Last Updated: 2nd August 2018

Privacy Notice for Ecobank Rapidtransfer

We value the trust you place in us to protect your personal information and respect your right to privacy. While new technologies have dramatically changed the way information is gathered, used and stored, preserving customer trust and the privacy of personal information at Ecobank remains a core objective. “Ecobank” refers to each existing or hereinafter established banking subsidiary of Ecobank Transnational Incorporated (ETI), a public limited liability company, having its registered office at 2365, Boulevard du Mono, Lomé, Togo. We believe it is important to make clear to our customers how information is being collected, used and shared at Ecobank, the benefits such use provides, and the protections put in place against unauthorized access and use. We respect your privacy and the confidentiality of your personal information, and we appreciate the opportunity to do business with you.

As controller, Ecobank recognizes the importance of privacy and security of our customers' personal information.

1. Our Privacy Principles

We will only collect, transfer, process and/or store your personal information with your express permission and/or if legally required to do so and will only use such information for the lawful purposes for which it is required, in conformity with the provisions of this Privacy Notice for Ecobank Rapidtransfer Service.

2.Information we collect

2.1We may collect some personal information from you directly. We may collect information from you when you register on our Rapidtransfer App. We may collect, amongst others, your name, e‐mail address, phone number, date of birth, nationality, gender, residential address, identity (ID) number, copy of your ID and a photograph, biometric data, device ID, device location, and details of your Debit/Credit/Prepaid Card. We collect information about you based on your use of our products, services or service channels (like our websites, applications, ATMs).

2.2In addition to 2.1 (above), to create a Rapidtransfer Profile, we collect and process your Debit/Credit/Prepaid Card information such as the Card PAN, Expiry Date, Card Currency, Name on Card and Card Billing Address.

2.3We may collect and combine information when You register on our mobile banking services including information you provide to us, device IDs, cookies, and other signals, including information obtained from third parties, to associate accounts and/or devices with you. We collect information about you when we receive it from third-parties and affiliates. We may collect information about you based on how you engage or interact with us such as on social media, emails, telephone calls and surveys.

2.4We collect information from devices such as mobile phones and tablets about how you interact with our services and those of our third-party partners and information that allows us to recognize and associate your activity across devices and services. This information includes device specific identifiers

and information such as IP address, cookie information, mobile device and advertising identifiers, browser version, operating system type and version, mobile network information, device settings, and software data.

2.5.In certain circumstances, we collect information about you whereas you do not have a direct relationship with us, for example if you are a beneficiary of transfer of funds made by our Customer.

3.On which legal basis do we collect and use the information we collect?

We collect and use your personal data; (i) to comply with various legal and regulatory obligations, including prevention of corruption, fraud, money laundering, trade sanctions or the financing of terrorism, banking and financial regulations, or to reply to an official requests from public or judicial authority, (ii) to perform a contract with you or to take steps prior to entering into a contract with you, and/or (iii) to respect your choice if you have consented to the processing beforehand.

4.How do we use the information we collect?

4.1Services

We use your data we have collected to authenticate you and authorize access to our services on the Rapidtransfer App. These services include, amongst others, money transfer services, KYC validation, and exchange rates conversion.

4.2 Communication

We will contact you through email, short message services (SMS), phone call, and other ways through our services, including text messages and push notifications. We will send you messages about the availability of our services, security, or other service-related issues. We also send messages about how to use the Services and network updates.

4.3 Advertising and Marketing

We serve you tailored advertisements both in App and through other channels and media of our services. We target advertisements in App and through other channels and media to customers of our services through a variety of ad networks and exchanges, using data from advertising technologies and information from advertising partners, publishers and data aggregators.

We use data and content about our customers for invitations, promotions and communications solely for promoting our services.

4.4 Customer Support

We use the data needed to investigate, respond to and resolve complaints and service issues

4.5 Security, Fraud and Investigations

We use your data if we think it’s necessary for security purposes or to investigate possible fraud or other violations of our User Agreement or this Privacy Notice and/or attempts to harm our customers.

4.6 Legal and regulatory requirements

We use your data to comply with any applicable legal and/or regulatory requirements

5. How do we secure your information?

Protecting our information systems and our users’ information is paramount to ensuring Ecobank brand, websites, apps, advertising services, products, services or technologies customers enjoy a secure experience and maintaining our users’ trust. We have taken the following measures to protect your information

5.1Ecobank has technical, administrative and physical safeguards in place to help protect against unauthorized access, use or disclosure of customer information we collect or store.

5.2We implement a variety of security measures to maintain the safety of your personal information when you enter, submit, or access your personal information.

5.3We offer the use of a secure transmission, processing and storage services using standardized security safeguards.

5.4All supplied sensitive card /credit information are encrypted via transaction layer security (TLS) technology during transmission to avoid misuse of your data. Card Number (PAN) and expiry date of any credit and prepaid cards attached to the Rapidtransfer App are tokenized and stored on our backend systems at our data processor.

5.5Your personal information may be accessible by those authorized with special access rights to such systems and are required to keep the information confidential. Information such as PINs and passwords are not accessible to our authorized personnel.

No method of transmission over the internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee its absolute security. If you have any questions about security, you can contact us at ecobankenquiries@ecobank.com.

6. How long do we keep your personal data?

We will retain your personal data for the periods allowed and/or required under applicable laws and regulations, and for the time you use the Rapidtransfer App, and/or remain Our customer.

7. How and with whom do we share your information?

7.1When you use or interact with our services, you consent to the data processing, sharing, transferring and uses of your information as outlined in this Privacy Notice. Ecobank Group will comply with all applicable data protection and privacy regulations. It being understood that “Ecobank Group” means collectively ETI and all its existing or hereinafter established banking subsidiaries and other subsidiary companies wherever located.

7.2To provide you with our services, your personal information may be transferred to countries other than your own to process and store data in accordance with our Privacy Notice and to provide you with

products and services. We may transfer your data to members of the Ecobank Group or partners, including for outsourced data processing undertaken on Ecobank’s behalf. The primary data processor for Ecobank is a technology services company known as eProcess International S. A. based in Ghana, a member of the Ecobank Group.

7.3We share information concerning your transactions and experience within the Ecobank Group. This sharing of information is intended only to facilitate the servicing of our customers’ accounts and to offer financial products and services we believe would be beneficial to our Customers.

7.4Under all sharing arrangements, Ecobank requires its service providers and marketing partners to keep such information strictly confidential, and to adhere to and comply with all applicable data protection laws and regulations and the terms of this Privacy Notice and prohibits them from disclosing such information to anyone for any other purpose.

7.5We do not, and will not, share customer information with non-financial companies for the purpose of allowing them to market their products and services to our customers. We do not disclose any non-public personal information about our customers to any other third parties, except as permitted or required by law.

7.6By using our products and services, you consent to us transferring your information to countries outside your local jurisdiction, if necessary, for providing you with our services and legitimate business purposes in line with the provisions of this Privacy Notice . We are committed to ensuring your information is protected and apply security safeguards in accordance with applicable law.

7.7We will share your information;

a.If we are under a duty to disclose or share your personal data to comply with any legal obligation;

b.To prevent and detect fraud or crime;

c.In response to a subpoena, warrant or court order, or as may be required by law; and

d.In response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

8.What rights and choices do you have about your personal information?

8.1 Right to Access and Control Your Personal Data

Within the limits set by applicable laws and regulations, you can access your personal data when you follow our procedures on data subject requests. If you reside in an European member state, You can (i) modify, delete, restrict or update your personal data using the applicable menus in the Rapidtransfer App,

(ii)object to the processing of your personal data, (iii) if the legal basis for the processing is your consent, you have the right to withdraw your consent to the processing at any time without justification, and (iv) you have the right to lodge a complaint with a data protection supervisory authority.

8.2 The Data Controller of Your Personal Data

The data controller responsible for your information is Ecobank to which you can contact through the Data Protection Manager indicated below.

When you wish to file a complaint on the Rapidtransfer App, you are required to send a request to ecobankenquiries@ecobank.com. Ecobank shall contact you within fourteen days to validate the request for processing. A de-activated account may still have transactional history kept on our terms in accordance with financial laws and data retention policies of the Bank.

8.3 Account Closure

We retain your personal data even after you have closed your account if reasonably necessary to comply with our legal obligations (including law enforcement requests), meet regulatory requirements, resolve disputes, maintain security and prevent fraud.

9.Protecting Children’s Privacy

Our services are for a general audience. We do not knowingly collect, use, or share information that could reasonably be used to identify children without prior parental consent consistent with applicable law.

10. Changes to our Privacy Policies

We may update this Privacy Notice to reflect changes to our information practices, if we make any material changes we will notify you by an email (sent to the email address specified in your account) or by means of a notice on this website or via a link from your mobile application prior to the change becoming effective. We encourage you to periodically review this page for updates on our privacy practices.

11. How can you contact us?

If we decide to change our Privacy Notice, we will post those changes on the Rapidtransfer App for your notice and consent when required. If there are any questions regarding this Privacy Notice, any further information you would may need, or a data breach incident you would like to report on, please contact us using the information provided below.

Data Protection Manager

eProcess International S. A.

2 Morocco Lane, Off Independence Avenue

P.O. Box AN 16746, Accra-North Accra, Ghana