Comprehensive Privacy Notice

April 2022

This Data Privacy Notice (hereinafter "Privacy Notice") explains how we handle personal data (hereinafter "Personal Data") related to how you use our services, whether you are a customer, visitor, and/or user of our websites or mobile applications, or interact with us in any other way. This Privacy Notice also describes whether your Personal Data is shared with other parties and the privacy policy we apply to protect your data.

We recommend that you regularly review and check the website and/or application for updates to this Privacy Notice. We will publish the updated version on the website and/or application, and by continuing to work with us, you agree to this Privacy Notice as it applies at any given time.

Contents

1. What personal data do we collect, how do we collect it, and why?

2. Accuracy of Your Personal Data

3. Electronic Know Your Customer (e-KYC)

4. Legitimate Interest

5. How long does RIA retain Personal Data?

6. Does RIA share my Personal Data with other parties?

7. Minors

8. Data Security

9. Profiling and Automated Decision-Making

10. Marketing and Advertising

11. Email Tracking

12. What are my rights?

13. Privacy Complaint Procedure

14. Notice to California Residents

15. Notice to European (EEA) Residents

16. Notice to Argentina Residents

17. Notice to Mexico Residents

18. Notice to Chile Residents

19. Notice to Malaysia Residents

20. Notice to New Zealand Residents

21. Notice to Australia Residents

22. Notice to India Residents

23. Our Company by Service

What are your rights?

You are the owner of your Personal Data and have the legal right to control it. You can request to exercise any of your rights at any time by emailing dpo@euronetworldwide.com . Depending on the country where you live, additional rights may be granted. Click here for more information.

• Access to your data and an electronic copy of it.

• Correction of your data.

• Deletion of your data (where permitted by law).

• Restriction of processing purposes.

1. What Personal Data do we collect, how do we collect it, and why?

identification data;

This may include name, surname, job title, residential and/or business address, email, phone and/or fax numbers and other contact details, date of birth, gender, photos, signature, passport and/or visa data, voice recording, and official authorizations. We will use only the identification data that is truly necessary for the purposes described.

Financial data

We collect your personal financial data when you register as a customer. We collect financial data such as bank accounts, financial statements, transfer purpose, profession, and other documents proving the source of funds you want to transfer (similar to pay stubs) so we can provide you with services.

Behavioral and technical information

Visitor IP address, behavioral information (to understand how you use our products and services), browser type and version, time zone settings, screen resolution settings, browser plugin types and versions, operating system and platform.

Visit our cookie policy here .

Location.

We may collect information about your location when you use our services.

Video surveillance.

Photo, video recording, and voice recording.

Biometric data.

Photo, video recording, and facial recognition. If we ever process any additional biometric data, you will be informed in advance and under no circumstances will we process such Personal Data without your prior consent.

Transfer data.

We collect Personal Data such as recipient data, bank account information, contact information, destination location where you send money, and bank preferences. Depending on local regulations, we collect information such as profession, relationship to recipient, transfer purpose, and additional documents proving the source of funds.

Sensitive personal data.

We may collect and process sensitive personal data (or other "special categories of personal data"), such as data related to your physical or mental health or condition, to fulfill applicable legal or regulatory obligations.

Non-identifying data.

Whenever possible, we use non-Personal Data rather than data that allows you to be identified directly (such as anonymous demographic and usage data). This non-identifying data may be used to improve our internal processes or service delivery without notifying you.

We may use aggregated data for various purposes, including but not limited to service evaluation and improvement and analysis of service traffic.

2. Accuracy of Your Personal Data

We are committed to ensuring that your Personal Data is accurate and up to date. Therefore, we take reasonable measures to guarantee the accuracy of your Personal Data, ensuring that the most recently received Personal Data is accurately recorded, and when we believe it is necessary, we periodically conduct checks to ensure all your Personal Data is current.

If you notice that your Personal Data is not accurate, you can exercise your right to correct it by emailing dpo@euronetworldwide.com .

3. Electronic Know Your Customer (e-KYC)

To use our services, you must be registered. Registration uses an electronic know your customer verification method.

As described in Section 1, we may use biometric data (where permitted by law) to verify your identity and confirm any documents you may have uploaded to our system so we can create your account. We also use this system to comply with all our legal obligations.

If you want to register but do not want to use the electronic know your customer solution, you can contact our customer service to help you.

4. Legitimate Interest

When we use customer Personal Data to pursue our legitimate interests, we make every effort to ensure that our interests align with yours and that your Personal Data is used only in ways permitted by applicable law or that will not harm your rights. Customers can request information about any data processing based on legitimate interest.

5. How long does RIA retain Personal Data?

Personal Data is used for various purposes and is subject to various rules and regulations. It is retained for as long as needed to provide customers with their requested services and to comply with applicable legal, accounting, or accountability obligations. Examples follow below.

• Legal and regulatory requirements: your Personal Data will be retained for as long as necessary to fulfill all our legal obligations.

• Customer service (customer relationship management, complaint handling, etc.): we will retain your Personal Data as long as you are our customer.

• Marketing: we will process your Personal Data for marketing purposes until you ask us to stop, as described in Section 8 of this Privacy Notice.

• Contractual obligation: we will retain Personal Data for the duration of the contract. Customers can contact our Euronet Group data protection officer to obtain a copy of the retention policy, which may vary depending on the laws applicable in the country and the specific business need.

6. Does RIA share my Personal Data with other parties?

Euronet group

Third-party service providers

Legal and regulatory authorities

Strategic partners

Professional partners

7. Minors

We do not provide services directly to children under 18 years of age and do not actively collect their personal information. If you are under 18 years old, do not use the websites or offers and do not share personal data with us. If you learn that a person under 18 years of age has unlawfully provided us with personal data, please contact us at dpo@euronetworldwide.com .

8. Data Security

We are committed to protecting customer Personal Data and have established commercially reasonable and appropriate security measures to prevent loss, misuse, and alteration of any information entrusted to us. RIA will always strive to ensure that your Personal Data is well protected according to best international practices. We honor this commitment by implementing appropriate physical, electronic, and administrative measures to protect and secure your personal information.

To protect our systems from unauthorized access, we use secure, complex advanced physical and organizational security measures that are continuously improved to ensure the highest level of security according to best international practices and cost-effectiveness given the personal data we process. All Personal Data is kept in a secure location, protected by barriers and other complex security mechanisms with limited administrative access.

Employees who have access to your data and how it is processed are contractually obligated to ensure the privacy of your data and comply with the privacy policy applied in our organization.

Although we strive to maintain the highest data protection standards by applying standard industry measures to protect your privacy, no security system is completely flawless or impenetrable. Therefore, we cannot guarantee (and do not guarantee) that Personal Data is completely secure.

9. Profiling and Automated Decision-Making

With your explicit permission, we provide you with customized information and advice about our products and services. Using third-party services, we perform data analysis so we can direct appropriate messages and advertisements to you, including invitations to exclusive customer events that we believe may interest you, as well as recommend products and services that we believe may be suitable for you.

In certain cases, we use automated decision-making and profiling where permitted by law and necessary to perform the contract. For example, automated approvals for transfer services. The legal basis for profiling and automated decision-making is legitimate interest.

We also make automated decisions in processes such as transaction monitoring to combat fraud in accordance with legal requirements related to anti-money laundering and terrorist financing prevention and financial services. You have the right to request that you not be subject to fully automated decision-making, including profiling, if such decision-making has legal consequences or similarly has a significant impact on you. This right does not apply if the decision-making is necessary to enter into or perform a contract with you, if the decision-making is permitted under applicable data protection laws, or if we have received your explicit consent.

10. Marketing and Advertising

Third-party advertisers provide advertisements that are displayed on our website, application, or elsewhere in our services. Third-party advertisers do not have access to any information directly provided to us by our customers. Typically, advertisers use cookies or other web and/or application mechanisms to determine which advertisements may be of interest to you. Without your consent, we do not use "Targeted Cookies" in the system and do not enable "Targeted Advertising" and "Location-Based Advertising".

If you have given your consent by accepting Targeted Cookies on the website or by enabling Targeted Advertising in the application, we may engage third parties (retargeting and similar audience functions). You can change your cookie settings here.

Third parties are not required to comply with our Privacy Notice. To understand third-party privacy policies, you should visit their website. You can find all third parties that may use targeted cookies in our cookie policy .

Sometimes we may contact you (by email, SMS, letter, or phone, if necessary and according to your specific instructions) and, when necessary, if you have given us explicit consent, provide targeted marketing about our services. You can withdraw your consent at any time by emailing dpo@euronetworldwide.com or by following the instructions provided in the marketing email we sent you.

11. Email Tracking

In our marketing emails, we may use pixels to report whether and how many times our emails were opened and to confirm any clicks on links or advertisements in the email. This information may allow us to:

• learn which of our emails seemed more interesting to the user;

• determine user activity and engagement with our products and services;

• inform advertisers (in general) how many users clicked on advertisements;

• determine which region our audience is in.

12. What are my rights?

Customers can request access to their Personal Data, update, modify, or delete it. Depending on the country where you live, your rights may differ. However, regardless of where you live, you can exercise these options at any time:

• Request access to any Personal Data ("Subject Access Request"). By exercising your access right, you can ask us about all your Personal Data we hold, the actions we take to process your Personal Data, the recipients of your Personal Data, the various categories of Personal Data, how long we process your Personal Data, and any automated decisions made regarding your Personal Data.

• Request correction of any inaccurate personal data we may have about you. If you have changed your email address or notice a spelling error in your personal data, you can exercise your right to make changes.

• Request deletion of any of your Personal Data we hold. If you no longer want to receive any news from us or no longer want to use any of our services, you can request deletion of any of your Personal Data we hold. Remember that in such case we may retain your Personal Data to fulfill any of our legal obligations. However, in this case, your Personal Data will not be used for any purpose.

Customers also have the right to file a complaint with the competent data protection authority or courts if they believe we have failed to fulfill our obligations under this privacy notice or applicable law. We encourage customers to report any potential complaints to us, even if not required, and we will respond according to our complaint handling procedure.

We will respond to your request as quickly as possible and always within the time period specified in applicable law.

For information about applicable rights and the specific time period within which we must respond to your request, see the specific resident section below.

To exercise any of your rights, you must send an email to dpo@euronetworldwide.com . To protect your privacy and ensure security, we will take steps to verify your identity and/or may ask you to provide additional information before granting you access or allowing you to modify any Personal Data. Unfortunately, if we do not have a copy of your personal identity document or any legally valid document proving your identity, we will not be able to respond to your request.

13. Privacy Complaint Procedure

Customers have the right to file a complaint with the data protection authority or courts if they believe we have failed to fulfill our obligations under this privacy notice or applicable law:

• Europe (EEA): members | European Data Protection Board (europa.eu)

• UK:Information Commissioner's Office (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Personal Data Protection Department

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice Privacy Section

• USA: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: National Institute of Transparency, Access to Information and Protection of Personal Data

• Chile: Council for Transparency

RIA reserves the right to modify this Privacy Notice in part at any time and will announce such changes on the RIA website or by other means acceptable to RIA.

14. Notice to California Residents

This additional disclosure is intended to comply with the requirements of the California Consumer Privacy Act (CCPA) and should be read together with the Privacy Notice.

Customers residing in California will have the right to:

• request information and obtain information about our personal information collection practices over the past 12 months, including the categories of personal information we collect, the categories of sources of such information, the business purposes for our collection and sharing of such information, and the categories of third parties with whom we share such information;

• request a copy of the personal information we have collected about them over the past 12 months and obtain it;

• request information and obtain information about our information sharing practices over the past 12 months, including a list of categories of personal information sold with categories of third-party recipients and a list of categories of personal information disclosed for business purposes;

• request that we not sell their personal information (we do not sell your personal information); and

• request that we delete (and direct service providers to delete) their personal information, subject to certain exceptions.

For CCPA purposes, personal information is information that identifies, relates to, describes, or could reasonably be directly or indirectly linked to a specific California resident or household.

To submit a request for information disclosure, California residents can contact us in the following ways:

1. Toll-free phone: 1-877-932-6640

2. Email: dpo@euronetworldwide.com

We may request that you provide a signed statement, knowing about the possibility of penalties for false statements, that you are the person you claim to be. We will confirm that we received your request within ten (10) days and will attempt to respond to you within forty-five (45) days from the date we receive your request, but if we need more time (up to an additional forty-five days), we will inform you of the need for additional time. We cannot respond to your request or provide you with personal information if we cannot verify your identity and confirm that the personal information is related to you.

You may submit a request to disclose our information collection practices, information collected about you, or sharing practices no more than twice in a 12-month period.

If you request a copy of the personal information we collected over the 12 months prior to your request submission, we will attempt to provide the information in a format that is easy to use, including sending a paper copy or providing an electronic copy to your registered account if you have registered an account with us. If you request deletion of your information, California law allows us to retain certain information and not delete it under certain circumstances (such as information related to a transaction, security incidents, fraud, etc.). For example, we are not required to comply with a request to delete information if the information is necessary for us to perform a transaction for you or otherwise fulfill a contract; detect, protect against security incidents, fraud or unlawful activity or prosecute those responsible; use information only internally in ways that reasonably align with your expectations as our customer (such as processing sales records), and comply with legal obligations. If we receive such a request from you, we will also inform all service providers we work with to delete your information.

We will not discriminate against you for exercising any of these rights.

We do not sell your information for monetary consideration and do not disclose your information for other valuable consideration. If we enter into agreements in the future that fall within the definition of "sale" under the CCPA, we will update this privacy policy and how we comply with the CCPA.

You may submit a request through a person with official authorization. Otherwise, you may submit a request using an authorized representative's services only if (1) you provide the authorized representative with written permission to submit the request and (2) you verify your identity directly with us. We will require the representative to provide us with evidence that they are authorized to make requests on your behalf.

Over the past 12 months, we have collected the following categories of information from the listed sources, used it for the listed business purposes, and shared it with third parties in the listed categories. The information categories include information we collect from our website visitors, registered users, employees, sellers, suppliers, and any other person who interacts with us online or offline. Not all information is collected about all individuals. For example, we may collect different information from job candidates, sellers, or customers.

* More specifically, the business purposes are as follows:

1. Providing services to you:

   • Administer or otherwise perform our obligations related to any contract of which we are a party.

   • Help you complete a transaction or order.

   • Allow tracking of shipments.

   • Prepare and manage invoices.

   • Respond to inquiries or requests and provide services and assistance.

   • Provide post-sale customer relationship management.

   • Create and manage customer accounts.

   • Inform you of changes to our services and products.

   • Administer any advertising, contests, surveys or competitions.

   • Provide you with information about our products and services.

   • Offer you our products and services in a personalized manner, for example, we may provide suggestions based on your previous inquiries so we can more quickly identify suitable products and services.

2. Audit related to transactions, internal scientific research and development:

   • For internal business administration and operations, including troubleshooting, website customization, improvement or creation, website testing, research, administration and operation, and data analysis.

   • Create products or services that may meet your needs.

   • Evaluate the performance of marketing initiatives, advertisements and websites created on our behalf by another company.

3. Security detection, protection and assurance; functionality adjustment, error correction:

   • We aim to ensure the security and protection of our websites.

   • Ensure the security of your account and our business, prevent fraud, malicious activity or misuse of our websites or detect it, for example, by requesting confirmation information to reset your account password (if applicable).

   • Ensure the physical security of our premises using video surveillance.

   • Resolve disputes, protect our, users' or other individuals' rights and interests, ensure their safety and comply with legal obligations.

4. Quality control:

   • Monitor quality control and ensure compliance with our legal obligations, codes and regulations, policies and procedures.

   • Create and improve our products and services, for example, by reviewing website visits and various subpages, demand for specific products and services, and user feedback.

For more information, contact us. If you have questions or concerns about our Privacy Notice and practices, please contact us using the contact information provided in the "Who We Are" section of this Privacy Notice.

15. Notice to European (EEA) Residents

Under the General Data Protection Regulation (GDPR), all residents of the European Economic Area (EEA) can exercise the following rights:

• Right to information

• Right of access

• Right to rectification

• Right to erasure

• Right to restrict data processing

• Right to data portability

• Right to object

• Right to avoid automated decision-making

To exercise any of the rights listed above, you must comply with the obligations set out in Section 12 of this Privacy Notice.

We will provide a response no later than 30 days from the date we receive your request, unless an extension of the deadline is requested.

16. Notice to Argentina Residents

Under the Personal Data Protection Act 25.326, you have the right to access, rectify, update and delete your data. To exercise your rights or the right to withdraw or submit any concerns or complaints about the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com , following the instructions provided in Section 12.

We inform you that there are opportunities to limit how we use or disclose your personal information for specific processing.

From the date we receive your request, we will respond to you no later than 5 days (for requests to delete and update your Personal Data) or no more than 10 days (for a request to access your Personal Data).

17. Notice to Mexico Residents

"Ria México" (as defined below), whose permanent address is intended to listen to and receive notices related to privacy and personal data protection purposes and indicated in Section 22, under the "Ley Federal de Protección de Datos Personales en Posesión de los Particulares" (hereinafter, Mexico Laws), its provisions and guidelines to its users or potential users, as data subjects, presents this Privacy Notice before beginning to collect Personal Data and strictly adheres to the principles of legality, consent, information, quality, purpose, loyalty, proportionality and accountability required by Mexican Laws.

In order to provide services as a money transfer company under Article 81-A of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, "Ria México" will collect Personal Data, if applicable, in accordance with the legal bases indicated in Section 1 and for the following purposes:

1. Verify that the Personal Data provided by "Ria México" in the voting authorization matches the data indicated in the Instituto Nacional Electoral registry.

2. Verify that the CURP data provided by "Ria México" matches the data registered in the Registro Nacional de Población.

Furthermore, when necessary, in order to comply with the General Provisions indicated in Article 95, Sections 4 and 4 of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, applicable to money transfer companies indicated in Article 81-A of the same Law (hereinafter, Provisions), "Ria México" is legally required to obtain information about your geolocation, as well as your voice and facial image recordings, in order to identify its users or potential users when not interacting directly, and obtain other important data, which will be explained in detail in the specific form located in the application, which is required by the Provisions. We will always process such information based on your consent.

You have the right to access, rectify, cancel and object to data processing (hereinafter, ARCO rights); you also have the right to limit or withdraw consent given to process your Personal Data at any time, to the extent permitted by law. To exercise any of your ARCO rights, withdraw consent or submit questions or complaints about the processing of your Personal Data, you can contact us at: dpo@euronetworldwide.com , following the instructions provided in Section 12.

We will provide you with a response no later than 20 days from the date your request is received, and it will take effect no later than 15 business days after we notify you of our response.

18. Notice to Chile Residents

Under the law, you have the right to access, rectify, cancel and object to data processing (hereinafter, ARCO rights); you also have the right to withdraw consent given to process your Personal Data at any time, to the extent permitted by law. To exercise your ARCO rights or the right to withdraw processing of your Personal Data or to raise any concerns or complaints, you can contact us at dpo@euronetworldwide.com , following the instructions provided in Section 12.

We inform you that there are opportunities to limit how we use or disclose your personal information for specific processing.

We will provide you with a response no later than 2 days from the date your request is received.

19. Notice to Malaysia Residents

Under the Personal Data Protection Act 2010 (hereinafter, PDPA), customers may provide us with their Personal Data for any of the purposes indicated in Section 2 of this Privacy Notice. If we process your Personal Data for any additional purpose, we will inform you in advance or request your explicit consent.

At any time, you can exercise the rights established in Section 10. You can also withdraw your consent, unless the processing activity is necessary to fulfill any legal obligation or to provide you with any of our services. You can also object to data processing if you believe such processing activity may harm you or cause inconvenience.

We will provide you with a response no later than 21 days from the date your request is received.

Under the PDPA conditions, RIA has the right to charge a fee for processing any request for access to data.

20. Notice to New Zealand Residents

The rights that all New Zealand residents can exercise regarding Personal Data processing are set out in Section 12. Please note that to exercise any of your rights, you must follow the instructions provided in the aforementioned Section 12.

From the date we receive your inquiry, we will respond to you no later than 20 days.

21. Notice to Australia Residents

The rights that all Australian residents can exercise regarding Personal Data processing are set out in Section 12. Please note that to exercise any of your rights, you must follow the instructions provided in the aforementioned Section 12.

You may also ask us to explain our data policy and practices under applicable law.

We will provide you with a response no later than 30 days from the date your request is received.

22. Notice to India Residents

The rights that all Indian residents can exercise regarding Personal Data processing are set out in Section 12. Please note that to exercise any of your rights, you must follow the instructions provided in the aforementioned Section 12.

Additionally, you can exercise your right to data portability and the right to opt out of automated decisions that produce legal consequences, such as profiling, if such profiling is not necessary to provide you with any of our services.

We will provide you with a response no later than 30 days from the date your request is received.

23. Our Company by Service

The data controller is "Ria", represented by the following companies, depending on the country and service:

Money Transfer Service

RIA stores and currency exchange services

You can always contact our Data Protection Officer by sending an email to: dpo@euronetworldwide.com .