Customer Data Protection Policy (GDPR) and DPIA Summary

Protecting the personal and financial information of our customers is central to how AYDAPAY works. This Policy explains, in clear language, what personal data we hold, why we hold it, who we share it with, how long we keep it, how we keep it secure and what rights you have. It applies to Individual Customers, representatives, directors, beneficial owners and authorised users of Business Customers, payees, and anyone who contacts us.

This Policy should be read together with our Privacy Policy (which also covers cookies and our website) and clause 17 of the Customer Account Agreement. If there is any conflict, the Customer Account Agreement prevails.

1. Our commitments to you

• We never sell your personal data and never share it for other companies' marketing.
• We collect only the data we need, and use it only for the purposes described in this Policy.
• We keep your payment information confidential under the professional secrecy rules of the Polish Act on Payment Services.
• We protect your data with technical and organisational security measures appropriate to a regulated financial service.
• No account is refused or closed, and no payment is permanently rejected, solely by an automated system: a trained member of staff always reviews the decision.
• We respond to data protection requests within one month, free of charge.

2. Who is responsible for your data

AYDAPAY SP. Z O.O. is the controller of your personal data for the AYDAPAY App, website and AYDAPAY Services. For data protection questions or to exercise your rights, contact us:

• Email: help@aydapay.com (subject: "Data Protection")
• In the App: Support / Help section
• Post: AYDAPAY SP. Z O.O. – Data Protection, Aleja Armii Ludowej 6/164, 00-571 Warsaw, Poland

Where a service in the App is provided by one of our regulated partners under its own licence ("Partner Services", Customer Account Agreement clause 1.4), that partner processes your data as an independent controller under its own privacy notice, which we provide on request. AYDAPAY remains your single point of contact for all data protection questions.

3. What personal data we collect

AYDAPAY services are for adults only. We do not knowingly collect data from anyone under 18.

4. Why we use your data and our legal basis

5. Identity verification, biometrics and automated decisions

• We verify identity using a regulated-grade identity verification provider that checks your document and performs a liveness check and face match. Biometric data is used only to confirm your identity and is not used for any other purpose.
• Biometric data is kept only for as long as needed to complete verification. We keep the verification result and the audit record, as required by anti-money laundering law.
• We use automated systems, including AI-assisted tools, for identity verification, sanctions screening, fraud detection and transaction monitoring. Alerts are reviewed by trained staff.
• If a decision based solely on automated processing has a legal or similarly significant effect on you, you can ask for human review, express your point of view and contest the decision (GDPR Art. 22).

6. Who we share your data with

We share personal data only where necessary and only with:

• Regulated partners – our Banking Partner, Money Transfer Partner and licensed payout partners in the destination country, to provide and execute your payments;
• Service providers acting on our instructions – identity verification, sanctions and PEP screening, fraud prevention, cloud hosting, communications and customer support tools;
• Professional advisers – auditors and legal advisers, under confidentiality obligations;
• Public authorities – including the Polish Financial Supervision Authority (KNF), the General Inspector of Financial Information (GIIF), tax authorities, courts and law enforcement, only where the law requires it.

Every service provider that processes data on our behalf is bound by a written data processing agreement under GDPR Art. 28, is subject to due diligence before appointment and may use the data only to provide its service to AYDAPAY.

7. International transfers

Some recipients are located outside the European Economic Area (EEA). We transfer data outside the EEA only where:

• the European Commission has recognised the country as providing adequate protection (for example, the United Kingdom);
• we have put in place the European Commission's Standard Contractual Clauses together with a transfer risk assessment; or
• the transfer is necessary to perform a payment you have instructed to a recipient in that country (GDPR Art. 49(1)(b)).

You may request information about the safeguards applied to a transfer by contacting us.

8. How long we keep your data

At the end of the retention period, data is securely deleted or irreversibly anonymised.

9. How we keep your data secure

We apply technical and organisational measures appropriate to the risks of a regulated payment service, including:

• Encryption of data in transit and at rest;
• Strong Customer Authentication for log-in and payments, device binding and automatic session timeout;
• Role-based access control on a need-to-know basis, with access logs and restricted access to compliance records;
• Tamper-evident logging and continuous monitoring of our systems for suspicious activity;
• Data minimisation – we send providers only the data they need;
• Data Protection Impact Assessments for high-risk processing, such as biometric verification and automated monitoring;
• Staff confidentiality undertakings and regular data protection, security and AML training;
• Vendor due diligence and contractual audit rights over our processors;
• Regular security testing, including independent penetration testing, and business continuity arrangements.

9A. Data Protection Impact Assessment (DPIA) – public summary

Under GDPR Art. 35 and the list of processing operations published by the President of UODO, we have carried out a Data Protection Impact Assessment for our highest-risk processing. It is approved by the Management Board and reviewed at least annually, and whenever our providers, models or monitoring rules change.

Outcome: with these measures in place the residual risk is acceptable, so prior consultation with the President of UODO under GDPR Art. 36 is not required. The full DPIA is available to the supervisory authority on request.

10. If a data breach happens

We maintain a documented Personal Data Breach Procedure. If a breach is likely to result in a risk to individuals, we notify the President of the Personal Data Protection Office (UODO) within 72 hours of becoming aware of it. If the risk to you is high, we tell you without undue delay, in clear language, what happened, what we have done and what you should do to protect yourself. Every breach, whether notified or not, is recorded and reviewed so that it does not happen again.

11. Your rights

How to exercise your rights: contact us through the App or at help@aydapay.com. We will verify your identity using your App log-in or registered email address, and reply within one month (extendable by two further months for complex requests, in which case we will tell you why within the first month). Requests are free of charge unless they are manifestly unfounded or excessive.

Legal limits: some rights are limited where the law requires us to keep data – for example, anti-money laundering records must be kept for 5 years. The law may also prevent us from disclosing certain information connected with anti-money laundering reviews or reports to the authorities.

12. How you can protect your data

• AYDAPAY will never ask you for your password or one-time codes, ask you to move money to a "safe account", or ask you to install remote-access software.
• We contact you only through the App, www.aydapay.com, emails from the aydapay.com domain and our official phone numbers.
• Keep your device locked and your App updated, and report any suspicious contact or unrecognised activity immediately to help@aydapay.com or through the App.

13. Complaints to the supervisory authority

If you are unhappy with how we handle your data, please contact us first so that we can put it right. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl, or with the data protection authority in the EU/EEA country where you live or work.

14. Changes to this Policy

We review this Policy at least once a year. If we make significant changes, we will inform you in the App or by email before they take effect. The current version is always available on our website and in the App.

AYDAPAY SP. Z O.O. · Aleja Armii Ludowej 6/164, 00-571 Warsaw, Poland · KRS 0001036277 · NIP 5214021930 · REGON 525460979 · help@aydapay.com