Data protection statement for professional partners

This privacy policy (“ Privacy Policy ”) explains how we process your personal data (“ Personal Data ”) while you browse our website or mobile application (“ Website/Application ”) and when you apply for or become a Ria and/or its agent. professional partner (“ Professional Partner ”) engages with us.

We encourage you to review this Privacy Notice regularly and check the Website/App for updates. We will post updates to this Privacy Notice on our Website/App, and by continuing to interact with us, you agree to this Privacy Notice and any future changes.

Where local laws require additional details to be included in this privacy notice, this information is included in the Regional Privacy Notices section below.

1. What personal data do we collect, how and why?

Below is a list of the categories, sources and reasons for collecting Personal Data. If the collection of Personal Data is based on your consent, you may withdraw your consent at any time. RIA does not “sell” or “share” Personal Data as defined by applicable law. We retain Personal Data for as long as is reasonably necessary to provide the Services and comply with our legal obligations.

If you have any questions or concerns regarding the processing of your personal data, you can contact us at any time at dpo@euronetworldwide.com .

Identifiers or identifying data

Personal Data collected from you may include name, email address, telephone and/or fax number, residential and/or business address and other contact information (“Contact Information”), address, date of birth, gender, images, videos or signature.

If necessary, we will only use identifying information for the purposes described.

Contractual obligation

Financial details and professional or employment-related information

We collect your personal financial information when you register to use our services. We collect financial information, such as bank account information, financial statements, reason for transfer, occupation (professional or employment-related information), or other documents that demonstrate the source of the funds you are transferring (similar to pay stubs), in order to provide you with our services.

Behavioral and technical information

IP address, internet or other similar network, browsing or search activity, behavioral information (to help us understand how you behave while using our products and services), browser type and version, time zone setting, screen resolution settings, browser plug-in types and versions, operating system and platform.

View our Cookie Policy

Audio and video surveillance

Image, video and audio/voice recording.

The Personal Data we collect from you may vary depending on the country in which our Services are offered. Not all of the data categories described above may apply to you. If you have any questions about the processing of your personal data, please contact us at dpo@euronetworldwide.com .

Non-identifiable data

Whenever possible, we use data where you are not directly identifiable (such as anonymous demographic and usage data) rather than personal data (“non-identifiable data”). We may use this non-identifiable data to improve our internal processes or services without further notice.

We may use aggregated data for a variety of purposes, including analyzing, evaluating, and improving our Services.

Device features

When using the application, we may need to access certain additional information and features on your device, such as your contact list. We will ask for your permission before accessing such information. The data obtained by using these features of your device will only be stored on your device, never on our servers or anywhere else.

2. Accuracy of personal data

We are committed to keeping your personal information accurate and up to date. We take reasonable steps to ensure the accuracy of your personal information by ensuring that the most recent personal information we receive is accurately recorded and, where we deem it necessary, we carry out regular checks and ask you to update your personal information. From time to time, we may send you an email asking you to confirm and/or update your personal information. This communication is based on our legitimate interest and legal obligation to maintain accurate and up-to-date information.

If you notice that your personal data is inaccurate, you can request that the data be corrected or updated by sending an email to dpo@euronetworldwide.com .

3. Legitimate interest

When we use your personal data to pursue our legitimate interests, we will make every effort to align our interests with yours, and to use your personal data only as permitted by applicable law or where it does not adversely affect your rights. Customers may request information about any processing based on legitimate interests.

4. How long does Ria retain personal data?

We will retain your personal data for as long as is necessary to provide you with the Services you have requested and to comply with any applicable legal, accounting or reporting obligations. The retention period will be determined based on applicable requirements and obligations, which may include:

• Legal and Regulatory Requirements : We will retain your Personal Data for as long as necessary to comply with all of our legal obligations, including without limitation trade, tax and anti-money laundering laws and regulations. While we will retain your Personal Data only for the purposes of complying with our legal obligations, we will restrict your Personal Data so that it cannot be used for any other purpose. Although restricted, you will only have access to your Personal Data on a need-to-know basis. When we receive a request to delete, we will also process your Personal Data in accordance with our legal obligations.

• Customer service and contractual relationship (customer relations, complaint handling, etc.) : We will retain your personal data for as long as you remain our customer. Once our contractual relationship is considered closed, we will restrict your data to be made available only to fulfill the legal obligations outlined above.

• Marketing : We will process your personal data for marketing purposes until you have asked us to unsubscribe, in accordance with Section 11 of this Privacy Policy, or until we become aware that you are no longer interested or that your data is not accurate.

5. Does Ria share my personal information with third parties?

Euronet Group

External service providers*

*The legal meaning and list of “third party service providers” may vary depending on your country. If you would like more information about which service providers have access to your personal data and why they have access to your personal data, please contact us at dpo@euronetworldwide.com .

Legal and regulatory authorities

Strategic partners

Professional partners

6. Minors

We do not provide Services directly to children under the age of 18 and do not proactively collect their personal information. If you are under the age of 18, please do not use the Site/App or the Offerings or provide us with your Personal Information. If you become aware that a person under the age of 18 has unlawfully provided us with personal information, please contact us at dpo@euronetworldwide.com .

7. Data security

We are committed to protecting your personal information and have implemented commercially reasonable and appropriate safeguards to prevent the loss, misuse and alteration of the information you entrust to us. At RIA, we always strive to protect your personal information appropriately in accordance with international best practice. We maintain our commitment to data security by implementing appropriate physical, electronic and managerial measures to safeguard and protect your personal information.

To protect our systems from illegal access, we employ secure, state-of-the-art physical and organizational security measures, which we continuously improve to ensure the highest level of security, in line with international best practices and cost-effectiveness. All Personal Data is stored in a secure location, protected by firewalls and other sophisticated security mechanisms, with limited administrative access.

Personnel who have access to your personal data and who are involved in processing activities related to your personal data are contractually obliged to keep your data confidential and must comply with the data protection policy applied in our organization.

We aim to achieve the highest level of data protection by adopting industry standard measures to protect your privacy.

8. Marketing and advertising

Third-party advertisers provide advertisements that appear on our website, app, or elsewhere in our services. Third-party advertisers do not have access to the information our customers provide to us directly. Advertisers typically rely on cookies or other web/app-based mechanisms to assess which advertisements may be of interest to you. We do not place “targeting cookies” or enable “targeting” and “location” on your system without your consent.

If you have agreed to accept targeting cookies on the website or enabled targeting in the app, we may use third parties to do this (remarketing and similar audience features). You can opt out of advertising by changing your cookie settings here .

Third parties are not subject to our privacy policy. To understand the privacy policy of their communications, please visit the third party's website. You can find all third parties that may use cookies for targeting in our Cookie Policy .

We may contact you from time to time (by email, SMS, letter or telephone as appropriate, as per your specific instructions) and where you have consented to us providing you with targeted marketing in relation to our Services and/or products.

Why would you receive electronic communications?

Depending on the country you are located in, you will receive marketing communications if you have authorized us to process your personal data for this purpose. This means that you have opted in during the registration process or at any time in your profile settings.

We may also send you electronic communications for marketing purposes if you have a contractual obligation with us, i.e. when you are using our Services, or if you have not specifically requested not to receive such marketing communications.

We will always inform you and ensure that you have all the necessary information during the use of our Services or even during the registration process in order to be aware that we may use your personal data for the given purpose and you will be given the opportunity during the registration process or use of our Services to expressly state that you do not wish to receive such marketing communications. In these cases, we will remove you from our list and you will not receive any updates that may be of interest to you regarding our services and products. You can unsubscribe at any time.

How can I unsubscribe?

You can withdraw your consent at any time using one of the following mechanisms:

• Go to your profile and update your marketing settings.

• Use the unsubscribe link you receive in any of our communications.

• By sending an email to dpo@euronetworldwide.com .

If you have any further questions about the use of your personal data for marketing purposes and/or would like to receive marketing communications, please also send an email to dpo@euronetworldwide.com .

9. Description of rights related to personal data

Depending on where you live, your rights to your personal data under applicable law may include:

1. Right to know : You have the right to know what personal data is being collected, sold or shared, and with whom.

2. Right of access : you have the right to request access to a copy of your personal data.

3. Right to rectification of inaccuracies : you have the right to request the correction of inaccuracies in your personal data.

4. Right to erasure : you can request the erasure of your personal data under certain conditions.

5. Unsubscribe rights :

   1. The right to opt out of the processing of personal data for targeted advertising.

   2. The right to opt out of the processing of Sensitive Personal Data.

   3. The right to object to the processing of personal data for profiling purposes in order to facilitate decisions that have legal or similarly significant effects on the Data Subject.

6. The right to limit the use and disclosure of sensitive personal information to specifically authorized purposes.

7. Right to restriction of processing : the right to restrict data processing under certain conditions.

8. Right to data portability : you have the right to receive your personal data in a structured, commonly used and machine-readable format and have the right to transmit your personal data to another controller under certain conditions.

9. Right to object : the right to object to the processing of personal data (i.e. for direct marketing purposes).

10. Rights related to automated individual decision-making : the right to exclude the effect of a decision based solely on automated data processing, including profiling, which produces legal or similarly significant effects on the individual.

11. Non-retaliation : a business may not discriminate against individuals for exercising their right to personal data.

We will respond to your request as soon as possible and within the time limit specified in applicable laws.

Please see the Regional Data Protection Statement below for applicable rights. To exercise any of your rights, you should send an email to dpo@euronetworldwide.com . In order to protect your personal data and maintain its security, we will take reasonable steps to verify your identity and may ask you to provide additional information before we can provide you with access to your personal data or initiate any changes to your Personal Data. If necessary, we will not be able to respond to your request if we do not have a copy of your ID card or any valid identification document.

Please note that certain rights may not be enforceable due to business needs or legal obligations in the provision of the Service. Your rights may be limited in order to comply with other legal obligations, such as anti-money laundering, contractual and compliance obligations. Although we will always respond to you when exercising the rights mentioned above and/or any additional rights you may have depending on your jurisdiction. If your right cannot be enforced, you will always receive an appropriate explanation.

10. Data protection complaints procedure

Data Subjects have the right to lodge a complaint with the data protection authority or the courts if they believe that we have not complied with our obligations arising from this Privacy Statement or from applicable law:

• Europe (EEA): members | European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Data Protection Commission

• Malaysia: Ministry of Personal Data Protection

• New Zealand: Office of the Data Protection Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice Privacy Division

• US: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

• Chile: Consejo para la Transparency

Ria reserves the right to modify this Privacy Statement at any time and will post such REGIONAL PRIVACY STATEMENTS .

11. Notice to US consumers

This notice is provided to U.S. consumers and customers (including former customers) to comply with the requirements of the federal Gramm-Leach-Bliley Act ("GLBA"), where applicable, regarding the collection, disclosure, and protection of "nonpublic personal information" ("NPI") as defined by the GLBA. For purposes of this notice, NPI means personally identifiable information about an individual that an RIA, as a financial institution, collects in connection with the provision of a financial product or service by the RIA under the GLBA, unless the information is lawfully made publicly available. NPI collected by an RIA may include:

• information that an individual provides to an RIA to obtain a financial product or service.

• information that the RIA obtains about an individual from a transaction involving the RIA's financial products or services (i.e., the fact that the individual is a customer/consumer of the RIA, account numbers, etc.); or

The categories of NPI that may be collected by RIA are listed in Section 1 of this Privacy Notice.

The categories of NPI that may be disclosed by RIA are listed in Section 9 of this Privacy Notice.

The categories of affiliated and unaffiliated third parties with whom NPI has been or may be disclosed are set forth in this Privacy Notice. If RIA discloses NPI to unaffiliated third parties pursuant to the exceptions set forth in the GLBA, all such disclosures will be made as permitted by law. An “unaffiliated third party” is any person other than an affiliate of the financial institution or a person employed jointly by a financial institution and a company that is not an affiliate of the institution.

The categories of information disclosed and the scope of common marketing/service provider exceptions included in the Privacy Policy are contained in this Privacy Statement.

If NPI may be disclosed to unaffiliated third parties and such disclosure does not fall under any of the exceptions to the privacy rule under the GLBA, consumers and customers have the right to opt out of these disclosures, and an opt-out mechanism must be made available to the consumer or customer.

Notice of RIA's information sharing between Euronet Group and its subsidiaries under the Fair Credit Reporting Act is provided in Section 9 of this Privacy Notice.

RIA's policies and practices for protecting the confidentiality and security of NPI are set forth in this Privacy Notice.

California consumers

Under the California Consumer Privacy Act, California residents may exercise the following rights:

• 1 (Right to know)

• 2 (Right of access)

• 3 (Right to rectification of inaccuracies)

• 4 (Right to erasure)

• 5 (Right to opt out of the sale or sharing of personal data for cross-contextual behavioral advertising purposes)

• 6 (Right to limit the use and disclosure of sensitive personal data to expressly permitted purposes)

• 11. (No retaliation following unsubscribing or exercising other rights)

12. Information for European (EEA) residents

In accordance with the General Data Protection Regulation (GDPR) and in addition to the rights set out in Section 15 above, all residents of the European Economic Area (EEA) may exercise the following rights:

• 2 (Right of access)

• 3 (Right to rectification of inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restriction of processing)

• 8 (Right to data portability)

• 9 (Right to object)

• 10 (Rights related to automated individual decision-making)

To exercise the rights listed above, you must comply with the obligations set out in Section 15 of this Privacy Statement.

We will respond to you within 30 days of receiving your request, unless an extension is requested.

When processing your Personal Data, we must share your Personal Data as follows:

13. Warning for UK residents

In accordance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018, all UK residents can exercise the following rights:

• 1 (Right of access)

• 3 (Right to rectification of inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restriction of processing)

• 8 (Right to data portability)

• 9 (Right to object)

• 10 (Rights related to automated individual decision-making)

To exercise the rights listed above, you must comply with the obligations set out in Section 15 of this Privacy Statement.

14. Notice to Argentine residents

Pursuant to Law 25,326 on the Protection of Personal Data, you have the following rights, as defined in Section 15 above:

• 2 (Right of access)

• 3 (Right to rectification of inaccuracies)

• 4 (Right to erasure)

To exercise your rights or right of withdrawal regarding the processing of your personal data, or to raise any doubts or complaints, please contact us at dpo@euronetworldwide.com following the instructions set out in Section 15.

We inform you that there are options to restrict the use or disclosure of your personal data for specific processing purposes.

We will respond to you within a maximum of 5 days (for requests to delete and update your personal data) or within a maximum of 10 days (for requests to access your personal data) from the date of receipt of your request.

15. Notice to Mexican Residents

Ria México, with its registered office in the area of ​​privacy and personal data protection, as indicated in Section 27, and in accordance with the Federal Law on Personal Data Protection in the Possession of Individuals (the "Mexican Law") and its regulations, and Guidelines, makes this Privacy Policy available to its potential users in their capacity as users or data subjects, prior to the collection of personal data, in strict compliance with the principles of legality, consent, information, quality, purpose, fidelity, proportionality and responsibility required by Mexican law.

Pursuant to article 81-A Bis. of the General Law on Organizations and Auxiliary Credit Activities, Ria México collects personal data, if any, in accordance with the legal bases mentioned in point. Section 1, and in connection with the following purposes:

• Verify that the personal information on the voting certificate submitted to Ria México matches the information in the Instituto Nacional Electoral registry.

• Verify that the CURP data provided to Ria México matches the data registered in the Registro Nacional de Población.

In addition, and where necessary, in accordance with the general provisions referred to in article 95a of the Ley General de Organizaciones y Actividades Auxiliares del Crédito. 4 and 4a. Under the same law (the "Regulations"), Ria México is legally obliged to obtain information about your geographical location, as well as recordings of your voice and facial image in order to identify its users or potential users in a non-personal manner, as well as other relevant data detailed in the specific form available in the request provided for by the Regulations. Such information will always be processed based on your consent.

You have the following rights (“ARCO Rights”):

• 2 (Right of access)

• 3 (Right to rectification of inaccuracies)

• 4 (Right to erasure)

• 9 (Right to object)

Similarly, you have the right to restrict or withdraw your consent to the processing of your personal data to the extent permitted by law. To exercise any of your ARCO rights, withdraw your consent, or to submit any questions or complaints regarding the processing of your personal data, please contact us at dpo@euronetworldwide.com following the instructions in Section 15.

We will respond to you no later than 20 days after receiving your request and it will take effect no later than 15 working days after we have notified you of the response.

16. Warning to Chilean residents

You have the following rights under the law ("ARCO Rights"):

• 2 (Right of access)

• 3 (Right to rectification of inaccuracies)

• 4 (Right to erasure)

• 9 (Right to object)

Similarly, you have the right to withdraw your consent to the processing of your personal data at any time, where permitted by law. To exercise your ARCO rights or your right of withdrawal, or to raise any questions or complaints regarding the processing of your personal data, please contact us at dpo@euronetworldwide.com following the instructions set out in Section 15.

We inform you that there are options that may limit the use or disclosure of your personal data for specific processing purposes.

We will respond within 2 days of receiving your request.

17. Warning to Malaysian residents

Under the Personal Data Protection Act 2010 (hereinafter referred to as the PDPA), customers may provide us with their personal data for any of the purposes set out in Section 1 of this Privacy Statement. If we would process your personal data for any additional purpose, we will inform you in advance or ask for your express consent.

You can exercise your rights under point 15 at any time. You can also withdraw your consent, unless the processing is necessary for compliance with any legal obligation or to provide our services. You can also object to processing if you consider that such processing may cause you harm or distress.

We will respond to you within a maximum of 21 days from the date we receive your request.

In accordance with the terms of the PDPA, the RIA is entitled to charge a fee for processing any data access request.

18. Notice to New Zealand Residents

Every person living in New Zealand has the following rights in relation to the processing of their personal data:

• 1 (Right to know)

• 2 (Right of access)

• 3 (Right to rectification of inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restriction of processing)

To exercise the rights listed above, you must comply with the obligations set out in Section 15 of this Privacy Statement.

We will respond within a maximum of 20 days from the date of receipt of the request.

19. Notice to Australian Residents

For all residents of Australia, your rights in relation to the processing of your personal data are as follows:

• 1 (Right to know)

• 2 (Right of access)

• 3 (Right to rectification of inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restriction of processing)

You can also ask us to explain our data processing policies and practices in accordance with applicable law.

We will respond to you within 30 days of receiving your request.

When processing your Personal Data, we must share your Personal Data as follows:

20. Warning to Indian residents

The rights that all Indian residents have in relation to the processing of their personal data are those listed in Section 15. Please note that to exercise any of your rights, you must follow the instructions set out in Section 15.

You can exercise your right to data portability, as well as the right not to be subject to automated decision-making that produces legal effects, such as profiling, where such profiling is not necessary for the provision of our services.

We will respond to you within 30 days of receiving your request.

21. Our companies by service

The data controller is RIA represented by the following companies, depending on the country and service:

Money transfer services

22. Our companies by service

The data controller is Ria, represented by the following companies, depending on the country and service:

You can submit a request to our Data Protection Officer at any time by sending an email to the following address: dpo@euronetworldwide.com .

*EEA (European Economic Area) countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.