Privacy Notice

November 2021

This Privacy Notice explains how we handle personal data that we collect when you use our services as a customer, visit and/or use our websites or mobile applications, or interact with us in other ways. In this Privacy Notice, we also specify how your information might potentially be shared with third parties and what privacy safeguards we have in place to protect your information.

Who are we?

We are Ria Money Transfer, a global brand that is part of the Euronet group.

You can find all our contact details here.

What types of data do we collect?

We collect only the data we need by law and local regulation. This includes:

• Identification data

• Financial data

• Behavioral data

We will never collect more data than necessary.

Why do we need to collect data?

Data collection is necessary only for specific contractual and legal purposes. At the same time, this information helps us improve your experience on our platforms.

How long does Ria Money Transfer keep data?

We will keep your Personal Data for as long as necessary under law and/or local regulations. In some cases, legal requirements may require a longer retention period. Data no longer required by law will be deleted or anonymized.

Who do we share customer data with?

We share customer data with other Ria companies, legal authorities, and partners to meet our regulatory and contractual commitments.

Where does Ria Money Transfer store customer personal data?

We store customer data in secure locations with strict security measures to ensure the safety of personal data.

If we need to transfer customer data to other countries, we will take all necessary measures to comply with legal obligations and ensure an adequate level of security.

What are your rights?

Our customers own their personal data and have the legal right to exercise control over it. You can request it at any time by emailing dpo@euronetworldwide.com :

• Data access

• Data modification

• Deletion

• Restrictions on processing purposes.

What personal data do we collect and how do we collect it?

Identification data

Personal data may include name, title, home and/or business address, email, phone and/or fax numbers and other contact details, date of birth, gender, images, signature, passport/visa details, voice recording, official credentials, and image capture.

Financial data

We collect your personal financial data for onboarding as a customer. This may include bank accounts, bank statements, transfer details, employment, or other documentation that shows the source of funds you wish to transfer (such as pay stubs)

Behavioral and technical information

Visitor IP address, behavioral information, browser type and version, time zone, screen resolution, browser plug-in types and versions, operating system and platform

Visit our Cookie Policy here

Location

We may collect information about your location when you use our services

Video surveillance

Images, videos, voice recordings

Biometric data

Images, video recordings, fingerprints, face scans

Transaction data

We may collect personal data such as beneficiary data, bank account data, contact information. The destination where you intend to send money and banking preferences. Additionally, depending on local regulations, we may collect other data, such as occupation, relationship with the beneficiary, reason for transfer, and additional documentation to demonstrate the source of funds.

Non-identifiable data

Where possible, we may use data based on which you cannot be directly identified (such as anonymous demographic and usage data) rather than personal data. This non-identifiable data can be used to improve our internal processes or service delivery.

We may use aggregated data for various purposes, including, by way of example, evaluating and improving services and analyzing traffic to the services.

In some circumstances, we may anonymize your personal data so that it can no longer be associated with you, in which case we may use such data without further notice.

Legitimate interest

When we use customers' Personal Data to pursue our legitimate interests, we will do everything possible to align our interests with theirs, so that customer data is used only with their permission or as otherwise permitted by applicable laws. We will always provide customers with access to any legitimate interest assessment upon request. Customers can contact us by email, as indicated in section 1 above.

How long does Ria Money Transfer keep Personal Data?

Personal Data is used for various purposes and is subject to a variety of laws and regulations. It is kept for as long as necessary to provide the Services requested by customers, to fulfill applicable legal, accounting, or reporting obligations, and to ensure they can access it easily.

The appropriate retention period for Personal Data is based on legal and regulatory obligations and the company's specific needs to provide better Service and your consent, as applicable. For example:

• Legal and regulatory requirements.

• Customer service (customer relationship management, complaint handling, etc.). We may continue to process and store a customer's Personal Data if we maintain a business relationship with them.

• Marketing. We will continue to process your personal data for marketing purposes as long as you have not asked us to unsubscribe

• Contractual obligation. We will keep Personal Data for the duration of the contractual agreement. Customers can contact the Euronet Group's data protection officer to receive a copy of our Retention Policy, which may vary based on applicable law and specific business needs, depending on the country.

Does Ria Money Transfer share my personal data with third parties?

Does Ria Money Transfer save correspondence sent by the customer?

Yes. We may retain correspondence sent to us by you, including emails and faxes, together with any record of your account. We may also retain customer service letters and other communications between us and any Euronet Group company, as well as our partners and suppliers. Such records will be kept in accordance with our Retention Policy.

Data security

We are committed to protecting customer personal data and have implemented safeguards to prevent any loss, misuse, and alteration of the information you have entrusted to us. Ria Money Transfer is always committed to ensuring that users' Personal Data is well protected. We maintain this commitment to data security by adopting appropriate physical, electronic, and managerial measures to safeguard and protect personal information.

To safeguard our systems from illegal access, we use sophisticated and secure procedures and continuously improve our security as new systems become available, to ensure the highest level of security according to the risks presented by processing your Personal Data to provide our Services.

To prevent unwanted access to our data centers and those of our partners, we use state-of-the-art physical security measures. Additionally, all personal data is stored in a secure location, protected by firewalls and other sophisticated security systems with limited administrative access.

All our staff who have access to, or are involved in processing Personal Data, are contractually bound to maintain the confidentiality of customer data and to adhere to the privacy rules we have implemented in our organization, following core principles and based on legal obligations.

No security system is flawless or impenetrable. Therefore, although we use industry-standard practices to protect user privacy, we cannot guarantee (and do not guarantee) the absolute security of personal data.

Profiling and automated decision-making

To provide you with personalized information and advice related to our products and Service, we perform data analysis using third parties, if you have expressly authorized us, so we can direct appropriate communications and advertisements, including invitations to exclusive customer events we believe may interest you, as well as recommend products and services we believe may be suitable for you.

In some cases, we may use automated decision-making and profiling processes, if legislation permits and if necessary for contract performance. An example is automatic authorization for payment services. The legal basis for profiling and automated decision-making is legitimate interest.

Marketing and advertising

Third-party advertisers provide ads that are displayed on our website, App, or elsewhere in the Services. Such third-party advertisers do not have access to any of the information our customers have provided directly to us, unless you have expressly agreed to share such Personal Data.

Delivered advertising may be personalized if customers have given their consent by accepting "Targeted Cookies" through the cookie consent manager or by enabling "Targeting" and "Location" on the App.

REMARKETING ON WEBSITE AND APP

If you have provided your consent by accepting targeted cookies on the website or enabling targeting on the App, we may use third parties to do this (remote marketing and similar audience functionality). You can modify your cookie settings here

To understand third-party privacy notices, visit their website. You can find all third parties that, if accepted, can use cookies for targeting in our Cookie Policy

Direct marketing

If you have given explicit consent, we may contact you from time to time (via email, SMS, letter, or phone, if necessary and according to your specific instructions) to provide targeted marketing on our Services. You can revoke your consent at any time by emailing dpo@euronetworldwide.com or by following the instructions contained in the marketing email we sent you.

Use of pixels in marketing emails

We may use pixels in our marketing emails to know if, and how many times, our email messages are opened and to verify any clicks on links or ads within them. Uses of this information may include:

• Discovering what our email users found most interesting.

• Determining user activity and their engagement with our products and services.

• Informing our advertisers (in aggregate form) how many users clicked on ads.

• Which region our audience is located in.

What are your rights?

Customers can request access and need to update, modify, or delete their Personal Data. Depending on your country, however, you may have different rights, and regardless of where you are located, you can exercise the following rights at any time:

• Request access to any personal data ("Data Subject Access Request"). When exercising your right of access, you can ask us for information about all Personal Data we hold, the processing activities we perform with such data, the recipients of Personal Data, the different categories of Personal Data, how long they are processed, and the existence of any automated decisions regarding your Personal Data.

• Request correction of any inaccurate Personal Data we may hold about you. If you have changed your email address or notice a spelling error in one of your Personal Data, you can exercise your right to correction.

• Request deletion of all Personal Data we hold about you. If you no longer wish to hear from us or do not wish to continue using our Services, you can ask us to delete all Personal Data we hold about you. In that case, we may retain Personal Data to fulfill any of our legal obligations. However, in this case it will not be used for any purpose.

Customers also have the right to file a complaint with a competent data protection authority or courts if you believe we have not met our obligations under this Privacy Notice or applicable law. We encourage customers to report any complaints to us, even though it is not required. We will commit to responding in accordance with our complaint procedure.

We will respond as soon as possible and in any case within the timeframes set by applicable law.

For any applicable rights and to determine the exact timeframe in which we must respond to requests, please see the specific resident sections below.

To exercise any of your rights, you must send an email to dpo@euronetworldwide.com . To protect privacy and maintain security, we will take steps to verify your identity and/or may ask you to provide additional details before granting access or modifying Personal Data. Unfortunately, if we do not have a copy of your ID or a document, valid by law, that proves your identity, we will not be able to respond to your request.

Privacy complaint procedure

Customers have the right to file a complaint with a Data Protection Authority or courts if you believe we have not met our obligations under this Privacy Notice or applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner Officer (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Department of Personal Data Protection

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice's Privacy Unit

• USA: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

• Chile: Consejo para la Transparencia

Ria Money Transfer reserves the right to modify this Privacy Notice at any time and to publish such modifications on the company website or through any other method deemed appropriate.

Notice for California residents

Customers who reside in California may have additional rights regarding our use of Personal Data under California law. Visit the CCPA Privacy Notice

California consumers have the right to request access to Personal Data we have collected about you in the last 12 months. You can make this request up to two times in a 12-month period.

You may also request additional details about our practices, including the categories of Personal Data we have collected about you, the categories of sources of such collection, the business or commercial purpose of collecting or selling personal information, the categories of third parties with whom we share and to whom we sell Personal Data, the categories of Personal Data we have disclosed about you in the preceding 12 months, and the categories of third parties to whom we have sold Personal Data in the preceding 12 months.

If you are a California consumer, you also have the right to request deletion of your Personal Data (subject to certain exceptions), to opt out of the sale of personal information, and to receive the same service and price, as well as not to be discriminated against even if you exercise any of your CCPA rights (unless permitted by applicable law, for example if the differences are reasonably attributable to your information).

We inform you that we do not sell your Personal Data to third parties. If necessary, we will request your specific consent.

From the day we receive your request, we will respond within a maximum of 45 days.

Notice for Mexico residents

In accordance with the Law, you enjoy the rights of access, correction, deletion, and opposition to processing (the "ARCO Rights"); furthermore, you have the right to revoke at any time the consent granted for the processing of your Personal Data, to the extent permitted by Law. To exercise your ARCO Rights or to revoke or raise doubts or complaints regarding the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com following the instructions defined in section 11.

You are hereby informed that there are various alternatives to limit how we use or disclose your personal information for specific processing.

From the day we receive your request, we will respond within a maximum of 20 days.

Notice for European residents (EEA)

In accordance with the General Data Protection Regulation (GDPR), all residents of the European Economic Area (EEA) can exercise the following rights:

• Right to information

• Right of access

• Right to rectification

• Right to erasure

• Right to restrict processing

• Right to data portability

• Right to object

• Right to avoid automated decision-making

To exercise any of the rights listed above, you must comply with the obligations established in section 11 of this Privacy Notice.

From the day we receive your request, we will respond within a maximum of 30 days.

Notice for Malaysia residents

In accordance with the Personal Data Protection Act 2010, customers can provide us with their personal data for any of the purposes established in section 2 of this Privacy Notice. If we were to process your personal data for any additional purpose, we will inform you in advance or request your explicit consent.

You can exercise the rights established in section 10 at any time. Additionally, you can revoke your consent unless the processing activity is necessary to fulfill any legal obligation or to provide any of our Services. Finally, you have the option to object to processing if you believe such processing activity may cause you personal harm or inconvenience.

From the day we receive your request, we will respond within a maximum of 21 days.

In accordance with the terms of the PDPA, Ria Money Transfer has the right to charge a fee for processing any data access request

Notice for New Zealand residents

The rights you can exercise regarding the processing of your Personal Data are listed in section 11. To exercise any of your rights, you must follow the instructions provided in section 11 mentioned above.

From the day we receive your request, we will respond within a maximum of 20 days.

Notice for Australia residents

The rights you can exercise regarding the processing of your Personal Data are listed in section 11. To exercise any of your rights, you must follow the instructions provided in section 11 mentioned above.

You also have the option to ask us for clarification on our data policies and practices, according to applicable law.

From the day we receive your request, we will respond within a maximum of 30 days.

Notice for residents in India

The rights you can exercise regarding the processing of your personal data are listed in section 11. To exercise any of your rights, you need to follow the instructions provided in section 11 mentioned above.

You also have the right to exercise your data portability right and the right not to be subject to automated decision-making that produces legal effects, such as profiling, if this is not necessary to provide one of our Services.

From the day we receive your request, we will respond within a maximum of 30 days.

Our companies divided by service

Money Transfer Service

The service provider is Ria Money Transfer represented by the companies listed below, depending on the country and service:

Ria Stores and Currency Exchange Services