Privacy Notice

This privacy notice (“Privacy Notice”) explains how we, Throo, (“we”, “our” “us”) collect, use, store, share with other parties, and otherwise process your (collectively, “you”, “your”) personal data (“Personal Data”) we obtain as a result of the visit and/or use of our website www.throo.com (“Website”).

By visiting or using our Website, you acknowledge that you have read, understood, and agree to be bound by this Privacy Notice. You should not provide us with any of your information if you do not agree with the terms of this Privacy Notice.

To the extent this Website allows access to other websites owned and operated by third parties, please note that this Privacy Notice will not apply to such websites, and we will, thus, not be held responsible for the protection of personal data processed by these third parties.

1. Who we are.

Throo, as part of Euronet Worldwide (“We”, “Us”).

Throo is a company registered under the name Throo Payments Europe, UAB, a company incorporated in the Republic of Lithuania under company number 305886592, with registered address at Gedimino av. 20, LT-01103, Vilnius.

We, as the data controller, are committed to safeguarding your right to privacy and your Personal Data in accordance with the applicable legislative and regulatory framework.

We encourage you to regularly review this Privacy Notice and check the Website for any updates. By continuing to deal with us, you agree to this Privacy Notice and any future modifications.

If you have any questions or concerns regarding the processing of your Personal Data, you may contact us any time at: dpo@euronetworldwide.com

2. What Personal Data is collected, how we collect these, and why?

The categories, sources, purposes, and legal bases for collecting and processing your Personal Data when you visit and/or use our Website are listed below. Where the collection and processing of Personal Data is based on your consent, you may withdraw your consent at any time.

• 2.1. Categories of Personal Data we collect.

We collect your Personal Data when you visit and/or use our Website or when you provide these to us in connection with your use of the Website, including when you visit the Website and complete the online forms provided through it, or when you submit any other requests for information or complaints in relation to the operation or use of this Website.

These data may include the following:

Identification and contact data: your name (or names), business name, postcode, email, telephone number and other contact data, title, date of birth, gender, signature, images, unique identifiers, as well as any other Personal Data that may be included in your online enquiry, request for information or complaint in relation to the operation or use of this Website.

It is possible that, during a process of responding and processing an online enquiry, request for information or complaint, or at a later stage, especially during correspondence with us or in the course of telephone conversations with our representatives, you will provide us with additional information. In such case, we will process the Personal Data you provided us with as set out in this Privacy Notice.

• Behavioral and technical data: information via cookies and similar technologies, including the IP address of visits, internet or other similar network, browsing or search activity, behavioral information (to understand the way you behave while using our Website), browser type and version, time zone setting, screen resolution settings, browser plug-in types and versions, operating system and platform, device signature, and technical characteristics of your device.

• Non-identifiable Data: Whenever possible, we use data where you cannot be directly identified (such as anonymous demographic and usage data) rather than Personal Data (“Non-identifiable Data”). These Non-identifiable Data may be used to improve our internal processes or delivery of services, without further notice to you. We may use aggregate data for a variety of purposes, including to analyze, evaluate and improve our Website and its content.

• 2.1.1. Where do we collect your Personal Data from?

We collect Personal Data from the following sources:

• Directly from you through your direct interactions and the submission of online forms, requests for information or complaints, as set out above.

• Through passive collection of information about your interactions, including page clicks, time spent, or other automatically collected meta-data.

• Internet service providers.

• Why do we collect and use your Personal Data?

We collect and use your Personal Data to pursue the following purposes:

• We may process your Personal Data in the context of your contractual relationship (art. 6 (1) (b) GDPR) with us:

• We may process your Personal Data for the purposes of our legitimate interests (art. 6 (1) (f) GDPR). When we use your Personal Data to pursue our legitimate interests, we will make every effort to ensure that your Personal Data will only be used as permitted by applicable law and that such use will not override your interests or fundamental rights and freedoms that require protection:

• To ensure the efficient operation, management, safety and security of our Website

  Please note that, amongst other safeguards, we have tools that protect our Website for the purposes of fraud prevention and security controls. This information relates to the IP connection or the device you may be accessing from, and other relevant information that assists in the protection of the Website and the information we process.

• To undertake activities to verify or maintain the quality of the Website, and to improve, upgrade, or enhance the Website, including to administer the Website for internal operations, such as troubleshooting, data analysis, testing, research, statistical and survey purposes.

• To pursue any legal claims, as well as for archival purposes related to this purpose, including securing information in the event of the need to prove facts.

• We may process your Personal Data if you have previously provided us with your consent (art. 6 (1) (a) GDPR) to provide advertising and marketing.

3. How long do we keep Personal Data?

Personal Data are kept for as long as it is necessary to achieve the purposes for which the Personal Data were collected and is subject to different standards and regulations. In general, Personal Data are retained for as long as necessary to process your enquiry, request for information or complaint or as otherwise may be required for purposes of complying with applicable legal and regulatory obligations. The retention period is determined based on the applicable requirements and obligations, which may include (to the extent relevant):

• Legal and Regulatory Requirements: We will retain your Personal Data if required to comply with all our legal and regulatory obligations, compliance procedures and statutory limitation periods. While we store your Personal Data only for the purposes of complying with legal and regulatory obligations, your Personal Data will be restricted such that they cannot be used for any other purpose, and they will be accessed only when necessary. We will take all reasonable steps to delete the data you have requested us to delete. Please note, however, that some data may be retained for legal or regulatory purposes, or for the purposes of protecting our business or other legal interests.

• Customer Service and Contractual relationship (administration of customer relationship, complaint handling, etc.): If you provide us with your Personal Data, we may (subject to any legal or regulatory considerations) retain your Personal Data for as long as necessary to deal with your online enquiry, or request of information or complaint. Please note that in the latter case, if your application is not accepted, we will delete all Personal Data you have shared with us.

4. Do we disclose your Personal Data?

Except as may otherwise be provided in this Privacy Notice, we may disclose your Personal Data for business purposes or to meet legal obligations as outlined below:

• Within the Euronet Group: We may share your Personal Data with Euronet and Euronet Group affiliates where it is necessary in order to enable or facilitate us to process your enquiry, request for information or complaint (as described above) or to otherwise pursue the purposes described in this Privacy Notice, or for purposes of compliance with Group obligations.

• To third-party service providers: We may share the Personal Data we collect with third-party service providers that assist us with certain technical, operational, regulatory of compliance tasks. By way of example, such third-party service providers may include database and website administration professionals, providers of development services, maintenance, customization of IT infrastructure, advertisers or advertising networks and social media companies to place personalized advertisements in digital services and to adapt to consumer preferences. For additional information regarding which providers have access and why they have access to your Personal Data, you may reach us at dpo@euronetworldwide.com.

• Corporate process: We may transfer your Personal Data to a third party as a result of a sale, acquisition, merger, or re-organisation involving Euronet, a company within the Euronet Group, or any of their respective assets. In these circumstances, we will take reasonably appropriate steps to ensure that your information is properly protected.

• Legal and regulatory: We may also disclose your Personal Data with entities that are entitled to request it under applicable law, including judicial or supervisory authorities as well as other public authorities within the scope of their competence.

• Professional Partners: We will share your Personal Data with advisers, lawyers, consultants, auditors, or accountants to comply with our legal obligations and to perform our contractual obligations and provide our services in accordance with best practices.

Do we share Personal Data outside of the EEA?

As explained above, we may share your Personal Data within the Euronet Group, which may involve transferring your data outside of the EEA. It is important for you to note that while the laws on holding data in the countries to which we may transfer your data may be less stringent than the laws of your country, we intend to adhere to the principles set forth in this Privacy Notice, unless otherwise required by applicable laws.

If we share Personal Data with third-party service providers based outside of the EEA, we will ensure a level of protection and safeguarding of your Personal Data in accordance with the applicable data protection laws.

Minors

We do not provide services directly to children under 18 or proactively collect their personal information. If you are under 18, please do not use our Website or offerings or share Personal Data with us. If you learn that anyone younger than 18 has unlawfully provided us Personal Data, please contact us at dpo@euronetworldwide.com.

Why would you receive electronic communications?

Depending on the country you are based in, you will receive marketing communications if you have authorized us to process your Personal Data for these purposes. That means you have opted-in during the registration process or otherwise.

We may also send you electronic communications for marketing purposes when you have a contractual relationship with us, meaning when you are currently using our services or when you haven’t expressly requested to not receive said marketing communications.

You will always be informed and we will make sure that during the usage of our services or even during the registration process or at any other relevant time, you have all the necessary information in order for you to be aware that your Personal Data may be used for that specific purpose and you will, during the registration process or during the usage of our services be given the opportunity to expressly say that you are not interested in receiving such marketing communications. In these instances, we will remove you from our list and you will not receive any updates that may be of your interest regarding our services and products. You will be able to opt-back in at any time.

How can you withdraw your consent?

You will be able to withdraw your consent at any time by using one of the following mechanisms:

• Use the opt-out link you will receive in any of our communications.

• By sending an email at dpo@euronetworldwide.com

If you have any additional questions regarding the usage of your Personal Data for marketing purposes and/or wish to start receiving marketing communications, you can also send an email to dpo@euronetworldwide.com.

Description of Personal Data Rights

Depending on where you live, your Personal Data Rights under applicable law may include:

• Right to Access:

  the right to request access to a copy of your Personal Data.

• Right to Correct Inaccuracies:

  the right to request correction of inaccuracies in your Personal Data.

• Right to Deletion:

  the right to request deletion of your Personal Data where certain conditions apply.

• Opt-Out Rights:

  • The right to opt-out of the processing of Personal Data for the purposes of targeted advertising.

  • The right to opt out of the processing of personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning the Data Subject.

• Right to Restrict Processing:

  the right to restrict processing where certain conditions apply.

• Right to Data Portability:

  the right to receive Personal Data in a structured, commonly used and machine-readable format and have the right to transmit the Personal Data to another controller under certain conditions.

• Right to Object:

  the right to object to the processing of Personal Data (i.e., for direct marketing purposes).

• Rights related to Automated Individual Decision-Making:

  the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on the individual.

We will respond to your request as soon as possible and within the timeframe stated in the applicable law.

For applicable rights please refer to the Regional Privacy Notice section below.

To exercise any of your rights, you must send an email to dpo@euronetworldwide.com. To help protect your privacy and maintain security we will take necessary steps to verify your identity and may ask you to provide other details before granting you access to your Personal Data or initiating a modification of any Personal Data. When required, if we don’t have a copy of your ID or any legal valid document that proves your identity, we will not be able to answer your request.

Be aware that some rights may not be enforceable due to business needs or legal obligations while providing you with the service. Your rights may be limited to comply with other legal obligations such as anti-money laundering, contractual and compliance obligations. Notwithstanding that you will always be responded to when exercising any of the rights stated above and/or any additional right you may have depending on your jurisdiction. If your rights can’t be enforced, you will always receive a proper explanation.

Privacy Complaints

If you have a complaint regarding our processing of your Personal Data, you may contact us at dpo@euronetworldwide.com.

Depending on the applicable privacy law, you may have the right to make a complaint to a Data Protection Authority or other regulatory body if you believe we have failed to comply with our obligations under this Privacy Notice or the applicable law:

• Europe (EEA): Members | European Data Protection Board (europa.eu)

• Greece: | Hellenic Data Protection Authority (dpa.gr)