Global Privacy Notice

In this global privacy notice ("privacy notice"), we explain how we handle personal data ("personal data") when you use our services as a customer, visitor, and/or user of our websites or mobile applications, or interact with us in any other way. The privacy notice also describes when your personal data may be shared with other parties and what privacy policies we use to protect your information.

We recommend that you review and check the website/app regularly to see if the privacy notice has been updated. We publish the updated version on the website/in the app, and by continuing to interact with us, you accept the version of the privacy notice that applies from time to time.

Table of Contents

1. What personal data do we collect, and how and why?

2. Accuracy of your personal data

3. e-KYC

4. Legitimate interest

5. How long does Ria keep personal data?

6. Does Ria share my personal data with other parties?

7. Minors

8. Data security

9. Profiling and automated decision-making

10. Marketing and advertising

11. Email evaluation

12. What rights do I have?

13. Privacy-related complaint procedure

14. Notice to California residents

15. Notice to residents of Europe (EEA)

16. Notice to residents of Argentina

17. Notice to residents of Mexico

18. Notice to residents of Chile

19. Notice to residents of Malaysia

20. Notice to residents of New Zealand

21. Notice to residents of Australia

22. Notice to residents of India

23. Our company by service

What rights do you have?

You own your personal data and have the legal right to exercise control over it. You can at any time request to exercise any of your rights by sending an email to dpo@euronetworldwide.com . You may have additional rights depending on your country. Click here for more information.

• Access to and an electronic copy of your data

• Correction of your data

• Deletion of your data (when permitted by law)

• Restriction of processing purposes.

1. What personal data do we collect, and how and why?

Identifying data

This may include name, title, residential and/or business address, email address, phone and/or fax number, and other contact details, date of birth, gender, images, signature, passport/visa information, voice recordings, and official identification details. We use only strictly necessary identifying data for the purposes described.

Financial data

We collect your personal financial data when you register as a customer. We collect financial data such as bank accounts, account statements, reason for transfer, occupation, or other documentation showing the source of the money you want to transfer (for example, pay stubs) in order to provide our services to you.

Behavioral data and technical information

Visitors' IP addresses, information about behavior (to understand how you behave while using our products and services), browser type and version, timezone settings and screen resolution, types and versions of browser extensions, operating system and platform.

See our cookie policy here .

Location

We may collect information about your location when you as a customer use our services.

Video surveillance

Image, video, and voice recording

Biometric data

Image, video recording, and facial scanning. If we ever process additional biometric data, you will be informed in advance, and we will under no circumstances process such personal data without first obtaining your consent.

Transaction data

We collect personal data such as information about the recipient, bank accounts, contact details, the destination to which you send money, and bank preferences. Depending on local regulations, we collect data such as employment, relationship to the recipient, reason for the transfer, and additional documentation to show the source of the money.

Sensitive personal data

We may collect and process sensitive personal data (or other "special categories of personal data"), such as data about your physical or mental health or your health status, to comply with applicable laws and regulations.

Non-identifiable data

When possible, we use data where you cannot be directly identified (for example, anonymous demographic data and usage data) rather than personal data. This non-identifiable data can be used to improve our internal processes or services without notifying you.

We may use aggregated data for a variety of purposes, including but not limited to evaluation and improvement of services and analysis of traffic to our services.

2. Accuracy of your personal data

We are committed to ensuring that your personal data is accurate and current. We therefore take reasonable measures to ensure that your personal data is accurate by ensuring that the most recent personal data we have received is correctly recorded and, when deemed necessary, perform regular checks to keep all your personal data current.

If you discover that your personal data is inaccurate, you can exercise your right to have it corrected by sending an email to dpo@euronetworldwide.com .

3. e-KYC

To use our services, you must be registered. The method used for registration is called electronic "Know Your Customer" (e-KYC).

As described in section 1, we may use biometric data (when permitted by law) to identify you and validate any documentation you have uploaded to our system to create your account. We also use this system to fulfill all our legal obligations.

If you want to register but do not want to use the e-KYC solution, you can contact our customer service for help with onboarding.

4. Legitimate interest

When we use our customers' personal data to exercise our legitimate interests, we do everything we can to align our interests with yours, so that your personal data is only used in a way that is permitted under applicable legislation or when it does not negatively impact your rights. Customers have the right to request information about any processing based on legitimate interests.

5. How long does Ria keep personal data?

Personal data is used for a variety of purposes and its use is governed by a variety of laws and regulations. Data is retained as long as it is necessary to provide customers with the services they have requested, and to comply with applicable legal, accounting, or reporting obligations. For example:

• Requirements under laws and regulations: Your personal data is retained as long as required to fulfill all our legal obligations.

• Customer service (management of customer relationships, complaints, etc.): We retain your personal data as long as you are a customer of ours.

• Marketing: We process your personal data for marketing purposes as long as you do not opt out in accordance with section 8 of this privacy notice.

• Contractual obligation: We retain personal data during the term of the contract. Customers can contact the Euronet Group data protection officer to request a copy of our retention policy, which may vary depending on applicable laws and our business needs in different countries.

6. Does Ria share my personal data with other parties?

Euronet Group

Third-party service providers

Legal authorities and regulatory authorities

Strategic partners

Professional partners

7. Minors

We do not provide services directly to children under 18 years of age, and do not proactively collect their personal data. If you are under 18 years of age, you should not use the websites or products or share personal data with us. If you become aware that anyone under 18 years of age has unlawfully provided personal data to us, we ask you to contact us at dpo@euronetworldwide.com .

8. Data security

We are committed to protecting customers' personal data and have taken commercially reasonable and appropriate security measures to prevent loss, misuse, and alteration of the information you have entrusted to us. At Ria, we will always strive to ensure that your personal data is well protected in accordance with international best practices. We maintain this commitment to data security by applying appropriate physical, electronic, and administrative measures to protect and secure your personal data.

To protect our systems against unauthorized access, we apply secure advanced physical and organizational security measures that are continuously improved to ensure the highest possible level of security in accordance with international best practices and cost-effectiveness considering the personal data processed. All personal data is stored in a secure location, protected by firewalls and other advanced security systems with limited administrative access.

Personnel who have access to your data and the way it is processed are contractually bound to keep your data private and follow the privacy policy we apply in our organization.

Although we strive to achieve the highest possible standard of data protection by applying industry-standard measures to protect your privacy, no security system is completely flawless or impenetrable. Therefore, we cannot provide, and do not provide, any guarantees that personal data is absolutely secure.

9. Profiling and automated decision-making

With your explicit consent, we provide you with customized information and advice about our products and services. We conduct data analysis with the help of third parties so that we can target appropriate communication and advertising to you, including invitations to exclusive customer events that we believe you may be interested in, and recommend products and services that we believe may suit you.

In some cases, we use automated decision-making and profiling, if permitted by law and necessary to fulfill a contract. An example is automatic authorization for transfer services. The legal basis for performing the profiling and automated decision-making is legitimate interest.

We also make automatic decisions in processes such as transaction monitoring to prevent fraud in accordance with legal requirements regarding money laundering, financing of terrorism, and financial services. You have the right to request not to be subject to fully automated decision-making, including profiling, if this decision-making has legal or other similarly significant consequences for you. This right does not apply if the decision-making is necessary to enter into or fulfill a contract with you, if the decision-making is permitted under applicable data protection laws, or if we have obtained your explicit consent.

10. Marketing and advertising

Third-party advertisers provide advertisements displayed on our website, in our app, or elsewhere in our services. Third-party advertisers do not have access to any of the data that our customers have provided directly to us. Typically, advertisers use cookies or some other web- or app-based mechanism to assess which advertisements may be of interest to you. We do not place "targeted cookies" or "targeting cookies" and do not enable targeting or location features in your system without your consent.

If you have given your consent by accepting targeted cookies on the website or enabling targeting in the app, we may hire a third party to perform this (remarketing and similar targeting functions). You can change your cookie settings here.

Third parties are not bound by our privacy notice. To get information about their privacy policies, you should visit their websites. You can find all third parties that may use cookies for targeting in our cookie policy .

We may from time to time contact you (via email, SMS, letter, or phone if necessary and according to your specific instructions) and after you, when required, have given your explicit consent to provide targeted marketing about our services. You can at any time withdraw your consent by sending an email to dpo@euronetworldwide.com or by following the instructions in the marketing message we have sent to you.

11. Email evaluation

We may use pixels in our marketing emails to find out if, and how many times, our emails are opened and to verify any clicks on links or advertisements in the email. We may use this information to:

• Understand which of our emails users found most interesting.

• Measure users' activity and engagement with our products and services.

• Inform our advertisers (with aggregated data) about how many users clicked on the ads.

• Find out which region our audience is located in.

12. What rights do I have?

Customers may want to access, update, change, or delete their personal data. Your rights may vary depending on your country. Regardless of country, you can at any time exercise the following rights:

• Request access to any personal data ("access request"). While exercising your right of access, you can ask us about all personal data we have about you, what processing we conduct for your personal data, the recipients of your personal data, the different categories of personal data, how long we process your personal data, and whether there is any automated decision-making regarding your personal data.

• Request correction of any inaccurate personal data we have about you. If you have changed your email address, or if you see that there is a spelling error in any of your personal data, you can exercise your right to correction.

• Request that all personal data about you be deleted. If you no longer want to receive any news from us, or if you do not want to continue using any of our services, you can ask us to delete all personal data we have about you. Note that we may retain your personal data to fulfill any of our legal obligations. However, your personal data will not be used for any other purpose.

As a customer, you also have the right to file a complaint with a competent supervisory authority or with a court if you believe we have failed to fulfill our obligations under this privacy notice or applicable law. We encourage customers to notify us of any complaints, even if not required, and we will respond in accordance with our complaint procedure.

We respond to your request as soon as possible and always within the timeframe specified in applicable law.

To find out what rights apply, and exactly within what timeframe we must respond to your request, see the relevant geographic area below.

To exercise any of your rights, you must send an email to dpo@euronetworldwide.com . To protect your privacy and maintain security, we will take steps to verify your identity and/or may ask you to provide other information before we give you access to or change any personal data. If we do not have a copy of your ID or other legally valid document proving your identity when this is required, we will not be able to respond to your request.

13. Privacy-related complaint procedure

Customers have the right to file a complaint with a competent supervisory authority or with a court if they believe we have failed to fulfill our obligations under this privacy notice or applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• United Kingdom:Information Commissioner Officer (ICO)

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

• India: Department of Electronics and Information Technology

• Singapore: Personal Data Protection Commission

• Philippines: National Privacy Commission

• Malaysia: Department of Personal Data Protection

• New Zealand: Office of the Privacy Commissioner

• Australia: Office of the Australian Information Commissioner

• California: Department of Justice's Privacy Unit

• USA: FTC

• Canada: Office of the Privacy Commissioner of Canada

• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales

• Chile: Consejo para la Transparencia

Ria reserves the right to change this privacy notice at any time and publishes information about such changes on Ria's website or in another manner that Ria deems appropriate.

14. Notice to California Residents

This additional information is intended to fulfill the requirements of the California Consumer Privacy Act ("CCPA") and should be read together with the privacy notice.

Customers who live in California have the right to:

• request and obtain information about our practices for collecting personal information during the past 12 months, including which categories of personal information we collect, from which categories of sources we have obtained the information, our business purpose for collecting or sharing the information, and which categories of third parties the information is shared with.

• request and obtain a copy of the personal information we have collected about them during the past 12 months.

• request and obtain information about our information sharing practices during the past 12 months, including a list of the categories of personal information that have been sold along with current categories of third party recipients and which categories of personal information we have disclosed for a business purpose.

• request that we do not sell personal information about them (we do not sell your personal information) and

• request that we delete (and direct our service providers to delete) their personal information with certain exceptions.

Under the CCPA, personal information means information that identifies, relates to, describes, could be associated with, or could reasonably be linked (directly or indirectly) to a specific person who is a California resident or a specific California household.

To submit an information request, California residents can contact us in the following ways:

1. Toll-free phone number: 1-877-932-6640

2. Email address: dpo@euronetworldwide.com

We may request that you submit a signed statement under penalty of perjury attesting that you are the person you claim to be. We will acknowledge receipt of your request within ten (10) days and will seek to respond within forty-five (45) days of receipt, but if we need more time (up to an additional forty-five days), we will notify you of this. We cannot respond to your request or disclose personal information to you unless we can verify your identity and confirm that the personal information relates to you.

You may request information about our data collection practices, what data we have collected about you, or our information sharing practices up to two times during a twelve-month period.

When you request a copy of the personal information we have collected during the 12 months before your request, we will seek to provide the information in an easy-to-use format, including by sending you a paper copy or providing an electronic copy to your registered account, if you have registered an account with us. When you request deletion of your information, California law permits us to retain certain information and, under certain circumstances, not delete it (i.e., information about a transaction, security incidents, fraud, etc.). For example, we are not required to comply with a request to delete information if the information is necessary for us to complete a transaction for you or otherwise fulfill a contract, to detect, protect against, or prosecute security incidents, fraud, or unlawful activity, to use the information solely internally in a manner that is reasonably aligned with your expectations as a customer (such as maintaining sales records), and to comply with legal obligations. If we receive such a request from you, we will also direct any service providers we have engaged to delete your information as well.

We will not discriminate against you in any way for exercising these rights.

We do not sell your information for monetary consideration, and we do not disclose your information for any other form of consideration. If we enter into any agreements in the future that fall within the definition of "sale" under the CCPA, we will update this privacy policy and our compliance with the CCPA.

You may submit a request through someone who holds a power of attorney. You may also submit a request through an authorized agent, but only if you (1) provide the authorized agent with your written permission to make the request and (2) verify your own identity directly with us. We require the agent to submit proof to us of their authority to make the request on your behalf.

During the past 12 months, we have collected information in the following categories from the indicated sources, used the information for the indicated business purposes, and shared it with the indicated categories of third parties. The information categories include information we collect from our website visitors, registered users, suppliers, and anyone else who interacts with us online or offline. Not all information is collected about all individuals. For example, we may collect different information from job applicants, suppliers, or customers.

*More specifically, these business purposes include:

1. Providing services to you:

   • Administering or otherwise performing our obligations in connection with a contract we are party to

   • Helping you complete a transaction or order

   • Enabling tracking of shipments

   • Preparing and processing invoices

   • Responding to questions or requests and providing service and support

   • Managing customer relationships after purchase

   • Creating and managing our customer accounts

   • Informing you of changes to our services and products

   • Administering campaigns, drawings, surveys or contests

   • Informing you about our products and services

   • Offering our products and services in a personalized manner, for example we may provide suggestions based on your previous inquiries so you can find appropriate products and services more quickly.

2. Audit of transactions, internal research and development:

   • Enabling internal business administration and operations, including troubleshooting, customization, improvement or development of websites, testing, research, administration and operation of our websites, and data analysis

   • Creating products or services that may meet your needs

   • Measuring the results of marketing initiatives, advertisements and websites that are "run by" another company on our behalf.

3. Security detection, protection and compliance, troubleshooting/debugging of features:

   • As part of our work to keep our websites secure

   • Ensuring the security of your account and our operations, preventing or detecting fraud, malicious activity or misuse of our websites, for example by requesting verification information to reset your account password (if applicable)

   • Ensuring the physical security of our premises by reviewing surveillance footage

   • Resolving disputes, protecting our, our users' and others' rights, safety and interests, and fulfilling our legal obligations.

4. Quality assurance:

   • Monitoring quality control and ensuring that our legal obligations, rules, regulations, policies and procedures are followed

   • Developing and improving our products and services, for example by reviewing visits to websites and various subpages, demand for specific products and services, and user feedback.

Contact us for more information: If you have questions or concerns about our privacy notice and our practices, you can contact us using the contact information provided in the Who are we? section of this privacy notice.

15. Notice to Residents of Europe (EEA)

In accordance with the General Data Protection Regulation (GDPR), anyone residing in the European Economic Area (EEA) can exercise the following rights:

• Right to information

• Right to access

• Right to rectification

• Right to erasure

• Right to restrict processing

• Right to data portability

• Right to object

• Right not to be subject to automated decision-making

To exercise any of the rights listed above, you must follow the obligations set out in section 12 of this privacy notice.

From the date we receive your request, we will respond to you within a maximum of 30 days, unless we request more time.

16. Notice to Residents of Argentina

Under the Ley de Protección de Datos Personales 25.326, you have the right to access, rectification, update and deletion. To exercise your rights or your right to withdraw or raise any doubts or complaints regarding the processing of your personal information, you can contact us at dpo@euronetworldwide.com in accordance with the instructions in section 12.

You are hereby informed that there are options available to you to limit how we use or disclose your personal information for specific processing.

From the date we receive your request, we will respond to you within a maximum of 5 days (for requests to delete or update your personal information) or within a maximum of 10 days (for requests to access your personal information).

17. Notice to Residents of Mexico

Ria México (the term defined below), with the address for hearing and receiving notices for purposes related to privacy and personal data protection as specified in section 22 and in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares ("Mexico's legislation"), its regulations and guidelines, makes this privacy notice available to its users or potential users as registered persons before personal information is collected, in strict compliance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality and accountability required under Mexico's legislation.

For the purpose of providing services as a money transfer provider under article 81-A Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito, Ria México will collect personal information, where applicable, in accordance with the legal bases mentioned in section 1 and for the following purposes:

1. To verify that the personal information contained on the voter ID card submitted to Ria México matches the Instituto Nacional Electoral's records.

2. To verify that the CURP information provided to Ria México matches the Registro Nacional de Población's records.

Additionally, and when required, to comply with article 4 and 4 Bis of the general provisions referred to in article 95 Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito applicable to the money transfer companies referred to in article 81-A Bis of the same law ("the provisions"), Ria México is legally required to obtain information about your geographic location as well as recordings of your voice and an image of your face to identify its users or potential users when this does not occur face-to-face, and to obtain other relevant information as explained in detail in the specific form available in the application that the provisions require. We will always process such information based on your consent.

You have the right to access, rectification, cancellation and objection to processing ("ARCO rights"). You also have the right to limit or withdraw your consent to processing of your personal information at any time, to the extent permitted by law. To exercise any of your ARCO rights, withdraw your consent, or raise any questions or complaints regarding the processing of your personal information, you can contact us at: dpo@euronetworldwide.com in accordance with the instructions in section 12.

We will respond to you no later than 20 days after the date we receive your request, and it will take effect no later than 15 business days after we have notified you of our response.

18. Notice to Residents of Chile

By law, you have the right to access, rectification, cancellation and objection to processing ("ARCO rights"). You also have the right to withdraw consent given to processing of your personal information at any time, to the extent permitted by law. To exercise your ARCO rights or your right to withdraw or raise any doubts or complaints regarding the processing of your personal information, you can contact us at dpo@euronetworldwide.com in accordance with the instructions in section 12.

You are hereby informed that there are options available to you to limit how we use or disclose your personal information for specific processing.

From the date we receive your request, we will respond to you within a maximum of 2 days.

19. Notice to Residents of Malaysia

In accordance with the Personal Data Protection Act 2010 ("PDPA"), customers may provide us with their personal information for any of the purposes stated in section 2 of this privacy notice. If we were to process your personal information for any additional purpose, we will inform you in advance or request your explicit consent.

You may exercise the rights set out in section 10 at any time. You may also withdraw your consent unless the processing is necessary to fulfill any legal obligation or to provide you with any of our services. You may also object to processing if you believe such processing may cause harm or concern to you.

From the date we receive your request, we will respond to you within a maximum of 21 days.

In accordance with the terms of the PDPA, RIA has the right to charge a fee for processing all requests for access to information.

20. Notice to Residents of New Zealand

For residents of New Zealand, the rights that can be exercised with respect to the processing of personal information are the rights set out in section 12. Note that to exercise any of your rights, you must follow the instructions in section 12 mentioned above.

From the date we receive your request, we will respond to you within a maximum of 20 days.

21. Notice to Residents of Australia

For residents of Australia, the rights that can be exercised with respect to the processing of personal information are the rights set out in section 12. Note that to exercise any of your rights, you must follow the instructions in section 12 mentioned above.

You may also ask us to explain our information policy and practices under applicable law.

From the date we receive your request, we will respond to you within a maximum of 30 days.

22. Notice to Residents of India

For residents of India, the rights that can be exercised with respect to the processing of personal information are the rights set out in section 12. Note that to exercise any of your rights, you must follow the instructions in section 12 mentioned above.

Additionally, you may exercise your right to data portability and the right not to be subject to automated decision-making that produces legal effects such as profiling, unless such profiling is necessary to provide you with any of our services.

From the date we receive your request, we will respond to you within a maximum of 30 days.

23. Our Company by Service

The data controller is Ria, represented by the companies below depending on country and service:

Money Transfer Service

Ria stores and currency exchange services.

You can always submit a request to our data protection officer by sending an email to the following address: dpo@euronetworldwide.com .