Privacy Notice for Professional Partners

September 2023

This privacy notice (" Privacy Notice ") explains how we handle your personal data (" Personal Data ") while you browse our website or mobile application (" Website/App ") and when you apply to become or are an agent for Ria and/or engage with us as a professional partner (" professional partner ").

We encourage you to review this privacy notice regularly and check the website/app for any updates. Updates to this privacy notice will be posted on our website/app, and by continuing to work with us you accept this privacy notice and any future changes.

Where local law requires additional details to be included in this privacy notice, such information is included in the Regional Privacy Notices section below.

1. What personal data do we collect, how do we collect it and why?

The categories, sources and reasons for collecting personal data are listed below. Where the collection of personal data is based on your consent, you may withdraw your consent at any time. Ria neither "sells" nor "shares" personal data, as these terms are defined under applicable laws. We retain personal data for as long as reasonably necessary to deliver the services and fulfill our legal obligations.

If you have questions or concerns about how we handle your personal data, you can contact us at any time at dpo@euronetworldwide.com

Identifiers or identification data

The personal data we collect from you may include name, email, phone and/or fax numbers, home and/or business address and other contact information ("contact details"), title, date of birth, gender, images, videos or signature.

Where necessary, identification data is used only for the described purposes.

Contractual obligation

Financial details and professional or employment-related information

We collect your personal financial data when you register to use our services. We collect financial data such as bank account information, accounting records, reason for transfer, occupation (professional or employment-related information) or other documentation to show the source of funds you wish to transfer (similar to pay stubs), in order to provide you with our services.

Behavioral and technical information

IP address, internet or other similar network, browsing or search activity, behavioral information (to understand how you behave while using our products and services), web browser type and version, time zone setting, screen resolution settings, browser plugin types and versions, operating system and platform.

See our cookie policy

Audio and video monitoring

Image, video and audio/voice recordings.

The personal data we collect from you may vary depending on the country in which our services are offered. Not all data categories described above may apply to you. If you have questions about how we handle your personal data, you can contact us at dpo@euronetworldwide.com

Non-identifiable data

Where possible, we use data where you cannot be directly identified (such as anonymous demographic data and usage data) instead of personal data ("non-identifiable data"). This non-identifiable data may be used to improve our internal processes or service delivery, without further notice to you.

We may use aggregated data for a variety of purposes, including to analyze, evaluate and improve our services.

Device features

When you use the app, we may need access to certain additional information and features on your device, such as your contact list. Before we access such information, we will ask for your permission. Any data collected using these device features will be stored only on your device, never on our server or elsewhere.

2. Accuracy of personal data

We are committed to keeping your personal data accurate and up to date. We take reasonable steps to ensure the accuracy of your personal data by ensuring that the latest personal data we have received is accurately recorded, and when deemed necessary, we perform periodic checks and ask you to update your personal data. From time to time, we may send you an email asking you to confirm and/or update your personal data. This communication is based on our legitimate interest and legal obligation to maintain accurate and current information.

If you discover that your personal data is not accurate, you can request a correction or update your information by emailing dpo@euronetworldwide.com .

3. Legitimate interest

When we use your personal data to pursue our legitimate interests, we will do our best to align our interests with yours so that your personal data will only be used as permitted under relevant law, or when it will not negatively affect your rights. Upon request, customers can ask for information about any processing based on legitimate interest.

4. How long does Ria retain personal data?

Personal data is retained for as long as necessary to deliver the requested services and to comply with applicable legal, accounting or reporting obligations. The retention period is determined based on applicable requirements and obligations, which may include:

• Legal and regulatory requirements : Your personal data is retained for as long as necessary to comply with all our legal obligations, including, without limitation, commercial, tax and anti-money laundering laws and regulations. While we store your personal data only to comply with legal obligations, your personal data will be restricted so that it cannot be used for other purposes. While restricted, you will only have access to your personal data when necessary. Each time we receive a deletion request, we will also retain your personal data in accordance with our legal obligations.

• Customer service and contractual relationships (administration of customer relationships, complaint handling, etc.) : We retain your personal data for as long as you remain our customer. When we consider our contractual relationship to be over, we will continue to restrict your data to make it available only to comply with legal obligations as stated above.

• Marketing : We will process your personal data for marketing purposes for as long as you have not asked us to opt out, in accordance with section 11 of this privacy notice or until we become aware that you are no longer interested or that your data is not correct.

5. Does Ria share my personal data with third parties?

Euronet Group

Third-party service providers*

*The legal meaning and list of "third-party service providers" may vary depending on the country you are based in. For further information about which vendors have access and why they have access to your personal data, you can contact us at dpo@euronetworldwide.com .

Legal and regulatory authorities

Strategic partners

Professional partners

6. Minors

We do not offer services directly to children under 18 years of age or proactively collect personal information. If you are under 18 years of age, please do not use the website/app or offers or share personal data with us. If you discover that someone younger than 18 years of age has unlawfully provided us with personal data, please contact us at dpo@euronetworldwide.com .

7. Data security

We are committed to protecting your personal data and have in place commercially reasonable and appropriate security measures to prevent loss, misuse and alteration of the information you have entrusted to us. At Ria, we will always strive to ensure that your personal data is well protected, in accordance with international best practices. We maintain this commitment to data security by implementing appropriate physical, electronic and administrative measures to protect and secure your personal information.

To protect our systems against unauthorized access, we use secure, cutting-edge physical and organizational security measures that are continuously improved to ensure the highest level of security in accordance with international best practices and cost-effectiveness. All personal data is stored in a secure location protected by firewalls and other sophisticated security mechanisms with limited administrative access.

Personnel who have access to your personal data as well as processing activities around your personal data are contractually obligated to keep your data private and comply with the privacy rules we have implemented in our organization.

We aim to achieve the highest standard of data protection by adopting industry-standard measures to protect your privacy.

8. Marketing and advertising

Third-party advertisers provide ads displayed on our website, app or elsewhere in our services. Third-party advertisers do not have access to any information our customers have provided to us directly. Typically, advertisers rely on cookies or another web/app-based mechanism to assess which ads may be of interest to you. We do not place "Targeting cookies" or enable "Targeting" and "Placement" on your system without your consent.

If you have given your consent by accepting targeting cookies on the website or enabled targeting on the app, we may use third parties to do this (remarketing and similar targeting features). You can opt out of advertising by changing your cookie settings here .

Third parties are not bound by our privacy notice. To understand the privacy policies of their notices, you should visit the third-party website. You can find all third parties that may use cookies for targeting in our cookie policy .

We may contact you from time to time (via email, SMS, letter or phone as needed and in accordance with your specific instructions) and when you have given us your consent to provide targeted marketing about our services and/or our products.

Why will you receive electronic communications?

Depending on the country you are based in, you will receive marketing communications if you have given us permission to process your personal data for these purposes. This means you have registered during the registration process or at any time in the settings section of your profile.

We may also send you electronic communications for marketing purposes when you have a contractual obligation with us, that is, when you are currently using our services or when you have not explicitly asked us not to receive such marketing communications.

You will always be informed, and we will ensure that during your use of our services or even during the registration process you have all the necessary information so that you are aware that your personal data may be used for the specific purpose, and you will, during the registration process or during the use of our services, have the opportunity to explicitly state that you are not interested in receiving such marketing communications. In these cases, we will remove you from our list, and you will not receive any updates that may be of interest to our services and products. You will be able to opt in at any time.

How can you opt out?

You will be able to withdraw your consent at any time by using one of the following mechanisms:

• Go to your profile and update your marketing preferences.

• Use the unsubscribe link you will receive in any of our communications.

• By sending an email to dpo@euronetworldwide.com .

If you have further questions about the use of your personal data for marketing purposes and/or wish to start receiving marketing communications, you can also email dpo@euronetworldwide.com .

9. Description of personal data rights

Depending on where you live, your personal data rights under applicable law may include:

1. Right to know : The right to know what personal data is collected, sold or shared and to whom.

2. Right to access : The right to request access to a copy of your personal data.

3. Right to correct inaccuracies : The right to request correction of inaccuracies in your personal data.

4. Right to deletion : The right to request deletion of your personal data where certain conditions apply.

5. Opt-out rights :

   1. The right to opt out of processing of personal data for targeted advertising.

   2. The right to opt out of processing of sensitive personal data.

   3. The right to opt out of processing of personal data for profiling to promote decisions that have legal or similarly significant effects for the individual.

6. The right to restrict the use and disclosure of sensitive personal data to specifically permitted purposes.

7. Right to restrict processing : The right to restrict processing where certain conditions apply.

8. Right to data portability : The right to receive personal data in a structured, commonly used and machine-readable format and has the right to transfer the personal data to another controller under certain conditions.

9. Right to object : The right to object to the processing of personal data (i.e. for direct marketing purposes).

10. Rights related to automated individual decision-making : The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects for the individual.

11. Right to non-retaliation : a business shall not discriminate against an individual for exercising their personal data rights.

We will respond to your request as soon as possible and within the timeframe specified in applicable law.

For applicable rights, see the Regional Privacy Notice section below. To exercise any of your rights, you must email dpo@euronetworldwide.com . To help protect your privacy and maintain security, we will take necessary steps to verify your identity and may ask you to provide other details before we give you access to your personal data or initiate a change to your personal data. Where required, if we do not have a copy of your ID or a legally valid document proving your identity, we will not be able to respond to your request.

Please note that some rights may not be enforceable due to business necessities or legal obligations while providing you with the service. Your rights may be limited to comply with other legal obligations such as anti-money laundering, contractual and compliance obligations. However, you will always be answered when you exercise any of the rights mentioned above and/or any additional rights you may have depending on your jurisdiction. If your right cannot be enforced, you will always receive a proper explanation.

10. Privacy complaint procedure

Individuals have the right to lodge a complaint with a data protection authority or courts if they believe we have not complied with our obligations under this privacy notice or applicable law:

• Europe (EEA): Members |European Data Protection Board (europa.eu)

• United Kingdom: Information Commissioner Officer (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Institute of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Personal Data Protection Institute

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice Privacy Unit

• USA: FTC

• Canada: Office of Privacy Commissioner of Canada

• Mexico: National Institute of Transparency, Access to Information and Protection of Personal Data

• Chile: Council for Transparency

Ria reserves the right to change this privacy notice at any time and will provide notice of such REGIONAL PRIVACY NOTICES

11. Notice to U.S. Consumers

This notice is provided to U.S. consumers and customers (including former customers) to comply with the requirements of the federal Gramm-Leach-Bliley Act ("GLBA"), where applicable, related to the collection, disclosure, and protection of "nonpublic personal information" ("NPI") as defined by the GLBA. For purposes of this notice, NPI means personally identifiable information about an individual that is collected by RIA as a financial institution under the GLBA in connection with RIA providing a financial product or financial service, unless the information is lawfully made publicly available. NPI collected by RIA may include any of the following:

• information an individual provides to RIA to obtain a financial product or financial service.

• information RIA obtains about an individual from a transaction involving RIA's financial products or services (i.e., the fact that the individual is a customer/consumer of RIA, account numbers, etc.); or

The categories of NPI that may be collected by RIA are listed in Section 1 of this privacy notice.

The categories of NPI that may be disclosed by RIA are listed in Section 9 of this privacy notice.

The categories of affiliates and nonaffiliated third parties to whom NPI is disclosed or may be disclosed in this privacy notice. Where RIA discloses NPI to nonaffiliated third parties pursuant to exceptions under the GLBA, all such disclosures are made as permitted by law. A "nonaffiliated third party" is any person other than a financial institution's affiliate or a person employed jointly by a financial institution and a company that is not the institution's affiliate.

The categories of information disclosed and to whom under joint marketing/service provider exceptions to the privacy rule are listed in this privacy notice.

If NPI may be disclosed to nonaffiliated third parties, and that disclosure does not fall within any of the exceptions in the privacy rules under the GLBA, consumers and customers have the right to opt out of these disclosures, and an opt-out mechanism will be provided to the consumer or customer.

Notice of RIA's information sharing among Euronet Group and its affiliates is provided in Section 9 of this privacy notice in compliance with the Fair Credit Reporting Act.

RIA's policies and practices with respect to protecting the confidentiality and security of NPI are set forth in this privacy notice.

California Consumers

In accordance with the California Consumer Privacy Act, California residents may exercise the following rights:

• 1 (right to know)

• 2 (right to access)

• 3 (Right to correct inaccuracies)

• 4 (Right to deletion)

• 5 (Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising purposes)

• 6 (Right to limit use and disclosure of sensitive personal information to specific permitted purposes)

• 11 (Right to non-retaliation for opting out or exercising other rights)

12. Notice to Residents of Europe (EEA).

In accordance with the General Data Protection Regulation (GDPR) and in addition to the rights in Section 15 above, all residents of the European Economic Area (EEA) may exercise the following rights:

• 2 (right to access)

• 3 (Right to correct inaccuracies)

• 4 (Right to deletion)

• 7 (Right to restrict processing)

• 8 (right to data portability)

• 9 (Right to object)

• 10 (Rights related to automated individual decision-making)

To exercise any of the rights listed above, you must comply with the obligations set out in Section 15 of this privacy notice.

From the day we receive your request, we will respond to you within a maximum of 30 days, unless an extension is requested.

While we process your personal data, we must share your personal data in accordance with the following:

13. Notice to Residents of the United Kingdom

In accordance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, all residents of the United Kingdom may exercise the following rights:

• 1 (right to access)

• 3 (Right to correct inaccuracies)

• 4 (Right to deletion)

• 7 (Right to restrict processing)

• 8 (right to data portability)

• 9 (Right to object)

• 10 (Rights related to automated individual decision-making)

To exercise any of the rights listed above, you must comply with the obligations set out in Section 15 of this privacy notice.

14. Notice to Argentine Residents

In accordance with the Law on Protection of Personal Data 25.326, you have the following rights, as defined in Section 15 above:

• 2 (right to access)

• 3 (Right to correct inaccuracies)

• 4 (Right to deletion)

To exercise your rights or your right to withdraw or lodge any doubt or complaint regarding the processing of your personal data, you can contact us at dpo@euronetworldwide.com by following the instructions in Section 15.

You are hereby informed that there are available options for you to limit the way we use or disclose your personal data for specific processing.

From the day we receive your request, we will respond to you within a maximum of 5 days (for requests related to deletion and updating of your personal data) or within a maximum of 10 days (for requests related to access to your personal data).

15. Notice to Mexican Residents

Ria México, with address for hearing and receiving notices for privacy and personal data purposes stated in Section 27, and in accordance with the Federal Law for the Protection of Personal Data in the Possession of Individuals ("the Mexican Law"), its regulations, and guidelines, makes available to its users or potential users in their capacity as data subjects, this privacy notice, prior to the collection of personal data, in strict compliance with the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability required by the Mexican Law.

For the purpose of providing services in the capacity of money transmitter in accordance with Article 81-A Bis of the General Law of Credit Organizations and Auxiliary Activities, Ria México will collect personal data, if applicable, in accordance with the legal basis mentioned in Section 1, and in connection with the following purposes:

• Verify that the personal data in the voting legitimation sent to Ria México matches those found in the registry of the National Electoral Institute.

• Verify that the CURP data provided to Ria México matches the data registered in the National Population Registry.

Additionally, and when necessary, to comply with Articles 4 and 4 Bis of the general provisions mentioned in Article 95 bis of the General Law of Credit Organizations and Auxiliary Activities applicable to money transmitters mentioned in Article 81-A Bis of the same law ("the Provisions"), Ria México is legally required to obtain information about your geolocation as well as recording of your voice and facial image to identify users or potential users in a non-face-to-face manner, and to obtain other relevant data that will be explained in detail in the specific form available in the application as required by the Provisions. We will always process such information based on your consent.

You have the following rights ("ARCO Rights"):

• 2 (right to access)

• 3 (Right to correct inaccuracies)

• 4 (Right to deletion)

• 9 (Right to object)

Similarly, you also have the right to limit or withdraw at any time the consent given for the processing of your personal data, to the extent permitted by law. To exercise any of your ARCO Rights, to withdraw your consent, or to submit inquiries or complaints about the processing of your personal data, you can contact us at: dpo@euronetworldwide.com by following the instructions in Section 15.

We will respond to you no later than 20 days from the date we receive your request, and it will take effect no later than 15 business days after we have notified you of our response.

16. Notice to Chilean Residents

In accordance with the law, you have the following rights ("ARCO Rights"):

• 2 (right to access)

• 3 (Right to correct inaccuracies)

• 4 (Right to deletion)

• 9 (Right to object)

Similarly, you have the right at any time to withdraw the consent given for the processing of your personal data to the extent the law permits. To exercise your ARCO Rights or your right to withdraw or lodge questions or complaints regarding the processing of your personal data, you can contact us at dpo@euronetworldwide.com by following the instructions in Section 15.

You are hereby informed that there are available options for you to limit the way we use or disclose your personal information for specific processing.

From the day we receive your request, we will respond to you within a maximum of 2 days.

17. Notice to Malaysian Residents

In accordance with the Personal Data Protection Act 2010 ("PDPA"), customers may provide us with their personal data for all purposes stated in Section 1 of this privacy notice. If we were to process your personal data for an additional purpose, we will inform you in advance or request your explicit consent.

You may at any time exercise the rights stated in Section 15. You may also withdraw your consent unless the processing activity is necessary to fulfill any legal obligation or to provide you with any of our services. You may also object to processing if you believe that such processing activity may cause harm or inconvenience to yourself.

From the day we receive your request, we will respond to you within a maximum of 21 days.

In accordance with the terms of the PDPA, RIA has the right to charge a fee for processing any request for data access.

18. Notice to New Zealand Residents

For all residents of New Zealand, the rights you may exercise regarding the processing of your personal data are as follows:

• 1 (right to know)

• 2 (right to access)

• 3 (Right to correct inaccuracies)

• 4 (Right to deletion)

• 7 (Right to restrict processing)

To exercise any of the rights listed above, you must comply with the obligations set out in Section 15 of this privacy notice.

From the day we receive your request, we will respond to you within a maximum of 20 days.

19. Notice to Australian Residents

For all residents of Australia, the rights you may exercise regarding the processing of your personal data are as follows:

• 1 (right to know)

• 2 (right to access)

• 3 (Right to correct inaccuracies)

• 4 (Right to deletion)

• 7 (Right to restrict processing)

You may also ask us to explain our data policies and practices in accordance with applicable law.

From the day we receive your request, we will respond to you within a maximum of 30 days.

While we process your personal data, we must share your personal data in accordance with the following:

20. Notice to Indian Residents

For all residents of India, the rights you may exercise regarding the processing of your personal data are the rights listed in Section 15. Please note that to be able to exercise any of your rights, you must follow the instructions in Section 15.

You may exercise your right to data portability and the right not to be subject to automated decisions that produce legal effects such as profiling, if such profiling is not necessary to provide you with any of our services.

From the day we receive your request, we will respond to you within a maximum of 30 days.

21. Our Companies by Service

The controller is RIA represented by the companies below, depending on country and service:

Money Transfer Services

22. Our Companies by Service

The controller is Ria represented by the companies below, depending on country and service:

You can always submit a request to our Data Protection Officer by sending an email to the following address: dpo@euronetworldwide.com .

*Countries within the EEA region (European Economic Area): Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.