Ria Money Transfer Privacy Notice

Version 3.2 - April 2025

This Privacy Notice explains how we process your Personal Data when you interact with our services, whether by browsing our website or mobile application, completing transactions, visiting our locations, or interacting with us in any other way. It also details how we may share your Personal Data with third parties and the security measures we have implemented to protect your information.

In this Privacy Notice, references to “we,” “us,” and “our” refer to Ria, a division of Euronet Worldwide. The specific legal entity acting as the Data Controller is detailed in the “Our Companies” section.

We encourage you to review this Privacy Notice periodically for updates, which will be posted on our website/app. Where local laws require additional information, this is provided in the Regional Privacy Notices section.

To contact the Privacy Department or the Data Protection Officer (DPO):

• Email: dpo@riamoneytransfer.com

• Postal address: DPO, Calle Cantabria 2, 2-A Alcobendas Madrid, Spain

You can also contact us by completing our web form or by contacting our Customer Service Team.

If you are an Authority, please contact us at the following address:

• Ria-Compliance@riafinancial.com

Frequently Asked Questions

What personal data do we collect?

We only collect the Personal Data necessary to provide our services and comply with legal obligations. The specific categories of Personal Data collected may vary depending on the service or interaction.

Where do we obtain your personal data from?

We collect personal data primarily from you, when you interact with our company and our services. However, we may collect additional data from other sources to fulfill our obligations.

Why do we collect personal data?

We collect personal data to fulfill our contractual obligations to you and to comply with our legal obligations. We process your personal data to ensure the delivery and security of our services and/or to improve our operations. Whenever we process your Personal Data for additional purposes, we will ensure that we inform you and, where necessary, obtain your consent.

How long do we retain Personal Data?

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including providing services, complying with legal obligations, or exercising or defending legal claims. Once the personal data is no longer needed, we securely delete or anonymize it in accordance with applicable laws.

With whom do we share personal data?

We may share personal data with Euronet Group companies, legal authorities, and selected third parties/partners when necessary to comply with regulatory requirements or fulfill contractual commitments.

Where is personal data stored?

We store personal data in secure facilities with strict security controls. Any international transfer of Personal Data complies with all legal obligations and maintains the highest security standards.

What are your rights regarding Personal Data?

Depending on your location, you may have specific rights regarding your Personal Data under applicable laws. The most common rights are described in the “Your Rights” section.

Notice to Website Visitors

By visiting or using our website, you acknowledge that you have read, understood, and agree to be bound by this Privacy Notice. You should not provide us with any personal information if you do not agree with the terms of this Privacy Notice.

To the extent that this website allows access to other websites owned and operated by third parties, please note that this Privacy Notice will not apply to such websites, and therefore we will not be responsible for the protection of personal data processed by these third parties.

What type of personal data do we collect?

Below are the categories, purposes, and legal bases for the collection and processing of your Personal Data when you visit and/or use our Website. Where the collection and processing of personal data is based on your consent, you may withdraw that consent at any time.

Identification and Contact Data

This may include name, email address, telephone number, address, job title, and other contact information. It may also include data that you voluntarily provide during chats, calls, or written correspondence.

Purposes and Legal Basis for Processing

• Provision of services: To manage your online inquiry through the website form (i.e., registering your inquiry, contacting you, processing and responding to it). This processing is carried out based on our pre-contractual and/or contractual obligations.

• Legal Claims and Archiving: To pursue any legal claims, as well as for archiving purposes related to this purpose, including securing information in case of the need to prove facts, when necessary to protect our legitimate interests.

• Marketing: To provide advertising and marketing, including measuring the impact of our emails, based on your consent.

• Participation in sweepstakes: To manage your participation in events or sweepstakes, based on your consent. • Regulatory compliance: To comply with applicable legislation, regulatory obligations, and decisions of competent authorities. This processing is necessary to fulfill our legal obligations.

Technical and behavioral information

Information collected through cookies or other tracking technologies such as IP address, network activity, browsing behavior, browser type, time zone, screen resolution, plugins, operating system, device signature, and technical characteristics.

For more information, please read our Cookie Policy.

Purposes and legal basis of processing

• Website security and integrity: To ensure the efficient operation, management, and security of our website. Please note that, among other security measures, we use tools to protect our website for fraud prevention and security monitoring purposes. This processing is based on our legitimate interest.

• Website maintenance and improvement: To perform activities to verify or maintain the quality of the website, as well as to improve, update, or optimize it, including website administration for internal operations such as troubleshooting, data analysis, testing, research, statistics, and surveys. This processing is based on our legitimate interest.

• Tracking and usability testing: To track detailed user activity on the website or other platforms (e.g., which buttons are clicked, how much scrolling occurs on pages, etc.). These tools allow us to understand how visitors interact with our content and features, enabling us to test improvements and optimize usability. This tracking is based on cookies and is implemented under our legitimate interest in improving our services and the user experience. Where required by applicable law, we obtain your consent before activating these tracking technologies.

• Personalization: To measure and evaluate your behavior through automated processing and to offer you a more personalized service. This processing is based on your consent.

Location Data

• Service Provision: We may collect information about your location when you visit our website, but not your precise location. This information is processed in accordance with our legal obligations.

• Nearby Locations: We may collect information about your location when you visit our website to show you our nearest locations. This information is based on your consent.

Non-Identifiable Data

Whenever possible, we use data that does not directly identify you (such as anonymous demographic and usage data) instead of Personal Data (“Non-Identifiable Data”). This non-identifiable data may be used to improve our internal processes or service delivery, without further notice. We may use aggregated data for a variety of purposes, including analyzing, evaluating, and improving our website and its content.

Notice to users of money transfer, currency exchange, bill payment, and check cashing services

This Privacy Notice applies to individuals who use Ria's financial services, including:

• Money Transfer: Allows you to send or receive funds.
• Currency Exchange: Provides the ability to exchange one currency for another.
• Bill Payment: Allows you to pay utility bills, phone top-ups, and other recurring obligations.
• Check Cashing: We facilitate the cashing of checks issued in your name.
  

What types of personal data do we collect?

Identification Data

We collect identification data, such as your name, email address, phone number, address, date of birth, gender, images, videos, and signature. We also process socio-demographic data such as age, marital status, family situation, residences, education, and occupation (type of contract, type of occupation, employer), level of education, and professional experience.

Purposes and legal basis for processing:

• Provision of services: To provide our services, in accordance with our contractual obligations.

• Customer Service: To provide customer service, based on our contractual obligations.

• Recording of conversations: We will monitor and record (through automated means or transcripts) our telephone calls, emails, and chat conversations with you, on any platform, to confirm the instructions you provide us. This is based on our legitimate interest.

• Account Management: To manage your account(s) (i.e., registration, administration, maintenance, and service). This processing is necessary for the performance of a contract.

• Marketing: To provide advertising and marketing. This processing is based on your consent.

• Participation in sweepstakes: To manage your participation in events or sweepstakes. This processing is based on your consent.

• Regulatory compliance: To comply with legal obligations, including retention requirements.

• Identity verification: In very limited circumstances, to perform a credit check and verify identity. This processing is necessary to comply with legal obligations. • Market research and consumer opinions: To analyze the information you voluntarily share with us about your experience using our products and services. This processing is based on your consent.

Financial Information

To provide our services, we collect financial information such as bank details and transaction purposes.

Purposes and legal basis for processing:

• Service provision: For processing transactions. This processing is necessary for the performance of a contract.
• Regulatory compliance: For the prevention of money laundering and terrorist financing. This processing is necessary to comply with legal obligations.
• Account management: To manage your account. This processing is necessary for the performance of a contract.
• Credit check: In very limited circumstances, to perform a credit check in order to provide the Services. This processing is necessary to comply with legal obligations.
• Identity check: To verify the customer's identity (i.e., KYC: for more information, click here). This processing is necessary to comply with legal obligations.

We will never ask you to provide your payment information (i.e., credit/debit card details). None of our employees or agents will ever ask you for your payment information. When payment information is required, we will ask you to enter the information directly into secure payment processing systems managed by authorized third-party payment processors (which may include affiliates of the Euronet group). These processors handle the data in accordance with the Payment Card Industry Data Security Standard (PCI DSS).

Transactional Data

We collect personal data such as recipient details, bank account information, contact information, the destination to which you are sending money, and banking preferences. Depending on local regulations, we may also collect details such as your relationship with the recipient, the reason for the transfer, and additional documentation related to the transaction.

Purposes and legal basis for processing:

Service Provision: To provide the Services, including completing a transaction. This processing is necessary for the performance of a contract.

Regulatory Compliance: For regulatory compliance purposes related to a transaction. This processing is necessary to comply with legal obligations.

Location Information or Geolocation Data

We may collect information about your location when you use our Services.

Purposes and legal basis for processing:

• Nearby Locations: To provide the Service, including using your device's location to identify nearby pick-up and delivery locations. This processing is based on your consent.

• Service Provision: We need to know your country of residence to provide you with our services. This processing is necessary to comply with our legal obligations. Please note that we will never know your exact location, only your country of residence.

Video and Audio Surveillance

We may use CCTV footage (image, video, and audio/voice recordings) to ensure security in our stores or offices in accordance with local regulations. The retention period for recordings will not exceed the duration required by our legal obligations.

Purpose and legal basis for processing:

• Security: To ensure security in our stores or offices. This processing is based on our legitimate interest or, where required by local regulations, on compliance with legal obligations.

• Fraud Prevention: Where permitted by local regulations, we may access CCTV content to verify transactions, prevent fraudulent activity, and protect our assets and the rights of our customers. This treatment is necessary to comply with legal obligations.

Sensitive Personal Data

When strictly necessary, we may collect special categories of data, such as biometric data (e.g., facial scans), government identification numbers, and health information, in accordance with local laws. Where required by applicable law, we will obtain your consent or provide you with the opportunity to opt out before processing your sensitive personal data.

Purposes and Legal Basis for Processing:

• Legal Compliance: For KYC (Know Your Customer) processes and fraud prevention. This processing is carried out to comply with legal obligations.
• Security and Verification: To verify identity during service use. This processing is carried out to fulfill our legal obligation. Where necessary, we will request your consent.

Non-Identifiable Data

Where possible, we use non-identifiable data to improve services, such as anonymous demographic data or aggregated usage data.

Beneficiary Personal Data

For money transfer services, personal data of beneficiaries of our customers is collected, as this is essential to fulfill the contractual agreement between us and our customer. As a beneficiary, you are the recipient of the payment transaction initiated by our customer.

The types of personal data we may collect about you include:

• Identification Data: Name, surname, and official identification document.
• Financial Data: Bank account information or payment information, such as wallet, card, or mobile phone number.

We process a beneficiary's Personal Data solely to fulfill our contractual and regulatory obligations.

In some cases, we may contact you, the beneficiary, to inform you about an ongoing transaction that requires your attention and action. We will never contact you to promote our services but only to fulfill our contractual or legal obligations.

Your data, as a beneficiary, will not be used for any other purposes.

If you have questions about how we process your Personal Data as a beneficiary, please contact us at dpo@euronetworldwide.com.

Know Your Customer (e-KYC) Procedure

For our digital services, and where legally permitted and required, we may verify your identity using an electronic Know Your Customer (e-KYC) process. This may involve submitting a valid photo ID, a video, or a selfie through our secure service provider's platform. This process is designed to enhance fraud detection and ensure compliance with anti-money laundering regulations.

When biometric data, such as facial scans, are collected, we will request your consent if required by local law. If you prefer not to provide biometric data, please contact our customer support team for assistance.

During the verification process, a video, including audio, may be recorded to ensure the integrity of the procedure. All biometric data shared with our service providers is carefully controlled and used strictly for identity verification purposes. Neither we nor our service providers will sell, rent, or trade your biometric information, and robust security standards are maintained to prevent unauthorized access.

In accordance with applicable privacy legislation, you may have rights regarding your biometric data, such as the right of access. For more information, please see the "Your Rights" section. If you have any questions about the e-KYC process, please contact us at dpo@euronetworldwide.com.

RIA Rewards Program

What types of personal data do we collect?

If you choose to enroll in our RIA Rewards program (when available), we will process your Personal Data as follows:

Identification Data

Identification data may include your name, title, residential and/or business address, email address, telephone numbers, date of birth, gender, images, signature, passport or visa details, voice recordings, and official credentials. We only use the Identification Data strictly necessary for the purposes detailed below:

Purposes of Processing Your Personal Data

Service Provision: For the provision of services. This processing is necessary to fulfill our contractual obligations.

Customer Service: To monitor and record communications (e.g., calls, emails, chats) and confirm instructions. This processing is based on our legitimate interest.

Account Management: For account registration and administration. This processing is necessary to fulfill our contractual obligations or for the implementation of pre-contractual measures.

Access to Tools and Information: To provide you with access to the tools and information requested through the application, including services such as currency exchange and payments. This processing is necessary to fulfill our contractual obligations or for the implementation of pre-contractual measures.

Correspondence and Record Keeping: We maintain records of communication and customer service interactions for support purposes, as well as communications with Euronet Group affiliates and partners. This processing is based on our legitimate interest.

Market Research and Consumer Opinions: To analyze the information you voluntarily share with us about your experience with our products and services. This processing is based on your consent.

Transactional Data

We collect information about transaction details, such as the amount and destination of transfers, to award points under the Rewards Program.

Purpose of Processing Your Transactional Data

Reward Points: To award points based on eligible transactions. This processing is necessary to fulfill our contractual obligations.

Contact Information for the Rewards Program

To withdraw from the program, report suspicious or unauthorized activity, or update your preferences, you can contact the Rewards Program at:

- Toll-free number 1800 882 077 during business hours or

- by email at riarewards@riamoneytransfer.com

Toll-free calls are free from landlines, but charges may apply from mobile phones depending on your provider.

If you have opted in to receive marketing communications from us, we will keep you informed when the Rewards Program becomes available in your country.

Notice to Agents

This Privacy Notice applies to individuals and representatives involved in a business relationship with us, when you apply to become or are an agent (“Agents”).

What types of personal data do we collect?

Identifiers or identification data

The personal data we collect from you may include your first name, last name, title, gender, date of birth, nationality, and identification documents, including document number, passport or visa details, country of birth, and address. We also collect other contact details, such as your residential and/or business address, email address, telephone and/or fax numbers, as well as unique identification numbers (e.g., tax ID) and other contact information ("Contact Data"). In addition, we may process images, videos, or your signature.

Purposes and legal basis of processing:

• Provision of Services: To provide the requested services. This processing is necessary to fulfill our contractual obligations.

• Company Representation: To represent the company in legal matters (contracts, negotiations). This processing is necessary to fulfill our contractual obligations.

• Operational Support: To provide support for our operations. This processing is based on our legitimate interest.

• Participation in prize draws: To allow your participation in promotional events or activities that we organize. This processing is based on your consent.

• Regulatory Compliance: To comply with our legal obligations regarding document and communication retention, we retain correspondence, including emails, faxes, or other types of electronic communication, along with customer account records. We also retain customer service letters and other communications between us and any Euronet Group company, as well as with our partners and suppliers. This processing is carried out in accordance with our legal obligations. • Account Management: To manage your account(s), including registration, administration, maintenance, and service. This processing is necessary to fulfill our contractual obligations.

• Marketing: To provide advertising and marketing. This processing is based on your consent.

• Criminal Background Checks: This processing is based on our legitimate interest or, where required by local regulations, to comply with legal obligations.

• Credit Checks: This processing is based on our legitimate interest or, where required by local regulations, to comply with legal obligations.

• Market Research and Consumer Opinions: To analyze any information you voluntarily share with us about your experience using our products and services. This processing is based on your consent.

Financial Data and Professional or Employment Information

We collect your personal financial data when you register to use our Services. We collect financial data such as bank account information, financial statements, reason for transfer, occupation (professional or employment-related information), or other documentation to demonstrate the source of the funds you wish to transfer (similar to pay stubs), in order to provide you with our Services.

Purposes and legal basis for processing:

Provision of Services: This processing is necessary to fulfill our contractual obligations.

Money Laundering Prevention: This processing is based on our legal obligations.

Terrorist Financing and Criminal Activities: This processing is based on our legal obligations.

Account Management: This processing is necessary to fulfill our contractual obligations.

Credit Checks: This processing is based on our legitimate interest or, where required by local regulations, to comply with legal obligations.

Audio and Video Surveillance

We may collect images, videos, and audio/voice recordings.

Purposes and legal basis for processing:

• Security: To ensure the security of our Services, we may use closed-circuit television (CCTV) cameras to ensure the safety of customers in our stores or offices. This processing is based on our legitimate interest or, where required by local regulations, on compliance with legal obligations.

Non-Identifiable Data

Whenever possible, we use data that does not directly identify you (such as anonymous demographic and usage data), instead of Personal Data (“Non-Identifiable Data”).

Purposes:

• Internal improvement: This non-identifiable data may be used to improve our internal processes or service delivery, without the need for further notification to the data subject.

• Service evaluation: We may use aggregated data to analyze, evaluate, and improve our Services.

General Notice

Where do we obtain your Personal Data?

We collect personal data primarily from you when you interact with our company and our services. However, we may collect additional data from the following sources:

o Passive collection on our websites, including information about clicks made, time spent, and other automatically collected metadata.

o Advertising networks and social media platforms.

o Service providers, including, but not limited to, data analytics providers, internet service providers, operating systems and platforms, and other third parties that support the delivery, operation, security, or analysis of our services.

o Other parties, such as government databases, business partners, and third-party sources.

Personal data collected from third parties

We may collect your personal data from other sources, depending on the service and local legal requirements. These third-party sources include:

Public authorities and registers

We may obtain personal data from public record sources (such as federal, state, or local government organizations) to comply with legal obligations and ensure the accuracy of the information we hold.

Purposes of Processing:

• Identification purposes: We may verify the Personal Data you have provided to us with third parties to ensure that your identity matches the information you have provided. The legal basis for this processing is our legal obligation.

• Fraud prevention: We may compare the data collected from you with data provided by third parties to prevent fraud, including identity theft, misuse of services, or other suspicious activity.

Business partners and other third parties

We may also obtain your Personal Data (such as name, email address, phone number, employer) from our business partners and other third parties. Personal Data obtained from these sources is processed solely for specific legitimate purposes and in accordance with applicable data protection legislation. These parties are responsible for obtaining your consent, where necessary, before sharing your Personal Data with us. However, if you believe we should not have your Personal Data, you can request its deletion at dpo@euronetworldwide.com.

Purposes of Processing:

• Provision of services and support: We may process your data to ensure we can provide you with a seamless experience, especially when our services are offered through our business partners and clients as part of integrated or co-branded solutions.

• Promotion of our services: To provide you with information about our products or services, where permitted by law and based on your consent, if required.

• Business Development: To maintain and develop business relationships and ensure relevant and accurate communication with both potential and existing business partners. This processing is based on consent.

If we process additional data obtained from a third party, we will inform you as soon as possible and obtain your consent where required by applicable law.

How Long We Keep Personal Data

We retain personal data only for as long as necessary to provide the services requested and to comply with legal, accounting, and reporting obligations. The retention period is determined by specific requirements and may include:

Customer Service and Contractual Relationship: We retain your Personal Data for as long as you remain our customer. Upon termination of our contractual relationship, we restrict access to your data to ensure that it is only accessible for the purpose of complying with legal requirements.

Marketing: We will process your personal data for marketing purposes unless you have opted out, as described in this Privacy Notice, or until we are aware that you no longer wish to receive communications or that your data is no longer accurate.

Legal and Regulatory Requirements: We retain your Personal Data for as long as necessary to comply with all applicable legal obligations, including commercial, tax, and anti-money laundering regulations. During this period, your Personal Data will be restricted to prevent its use for any other purpose and will only be accessed when necessary to comply with these obligations.

Please note that if you request data deletion, we may still be required to retain some of your data to comply with our legal obligations. The retained information will only be accessible by authorized personnel and limited to fulfilling any legal requirements, and will be duly deleted once the legal retention period has expired.

Do we share personal data?

Euronet Group Affiliates

We may disclose personal data to Euronet and its affiliated companies for ordinary business activities and to fulfill compliance obligations within the Group.

Types of Personal Data: identification data, video surveillance data, transactional data, financial data, behavioral data, and technical data.

Purpose: Sharing data with affiliates for customer service, regulatory compliance, and day-to-day business functions. This may include 24/7 customer support requiring access to data across Euronet Group affiliates.

In the event of a sale, acquisition, merger, or reorganization involving Euronet or any company within the Euronet Group, we may transfer Personal Data to third parties, ensuring appropriate safeguards are in place.

This processing is carried out to comply with legal obligations and/or to fulfill contractual obligations, as applicable.

Third-Party Service Providers

We may share certain personal data with external service providers to support compliance verification, service delivery, and marketing efforts.

Types of Personal Data: identification and biometric data, financial details, contact details, transactional, behavioral, and technical data.

Purpose of Processing

Compliance and Fraud Prevention: Personal Data may be shared with verification and analytics providers to comply with regulatory obligations and mitigate risks (e.g., to verify customer data or detect suspicious activity). This processing is carried out to comply with our legal obligations or, where applicable, with your consent.

Service Provision: Our partners and third parties, such as agents and correspondents, may access Personal Data to facilitate the provision of services. This processing is based on our contractual obligation.

Marketing: Advertising networks and social media platforms may receive data to deliver personalized ads tailored to user preferences. This processing is based on your consent.

Note: The definition and scope of “external service providers” may vary depending on country regulations.

Authorities

We may be required to disclose your personal data, including sensitive personal data, to legal or regulatory authorities for compliance purposes, to enforce agreements, or to comply with legal requests.

Types of personal data: Identification data, Video surveillance data, Transactional data, Financial details.

Purpose of Processing: To comply with applicable legislation, respond to binding requests from public authorities, support investigations, or fulfill obligations related to the processing of financial transactions. This processing is based on our legal obligations.

Strategic Partners

Personal data may be shared with strategic partners when necessary to provide our services or to ensure that they comply with their legal obligations.

Types of personal data: Identification data, Transactional data, Financial details.

Purpose of Processing

Purpose: Provision of services in collaboration with strategic partners. This is carried out as part of our contractual obligations.

Regulatory Compliance: To assist our partners in complying with applicable legal or regulatory requirements. This processing is based on legal obligations.

Operational Efficiency and Risk Management: To ensure the secure and smooth provision of services between different partners or providers, or to prevent abuse or misuse of our services. This processing is based on our legitimate interests.

Professional Partners

We may disclose personal data to professional advisors, including lawyers, consultants, auditors, or accountants, to fulfill our legal and business obligations.

Types of personal data: Identification data, Video surveillance data, Transactional data, Financial data.

Purpose of Processing: The processing is carried out to comply with our legal obligations and based on our legitimate interest.

Legitimate Interest

When we use your Personal Data to pursue our legitimate interests, we will do our best to ensure that our interests align with yours so that your Personal Data is only used as permitted by applicable law or when it does not negatively affect your rights. You may request information about any processing based on legitimate interest.

International Transfers

We are a global company with global operations, partners, and suppliers. When necessary for the efficient and effective performance of a business transaction or the fulfillment of one of the uses of Personal Data described above, we may need to transfer your Personal Data from the country where it was collected to other countries, which may have data protection laws that are different from the laws where you live. When such a transfer is required, we implement appropriate safeguards to ensure that you receive the same level of protection and that the transfer is carried out in accordance with our legal obligations.

Personal Data of Minors

We do not offer services directly to minors, as defined by applicable local law, nor do we proactively collect their personal information. If you are considered a minor under local laws, please ensure you have the necessary authorizations from your legal guardian to use our sites and services or share personal data with us.

If you become aware that a minor has unlawfully provided us with personal data, please contact us at dpo@euronetworldwide.com.

Security

We are dedicated to safeguarding your Personal Data and have implemented robust and commercially reasonable security measures to prevent its loss, misuse, or unauthorized alteration. We continuously work to protect your data in accordance with international best practices by implementing rigorous physical, electronic, and administrative security measures.

To prevent unauthorized access, we employ advanced physical and organizational security measures that are regularly updated to ensure the highest level of protection while maintaining cost-effectiveness. All personal data is stored in secure locations, protected by firewalls and other sophisticated security systems with restricted administrative access. Our staff, as well as all activities related to your personal data, are governed by strict confidentiality agreements and must comply with our organization's Privacy Policy.

Our goal is to maintain the highest standards of data protection through industry-leading practices that safeguard your privacy.

Accuracy of Personal Data

We are committed to keeping your personal data accurate and up-to-date. We take reasonable steps to ensure the accuracy of your Personal Data by ensuring that the most recent Personal Data we receive is accurately recorded and, where necessary, we conduct periodic checks and ask you to update your Personal Data.

You can request a correction or update to your Personal Data if it is inaccurate, as described in the Your Rights section below.

Your Rights

To exercise any of your rights, please email us at dpo@euronetworldwide.com. To protect your privacy and security, we may ask you to verify your identity and provide us with additional information.

Depending on your location, your rights regarding Personal Data under applicable laws may include:

1. Right to be informed: You have the right to know what Personal Data is collected, sold, or shared, and with whom.
2. Right of access: You can request access to a copy of your Personal Data.
3. Right to rectification: You can request corrections to inaccuracies in your Personal Data.
4. Right to erasure: You can request the deletion of your Personal Data under certain conditions.
5. Opt-out rights: You can opt out of the processing of personal data for targeted advertising. You can opt out of the processing of personal data. You can opt out of the processing of Personal Data for profiling that produces legal or similarly significant effects concerning you.
6. Right to limit the use of personal data: You can request to limit the use and disclosure of personal data to specific and permitted purposes.
7. Right to restrict processing: You can request restrictions on data processing under certain conditions.
8. Right to object: You can object to the processing of your Personal Data, for example, for direct marketing purposes.
9. Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you.
10. Right to Non-Discrimination: You have the right not to be discriminated against for exercising your rights regarding your Personal Data.

We will respond to your requests promptly and within the legally required timeframe. To learn about the specific rights in your jurisdiction, please see the Regional Privacy Notice section below.

Please note that some rights may not be enforceable due to business or legal requirements necessary for the provision of our services, such as contractual obligations, compliance requirements, or anti-money laundering regulations. However, we will always respond to any rights requests as described above, and you may have additional rights depending on your location.

Privacy Complaints

If you have any complaints about how we handle your Personal Data, please contact us at dpo@euronetworldwide.com.

Under applicable privacy laws, you may also have the right to file a complaint with a Data Protection Authority or other regulatory body if you believe we have not complied with our obligations under this Privacy Notice or relevant legal requirements.

Access to Your Device Features

We may request access to certain features of your device to enhance your experience and enable specific functionalities. Access to these features is optional and based on your prior consent:

• Contact List: Through the application, we may access your contact names and numbers solely to facilitate beneficiary selection. These contacts are stored locally on your device and are not downloaded, processed, or used for any other purpose.

• Camera and Microphone: When necessary for identity verification (e.g., during the e-KYC process), the application may access your camera and microphone. These features are used exclusively to securely complete the verification process.

• Location Services: If enabled, your location may be used to personalize services, such as identifying nearby branches or tailoring content regionally.

You can revoke access to these features at any time through your device or application settings.

Use of Artificial Intelligence

We may use artificial intelligence (AI) and machine learning (ML) technologies, developed internally or provided by trusted third parties, to assist with operational, regulatory, and compliance purposes across our global services.

The use of such technologies is strictly limited to the legitimate purposes described in this Privacy Notice and is implemented in a manner that respects individuals' fundamental rights and freedoms. Where required by applicable law, Euronet conducts data protection impact assessments (DPIAs) to assess and mitigate any risks associated with the implementation of AI/ML systems. These technologies do not make decisions that produce legal or similarly significant effects on individuals without appropriate human oversight. Where applicable, and in accordance with regional data protection laws, individuals have the right to:

• Request information about the existence and nature of any automated processing of their data,

• Object to processing based solely on automated decision-making,

• Request human intervention or express their point of view in such contexts.

Euronet maintains appropriate security measures to ensure the transparency, accuracy, fairness, and security of any AI or ML technology used in the processing of personal data and regularly reviews these systems to ensure continued compliance with global data protection standards.

Machine Learning

Machine learning (ML) is used to support internal processes such as project management, data analysis, communications, system security, anti-money laundering, and fraud prevention. These technologies can be used, for example, to extract necessary information from documents submitted for identity verification (KYC), anti-money laundering (AML), fraud detection, and transaction monitoring.

When photos and selfies are uploaded during the identity verification process, they are analyzed to confirm whether the individual registering matches the person shown on the provided identification. This technology scans images, converts them into digital representations, and compares them to each other and to a database of images to determine a match.

We have developed machine learning models to support regulatory compliance by identifying potential transactional fraud. This analysis helps us provide the requested services while simultaneously fulfilling legal obligations related to fraud prevention, money laundering, and terrorist financing. The process involves analyzing transactional data, assigning values ​​to specific indicators, and processing these values ​​through a machine learning model to assess the likelihood of fraudulent activity.

Profiling and Automated Decision-Making

When you expressly agree, we will provide you with personalized information about our products and services. We perform data analysis to target you with appropriate communications and advertising, including invitations to exclusive customer events that we believe might interest you, as well as recommending products and services that we believe might be suitable for you.

In some cases, we use automated decision-making and profiling if authorized by law and necessary for the performance of a contract. For example, automated authorization of remittance services. The legal basis for proceeding with profiling and automated decision-making is legitimate interest.

We also make automated decisions in processes such as transaction monitoring in order to combat fraud in compliance with legal requirements related to anti-money laundering, terrorist financing, and financial services. Depending on your place of residence, you may have the right to object to being subject to a decision based solely on automated processing, including profiling, if such decision produces legal effects concerning you or similarly significantly affects you. This right will not apply when the decision-making is necessary for entering into or performing a contract, when it is expressly authorized by data protection law, or when it is based on your explicit consent.

Chatbot

Our services may include a chatbot functionality. This service records conversations not only for quality control purposes but also to ensure compliance with our regulatory obligations.

In some cases, the chatbot function is supported by an artificial intelligence system. This service does not reuse your data or learn from the data you provide. This service is used to provide responses extracted directly from our systems.

Consent-Based and Soft Opt-In Marketing Communications

You may receive marketing communications from us through two different mechanisms:

1. Based on your consent (Regular Subscription)

You will receive marketing messages if you have given us explicit permission to use your Personal Data for this purpose. This happens, for example, when:

• You opt in during registration; or

• You update your preferences in your profile settings.

With your consent, we provide you with personalized information about our products and services. We use data analytics to deliver targeted communications, advertisements, and invitations to exclusive events, along with recommendations for products and services that may interest you. You can withdraw your consent at any time.

2. Based on a legitimate interest (Soft Opt-In)

Where permitted by local law, you may also receive marketing communications if:

• You have a contractual relationship with us (for example, you are actively using our Services); and

• You have not specifically opted out.

This applies only to products or services similar to those you have previously used, and you will always be informed during registration and use of our Services that your Personal Data may be used for this purpose.

How to Opt Out or Withdraw Consent

You can stop receiving marketing communications at any time. If you do, we will remove you from our marketing list, and you will no longer receive promotional updates. You can also re-subscribe later if you wish.

You can withdraw your consent or unsubscribe using any of the following methods:

• By updating your preferences in your profile;

• By clicking the unsubscribe link included in our communications;

• By contacting us at dpo@euronetworldwide.com.

If you have any further questions or wish to start receiving marketing communications, please contact dpo@euronetworldwide.com.

Third-Party Advertising

Third-party advertisers provide ads that are displayed on our website, our app, or elsewhere within our Services. Third-party advertisers do not have access to any of the information our customers have provided to us directly. Advertisers typically rely on cookies or other web- or app-based mechanisms to determine which ads might be of interest to you.

We do not place “targeting cookies” or enable “targeting” on your system without your consent, where required by law.

If you have provided your consent by accepting targeting cookies on the website or enabling targeting in the app, we may use third parties to do so (remarketing and lookalike audience features). With your consent, we may share your Personal Data with third parties for such marketing purposes. You can opt out of targeted advertising by adjusting your cookie settings.

Third parties are not subject to our Privacy Notice. To understand a third party’s privacy practices, please visit their website and review their privacy policy. You can consult our Cookie Policy to see all the third parties that may use cookies for targeted advertising.

Captcha-Based Protection Tools Against Automated Access or Bots

To protect our website and forms from spam, abuse, and automated misuse, we use CAPTCHA technologies. These tools analyze user behavior to distinguish human users from bots.

Where applicable, we may use non-intrusive CAPTCHA services to prevent fraud or abuse. These tools are designed to verify users without significantly impacting their experience. This processing is also based on our legitimate interest in protecting our digital services.

Regional Privacy Notices

Notice to United States Residents Regarding Financial Services

Applicability of the Gramm-Leach-Bliley Act (GLBA)

This Notice informs U.S. consumers and customers (including former customers) about the requirements of the federal Gramm-Leach-Bliley Act (“GLBA”). It addresses the collection, disclosure, and protection of “nonpublic personal information” (“NPI”).

For purposes of this Notice, NPI is personally identifiable information collected as a financial institution under the GLBA that is not publicly available. NPI may include any:

• Information provided by an individual when obtaining a financial product or service.

• Information obtained about an individual from transactions involving financial products or services.

• Information acquired about an individual in connection with providing a financial product or service, such as information from a consumer report or court record.

All disclosures of NPI are made as permitted by law. An “unaffiliated third party” is any person other than an affiliate of a financial institution or a person jointly employed by a financial institution and a company that is not an affiliate of the institution.

This Privacy Notice lists the categories of information disclosed and to whom it is disclosed under the joint marketing/service provider exception of the Privacy Rule.

If NPI may be disclosed to unaffiliated third parties, and that disclosure does not fall within any of the exceptions to the Privacy Rule under the GLBA, consumers and customers have the right to opt out of these disclosures, and the consumer or customer will be provided with an opt-out mechanism.

Notice regarding information sharing between Euronet Group and its affiliates pursuant to the Fair Credit Reporting Act.

We comply with the rules issued to implement Executive Order 14117, restricting the sharing of Sensitive Personal Data with the identified countries of concern as defined in the Final Rule.

Universal Opt-Out Mechanism: We recognize a simple opt-out preference signal. This signal applies to your device, consumer, and/or offline sales, and grants you the right to opt out of the sharing of your personal data for targeted advertising purposes. To implement an opt-out preference signal, please visit https://globalprivacycontrol.org/ to learn how to download a compatible browser or extension.

By providing your mobile phone number, you agree to receive SMS messages, including fraud alerts. When applicable, such messages will only be sent if you have provided prior consent. Message frequency may vary. Standard message and data rates may apply. You can unsubscribe at any time by replying “STOP” or following the instructions in any message.

We will not share your number with third parties or affiliates for marketing or promotional purposes. We may share your number with subcontractors who support the provision of services, such as customer service. All text message consent data is excluded from such sharing.

California Residents

In accordance with the California Consumer Privacy Act, California residents may exercise the following rights:

• Right to know

• Right of access

• Right to correct inaccuracies

• Right to deletion

• Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising purposes

• Right to limit the use and disclosure of Sensitive Personal Information to specifically permitted purposes

• Right to non-retaliation following opt-out or exercise of other rights

We will respond to your request within 45 days of receiving it, unless you request an extension. Internal Appeal Process: If you receive a notification from us indicating that your Personal Information rights request has been denied, you may appeal the denial within a reasonable time after receiving the notification by emailing dpo@euronetworldwide.com.

Our use of cookies or other tracking technologies may be considered a "sale" or "sharing" under applicable law. You may have the right to opt out of the sharing of your personal information for targeted advertising purposes. We do not provide services directly to children under 16 years of age, and we do not knowingly sell or share the personal information of consumers under 16 years of age.

In the past 12 months, we may have shared the following categories of personal information: Identifiers such as contact information, internet and other electronic network activity information, including technical and behavioral data.

In the past 12 months, we may have shared your personal information with the following categories of third parties: Third-party service providers, including advertisers or advertising networks and social media companies.

Texas Residents

If you have a complaint, please first contact Dandelion Payments, Inc.'s consumer assistance division at +18774431399. If you still have an unresolved complaint regarding the company's activities, please direct your complaint to: Texas Department of Banking, 2601 North Lamar Boulevard, Austin, Texas 78705, 1-877-276-5554 (toll-free), www.dob.texas.gov.

Notice for European (EEA) Residents

In accordance with the General Data Protection Regulation (GDPR) and in addition to the rights outlined above, all residents of the European Economic Area (EEA) may exercise the following rights:

• Right of access

• Right to rectify inaccuracies

• Right to erasure

• Right to restrict processing

• Right to data portability

• Right to object

• Rights related to automated individual decision-making

To exercise any of the aforementioned rights, you must comply with the obligations set forth above in this Privacy Notice.

From the date we receive your request, we will respond within a maximum of 30 days, unless you request an extension.

When processing your Personal Data, we need to share your Personal Data as follows:

The EEA data protection authorities are listed at this link: Europe (EEA): Members | European Data Protection Board (europa.eu)

Notice for UK Residents

In accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all UK residents may exercise the following rights:

• Right of access

• Right to rectify inaccuracies

• Right to erasure

• Right to restrict processing

• Right to data portability

• Right to object

• Rights relating to automated individual decision-making

To exercise any of the rights listed above, you must comply with the obligations set out earlier in this Privacy Notice regarding sending your request to dpo@euronetworldwide.com and verifying your identity.

From the date we receive your request, we will respond within a maximum of 30 days, unless you request an extension.

To contact the Data Protection Authority, you can follow this link: Information Commissioner's Office (ICO)

Notice to Residents of Argentina

In accordance with the Personal Data Protection Law, Law No. 25,326 of 2000, you have the following rights, as defined above:

• Right of access

• Right to correct inaccuracies

• Right of rectification and updating

• Right of deletion

To exercise the above rights or your right to withdraw your consent, or if you have any questions or complaints regarding the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com.

You are also informed that you may limit how we use or disclose your personal data for specific purposes, in accordance with your rights.

For requests related to the deletion or updating of your Personal Data, we will respond within a maximum of 5 days.

For requests for access to your Personal Data, we will respond within a maximum of 10 days. We also inform you that the Public Information Access Agency, as the supervisory authority for the application of Law No. 25,326, has the power to handle complaints or violations related to data protection legislation. For more information on how to file a complaint, you can contact the supervisory authority directly: Public Information Access Agency.

Notice to Residents of Mexico

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations, this Privacy Notice is made available to users and potential users in Mexico prior to the collection of any personal data.

Personal data is collected in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability.

When biometric or sensitive data is processed, it will be based on your explicit consent.

You may exercise your ARCO rights (Access, Rectification, Cancellation, and Objection), or withdraw your consent, by contacting: dpo@euronetworldwide.com. We will respond within 20 days and implement the approved actions within the following 15 business days.

To contact the local data protection authority, please follow this link: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

Notice to Residents of Chile

In accordance with the Chilean Personal Data Protection Law, residents of Chile have the following rights (the "ARCO Rights"):

• Right of access

• Right of rectification

• Right of erasure

• Right to object

• Rights related to automated individual decision-making

In addition, you have the right to withdraw your consent to the processing of your Personal Data at any time, to the extent permitted by law. To exercise your ARCO Rights, your right to withdraw your consent, or to ask questions or file complaints about the processing of your Personal Data, you can contact us at dpo@euronetworldwide.com.

Please note that options are available to limit how we use or disclose your personal information for specific processing purposes.

From the date we receive your request, we will respond within a maximum of 30 days unless an extension is necessary.

To contact the local data protection authority, please follow this link: Consejo para la Transparencia

Notice for Residents of Malaysia

In accordance with the Personal Data Protection Act 2010 (PDPA), customers may provide us with their Personal Data for any of the purposes set out in the “What Type of Personal Information Do We Collect?” section of this Privacy Notice. If we process your Personal Data for any additional purpose, we will inform you in advance or obtain your explicit consent.

In accordance with the Personal Data Protection Act 2010 (the “PDPA”), all Malaysian residents may exercise the following rights:

• Right of access

• Right to correct inaccuracies

• Right to erasure

• Right to restrict processing

• Right to data portability

• Right to object

We will respond to your request within a maximum of 21 days from the date we receive it.

In accordance with the terms of the PDPA, we have the right to charge a fee for processing any data access request.

To contact the local data protection authority, please follow this link Departamento de Protección de Datos Personales

Notice for Residents of New Zealand

For all residents of New Zealand, the rights you may exercise regarding the processing of your Personal Data are as follows:

• Right to know

• Right of access

• Right to correct inaccuracies

• Right to erasure

• Right to restrict processing

To exercise any of the rights listed above, you must comply with the obligations set forth in this Privacy Notice regarding submitting your request to dpo@euronetworldwide.com and verifying your identity.

We will respond to your request within a maximum of 20 days from the date we receive it.

To contact the local data protection authority, please visit:Oficina del Comisionado de Privacidad

Notice for Australian Residents

For all residents of Australia, the rights you can exercise regarding the processing of your Personal Data are as follows:

• Right to know

• Right of access

• Right to correct inaccuracies

• Right to erasure

• Right to restrict processing

You can also ask us to explain our data policies and practices in accordance with applicable law.

We will respond to your request within a maximum of 30 days from the date we receive it.

When processing your Personal Data, we need to share your Personal Data as follows:

To contact the local data protection authority, please visit: Office of the Australian Information Commissioner

Notice to Residents of India

In accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Information Technology Rules, all Indian residents may exercise the following rights:

• Right of access

• Right to correct inaccuracies

• Right to erasure

• Right to restrict processing

• Right to data portability

• Right to object

• Rights relating to automated individual decision-making

We will respond to your request within a maximum of 30 days from the date we receive it.

To contact the local data protection authority, please refer to: Department of Electronics and Information Technology

Notice to Residents of Canada

For all residents of Canada, the rights you may exercise regarding the processing of your Personal Data are as follows:

• Right to know

• Right of access

• Right to correct inaccuracies

We will respond to your request within a maximum of 30 days from the date we receive it.

We may send you informational or transactional messages via email or SMS without requiring your prior consent.

To contact the local data protection authority, please visit: Office of the Privacy Commissioner of Canada

Notice to Residents of Colombia

Where necessary to fulfill our service obligations, we may legally conduct criminal and judicial background checks to prevent money laundering, terrorist financing, and related crimes.

In accordance with Colombian Statutory Law 1581 of 2012 and Decree 1377 of 2013, which regulate the protection of personal data, Colombian residents have the right to access, update, correct, and delete their data. To exercise these rights, withdraw consent, or submit questions or complaints regarding the processing of your Personal Data, please contact us at dpo@euronetworldwide.com, following the instructions provided in the "Your Rights" section.

Upon receiving a request for information, we will respond within a maximum of 15 business days from the day after receiving the request. For requests related to complaints, we will respond within a maximum of 23 business days from the day after receiving the request.

To contact the local data protection authority: Superintendencia de Industria y Comercio. And Superintendencia Financiera de Colombia, is the competent authority for any claims related to the protection of the personal data of financial consumers in Colombia.

Notice to Residents of Senegal

When you register on our application to use the Wallet service, we will collect personal data, including your full name, email address, and phone number. The processing of this data is based on our legitimate interest in properly providing the service and ensuring the correct functioning and continuous development of the App.

Beneficiaries who receive funds through our service may be contacted via SMS to notify them of the availability of these funds in the App. The legal basis for this communication is the provision of payment services under PSD2, which establishes the legitimate interest of the data controller or a third party in fulfilling the contract with the payment service user.

In accordance with Law No. 2008-12 of January 2008, and in addition to the rights mentioned above, all residents of Senegal may exercise the following rights:

• Right of access

• Right to rectification

• Right to erasure

• Right to object

• Right to restriction of processing

From the day we receive your request, we will respond within a maximum of 30 days, unless you request an extension.

To contact the local data protection authority: Home- CDP

Notice for Residents of Japan

In accordance with the Personal Information Protection Act (PIPA), the rights you may exercise regarding the processing of your Personal Data are as follows:

Right to be informed

Right of access

Right of correction

Right of erasure / Cessation of use

Right to object to third-party disclosures

Right of access to records of third-party transfers

Right to file a complaint

From the date we receive your request, we will respond within a maximum of 30 days, unless an extension is necessary.

To contact the local data protection authority: Personal Information Protection Commission ("PPC")

Notice to Residents of Panama

In compliance with Law No. 81 of 2019 and Executive Decree No. 285 of 2021, we inform you that, in Panama, certain additional obligations apply regarding the processing of personal data. These include the duty to ensure that all communications addressed to the data subject prior to the collection of their data contain the information required in Article 14 of the aforementioned Decree, and that consent, when required, is documented in a verifiable manner, including technological mechanisms that ensure its traceability.

We also inform you that in Panama we maintain an internal register of personal data transfers made to third parties, in accordance with the provisions of the applicable sectoral regulations. If you are a customer of remittance services or other regulated financial products, your information may be processed in accordance with the exceptions provided for in current banking legislation.

The National Authority for Transparency and Access to Information (ANTAI) is the competent authority for any claims related to the protection of personal data in Panama.

Notice to Residents of Thailand

In accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”), residents of Thailand have the following rights regarding the processing of their Personal Data:

Right of access: You can request access to your Personal Data and obtain a copy of it.

Right to rectification: You can request the correction of inaccurate or incomplete Personal Data.

Right to erasure: You can request the deletion of your Personal Data under certain conditions.

Right to restrict processing: You can request the restriction of the processing of your Personal Data.

Right to object: You can object to the processing of your Personal Data for specific purposes.

Right to data portability: You can request to receive your Personal Data in a structured format or have it transferred to another data controller.

Right to withdraw consent: You can withdraw your consent at any time, unless restricted by law or contract.

Right to lodge a complaint: You can lodge a complaint with the Personal Data Protection Committee (PDPC) Office if you believe your rights have been violated.

To exercise any of these rights, please contact us at dpo@euronetworldwide.com. We will respond to your request within a maximum of 30 days, unless an extension is necessary.

If you wish to contact the local Data Protection Authority, you can contact the Personal Data Protection Committee (PDPC) Office through their website.: https://www.pdpc.go.th.

Other countries where we operate

Philippines

The National Privacy Commission is the competent authority for any claims related to the protection of personal data in the Philippines.

Brazil

The National Data Protection Authority is the competent authority for any claims related to the protection of personal data in Brazil.

South Africa

The Information Regulator of South Africa is the competent authority for any claims related to the protection of personal data in South Africa.

Our companies

The data controller is RIA, represented by the companies listed below, depending on the country and service:

Contact Euronet Privacy

For questions, suggestions, or complaints, please contact our Privacy department directly.

• Email: dpo@euronetworldwide.com

• Postal address: DPO, Calle Cantabria 2, 2-A Alcobendas, Madrid, Spain