we have implemented in our organization.

Our goal is to achieve the highest standards of data protection, adopting industry standard measures aimed at protecting your privacy.

8. Marketing and advertising

Third party advertisers provide advertisements which appear on our Website, our Application or elsewhere in our services. Third party advertisers do not have access to any information directly provided to us by our customers. Typically, advertisers rely on cookies or some other Website/Application-based mechanism to assess which advertisements may interest you. We do not place "Targeting Cookies" nor do we enable "Targeting" and "Location" on your system without your prior consent.

If you have given your consent by accepting Targeting Cookies on the Website or by enabling targeting on the Application, we may use third parties to do so (remarketing and Similar Audience functions). You can opt out of advertising by modifying your cookie settings here.

Third parties are not bound by our Privacy Statement. To understand their disclosure privacy policy, you should visit the third party's website. You can find all third parties that may use Targeting Cookies in the Cookie Policy we apply.

We may contact you from time to time (via email, SMS, letter or phone, depending on your needs and specific instructions) and when you have given us your consent to provide you with targeted marketing about our Services or/and products.

Why receive electronic communications?

Depending on the country you are in, you will receive marketing communications if you have authorized us to process your Personal Data for these purposes. This means that you have made the relevant choice during the registration process or at any time in the settings section of your profile.

We may also send you electronic communications for marketing purposes when you have a contractual obligation with us, that is, when you are currently using our Services or when you have not explicitly asked us not to receive such marketing communications.

You will always be informed and we will ensure that when using our Services or even during the registration process, you will have all the necessary information so you know that your Personal Data may be used for the specific purpose and how during the registration process or when using our Services you will have the opportunity to explicitly state that you are not interested in receiving such marketing communications. In these cases, we will remove you from our list and you will not receive any updates that may interest you about our Services and products. You will be able to change your mind at any time.

How can you opt out?

You can withdraw your consent at any time using one of the following mechanisms:

• Go to your profile and update your marketing preferences.

• Use the opt-out link you will receive in any of our communications.

• By sending an email to dpo@euronetworldwide.com .

If you have any additional questions about the use of your personal data for marketing purposes or/and wish to start receiving marketing communications, you can also send an email to dpo@euronetworldwide.com.

9. Description of Personal Data rights

Depending on where you live, the Personal Data Rights that arise from applicable law may include:

1. Right to know : the right to know what Personal Data is collected, sold or disclosed and to whom.

2. Right to access : the right to request access to a copy of your Personal Data.

3. Right to correct inaccuracies : the right to request correction of inaccuracies in your Personal Data.

4. Right to deletion : the right to request deletion of your Personal Data, provided certain conditions are met.

5. Rights to opt-out :

   1. The right to opt out of processing Personal Data for targeted advertising purposes.

   2. The right to opt out of processing sensitive personal data.

   3. The right to opt out of processing personal data for profiling to promote decisions that produce legal or similar significant results for the data subject.

6. The right to restrict the use of sensitive personal data and disclosures to specifically permitted purposes.

7. Right to restrict processing : the right to restrict processing when certain conditions are met.

8. Right to data portability : the right to receive Personal Data in a structured, commonly used and machine-readable format, as well as the right to transmit Personal Data to another controller under specific conditions.

9. Right to object : the right to object to the processing of Personal Data (e.g. for direct marketing purposes).

10. Rights related to automated individual decision-making : the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similar significant results for the individual.

11. Right to non-retaliation : a business must not discriminate against an individual because they exercise their rights in relation to Personal Data.

We will respond to your request as soon as possible and within the timeframe set by applicable law.

For applicable rights, refer to the "Regional Privacy Statement" section below. To exercise any of your rights, you must send an email to dpo@euronetworldwide.com . To protect your privacy and maintain security, we will take necessary measures to verify your identity and may ask you to provide additional information before we give you access to your Personal Data or before we begin modifying any Personal Data. When required, if we do not have a copy of your ID or any legally valid document proving your identity, we will not be able to respond to your request.

Please note that certain rights may not be enforceable due to operational needs or legal obligations when providing the Service. Your rights may be limited to ensure compliance with other legal obligations, such as combating money laundering from illegal activities, contractual obligations and compliance obligations. Nevertheless, we will always respond when you exercise any of the rights mentioned above or/and any additional right you may have depending on the jurisdiction in which you are located. If your right cannot be exercised, you will always receive an appropriate explanation.

10. Privacy complaint procedure

Data subjects have the right to file a complaint with the Data Protection Authority or with the courts, if they believe we have not complied with our obligations under this Privacy Statement or applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• UK: Information Commissioner's Office (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Personal Data Protection Department

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Consumer Affairs Privacy Protection Bureau

• USA: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: National Institute of Transparency, Access to Information and Personal Data Protection

• Chile: Consejo para la Transparencia

Ria reserves the right to modify this Privacy Statement at any time and will notify you of such modifications through REGIONAL PRIVACY STATEMENTS

11. Statement for consumers of the United States

This Statement is provided to consumers and customers of the United States (including former customers) to comply with the requirements of the federal Gramm-Leach-Bliley Act ("GLBA"), as applicable, regarding the collection, disclosure, and protection of "nonpublic personal information" ("NPI") as defined by the GLBA. For purposes of this Statement, NPI means personally identifiable information about an individual that is collected by RIA as a financial institution under the GLBA in connection with providing a financial product or service by RIA, unless the information is publicly disclosed. NPI collected by RIA may include any of the following:

• information that an individual provides to RIA to obtain a financial product or service.

• information that RIA receives about an individual from a transaction involving RIA's financial products or services (e.g., the fact that the individual is a RIA customer/consumer, account numbers, etc.), or

The categories of NPI that may be collected by RIA are listed in Section 1 of this Privacy Statement.

The categories of NPI that may be disclosed by RIA are listed in Section 9 of this Privacy Statement.

The categories of service providers and unaffiliated third parties to whom NPI is or may be disclosed are set forth in this Privacy Statement. Where RIA discloses NPI to unaffiliated third parties in accordance with GLBA exceptions, all such disclosures occur as permitted by law. "Unaffiliated third party" means any person other than a subsidiary of a financial institution or a person employed jointly by a financial institution and a company that is not a subsidiary of the institution.

The categories of information disclosed and to whom, in accordance with the joint marketing/service provider exception that is an exception to the Privacy Rule are set forth in this Privacy Statement.

If NPI may be disclosed to unaffiliated third parties and such disclosure does not fall within any of the exceptions to the Privacy Rule under the GLBA, consumers and customers have the right to opt out of such disclosures and an opt-out mechanism will be provided to the consumer or customer.

Section 9 of this Privacy Statement provides notice regarding RIA's sharing of information among the Euronet Group and its subsidiaries in accordance with the Fair Credit Reporting Act.

RIA's policies and practices regarding the protection of the confidentiality and security of NPI are set forth in this Privacy Statement.

California Consumers

Under the California Consumer Privacy Act, California residents can exercise the following rights:

• 1 (Right to Know)

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 5 (Right to Opt Out of Sale or Sharing of Personal Information for Cross-Context Behavioral Advertising Purposes)

• 6 (Right to Limit Use of Sensitive Personal Information and Disclosures for Specific Permitted Purposes)

• 11 (Right to Non-Retaliation After Opting Out or Exercising Other Rights)

12. Statement for residents of Europe (EEA).

Under the General Data Protection Regulation (GDPR) and in addition to the rights mentioned in Section 15 above, all residents of the European Economic Area (EEA) can exercise the following rights:

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

• 8 (Right to Data Portability)

• 9 (Right to Object)

• 10 (Rights Related to Automated Individual Decision-Making)

To exercise any of the rights mentioned above, you must comply with the obligations set out in Section 15 of this Privacy Statement.

From the day we receive your request, we will respond to you within a maximum of 30 days, unless an extension is requested.

When processing your Personal Data, we must disclose your Personal Data in accordance with the following:

13. Statement for residents of the UK

Under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all residents of the United Kingdom can exercise the following rights:

• 1 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

• 8 (Right to Data Portability)

• 9 (Right to Object)

• 10 (Rights Related to Automated Individual Decision-Making)

To exercise any of the rights mentioned above, you must comply with the obligations set out in Section 15 of this Privacy Statement.

14. Statement for residents of Argentina

Under the Ley de Protección de Datos Personales 25.326, you have the following rights, as defined in Section 15 above:

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

To exercise your Rights or your right to withdraw or raise any questions or complaints regarding the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com following the instructions mentioned in Section 15.

We inform you that there are available options to limit how we use or disclose your personal information for specific processing.

From the day we receive your request, we will respond to you within a maximum of 5 days (for requests related to deletion and updating of your Personal Data) or within a maximum of 10 days (for a request related to access to your Personal Data).

15. Statement for residents of Mexico

Ria México, with an address for hearing and receiving notices for privacy and Personal Data protection purposes as mentioned in Section 27, and in accordance with the federal law Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the "Mexican Law"), its regulations and guidelines, makes available to its users or potential users, in their capacity as Data Subjects, this Privacy Statement, prior to the collection of Personal Data, in strict compliance with the principles of legality, consent, information, quality, purpose, good faith, proportionality and accountability required by Mexican Law.

For the purposes of providing services in its capacity as a money transmitter in accordance with Article 81-A (a) of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, Ria México will collect Personal Data, as applicable, in accordance with the legal bases mentioned in Section 1, and in connection with the following purposes:

• Verifies that the Personal Data contained in the voting authorization submitted to Ria México matches those contained in the Instituto Nacional Electoral registry.

• Verify that the CURP data provided to Ria México matches the data registered in the Registro Nacional de Población.

Additionally, and when deemed necessary, in order to comply with Articles 4 and 4a of the General Provisions referred to in Article 95a of the Ley General de Organizaciones y Actividades Auxiliares del Crédito applicable to money transmitters referred to in Article 81-A (a) of the same law (the "Provisions"), Ria México is legally required to obtain information regarding your geographic location, as well as recordings of your voice and image, in order to identify users or potential users in a non-face-to-face manner, and to obtain other relevant data that will be explained in detail in the specific form available in the application, as required by the Provisions. We will always process this information based on your consent.

You have the following rights (the "ARCO Rights"):

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 9 (Right to Object)

Similarly, you also have the right to restrict or withdraw at any time the consent granted for processing of your Personal Data, to the extent permitted by law. To exercise any of the ARCO Rights you hold, to withdraw your consent, or to submit any questions or complaints regarding the processing of your Personal Data, you can contact us at: dpo@euronetworldwide.com following the instructions in Section 15.

We will respond to you no later than 20 days from the date of receipt of your request and it will take effect no later than 15 business days after we notify you of our response.

16. Statement for residents of Chile

Under the law, you have the following rights (the "ARCO Rights"):

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 9 (Right to Object)

Similarly, you have the right to withdraw at any time the consent granted for processing of your Personal Data to the extent permitted by law. To exercise your ARCO Rights or your right to withdraw or raise any questions or complaints regarding the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com following the instructions mentioned in Section 15.

We inform you that there are available options to limit how we use or disclose your Personal Information for specific processing.

From the day we receive your request, we will respond to you within a maximum of 2 days.

17. Statement for residents of Malaysia

Under the Personal Data Protection Act 2010 (the "PDPA"), customers can provide us with their Personal Data for any of the purposes specified in Section 1 of this Privacy Statement. If we are to process your Personal Data for any additional purpose, we will inform you beforehand or request your explicit consent.

At any time, you can exercise the rights defined in Section 15. You also have the ability to withdraw your consent, unless the processing activity is necessary to fulfill any legal obligation or to provide you with any of our Services. You can also object to processing if you believe that such processing activity may cause you any harm or discomfort.

From the day we receive your request, we will respond to you within a maximum of 21 days.

Under the terms of the PDPA, RIA has the right to charge a fee for processing any data access request.

18. Statement for residents of New Zealand

For all residents of New Zealand, the rights you can exercise regarding the processing of your Personal Data are as follows:

• 1 (Right to Know)

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

To exercise any of the rights mentioned above, you must comply with the obligations set out in Section 15 of this Privacy Statement.

From the day we receive your request, we will respond to you within a maximum of 20 days.

19. Statement for residents of Australia

For all residents of Australia, the rights you can exercise regarding the processing of your Personal Data are as follows:

• 1 (Right to Know)

• 2 (Right to Access)

• 3 (Right to Correct Inaccuracies)

• 4 (Right to Delete)

• 7 (Right to Restrict Processing)

You can also ask us to explain our data policies and practices in accordance with applicable law.

From the day we receive your request, we will respond to you within a maximum of 30 days.

When processing your Personal Data, we must disclose your Personal Data in accordance with the following:

20. Statement for residents of India

For all residents of India, the rights you can exercise regarding the processing of your Personal Data are the rights mentioned in Section 15. Note that to exercise any of your rights you must follow the instructions listed in Section 15.

You can exercise your right to data portability and the right not to be subject to automated decision-making with legal consequences, such as profiling, if profiling is not necessary to provide any of our Services.

From the day we receive your request, we will respond to you within a maximum of 30 days.

21. Our companies by service

The data controller is RIA, which is represented by the following companies, depending on the country and service:

Money Transfer Services

22. Our companies by service

The data controller is represented by the following companies, depending on the country and service:

You can always submit a request to our Data Protection Officer by sending an email to the following address: dpo@euronetworldwide.com .

*Countries within the EEA (European Economic Area) region: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.