This privacy notice (“Privacy Notice”) explains how we process your personal data (“Personal Data”) when you browse our website or mobile applications (“Website/App”) and when you apply to become or act as a Ria agent and/or interact with us as a professional partner (“Professional Partner”).

We encourage you to review this Privacy Notice regularly and to check the Website/App for any updates. Updates to this Privacy Notice will be published on our Website/App, and by continuing to deal with us, you accept this Privacy Notice and any future amendments.

Where local law requires additional details to be included in this Privacy Notice, such information has been included in the Regional Privacy Notices section below.

Who are we?

We are RIA, part of the Euronet Group of companies.

You can find all of our contact details here.

What types of Personal Data are collected?

We only collect Personal Data necessary to provide you with the Services and to comply with applicable laws.

Why do we collect Personal Data?

We collect Personal Data for specific contractual and legal purposes.

With your consent, we also collect data for additional purposes.

How long does RIA retain Personal Data?

We retain Personal Data only for as long as necessary or as required by applicable law.

With whom do we share Personal Data?

We share Personal Data with other Euronet Group companies, legal authorities, and partners where necessary to satisfy regulatory requirements or contractual commitments.

Where does RIA store Personal Data?

We store Personal Data in secure locations with strict security measures.

If we need to transfer Personal Data to another location

If we need to transfer Personal Data to another location, we take all necessary steps to comply with legal obligations and ensure the appropriate level of security.

What are your Personal Data rights?

Depending on where you live, you may have rights relating to your Personal Data under applicable laws. A description of common Personal Data rights is set out in Section 15 below. To make a request, you may contact us by email at dpo@euronetworldwide.com or by telephone (local telephone numbers are available here).

Internal Appeal Process

If you receive notice from us that your Personal Data rights request has been denied, you may appeal such denial within a reasonable period after receiving the notice by sending an email to dpo@euronetworldwide.com.

1. What Personal Data do we collect, how do we collect it, and why?

The categories, sources, and reasons for collecting Personal Data are listed below. Where the collection of Personal Data is based on your consent, you may withdraw your consent at any time. RIA does not and will not “sell” or “share” Personal Data, as those terms are defined under applicable law. We retain Personal Data for as long as reasonably necessary to provide the Services and fulfill our legal obligations.

If you have any questions or concerns regarding the processing of your Personal Data, you may contact us at any time at dpo@euronetworldwide.com.

Identifiers or Identification Data

The Personal Data we collect from you may include name, email address, telephone and/or fax number, residential and/or business address, and other contact data (“Contact Details”), title, date of birth, gender, image, video, or signature.

Where necessary, Identification Data is used only for the purposes described.

Financial Details and Professional or Employment-Related Information

We collect your personal financial data when you register to use our Services. We collect financial data such as bank account information, financial statements, reasons for transfers, employment information (professional or employment-related information), or other documentation demonstrating the source of funds you wish to transfer (such as payslips), in order to provide our Services to you.

Behavioral and Technical Information

IP address, internet or similar network activity, browsing or search activity, behavioral information (to understand how you behave when using our products and services), browser type and version, time zone settings, screen resolution settings, browser plug-in types and versions, operating system, and platform.

See our Cookie Policy.

Audio and Video Monitoring

Images, videos, and audio/voice recordings.

The Personal Data collected from you may vary depending on the country where our Services are offered. Not all categories of data described above may apply to you. If you have any questions about the processing of your Personal Data, you may contact us at dpo@euronetworldwide.com.

Non-Identifiable Data

Where possible, we use data that does not directly identify you (such as anonymous demographic and usage data) instead of Personal Data (“non-identifiable data”). Such non-identifiable data may be used to improve our internal processes or service delivery without further notice to you.

We may use aggregated data for various purposes, including analyzing, evaluating, and improving our Services.

Device Features

When using the app, we may require access to additional information and certain device functions, such as your contact list. Before accessing such information, we will request your permission. Any data obtained through these device features will only be stored on your device and never on our servers or elsewhere.

2. Accuracy of Personal Data

We are committed to ensuring that your Personal Data is accurate and up to date. We take reasonable steps to ensure the accuracy of your Personal Data by ensuring that the most recent Personal Data we receive is accurately recorded and, where deemed necessary, we conduct periodic reviews and request that you update your Personal Data. From time to time, we may send you emails requesting that you confirm and/or update your Personal Data. These communications are based on our legitimate interest and legal obligation to maintain accurate and current information.

If you discover that your Personal Data is inaccurate, you may request correction or update your information by sending an email to dpo@euronetworldwide.com.

3. Legitimate Interests

Where we use your Personal Data to pursue our legitimate interests, we will make every effort to align our interests with yours so that your Personal Data will only be used as permitted by applicable law or where it will not adversely affect your rights. Upon request, customers may obtain information regarding any processing based on legitimate interests.

4. How long does Ria retain Personal Data?

Personal Data is retained for as long as necessary to provide the requested Services and to comply with applicable legal, accounting, or reporting obligations. Retention periods are determined based on applicable requirements and obligations, which may include:

Legal and Regulatory Requirements

Your Personal Data is retained for as long as necessary to comply with all our legal obligations, including without limitation commercial, tax, and anti-money laundering laws and regulations. Even where we retain your Personal Data solely for compliance purposes, your Personal Data will be restricted so that it cannot be used for any other purpose. Access to such restricted Personal Data will only occur where necessary. Whenever we receive a deletion request, we will also retain your Personal Data in accordance with our legal obligations.

Customer Service and Contractual Relationship

(Customer relationship administration, complaint handling, etc.): We will retain your Personal Data for as long as you remain our customer. Once we consider our contractual relationship to have ended, we will continue to block your data so that it is available only to comply with legal obligations as described above.

Marketing

We will process your Personal Data for marketing purposes until you request to opt out in accordance with Section 11 of this Privacy Notice or until we determine that you are no longer interested or that your data is inaccurate.

5. Does Ria share my Personal Data with third parties?

Euronet Group

As a result of a sale, acquisition, merger, or reorganization involving Euronet, a company within the Euronet Group, or any of their respective assets, we may transfer customers’ Personal Data to third parties. In doing so, we will take reasonable steps to ensure that such information is adequately protected.

Your Personal Data is also disclosed in order to provide you with customer service whenever you require our assistance. To provide 24/7 customer service access, we must share your Personal Data with Group affiliates.

Third-Party Service Providers*

*The legal meaning and list of “third-party service providers” may vary depending on the country in which you are located. For additional information regarding providers that have access to your Personal Data and the reasons for such access, you may contact us at dpo@euronetworldwide.com.

Legal and Regulatory Authorities

Strategic Partners

Professional Partners

6. Minors

We do not directly provide Services to children under the age of 18 or proactively collect their personal information. If you are under 18 years old, please do not use the Website/App or Offers or share Personal Data with us. If you become aware that anyone under the age of 18 has unlawfully provided us with Personal Data, please contact us at dpo@euronetworldwide.com.

7. Data Security

We are committed to protecting your Personal Data and have implemented reasonable and commercially appropriate safeguards to prevent any loss, misuse, or alteration of the information entrusted to us. At RIA, we will always endeavor to ensure that your Personal Data is well protected in accordance with international best practices. We maintain this commitment to data security by implementing appropriate physical, electronic, and managerial measures to safeguard and secure your personal information.

To protect our systems from unlawful access, we use secure and sophisticated physical and organizational security measures that are continuously enhanced to ensure the highest level of security in accordance with international best practices and cost efficiency. All Personal Data is stored in secure locations protected by firewalls and other advanced security mechanisms with restricted administrative access.

Personnel with access to your Personal Data, as well as processing activities involving your Personal Data, are contractually bound to maintain the confidentiality of your data and comply with the Privacy Policies implemented within our organization.

We aim to achieve the highest standards of data protection by using industry-standard measures to safeguard your privacy.

8. Marketing and Advertising

Third-party advertisers provide advertisements displayed on our website, our App, or elsewhere within our services. Third-party advertisers do not have access to any information directly provided by our customers. Typically, advertisers rely on cookies or other web/app-based mechanisms to assess advertisements that may be of interest to you. We do not place “Targeting Cookies” or enable “Targeting” and “Location” on your systems without your consent.

If you have provided your consent by accepting Targeting Cookies on the Website or enabling Targeting on the App, we may use third parties to do so (remarketing and Similar Audience features). You may opt out of advertising by modifying your cookie settings here.

Third parties are not bound by our Privacy Notice. To understand their privacy policies, you should visit the relevant third-party websites. You may find all third parties that may use Cookies for targeting purposes in our Cookie Policy.

We may contact you from time to time (by email, SMS text message, post, or telephone where necessary and in accordance with your specific instructions) where you have provided your consent for us to deliver targeted marketing regarding our Services and/or products.

Why will you receive electronic communications?

Depending on the country in which you are located, you will receive marketing communications if you have authorized us to process your Personal Data for such purposes. This means that you have opted in during the registration process or at any time within your profile settings.

We may also send you electronic communications for marketing purposes where you have a contractual relationship with us, meaning while you are using our Services or where you have not expressly requested not to receive such marketing communications.

You will always be informed, and we will ensure that during your use of our Services or during the registration process, you are provided with all necessary information so that you understand that your Personal Data may be used for such specific purposes. During registration or use of our Services, you will be given the opportunity to expressly indicate that you are not interested in receiving such marketing communications. In such cases, we will remove you from our lists and you will not receive updates that may be of interest to you regarding our Services and products. You may opt in again at any time.

How can you opt out?

You may withdraw your consent at any time using one of the following mechanisms:

• Go to your profile and update your marketing preferences.

• Use the opt-out link included in any of our communications.

• Send an email to dpo@euronetworldwide.com.

If you have any additional questions regarding the use of your Personal Data for marketing purposes and/or wish to begin receiving marketing communications, you may also send an email to dpo@euronetworldwide.com.

9. Description of Personal Data Rights

Depending on where you reside, your rights under applicable Personal Data laws may include:

• Right to Know: the right to know what Personal Data is being collected, sold, or shared and with whom.

• Right of Access: the right to request access to copies of your Personal Data.

• Right to Correct Inaccuracies: the right to request correction of inaccuracies in your Personal Data.

• Right to Deletion: the right to request deletion of your Personal Data where certain conditions apply.

• Opt-Out Rights:

  • the right to opt out of the processing of Personal Data for targeted advertising purposes;

  • the right to opt out of the processing of Sensitive Personal Data;

  • the right to opt out of the processing of Personal Data for profiling in furtherance of decisions producing legal or similarly significant effects concerning the Data Subject;

  • the right to limit the use and disclosure of sensitive personal data to specifically permitted purposes.

• Right to Restrict Processing: the right to restrict processing where certain conditions apply.

• Right to Data Portability: the right to receive Personal Data in a structured, commonly used, and machine-readable format and to transmit such Personal Data to another controller under certain conditions.

• Right to Object: the right to object to the processing of Personal Data (e.g., for direct marketing purposes).

• Rights Related to Automated Individual Decision-Making: the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning the individual.

• Right to Non-Retaliation: businesses may not discriminate against individuals for exercising their Personal Data rights.

We will respond to your request as soon as possible and within the time periods established under applicable law.

For applicable rights, please refer to the Regional Privacy Notices section below. To exercise any of your rights, you must send an email to dpo@euronetworldwide.com. To help protect your privacy and maintain security, we will take the necessary steps to verify your identity and may request additional details before granting access to your Personal Data or making modifications to any Personal Data. Where required, if we do not have a copy of your identification document or other valid documentation proving your identity, we may be unable to respond to your request.

Please note that certain rights may not be enforceable due to business requirements or legal obligations involved in providing the Services to you. Your rights may be limited in order to comply with other legal obligations, such as anti-money laundering, contractual, and compliance obligations. However, you will always receive a response when exercising any of the rights described above and/or any additional rights you may have depending on your jurisdiction. Where your rights cannot be enforced, you will always receive an appropriate explanation.

10. Privacy Complaint Procedures

Data Subjects have the right to lodge a complaint with a data protection authority or court if they believe that we have failed to comply with our obligations under this Privacy Notice or applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• UK: Information Commissioner’s Office (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Personal Data Protection Department

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice Privacy Unit

• US: FTC

• Canada: Office of the Privacy Commissioner of Canada

• México: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

• Chile: Consejo para la Transparencia

Ria reserves the right to amend this Privacy Notice at any time and will provide notice of such REGIONAL PRIVACY NOTICES.

11. Notice to United States Consumers

This notice is provided to United States consumers and customers (including former customers) to satisfy the requirements of the federal Gramm-Leach-Bliley Act (“GLBA”), where applicable, regarding the collection, disclosure, and protection of “nonpublic personal information” (“NPI”) as defined under the GLBA. For purposes of this Notice, NPI means personally identifiable information about an individual collected by RIA as a financial institution under the GLBA in connection with RIA providing financial products or services, unless such information is otherwise lawfully publicly available. NPI collected by RIA may include any of the following:

• information provided by an individual to RIA in order to obtain financial products or services;

• information that RIA obtains about an individual from transactions involving RIA financial products or services (e.g., the fact that the individual is a RIA customer/user, account number, etc.); or

• categories of NPI that may be collected by RIA as listed in Section 1 of this Privacy Notice.

The categories of NPI that may be disclosed by RIA are listed in Section 9 of this Privacy Notice.

The categories of affiliates and non-affiliated third parties to whom NPI is disclosed or may be disclosed are described in this Privacy Notice. Where RIA discloses NPI to non-affiliated third parties pursuant to exceptions under the GLBA, all such disclosures are made as permitted by law. A “non-affiliated third party” means any person other than an affiliate of a financial institution or a person jointly employed by a financial institution and a company that is not an affiliate of such institution.

The categories of information disclosed and the parties to whom such information is disclosed under the joint marketing/service provider exceptions of the Privacy Rule are listed in this Privacy Notice.

Where NPI may be disclosed to non-affiliated third parties and such disclosure does not fall within any Privacy Rule exception under the GLBA, consumers and customers have the right to opt out of such disclosure, and an opt-out mechanism will be provided.

Notice regarding RIA’s information sharing among the Euronet Group and its affiliates is provided in Section 9 of this Privacy Notice pursuant to the Fair Credit Reporting Act.

RIA’s policies and practices regarding safeguarding the confidentiality and security of NPI are set out in this Privacy Notice.

California Consumers

In accordance with the California Consumer Privacy Act, California residents may exercise the following rights:

1. Right to Know

2. Right of Access

3. Right to Correct Inaccuracies

4. Right to Deletion

5. Right to Opt Out of the Sale or Sharing of Personal Data for Cross-Context Behavioral Advertising

6. Right to Limit the Use and Disclosure of Sensitive Personal Data to Specifically Permitted Purposes

7. Right to Non-Retaliation Following Opt-Out or Exercise of Other Rights

12. Notice to Residents of Europe (EEA)

In accordance with the General Data Protection Regulation (GDPR), and in addition to the rights set out in Section 15 above, all residents of the European Economic Area (EEA) may exercise the following rights:

1. Right of Access

2. Right to Correct Inaccuracies

3. Right to Deletion

4. Right to Restrict Processing

5. Right to Data Portability

6. Right to Object

7. Rights Related to Automated Individual Decision-Making

To exercise any of the rights listed above, you must comply with the obligations established in Section 15 of this Privacy Notice.

From the date we receive your request, we will respond within a maximum of 30 days unless an extension is required.

During the processing of your Personal Data, we may need to share your Personal Data as follows:

13. Notice to Residents of the United Kingdom

In accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all UK residents may exercise the following rights:

1. Right of Access

2. Right to Correct Inaccuracies

3. Right to Deletion

4. Right to Restrict Processing

5. Right to Data Portability

6. Right to Object

7. Rights Related to Automated Individual Decision-Making

To exercise any of the rights listed above, you must comply with the obligations established in Section 15 of this Privacy Notice.

14. Notice to Residents of Argentina

In accordance with Ley de Protección de Datos Personales 25.326, you have the following rights, as defined above in Section 15:

1. Right of Access

2. Right to Correct Inaccuracies

3. Right to Deletion

To exercise your Rights or your right to revoke consent, or to raise any questions or complaints regarding the processing of your Personal Data, you may contact us at dpo@euronetworldwide.com in accordance with the instructions established in Section 15.

You are hereby informed that there are mechanisms available to limit the way we use or disclose your personal information for specific processing activities.

From the date we receive your request, we will respond within a maximum of 5 days (for requests related to deletion and updating of your Personal Data) or within a maximum of 10 days (for requests related to access to your Personal Data).

15. Notice to Residents of Mexico

Ria México, with domicile for hearing and receiving notices for privacy and Personal Data protection purposes as stated in Section 27, and in compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (“Mexican Law”), its Regulations, and Guidelines, provides this Privacy Notice to its users or prospective users in their capacity as data subjects prior to the collection of Personal Data, in compliance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability required by Mexican Law.

For the purpose of providing services in its capacity as a money transmitter under Article 81-A Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, Ria México will collect Personal Data, where applicable, pursuant to the legal bases mentioned in Section 1 and in connection with the following purposes:

• Verify that the Personal Data contained in the voter identification credential submitted to Ria México matches the data contained in the records of the Instituto Nacional Electoral.

• Verify that the CURP data provided to Ria México matches the data registered with the Registro Nacional de Población.

Additionally, and where necessary, in order to comply with Articles 4 and 4 Bis of the General Provisions referred to in Article 95 Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito applicable to money transmitters referred to in Article 81-A Bis of the same law (“Provisions”), Ria México is legally required to obtain information regarding your geolocation, as well as voice recordings and facial image recordings, in order to identify its users or prospective users remotely, and to obtain other related data that will be described in detail in the specific forms available in the applications required by the Provisions. We will always process such information based on your consent.

You have the following rights (“ARCO Rights”):

1. Right of Access

2. Right to Correct Inaccuracies

3. Right to Deletion

4. Right to Object

Likewise, you also have the right to limit or revoke at any time the consent granted for the processing of your Personal Data, to the extent permitted by law. To exercise any of your ARCO Rights, revoke your consent, or submit any questions or complaints regarding the processing of your Personal Data, you may contact us at dpo@euronetworldwide.com in accordance with the instructions set out in Section 15.

We will respond no later than 20 days from the date we receive your request, and such response will take effect no later than 15 business days after we notify you of our response.

16. Notice to Residents of Chile

In accordance with applicable law, you have the following rights (“ARCO Rights”):

1. Right of Access

2. Right to Correct Inaccuracies

3. Right to Deletion

4. Right to Object

Likewise, you have the right to revoke at any time the consent granted for the processing of your Personal Data to the extent permitted by law. To exercise your ARCO Rights, revoke your consent, or submit any questions or complaints regarding the processing of your Personal Data, you may contact us at dpo@euronetworldwide.com in accordance with the instructions established in Section 15.

You are hereby informed that there are mechanisms available to limit the way we use or disclose your Personal Information for specific processing activities.

From the date we receive your request, we will respond within a maximum of 2 days.

17. Notice to Residents of Malaysia

In accordance with the Personal Data Protection Act 2010 (“PDPA”), customers may provide us with their Personal Data for any purpose established in Section 1 of this Privacy Notice. If we process your Personal Data for any additional purpose, we will first inform you or request your explicit consent.

At any time, you may exercise the rights set out in Section 15. You may also withdraw your consent unless the processing activity is required to fulfill a legal obligation or to provide any of our Services to you. You may also object to processing if you believe such processing activity may cause damage or distress to you.

From the date we receive your request, we will respond within a maximum of 21 days.

In accordance with the terms of the PDPA, RIA reserves the right to charge a fee for processing any data access request.

18. Notice to Residents of New Zealand

All residents of New Zealand may exercise the following rights in relation to the processing of their Personal Data:

1. Right to Know

2. Right of Access

3. Right to Correct Inaccuracies

4. Right to Deletion

5. Right to Restrict Processing

To exercise any of the rights listed above, you must comply with the obligations established in Section 15 of this Privacy Notice.

From the date we receive your request, we will respond within a maximum of 20 days.

19. Notice to Residents of Australia

All residents of Australia may exercise the following rights in relation to the processing of their Personal Data:

1. Right to Know

2. Right of Access

3. Right to Correct Inaccuracies

4. Right to Deletion

5. Right to Restrict Processing

You may also request that we explain our data policies and practices in accordance with applicable law.

From the date we receive your request, we will respond within a maximum of 30 days.

During the processing of your Personal Data, we may need to share your Personal Data as follows:

20. Notice to Residents of India

All residents of India may exercise the rights listed in Section 15 in relation to the processing of their Personal Data. Please note that in order to exercise any of your rights, you must follow the instructions established in Section 15.

You may exercise your right to data portability and the right not to be subject to automated decision-making producing legal effects, such as profiling, where such profiling is not required in order to provide any of our Services to you.

From the date we receive your request, we will respond within a maximum of 30 days.

21. Our Companies by Service

The controller is RIA, represented by the companies listed below, depending on the country and service:

Money Transfer Services

22. Our Companies by Service

The controller is Ria, represented by the companies listed below, depending on the country and service:

You may always submit requests to our Data Protection Officer by sending an email to: dpo@euronetworldwide.com.

*Countries within the EEA (European Economic Area): Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.