Globen Privacy and Personal Data Protection Policy

1.1 Controller

Payphone Global Inc., a corporation organized under the laws of the State of Wyoming, United States of America, with its principal office at 3561 FAU Blvd., Suite 400, Boca Raton, FL 33431 ("Payphone Global"), owns and operates the mobile application, web portal, APIs and other channels of the payments platform identified by the GLOBEN brand (the "Platform"). In this Policy, "GLOBEN", "we", "us" and "our" refer to Payphone Global and, when the service is provided outside the United States of America, to the subsidiary acting as the Contracting Entity under Section 15.

Payphone Global heads a corporate group made up of its subsidiaries and affiliates, including ECUAPAYPHONE C.A. (Ecuador), Payphone El Salvador S.A. de C.V., Payphone Guatemala S.A. and Payphone Nicaragua S.A. de C.V. (the "Group").

1.2 To Whom and to What This Policy Applies

This Policy describes how we collect, use, disclose, retain and protect the personal information of:

a) Users holding Personal Accounts and Business Accounts.

b) Legal representatives, attorneys-in-fact, owners, beneficial owners and control persons of Merchants.

c) Payers and cardholders who make payments to Merchants through the Platform.

d) Recipients of transfers and payments made through the Platform.

e) Visitors to our Website, prospects and people who contact us.

It applies to information collected through the App, the Website, the APIs, the payment button, payment links, our support channels (email, chat, phone and messaging), our social media pages and any other interaction with us.

This Policy does not apply to: (i) information about our employees and job applicants, which is governed by specific notices; (ii) third-party sites, applications or services, including those of Merchants, which have their own policies; or (iii) de-identified or aggregated information that cannot reasonably be linked to an individual.

Merchants and their customers. When we process information about a Merchant's customers to provide our service to that Merchant, we act on the Merchant's behalf as a service provider or processor, and the Merchant is responsible for informing its customers about its own privacy practices. For purposes of fraud prevention, anti-money laundering and sanctions compliance, and legal obligations, we process that information as an independent controller.

1.3 Relationship with the Terms and Conditions

This Policy forms an integral part of the GLOBEN App and Platform Terms and Conditions of Use (the "Terms"). Capitalized terms not defined here have the meaning given to them in the Terms. This Policy is issued in English and Spanish: for residents of the United States of America the English version prevails, and for Users to whom Section 15 applies the Spanish version prevails.

In the United States of America, we process personal information in accordance with applicable federal and state law, including, as applicable: the Gramm-Leach-Bliley Act (GLBA) and its Regulation P; Section 5 of the Federal Trade Commission Act; the FTC Safeguards Rule (16 C.F.R. Part 314); the Fair Credit Reporting Act (FCRA); the Bank Secrecy Act and the Customer Identification Program rules; the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), and other comprehensive state privacy laws; state biometric privacy laws, such as the Illinois Biometric Information Privacy Act (BIPA); the Children's Online Privacy Protection Act (COPPA); the CAN-SPAM Act; the Telephone Consumer Protection Act (TCPA); and state data breach notification laws. Outside the United States of America, we also apply the local laws indicated in Section 15.

Regardless of jurisdiction, we apply as a minimum standard the internationally recognized principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and accountability, including the Updated Principles on Privacy and Personal Data Protection of the Organization of American States (2021).

3.1 Information YouProvide to Us

a) Identifiersand identification data: name, username, postal address, email, phonenumber, date of birth, nationality, Social Security Number (SSN), ITIN, EIN orother tax identifier, identity document number and images (driver's license,passport or national ID) and signature.

b) Businessinformation (Business Accounts): legal name, trade name (DBA), tax identifier,formation documents, ownership structure, identification data of owners,beneficial owners and control persons, licenses, website, business activity,expected transaction volume and settlement bank account.

c) Financialinformation: bank account and routing numbers, card information (which wetokenize and do not retain in full), balances, transaction history, source anduse of funds, and tax forms (W-9 or W-8).

d) Communications:messages, inquiries and complaints you send us, call recordings (with priornotice), survey responses and participation in promotions.

e) Informationabout third parties: data about recipients of transfers or payments andcontacts that you choose to share with our authorization. You represent thatyou have the right to provide us with such information.

3.2 Information We CollectAutomatically

a) Deviceinformation: model, operating system, device and advertising identifiers,IP address, browser, language settings and mobile carrier.

b) Usageinformation: pages and screens visited, features used, access dates andtimes, error and security logs, and session data.

c) Location:approximate location derived from your IP address and, only if you allow it onyour device, precise location, which we use primarily for fraud prevention andsecurity.

d) Fraudprevention signals: device and connection characteristics, behavioralpatterns and device fingerprinting, used to detect unauthorized access andfraudulent transactions.

e) Cookies,pixels, SDKs and similar technologies, as described in Section 6.

3.3 Biometric Data

To verify your identity, we may ask you for a photograph (selfie) or aliveness video, from which our verification provider generates a facialgeometry template that is compared with the photograph on your identitydocument ("Biometric Data"). The processing of Biometric Data isgoverned by Section 5.

Your device's biometric unlock features (for example, Face ID, Touch IDor Android fingerprint recognition) are managed by your device's operatingsystem. GLOBEN does not receive or store that biometric information; it onlyreceives confirmation that authentication was successful.

3.4 Information We Obtainfrom Third Parties

a) Identityverification, KYC/KYB, sanctions and politically exposed persons screeningproviders.

b) Consumerreporting agencies (for example, to evaluate the owners or guarantors of aBusiness Account, with their authorization and in accordance with the FCRA).

c) Fraudprevention services and payments industry databases.

d) RegulatedPartners, acquiring and issuing banks, processors and Card Networks, regardingtransactions and disputes.

e) Bankaccount verification services, when you link a bank account through them.

f) Merchants,regarding their customers' transactions.

g) Groupcompanies.

h) Publicrecords and government sources (for example, corporate registries and taxregistries).

i) Socialnetworks, when you interact with us through them or use them to log in, inaccordance with your privacy settings.

j) Marketingand analytics partners.

3.5 Sensitive PersonalInformation

Some of the categories above constitute sensitive personal informationunder certain state laws, such as your SSN and other government identifiers,account login credentials, financial account numbers, precise geolocation andBiometric Data. We use this information only to provide the services yourequest, verify your identity, ensure the security and integrity of thePlatform, prevent fraud and comply with the law, and we do not use it to infercharacteristics about you.

We do not knowingly collect information about your health, racial orethnic origin, religious or philosophical beliefs, sexual orientation, sexlife, union membership or political opinions, unless required by law orvoluntarily provided by you.

3.6 Mandatory Information

Certain information is required to open and maintain a GLOBEN Account,particularly the information required by customer identification and anti-moneylaundering laws. If you do not provide it, we will not be able to provide theservice or will have to limit it.

We use personal information for the following purposes:

a) Providing and operating the services: opening and managing your account, processing collections, payments, transfers, withdrawals and subscriptions, managing the Digital Wallet, issuing receipts and providing support.

b) Verifying your identity and meeting due diligence obligations: Customer Identification Program, KYC/KYB, beneficial ownership identification, and sanctions and politically exposed persons screening.

c) Preventing fraud and managing risk: detecting and preventing fraudulent transactions, unauthorized access and abuse, managing chargebacks, bank alerts and preventive holds, and assessing account risk.

d) Complying with the law and industry rules: filing regulatory reports (including suspicious activity and currency transaction reports where applicable), meeting tax and information reporting obligations (for example, Form 1099-K), responding to requests from authorities and legal process, and complying with the Network Rules and Regulated Partner requirements.

e) Communicating with you: sending transactional, security and Terms-change notices, and responding to your inquiries.

f) Improving and developing products: conducting analytics, research, testing and feature development, using aggregated or de-identified information where possible.

g) Marketing and promotions: sending you information about GLOBEN and Group products and services, showing personalized advertising and running contests or promotions under their official rules, subject to your opt-out choices (Section 8).

h) Protecting rights and safety: enforcing the Terms, protecting the rights, property and safety of GLOBEN, our Users and the public, and establishing or defending legal claims.

i) Corporate transactions: in connection with a merger, acquisition, financing, reorganization or sale of assets.

j) Other purposes that we disclose to you at the time of collection or for which we obtain your consent.

Automated decisions. We use automated risk assessment and fraud detection systems that may result in the limitation, suspension or rejection of a transaction or an account. You may request human review of such decisions in accordance with Section 13.7 of the Terms.

Purpose. We collect Biometric Data solely to verify your identity, prevent fraud and protect your account.

b) Consent. Before collecting Biometric Data, we will inform you in writing of its purpose and retention period and obtain your express written consent, which may be given electronically in the App. You may choose an alternative verification method when we offer one.

c) Providers. Biometric Data is processed by our identity verification provider on our behalf, under a contract that prohibits it from using the data for any other purpose.

d) No commercialization. We do not sell, lease, trade or otherwise profit from Biometric Data.

e) Disclosure. We do not disclose Biometric Data except to our verification provider, with your consent, when necessary to complete a transaction you requested, or when required by law or court order.

f) Retention and destruction. We permanently destroy Biometric Data when the purpose for which it was collected has been satisfied or, at the latest, three (3) years after your last interaction with GLOBEN, whichever occurs first, unless a court order or legal obligation requires us to retain it longer.

g) Security. We protect Biometric Data using a standard of care equal to or more protective than the one we apply to other confidential information.

We use first-party and third-party cookies, pixels, web beacons, SDKs and similar technologies for the following purposes:

a) Strictly necessary: enabling login, maintaining security and preventing fraud.

b) Functionality: remembering your preferences.

c) Analytics: understanding how the Website and the App are used, and improving them.

d) Advertising: measuring campaigns and showing relevant ads on other sites and apps.

Some analytics and advertising partners (for example, Google and Meta) may collect information about your online activities over time and across different sites. We also use pixels in our emails to know whether they were opened.

Your choices. You can manage non-essential cookies through the cookie preferences panel on the Website, your browser settings and, on mobile devices, your operating system's advertising settings. You can also use the advertising industry's opt-out mechanisms, such as those of the Network Advertising Initiative and the Digital Advertising Alliance.

Opt-out preference signals. We treat Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of personal information for advertising, in the states where the law requires it. Because there is no uniform standard, we do not currently respond to browser "Do Not Track" signals.

We may disclose personal information to the following categories of recipients:

a) Group companies, to operate the Platform, provide support, ensure regulatory compliance and prevent fraud and, subject to your choices, for marketing.

b) Service providers acting on our behalf under contract (cloud hosting, identity verification, list screening, fraud prevention, customer support, communications, analytics, payment processing, collections and professional services), which are prohibited from using the information for their own purposes.

c) Regulated Partners, acquiring and issuing banks, processors, Card Networks and ACH network participants, to process transactions and as required by their rules.

d) Our commitments. We do not sell your personal information for monetary consideration. We do not share our customers' nonpublic personal information with nonaffiliated third parties for them to market their own products or services. The use of certain advertising cookies and pixels may be considered a "sale" or "sharing" of personal information under some state laws; you can opt out as described in Sections 8 and 9. the Merchant you pay receives the data necessary for the transaction (for example, name, email and purchase details); the payer receives the Merchant data shown on the receipt; and the recipient of a transfer sees your name or username.

e) Consumer reporting agencies and industry fraud prevention databases (including the Card Networks' high-risk merchant lists), in accordance with the law.

f) Government authorities, regulators, law enforcement and courts, when required by law, legal process or a regulatory request, or to protect rights and safety.

g) Auditors, legal and accounting advisors and insurers, bound by confidentiality.

h) Parties to a corporate transaction, such as a merger, acquisition or sale of assets, subject to confidentiality obligations.

i) Third parties with your consent or at your direction, for example, integrations you authorize.

j) Advertising and analytics partners, through cookies and similar technologies, as described in Section 6.

We may also share aggregated or de-identified information, which we commit not to re-identify.

Our commitments. We do not sell your personal information for monetary consideration. We do not share our customers' nonpublic personal information with nonaffiliated third parties for them to market their own products or services. The use of certain advertising cookies and pixels may be considered a "sale" or "sharing" of personal information under some state laws; you can opt out as described in Sections 8 and 9.

a) Marketing emails: you can unsubscribe using the link included in each email. We will continue to send you transactional and security communications.

b) Text messages: you can reply "STOP" to stop receiving marketing messages.

c) Push notifications and location: you can disable them in your device settings, although some security features may be affected.

d) Affiliate marketing: you can ask that Group companies not use the information we share with them to market their products to you by writing to [email protected]. Your choice will remain in effect for at least five (5) years and may be renewed.

e) Cookies and personalized advertising: as described in Section 6, through the "Your Privacy Choices" link on the Website and in the App, and through GPC signals.

f) Updating your information: you can update most of your information in the App.

g) Closing your account: you can request it under Section 17.2 of the Terms. We will retain certain information as described in Section 10.

9.1 Applicability

If you reside in California or another state with a comprehensive privacy law (for example, Virginia, Colorado, Connecticut, Utah, Texas or Oregon, among others), you may have the rights described in this Section, subject to the exemptions provided in those laws. Many of them exclude, in whole or in part, information subject to the GLBA or the FCRA, so some rights may not apply to information related to the financial services we provide to you.

9.2 Your Rights

Depending on your state of residence, you may have the right to:

a) Know and access the categories and specific pieces of personal information we have collected about you, its sources, the purposes and the categories of third parties to whom we disclose it.

b) Delete the personal information we have collected from you.

c) Correct inaccurate personal information.

d) Portability, meaning to receive your information in a usable format.

e) Opt out of the sale of your personal information, sharing for cross-context behavioral advertising and targeted advertising.

f) Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where the law provides.

g) Limit the use of your sensitive personal information. As stated in Section 3.5, we only use that information for the purposes permitted by law.

h) Not be discriminated or retaliated against for exercising your rights.

i) Appeal our decision on your request.

9.3 How to Exercise Your Rights

You can submit your request: (i) by writing to [email protected]; (ii) through the "Your Privacy Choices" link on the Website or in the App; or (iii) to opt out of sale or sharing, through the "Do Not Sell or Share My Personal Information" link or a GPC signal.

Verification. To protect your information, we will verify your identity by matching the data you provide with the data we have on file, and we may ask you for additional information. Identity verification is not required for opt-out requests.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. We will ask for permission signed by you and may verify your identity directly with you.

Timing. We will acknowledge receipt of your request within ten (10) Business Days and respond within forty-five (45) calendar days of receipt. If we need more time, we will inform you of the reason and may extend the period by an additional forty-five (45) calendar days.

Cost. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act on them, explaining the reason.

Appeals. If we deny your request in whole or in part, you may appeal by replying to our communication or by writing to [email protected] with the subject line "Appeal". We will respond within the period established by your state's law. If your appeal is denied, you may contact your state's Attorney General.

9.4 Additional Information for California Residents

Notice at collection. In the past twelve (12) months we have collected the categories of personal information described in Section 3 (identifiers; customer records; protected classification characteristics, such as age; commercial and transaction information; biometric information; internet activity; geolocation data; audio or visual information, such as call recordings; professional information, regarding Merchants; sensitive personal information; and inferences drawn from the foregoing), from the sources indicated in Section 3.4, for the purposes described in Section 4. We disclose those categories for business purposes to the recipients indicated in Section 7, and we retain them as described in Section 10.

Sale and sharing. We do not sell personal information for money. The advertising cookies and pixels described in Section 6 may constitute a "sale" or "sharing" of identifiers and internet activity information with advertising and analytics partners. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age.

Shine the Light. We do not share personal information with third parties for their own direct marketing purposes without your consent. California residents may request information about this once a year by writing to [email protected].

9.5 Nevada Residents

We do not sell covered information as defined in Chapter 603A of the Nevada Revised Statutes. Nevada residents may submit an opt-out request to [email protected].

We retain personal information for as long as necessary to fulfill the purposes for which it was collected and the applicable legal, regulatory, tax and contractual obligations, according to the following criteria:

Retention periods

Category	Retention period
Identification files (KYC/KYB) and transaction records	Ten (10) years after account closure, a period that covers the five (5)-year minimum required by the Bank Secrecy Act, or any longer period required by applicable law
Records of acceptance of the Terms and recurring billing consents	For the duration of the relationship and ten (10) additional years
Support communications and call recordings	Five (5) years from creation
Biometric Data	Until the verification purpose is satisfied and, at most, three (3) years from the last interaction (Section 5)
Marketing information and preferences	Until you withdraw your consent or the account is closed
Information about visitors and prospects without an account	Up to twenty-four (24) months from the last interaction
Cookies and similar technologies	Depending on their type, from the session duration up to twenty-four (24) months

These periods may be extended when there is an investigation, litigation, a legal hold or a request from an authority. Once they expire, we securely delete or de-identify the information.

We maintain a comprehensive information security program, in accordance with the FTC Safeguards Rule and industry standards, which includes: periodic risk assessments; encryption of information in transit and at rest; multi-factor authentication; access controls based on the principle of least privilege; PCI DSS compliance and tokenization of card data; vendor oversight; activity logging and monitoring; penetration testing; staff training; and an incident response plan.

No transmission or storage system is completely secure. You must protect your credentials and devices and notify us immediately at [email protected] if you suspect unauthorized access. GLOBEN will never ask for your password, PIN or verification codes by email, call or message.

Breach notification. If a security breach affecting your personal information occurs, we will notify you without unreasonable delay and within the timeframes established by applicable state laws, and we will inform the appropriate authorities, including the Federal Trade Commission when an event affects five hundred (500) or more people, in accordance with the FTC Safeguards Rule.

Payphone Global is headquartered in the United States of America, where we primarily process information. We may also process it in the countries where Group companies (including Ecuador, El Salvador, Guatemala and Nicaragua) and our providers operate. In all cases we apply appropriate safeguards, such as data processing agreements among Group companies, contractual clauses with providers, encryption and access controls, and the transfer mechanisms required by the law of the country where the data originates.

Our Website and the App may contain links to third-party sites and services, including social networks and government sites, whose privacy practices we do not control. We recommend that you read their policies.

If you contact us through WhatsApp or other messaging platforms or social networks, the information you share will also be subject to the policies of those platforms (for example, Meta Platforms, Inc.) and may be stored on servers outside your country. Do not share full card numbers, passwords or verification codes through those channels.

The Platform is not directed to children under thirteen (13) years of age, and we do not knowingly collect their personal information. We do not open accounts for persons under eighteen (18) years of age or the applicable age of majority, except under the limited option provided in Section 3.1 of the Terms, if ever enabled, and with the verifiable consent of their parent or legal guardian. If we learn that we have collected information from a child under thirteen (13) without such consent, we will delete it. If you are a parent or guardian and believe your child has provided us with information, write to us at [email protected].

15.1 General Rules

When the service is provided to you by a subsidiary of Payphone Global under the Terms, that company will be the controller of your data and will apply the data protection laws of your country, which will prevail over this Policy to the extent more protective. Payphone Global may act as joint controller or as processor with respect to the activities it performs to operate the Platform. For these Users, the Spanish version of this Policy prevails.

15.2 Ecuador

a) Controller: ECUAPAYPHONE C.A., a subsidiary of Payphone Global Inc., with RUC 0190402452001, domiciled at calle Pedro Calderón de la Barca y Gustavo Adolfo Bécquer, parroquia Yanuncay, Cuenca, Ecuador.

b) Applicable law: the Organic Law on Personal Data Protection (Ley Orgánica de Protección de Datos Personales, LOPDP) and its Regulations.

c) Legal bases: consent; performance of the contract; compliance with legal obligations, including those arising from its status as an entity supervised by the Central Bank of Ecuador and the Superintendency of Banks and from anti-money laundering regulations; and legitimate interest, under the terms of the LOPDP.

d) Rights: access, rectification and updating, erasure, objection, portability, suspension of processing and not to be subject to decisions based solely on automated assessments, which you may exercise at [email protected] within the timeframes established in the LOPDP. Adolescents over fifteen (15) years of age may exercise their rights directly, in accordance with the law.

e) Data Protection Officer: ECUAPAYPHONE C.A. has a designated Data Protection Officer, who may be contacted at [email protected].

f) Supervisory authority: the Superintendency of Personal Data Protection (Superintendencia de Protección de Datos Personales), with which you may file complaints.

g) International transfers: data may be transferred to Payphone Global in the United States of America and to providers in other countries, with appropriate safeguards and in accordance with the LOPDP and the provisions issued by the Superintendency of Personal Data Protection.

h) Specific recipients: in addition to those indicated in Section 7, data may be disclosed to the competent Ecuadorian authorities, such as the Financial and Economic Analysis Unit (UAFE), the Internal Revenue Service (SRI), the Superintendency of Banks, the Central Bank of Ecuador, the Superintendency of Companies, Securities and Insurance, the Attorney General's Office and the courts, in the cases provided by law.

15.3 El Salvador

Controller: Payphone El Salvador S.A. de C.V. The Salvadoran data protection regulations in effect and the Law Regulating Personal Credit History Information Services apply. You may exercise your rights at [email protected].

15.4 Guatemala

Controller: Payphone Guatemala S.A. In the absence of a general personal data protection law, we apply as a minimum standard the principles and rights of this Policy, the constitutional guarantees of privacy and access to information, and the applicable sector regulations. You may exercise your rights at [email protected].

15.5 Nicaragua

Controller: Payphone Nicaragua S.A. de C.V. Law 787, the Personal Data Protection Law, and its regulations apply. You may exercise your rights at [email protected].

15.6 Other Countries

When the service is provided directly by Payphone Global to Users in other countries, we will apply this Policy and, to the extent more protective, the data protection laws of the User's country.

We may update this Policy to reflect changes in our practices, the law or the services. We will indicate the date of the last update at the beginning of the document. If we make material changes, we will notify you at least thirty (30) calendar days in advance by email, in-App notification or prominent notice on the Website, and we will obtain your consent where required by law. We keep prior versions of this Policy, which you may request through the contact channels.

• Privacy and data protection: [email protected]
• Security (incident reporting): [email protected]
• General support: [email protected]
• Legal matters: [email protected]
• Mailing address: Payphone Global Inc., 3561 FAU Blvd., Suite 400, Boca Raton, FL 33431, United States of America. Attn: Privacy / Legal Department.
• Users in Ecuador: ECUAPAYPHONE C.A., Data Protection Officer, [email protected], Cuenca, Ecuador.