Privacy Notice for Professional Partners

This privacy notice (“ Privacy Notice ”) explains how we process your personal data (“ Personal Data ”) while you browse our website or mobile application (“ Site/App ”) and when you apply for or become a Ria and/or agent. work with us as a professional partner (“ Professional Partner ”).

We encourage you to regularly review this Privacy Statement and check the website/app for updates. Updates to this Privacy Statement will be posted on our website/app, and by continuing to interact with us, you agree to this Privacy Statement and any future changes.

If local law requires that additional information be included in this privacy notice, such information is included below in the Regional Privacy Notices section.

1. What personal data do we collect, how do we collect it and why?

The categories, sources and reasons for collecting Personal Data are set out below. Where the collection of Personal Data is based on your consent, you may withdraw your consent at any time. RIA does not “sell” or “share” Personal Data, as those terms are defined in applicable law. We retain Personal Data for as long as is reasonably necessary to provide the Services and comply with our legal obligations.

If you have any questions or concerns about the processing of your personal data, you can contact us at any time by email at dpo@euronetworldwide.com

Identifiers or identification data

The personal data we collect from you may include name, email number, telephone and/or fax number, residential and/or business address and other contact information (“Contact Information”), title, date of birth, gender, images, videos or signature.

If necessary, Identification Data is used only for the purposes described.

Contractual obligations

Financial information and professional or work-related information

We collect your personal financial data when you register to use our Services. We collect financial data, such as bank account information, financial statements, reason for transfer, occupation (professional or employment-related information), or other documents to show the source of the funds you wish to transfer (similar to pay stubs) in order to provide you with our Services.

Behavioral and technical information

IP address, internet or other similar network, browsing or search activities, behavioral information (to understand how you behave when using our products and services), browser type and version, time zone setting, screen resolution settings, browser plug-in types and versions, operating system and platform.

See our cookie policy

Audio and video surveillance

Image, video and audio/voice recording.

The personal data collected from you may vary depending on the country in which our Services are offered. Not all of the data categories described above may apply to you. If you have any questions about the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com

Non-identifiable data

Whenever possible, we use data that does not directly identify you (such as anonymous demographic and usage data) rather than personal data (“non-identifiable data”). This non-identifiable data may be used to improve our internal processes or service delivery, without further notice to you.

We may use the collected data for various purposes, including to analyze, evaluate, and improve our Services.

Device features

When you use the app, we may need to access certain additional information and features on your device, such as your contact list. We will ask for your permission before accessing such information. Any data collected through these device features will be stored only on your device, never on our servers or anywhere else.

2. Accuracy of personal data

We are committed to ensuring that your Personal Data is accurate and up-to-date. We take reasonable steps to ensure the accuracy of your Personal Data by ensuring that the most recent Personal Data we receive is accurately recorded, and we conduct periodic reviews and request updates to your Personal Data when we deem it necessary. From time to time, we may send you an email asking you to confirm and/or update your Personal Data. This communication is based on our legitimate interests and legal obligation to maintain accurate and up-to-date information.

If you notice that your personal data is inaccurate, you can request corrections or update your information by sending an email to dpo@euronetworldwide.com .

3. Legitimate interests

When we use your personal data to pursue our legitimate interests, we will do our best to align our interests with yours so that your personal data is only used in accordance with applicable law or where it will not adversely affect your rights. Upon request, customers can request information about any processing based on legitimate interests.

4. How long does Ria store Personal Data?

Personal data is retained for as long as necessary to provide the requested Services and to comply with applicable legal, accounting or reporting obligations. The retention period is determined based on applicable requirements and obligations, which may include:

• Legal and Regulatory Requirements : Your Personal Data is retained for as long as necessary to comply with all of our legal obligations, including without limitation commercial, tax and anti-money laundering laws and regulations. While we retain your Personal Data only to comply with our legal obligations, your Personal Data will be restricted so that it cannot be used for other purposes. While it is restricted, your Personal Data will only be accessed on a need-to-know basis. Whenever we receive a request for erasure, we will also retain your Personal Data in accordance with our legal obligations.

• Customer service and contractual relationships (customer relationship administration, complaint handling, etc.) : We will retain your personal data for as long as you remain our customer. Once we consider that our contractual relationship has ended, we will continue to restrict your data to only be available for the purposes of fulfilling the legal obligations outlined above.

• Marketing : We will process your personal data for marketing purposes until you ask us to opt out, in accordance with Section 11 of this Privacy Notice, or until we learn that you are no longer interested or your data is inaccurate.

5. Does Ria share my personal data with third parties?

Euronet Group

Third-party service providers*

*The legal meaning and list of third-party service providers may vary depending on the country you are located in. For more information about which service providers have access to your personal data and why they have access to it, you can contact us at dpo@euronetworldwide.com .

Legal and regulatory authorities

Strategic partners

Professional partners

6. Minors

We do not provide the Services directly to children under the age of 18 and do not actively collect their personal information. If you are under the age of 18, please do not use the Site/App or the Offerings or share any personal information with us. If you become aware that someone under the age of 18 has unlawfully provided us with personal information, please contact us at dpo@euronetworldwide.com .

7. Data security

We are committed to protecting your personal data and have implemented commercially reasonable and appropriate safeguards to prevent any loss, misuse and alteration of the information entrusted to us. At RIA, we will always strive to ensure that your personal data is properly protected in accordance with international best practices. We maintain this commitment to data security by implementing appropriate physical, electronic and managerial measures to safeguard and protect your personal information.

To protect our systems from unauthorized access, we use secure, advanced physical and organizational security measures that are constantly improved to ensure the highest level of security in accordance with international best practices and cost-effectiveness. All Personal Data is stored in a secure location protected by firewalls and other sophisticated security mechanisms with limited administrative access.

Personnel who have access to your personal data, as well as processing activities related to your personal data, are contractually obligated to maintain the privacy of your data and to comply with the Privacy Policy implemented within our organization.

We aim to achieve the highest standard of data protection by adopting industry standard measures to protect your privacy.

8. Marketing and advertising

Third-party advertisers serve ads that appear on our website, in our app, or elsewhere on our services. Third-party advertisers do not have access to information that our customers have provided to us directly. Typically, advertisers rely on cookies or some other web/app mechanism to assess which ads you may be interested in. We do not place “Targeting Cookies” and do not enable “Targeting” and “Location” on your system without your consent.

If you have given your consent by accepting Targeting Cookies on the website or enabling Targeting in the app, we may use third parties to do this (remarketing and similar audience features). You can opt out of advertising by changing your cookie settings here .

Third parties are not bound by our privacy notice. To understand their privacy notices, you should visit the third party's website. You can find all third parties that may use cookies for targeting in our cookie policy .

We may contact you from time to time (by email, text message, letter or telephone, as appropriate and in accordance with your specific instructions) and where you have given us your consent to provide targeted marketing about our services and/or our products.

Why would you receive electronic communications?

Depending on the country you are located in, you will receive marketing communications if you have authorized us to process your personal data for these purposes. This means that you have logged in during the registration process or at any time in your profile settings.

We may also send you electronic communications for marketing purposes if you have a contractual relationship with us, namely when you are currently using our Services or if you have not expressly requested not to receive said marketing communications.

You will always be informed and we will make sure that you have all the necessary information during the use of our Services or even during the registration process so that you know that your Personal Data may be used for this specific purpose and you will be given the opportunity to clearly state during the registration process or use of our Services that you are not interested in receiving such marketing communications. In such cases, we will remove you from our list and you will not receive any updates that may be of interest to you about our services and products. You can come back at any time.

How can you refuse?

You may withdraw your consent at any time using one of the following mechanisms:

• Go to your profile and update your marketing preferences.

• Use the unsubscribe link you will receive in any communication from us.

• By sending an email to dpo@euronetworldwide.com .

If you have any further questions about the use of your Personal Data for marketing purposes and/or would like to start receiving marketing communications, you can also send an email to dpo@euronetworldwide.com .

9. Description of personal data rights

Depending on where you live, your personal data rights under applicable law may include:

1. Right to know : the right to know what Personal Data is being collected, sold or shared and to whom.

2. Right of access : the right to request access to a copy of your personal data.

3. Right to rectification of inaccuracies : the right to request the rectification of inaccuracies in your personal data.

4. Right to erasure : the right to request the erasure of your personal data, if certain conditions apply.

5. Right of withdrawal :

   1. The right to object to the processing of Personal Data for targeted advertising purposes.

   2. The right to object to the processing of Sensitive Personal Data.

   3. The right to object to the processing of personal data for profiling purposes in order to facilitate decisions that have legal or similarly significant effects concerning the Data Subject.

6. The right to limit the use and disclosure of sensitive personal data to specifically authorized purposes.

7. Right to restrict processing : the right to restrict processing if certain conditions apply.

8. Right to data portability : the right to receive Personal Data in a structured, commonly used and machine-readable format and the right to transmit Personal Data to another controller under certain circumstances.

9. Right to object : the right to object to the processing of Personal Data (i.e. for direct marketing purposes).

10. Rights relating to automated individual decision-making : the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on the individual.

11. Rights without retaliation : A company may not discriminate against an individual for exercising their personal data rights.

We will respond to your request as quickly as possible and within the time limit set by applicable law.

For information on applicable rights, please see the Regional Privacy Notice below. To exercise any of your rights, you should send an email to dpo@euronetworldwide.com . To help protect your privacy and maintain security, we will take reasonable steps to verify your identity and may ask you to provide other information before granting you access to your Personal Data or making any changes to any Personal Data. If we do not have a copy of your identification document or a legally valid document that proves your identity, we will not be able to respond to your request.

Please note that when providing you with the Service, some rights may not be enforceable due to business needs or legal obligations. Your rights may be limited to comply with other legal obligations, such as anti-money laundering, contractual and compliance obligations. Notwithstanding the above, you will always be entitled to a refund if you exercise any of the rights set out above and/or any additional rights you may have depending on your jurisdiction. If your rights cannot be enforced, you will always receive an appropriate explanation.

10. Privacy complaints procedure

Data subjects have the right to lodge a complaint with a data protection authority or court if they consider that we have not complied with our obligations under this privacy notice or applicable law:

• Europe (EEA): Member States | European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Department of Personal Data Protection

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice Privacy Division

• USA: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

• Chile: Consejo para la Transparency

Ria reserves the right to amend this Privacy Statement at any time and will post notices of such REGIONAL PRIVACY NOTICES

11. Notice to United States Consumers

This notice is provided to United States consumers and customers (including former customers) to comply with the requirements of the federal Gramm-Leach-Bliley Act ("GLBA"), as applicable, which relates to the collection, disclosure, and protection of "nonpublic personal information" ("NPI") as defined in the GLBA. For the purposes of this notice, NPI means personally identifiable information about an individual that an RIA collects as a financial institution under the GLBA in connection with an RIA providing a financial product or service, unless the information is lawfully made public. NPI collected by an RIA may include any of the following:

• information that an individual provides to an RIA in order to obtain a financial product or service.

• information that the RIA obtains about an individual from a transaction involving the RIA's financial products or services (i.e. the fact that the individual is a client/consumer of the RIA, account numbers, etc.); or

The non-profit categories that may be collected by RIA are listed in Section 1 of this Privacy Statement.

The categories of non-profits that RIA may disclose are set forth in Section 9 of this Privacy Statement.

Categories of Affiliates and Unaffiliated Third Parties to Which NPI Is or May Be Disclosed in This Privacy Statement. If RIA discloses NPI to unaffiliated third parties under the GLBA exceptions, all such information is provided in accordance with the law. An “unaffiliated third party” is any person other than an affiliate of a financial institution or a person employed jointly by a financial institution and a business that is not an affiliate of the institution.

The categories of information that are disclosed and to which the joint marketing/service provider's privacy terms are exempt are set forth in this Privacy Notice.

If NPI may be disclosed to unrelated third parties and that disclosure does not fall under any of the exceptions to the privacy provision under the GLBA, consumers and customers have the right to opt out of the disclosure of that information, and an opt-out mechanism will be provided to the consumer or customer.

Notice of the exchange of RIA information between Euronet Group and its affiliates is provided in Section 9 of this Privacy Notice in accordance with the Fair Credit Reporting Act.

RIA's policies and practices regarding protecting the confidentiality and security of NPI are set forth in this Privacy Statement.

California consumers

Under the California Consumer Privacy Act, California residents have the following rights:

• 1 (Right to know)

• 2 (access rights)

• 3 (Right to correct inaccuracies)

• 4 (Right to erasure)

• 5. (Right to opt out of the sale or sharing of personal data for the purpose of cross-contextual behavioral advertising)

• 6 (Right to limit the use and disclosure of sensitive personal data to specifically permitted purposes)

• 11 (Rights without retaliation after waiver or exercise of other rights)

12. Notice to European (EEA) residents

In accordance with the General Data Protection Regulation (GDPR) and in addition to the rights set out in Section 15, all residents of the European Economic Area (EEA) may exercise the following rights:

• 2 (access rights)

• 3 (Right to correct inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restrict processing)

• 8 (right to data portability)

• 9 (Right to object)

• 10 (Rights related to automated individual decision-making)

To exercise any of the above rights, you must comply with the obligations set out in Section 15 of this Privacy Notice.

From the date we receive your request, we will respond to you within a maximum of 30 days, unless an extension is requested.

When processing your personal data, we must share your personal data in accordance with the following:

13. Notice to residents of the United Kingdom

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all UK residents have the following rights:

• 1 (access rights)

• 3 (Right to correct inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restrict processing)

• 8 (right to data portability)

• 9 (Right to object)

• 10 (Rights related to automated individual decision-making)

To exercise any of the above rights, you must comply with the obligations set out in Section 15 of this Privacy Notice.

14. Notice to the people of Argentina

In accordance with the Ley de Protección de Datos Personales 25.326, you have the following rights, as defined in section 15 above:

• 2 (access rights)

• 3 (Right to correct inaccuracies)

• 4 (Right to erasure)

To exercise your rights or the right to withdraw or to raise any concerns or complaints regarding the processing of your personal data, you can contact us by email at dpo@euronetworldwide.com , following the instructions provided in Section 15.

You are hereby informed that you have options available to limit the way we use or disclose your personal information for a particular treatment.

From the date we receive your request, we will respond to you within a maximum of 5 days (for requests related to the deletion and updating of your personal data) or within a maximum of 10 days (for requests related to access to your personal data).

15. Notice to the people of Mexico

Ria México, whose domicile is to hear and receive communications for the purposes of privacy and personal data protection indicated in Section 27, and in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares ("Mexican Law"), its regulations, and the Guidelines, makes available to its users or potential users as data subjects this Privacy Notice prior to the collection of Personal Data, in strict compliance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality and accountability established by Mexican law.

In order to provide services as a money transmitter in accordance with article 81-A Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, Ria México will collect personal data, where applicable, in accordance with the legal bases referred to in section 1 and in relation to the following purposes:

• Check that the personal data contained in the voting authorization submitted by Ria México matches the data in the Instituto Nacional Electoral registry.

• Check that the CURP data provided by Ria México matches the data registered in the Registro Nacional de Población.

Furthermore, and where necessary, in order to comply with articles 4 and 4a of the General Regulations referred to in article 95a of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, which apply to money transmitters referred to in article 81-A Bis. under the same law (the “Regulations”), Ria México is legally obliged to obtain information about your geographical location, as well as recordings of your voice and facial image, in order to identify its users or potential users in absentia, and to obtain other essential data that will be explained in detail in the specific form available in the application provided for in the Regulations. We will always process such information based on your consent.

You have the following rights ("ARCO Rights"):

• 2 (access rights)

• 3 (Right to correct inaccuracies)

• 4 (Right to erasure)

• 9 (Right to object)

You also have the right to restrict or withdraw your consent to the processing of your Personal Data at any time, to the extent permitted by law. To exercise any of your ARCO rights, withdraw your consent or raise any questions or complaints about the processing of your Personal Data, you can contact us by email at: dpo@euronetworldwide.com , following the instructions in Section 15.

We will respond to you no later than 20 days from the date of receipt of your request, and it will take effect no later than 15 business days after we have informed you of our response.

16. Notice to the people of Chile

Under the law, you have the following rights ("ARCO rights"):

• 2 (access rights)

• 3 (Right to correct inaccuracies)

• 4 (Right to erasure)

• 9 (Right to object)

You also have the right to withdraw your consent to the processing of your Personal Data at any time, to the extent permitted by Law. To exercise your ARCO rights or the right to withdraw or to raise any question or complaint regarding the processing of your Personal Data, you can contact us by email at dpo@euronetworldwide.com , following the instructions provided in Section 15.

You are hereby informed that you have options available to limit the way we use or disclose your Personal Information for certain treatments.

We will respond to you within 2 days of receiving your request.

17. Notice to Malaysians

In accordance with the Personal Data Protection Act 2010 (“PDPA”), customers may provide us with their personal data for any of the purposes set out in Section 1 of this Privacy Notice. If we process your personal data for any additional purpose, we will inform you in advance or seek your explicit consent.

You can exercise your rights under Section 15 at any time. You can also withdraw your consent, unless the processing is necessary to comply with a legal obligation or to provide you with one of our services. You can also object to the processing if you believe that such processing may cause you harm or discomfort.

We will respond to you no later than 21 days from the date we receive your request.

Under the terms of the PDPA, RIAs have the right to charge a fee for processing any data access request.

18. Notice to New Zealanders

For all New Zealand residents, the rights you can exercise in relation to the processing of your personal data are as follows:

• 1 (Right to know)

• 2 (access rights)

• 3 (Right to correct inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restrict processing)

To exercise any of the above rights, you must comply with the obligations set out in Section 15 of this Privacy Notice.

We will respond to you within 20 days of receiving your request.

19. Notice to Australians

For all Australian residents, the rights you can exercise in relation to the processing of your personal data are as follows:

• 1 (Right to know)

• 2 (access rights)

• 3 (Right to correct inaccuracies)

• 4 (Right to erasure)

• 7 (Right to restrict processing)

You can also ask us to explain our data policies and practices in accordance with applicable law.

We will respond to you no later than 30 days from the date we receive your request.

When processing your personal data, we must share your personal data in accordance with the following:

20. Notice to the people of India

For all residents of India, the rights you may exercise in relation to the processing of your personal data are those listed in Section 15. Please note that to exercise your rights, you must follow the instructions provided in Section 15.

You can exercise your right to data portability and the right not to be subject to automated decision-making that produces legal effects, such as profiling, where such profiling is not necessary to provide you with one of our services.

We will respond to you no later than 30 days from the date we receive your request.

21. Our companies after service

The controller is RIA, represented by the following companies depending on the country and service:

Money transfer services

22. Our companies after service

The controller is Ria, represented by the following companies depending on the country and service:

You can always submit a request to our Data Protection Officer by sending an email to the following address: dpo@euronetworldwide.com .

* EEA (European Economic Area) countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.