PRIVACY POLICY

Consolidated for the United Arab Emirates and the State of Qatar

1. INTRODUCTION & PURPOSE

XSquare Payment Services & XSquare LLC (“XSquare”, “we”, “our” or “us”) is committed to protecting your Personal Data and privacy. This Privacy Policy explains how we collect, Process, store and use the Personal Data you provide to us, and helps you make informed decisions while using our Services.

This Privacy Policy has been developed for the purpose of compliance with the data protection laws applicable in each country in which we operate. The specific governing law, supervisory authority and local requirements for your country are set out in the Schedule for your jurisdiction:

• Schedule A - United Arab Emirates (UAE), applying the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL); and
• Schedule B - State of Qatar, applying Law No. 13 of 2016 Concerning Personal Data Privacy Protection (PDPPL).

Where the main body of this Policy and a Schedule address the same matter, the Schedule for your jurisdiction prevails for that country. This Policy forms part of your customer relationship with us and also serves as our data privacy notice. Without information about you, we may be unable to provide the Services or support your request. Some information is collected to comply with applicable laws, including anti-money laundering laws.

2. APPLICABILITY OF THIS POLICY

This Privacy Policy applies uniformly to our sites, mobile applications, APIs, and all devices, functionalities, features, technologies and other services (collectively, the “Platform”). It must be read together with the Terms of Use of the Platform. By using our Services you acknowledge that internet transmissions are never completely private or secure, and that any message or information you send to the Platform may be read or intercepted by others, even where a particular transmission (for example, card or account information) is encrypted.

3. DEFINITIONS

XSquare Associates means such entities that provide joint services with XSquare, including banks and third-party service providers such as operators of payment gateways or other vendors engaged by XSquare to provide its Services. Any reference to “third parties” in this Policy includes such entities.

Services means any services, and all related XSquare platforms, applications and services offered to you by XSquare in connection with your XSquare account.

Personal Data means any information relating to an identified or identifiable natural person — a person who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, or one or more factors specific to their physical, physiological, biometric, mental, economic, cultural or social identity. It can include name, postal address (including billing and shipping addresses), telephone number, email address, card number, bank account number, other financial account information, date of birth, and government-issued credentials (e.g. driving license, passport). It does not include information that does not identify a specific natural person.

Process / Processing means any operation performed on Personal Data, including its collection, storage, recording, organization, adaptation, modification, retrieval, exchange, sharing, use, disclosure by transmission, dissemination, alignment or combination, restriction, erasure, or destruction.

Sites means XSquare's Platform, official social media portals, or other online properties through which XSquare offers the Services and which reference this Privacy Policy.

Supervisory Authority means the data protection regulator identified for your jurisdiction in the applicable Schedule.

4. PERSONAL DATA PROTECTION PRINCIPLES

Your Personal Data is collected and processed in accordance with the relevant data protection principles, including: lawfulness, fairness and transparency; purpose limitation; collection limitation; data minimization; accuracy and rectification; storage limitation; and integrity and confidentiality (security) — in each case as required by the applicable law of your jurisdiction.

5. ACCEPTANCE OF THIS POLICY

By accepting this Privacy Policy and the Terms of Use, you expressly consent to our collection, storage, Processing, use and disclosure of your Personal Data as described here. If you do not agree with any part of this Policy or the Terms of Use, you must not use or access our Platform.

By applying or signing up for our Services, you authorize us to obtain from, and disclose to, third parties any Personal Data about you in connection with identity/account verification, fraud detection, or as otherwise permitted or required by applicable law. You represent that you have the legal authority to enter into these terms on your own or your organization’s behalf and to provide Personal Data relating to your organization’s directors, principals and beneficial owners, as required under applicable anti-money laundering law.

You may withdraw your consent. Withdrawal does not affect the lawfulness of Processing based on consent given before withdrawal, and takes effect within the period specified in the applicable Schedule after submission of the request to [email protected]. Withdrawal of consent may limit our ability to provide Services, and at XSquare's discretion may be permitted only after closure of your XSquare account.

6. CHANGES TO THIS POLICY

We may revise this Privacy Policy from time to time to reflect changes to our business, the Sites/Services, or applicable law. The revised Policy is effective from its published Effective Date. Material changes may be prominently posted on the relevant Platform and notified when you log in. You should familiarize yourself with the current version periodically.

7. PERSONAL DATA WE COLLECT

We collect the following Personal Data about you:

• When you set up an account, avail any Service, or download/access any component of our Platform: name, postal address, age, mobile/telephone number, email address, and other identification information necessary to set up the account. As XSquare primarily operates in the B2B segment, we also collect information relating to the organization being registered (financial statements, bank statements, bank account details, communication address) and Personal Data of its directors and ultimate beneficial owners.
• After obtaining your consent at registration: Device ID (to map the application to your device); SMS (to enter the activation code); browser, operating system, domain name, IP address and application version details; and gallery and camera input when you upload KYC documents or an invoice.
• When you access our Platform to receive, process or send money: information about the transaction, including amounts, merchant information, funding instruments used, device information, technical usage data and geolocation information.
• Personal Data you provide about other participants in a transaction, including the name, postal address, telephone number and financial account information of a payee/payer.
• Additional information when you communicate with us, contact customer support or respond to a survey.
• Information relating to your suppliers or vendors, which may contain their Personal Data; you must ensure the supplier or vendor has given prior written consent, and we are not liable for any failure by you to obtain it.

By choosing to provide this Personal Data, you expressly consent to its transfer to, and storage on, XSquare / XSquare Associate servers, subject to the localization requirements in the applicable Schedule.

8. HOW WE COLLECT PERSONAL DATA

Data you provide directly

When you register, correspond with us by email, upload data, or submit queries or support requests, we collect the Personal Data you provide.

Data collected automatically

We may automatically receive and store technical information (browser and operating system, IP address, unique device identifiers, device type) and site-usage information (pages visited before and during your visit, time spent) to understand traffic patterns and improve the Platform.

Data collected from third-party services

We collect information, which may include Personal Data, from third-party partners and XSquare Associates who have your consent to share it. If you are a proprietor, director or beneficial owner of an organization using our Services, your Personal Data may be collected from the person registering that organization, and is Processed for anti-money laundering purposes.

9. STORAGE & RETENTION OF PERSONAL DATA

We retain Personal Data to fulfil our legal and regulatory obligations and to provide the Services. We may retain Personal Data for longer than the period you consent to where permitted by law. If your account is closed, we may mask Personal Data but reserve the right to retain and access it for compliance with applicable law. Storage location requirements are set out in the applicable Schedule.

10. USE OF PERSONAL DATA

We use Personal Data to: provide and improve the Services; perform creditworthiness and financial-standing checks and verify information; tailor your experience; provide content you may be interested in; resolve disputes and troubleshoot problems; promote safe Service and measure interest; inform you of offers, products and updates; detect and protect against error, fraud and criminal activity; and comply with applicable laws and enforce our Terms of Use.

When you use our Platform or send communications to XSquare or XSquare Associates, such information may be communicated through a third-party portal controlled by an XSquare Associate, and you consent to receiving communications via electronic records. Upon registration you agree to be contacted on your mobile or email for transaction authentication, content updates, and - where permitted - promotional messages. We do not sell or rent Personal Data to anyone.

11. AGGREGATED, ANONYMISED & DE-IDENTIFIED DATA

We may create and use aggregated, anonymized or de-identified data (such as statistical or demographic data) for any purpose, including to comply with legal obligations, detect and prevent misuse (including fraud and unauthorized payments), and enforce our Terms of Use. We may share such data with our group, service providers and key partners, taking necessary steps to ensure any cross-border transfer is secure and permitted under applicable data protection law.

12. IF YOU DO NOT PROVIDE NECESSARY PERSONAL DATA

If you fail, refuse or are unable to provide Personal Data that we need to provide the Services, or that we must collect by law (for example, identification information for anti-money laundering obligations), we may be unable to provide Services and may discontinue them and/or close your account. We will notify you at the earliest opportunity.

13. PROCESSING WITHOUT CONSENT

We may Process some Personal Data without your consent only where required or permitted by law - for example, data relating to proprietors, directors and beneficial owners to comply with AML/CFT requirements, or where compelled by a court or administrative order. Other situations include, without limitation:

• where Processing relates to Personal Data you have made publicly available;
• where Processing is necessary to initiate or defend legal claims or is associated with legal or judicial procedures;
• where Processing is necessary to perform a contract to which you are a party, or to act on your request to conclude, amend or terminate such a contract; and
• where Processing is necessary in the public interest, as recognized under the applicable law of your jurisdiction.

14. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

Any third party that receives Personal Data must protect it and use it only to carry out the services they perform for you or for XSquare, unless otherwise required or permitted by law. We contract with such third parties on terms no less protective than our obligations to you, and ensure Personal Data is retrieved or destroyed on termination of the relationship. With your prior consent, we may disclose relevant Personal Data:

• to XSquare Associates, suppliers or subcontractors as reasonably necessary to provide the Services;
• where legally required, to comply with applicable law, governmental requests, a court order or legal process, or to investigate or prevent suspected fraud, threats to safety, or violations of our policies;
• where necessary for proper management of credit or business risk;
• in connection with a merger, acquisition, financing, insolvency or sale of all or part of our business, in which case Personal Data may transfer as a business asset;
• to governmental bodies, regulatory and judicial authorities, and our advisers for compliance with legal obligations or the defense of legal claims (which may occur without your prior consent);
• to our group companies and affiliates for rendering Services and improving quality; and
• to other users of our Services with whom you interact, for example when you make a transaction.

We will not sell or rent your Personal Data to third parties for their marketing purposes without your explicit consent.

15. INTERNATIONAL TRANSFER OF PERSONAL DATA

Your Personal Data is stored and transferred in compliance with the applicable legislation of each jurisdiction in which we operate, and subject to the localization requirements in the applicable Schedule. Certain XSquare Associates (such as payment gateways and processors) may be located in a different jurisdiction from you or us; if you proceed with a transaction involving such an Associate, your Personal Data may become subject to the laws of that jurisdiction. For example, if you are located in the UAE or Qatar and your transaction is processed by a payment gateway located elsewhere, your Personal Data used to complete that transaction may be subject to disclosure under that country's laws. Where required, we take steps to ensure transfers are secure and permitted under applicable data protection law.

16. THIRD-PARTY ADVERTISING & ANALYTICS

We may allow certain XSquare Associates to deliver content and advertisements and to provide anonymous site metrics and analytics. These third parties may use cookies, web beacons and similar technologies to collect information such as your IP address, device identifiers, browsers used, pages viewed and conversion information. They are bound by confidentiality obligations and applicable law. This Policy does not cover third-party cookies or tracking technologies, which are governed by those third parties' own privacy policies.

17. LINKS TO THIRD-PARTY WEBSITES

Our Platform and communications may contain links to third-party websites that we do not own or operate and that are governed by their own privacy policies. We are not responsible for those policies and encourage you to review them. Such sites are typically used for advertising and marketing services; SMS and email notifications; international payment networks; financial and credit institutions; and auditors.

18. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

Subject to the applicable law of your jurisdiction, you have the following rights in respect of your Personal Data. The precise scope of each right, and the authority with which you may lodge a complaint, are set out in the applicable Schedule.

• Right to be informed - to know our identity and contact details, the purposes and legal basis of Processing, the recipients of your Personal Data, retention periods, and your rights.
• Right of access - to obtain the categories and purposes of Processing, recipients, storage controls, safeguards for cross-border transfer, and the procedure to complain to the Supervisory Authority.
• Right to rectification - to correct inaccurate, and complete incomplete, Personal Data.
• Right to erasure - to request deletion where the data is no longer necessary, you withdraw consent, you object to Processing, or the data was unlawfully Processed.
• Right to restrict Processing - where you contest accuracy, Processing is unlawful, or you require the data to establish or defend legal claims.
• Right to object / stop Processing - including Processing for direct marketing or statistical survey purposes.
• Right to data portability - to receive your Personal Data in a structured, commonly used, machine-readable format where Processing is based on consent or contract and carried out by automated means.
• Right to object to automated decision-making - where it has legal or similarly significant effects on you.
• Right to lodge a complaint - with the Supervisory Authority identified in the applicable Schedule.

We may refuse a request that is excessively repeated, contravenes a judicial proceeding or investigation, negatively affects data security, or relates to a third party's privacy.

19. SUBMITTING REQUESTS TO EXERCISE YOUR RIGHTS

We aim to respond to all legitimate requests without undue delay and within the timeframe specified in the applicable Schedule. Complex or numerous requests may take longer, in which case we will keep you updated. To exercise any right, contact us at [email protected]. We may request information to verify your identity before acting on a request.

20. PERSONAL DATA SECURITY

Our Platform has security measures in place to protect against loss, misuse and alteration of Personal Data under our control, including secure servers and access limited on a need-to-know basis. Card numbers, PINs, passwords and account information are encrypted in accordance with the requirements of the financial regulator identified in the applicable Schedule. You are responsible for keeping your password and account information confidential and accurate. No security system is impenetrable; you acknowledge the residual risks of internet transmission, and that we may not encrypt all content or communications to and from our Platform.

21. CHOICE OF OPT IN / OPT OUT

After setting up an account, you may opt out of receiving non-essential (promotional or marketing) communications from us and on behalf of our partners. To remove your contact information from our lists and newsletters, please use the unsubscribe option provided.

22. GENERAL

This Policy does not apply to companies that XSquare does not own or control, or to people XSquare does not employ or manage. If you have any questions, please write to XSquare Customer Support at [email protected]. Data protection and rights queries should be sent to [email protected].

SCHEDULE A

Jurisdiction-Specific Provisions - United Arab Emirates

This Schedule applies to customers and users located in, resident in, or registered in the United Arab Emirates, and prevails over the main body of this Policy in respect of the matters below.

SCHEDULE B

Jurisdiction-Specific Provisions - State of Qatar

This Schedule applies to customers and users located in, resident in, or registered in the State of Qatar, and prevails over the main body of this Policy in respect of the matters below.