WHAT – Information we hold about you The information we collect will often be shared with us by you directly (e.g. when you apply for a new service or product) this includes but is not limited to the following information:

• Personal details (e.g. name, date of birth, passport information or other identification information);
• Contact details (e.g. phone number, email address, postal address or mobile number);
• Biometric information (e.g. voice recognition when you call our call centres, as well as facial recognition for certain products);
• Transactional details (e.g. payments you make and receive);
• Financial information (e.g. bank account number, credit or debit card numbers, financial history) including information you provide for the purposes of providing payment initiation services and account information services regarding accounts you hold with other providers;
• Information about criminal convictions and offences (e.g. for mortgage applications); and

If you do not provide personal data that we tell you is mandatory, it may mean that we are unable to provide you with the services and/or perform all of our obligations under our agreement with you.

We will also hold information we collect about you from other sources, this will include:

• The way you are using our telephone services, websites or mobile applications;
• Your interactions with us, for example, through social media or other channels;
• Your digital devices where we perform various checks designed to ascertain and verify your residency to ensure we meet our regulatory obligations. These checks include identifying the IP address your device connects from and the collection of information about your use of the website or mobile app (including device type, operating system, screen resolution, and the way you interact with us);
• The way you use your accounts, including information about payments you make or receive such as the date, amount, currency and the details of the payee or payer (for example, retailers or other individuals);
• Information from credit reference agencies and fraud prevention agencies;
• Publicly available information about you which is available online or otherwise;
• Criminal record checks and information;
• Employers;
• People appointed to act on your behalf;
• Credit reference agencies (who may check the information against other databases – public or private – to which they have access);
• Fraud prevention agencies; and
• Publicly available sources, such as media stories.

If you give us personal data about other people (such as joint account holders) which we will use to provide services, or if you ask us to share that information with third parties, for example to provide payment initiation or account information services, then you confirm that you know that they are aware of the information in this notice about how we will use their personal data.

USE – How we use the information we hold We use the information discussed above in a number of ways:

• Processing applications and transactions;
• In order to provide you with products / services and perform our contract with you, if any, e.g. to make and receive payments;
• Verifying your identity (such as when you access your account information);
• Preventing fraud and enhancing the security of your account or our Electronic Banking Services;
• To determine your eligibility for products and services that Endcash offers;
• To help Endcash better understand the current and future needs of our customers;
• To communicate to you any benefit, feature and other information about products and services you have with Endcash;
• To improve the efficiency of the Electronic Banking Services;
• Responding to your requests and communicating with you;
• Managing your preferences;
• Performing analytics concerning your use of our Electronic Banking Services, including your responses to our emails and the pages and advertisements you view;
• Providing you tailored content and marketing messages;
• Operating, evaluating and improving our business (including developing new products and services; improving existing products and services; performing data analytics; and performing accounting, auditing and other internal functions);
• Complying with and enforcing applicable legal requirements, relevant industry standards, contractual obligations and our policies for example, obtaining proof of identity to enable us to meet our anti-money laundering obligations; and
• For any other purposes that we may specifically disclose at the time you provide or we collect your information.

SHARE – Who we share this information with The information about you collected by Endcash shall not be disclosed for purposes other than those stated above without your prior consent PROVIDED HOWEVER that:

• Endcash Limited is powered by Republic Bank Limited (RBL), so we work closely with other businesses and companies that fall under the RBL. We may share certain information with other RBL affiliates for example, to provide you with products or services, for marketing purposes, for internal reporting and where those companies provide services to us. Related to this we may also make this information available to RBL’s employees, agents and service providers and others who are required to maintain the confidentiality of this information.
• Independent third-party service providers who you (or a third party properly authorised to give instructions on your account) ask us to share information with, for example, payment initiation or account information services. If such information is shared with these third parties, we will have no control over how that information is used. You (or the person(s) with authority over your account) will need to agree the scope of such use directly with the third party.
• Other financial institutions (including correspondent banks) or persons with whom you have or may have financial and other business dealings, wherever located;
• Credit reporting agencies who may share it with others;
• Upon your request and with your consent, Endcash may give this information to other persons;
• Regulatory bodies and public authorities to the extent required by law.

SHARE – Who we share this information with You have certain rights regarding your personal data, subject to applicable legislation. These include the following rights to:

• Request a copy of the personal data we hold about you;
• Request that we supply you (or a nominated third party) with an electronic copy of the personal data that you have provided us with;
• Inform us of a correction to your personal data;
• Exercise your right to restrict our use of your personal data;
• Exercise your right to erase your personal data (subject to applicable legislation); or
• Object to particular ways in which we are using your personal data.

Your ability to exercise these rights will depend on a number of factors and in some instances, we will not be able to comply with your request e.g. because we have legitimate grounds for not doing so or where the right doesn't apply to the particular data we hold on you. If you would like more information on these rights, or wish to exercise them, please submit a request via Endcash.com or republictt.com. Please contact us to update or correct your information if it changes or if the personal data, we hold about you is inaccurate. A copy of this privacy notice can be requested from us using the contact details located on republictt.com. We may modify or update this privacy notice from time to time.

Retention of Data We will keep your personal data for as long as we have a relationship with you and/or as long as we are legally required to do so.

• We will only retain information that enables us to:
• Maintain business records for analysis and/or audit purposes;
• Comply with record retention requirements under the law (for example, as required under banking legislation and/or legislation concerning the prevention, detection and investigation of money laundering and terrorist financing);
• Defend or bring any existing or potential legal claims;
• Maintain records of anyone who does not want to receive marketing from us;
• Deal with any future complaints regarding the services we have delivered;
• Assist with fraud monitoring; or
• Assess the effectiveness of marketing that we may have sent you.

The retention period is often linked to the amount of time available to bring a legal claim, which in many cases, is six (6), or seven (7) years, following closure of your account or following a transaction. We will retain your personal data after this time if we are required to do so to comply with the law, if there are outstanding claims or complaints that will reasonably require your personal data to be retained, or for regulatory or technical reasons. If we do, we will continue to make sure your privacy is protected.

Accessing Your Contacts When you download our app and sign up, you may be asked to grant Endcash permission to access your contacts. Endcash will access the names, phone numbers and email addresses of your contacts to improve your search results, let you invite contacts and as otherwise permitted in our Privacy Policy. You can choose to deny the request if you so desire.

Syncing will find your contacts that use Endcash, so you can easily find, pay, and share payments with each other.

If you choose "Don't Allow" you can grant Endcash access to your contacts later by selecting Endcash in your device Settings and enabling Contacts.