Legal Information & Documents

PRIVACY POLICY OF IUTEPAY SHPK

Effective as of: 01.03.2025

We, IUTEPAY SHPK, Registry Code M02209002O, seat and registered address: Rruga “Andon Z. Çajupi”, Ndërtesa Nr. 3, Hyrja Nr. 2, Kati 3-të, Tiranё, Albania; e-mail: (“Company” or “Controller” or “we” or “us”), collect and Process Personal data of individuals: our customers, contracting parties or other contacts (“You”). The Company is an Electronic Money Institution entered in the Register maintained by the Albanian National Bank (“Bank of Albania” or “BoA”), as per License No. 53 dated 28.01.2022. We are aware of the responsibility that we must take care of, and protect, Your Personal data, to comply with the applicable legislation in the field of privacy and protection of Personal data. With this Privacy Policy (“Policy” or “Privacy Policy”), we would like to introduce to You the way we collect and use Your personal information. The Policy describes what methods are used and for what purposes the Company, respectively our service providers and partners, process the information collected from and about You while offering our services and concluding agreements, including on-site payment agreements at the Controller’s offices, through our intermediaries or when You are visiting or using our services through the website www.iute.al (“Website”) and/or through the customer service phone 044 50 50 60 (“Customer Service Phone”) and/or Myiute App (“Myiute”) or any other channels as we may make available, including providing services of the Company through third parties (hereinafter jointly referred to as “Available Channels”). We also explain what data subjects’ rights are and our obligations and liability.

Important!

Read this Policy carefully. It provides important information about how we process Personal data and explains Your legal rights. This Policy is not intended to change the terms and conditions of any agreement entered into with us, nor the rights that You have under the applicable data protection laws. We do not provide services to people under the age of 18. If You are under the age of 18, please do not provide us with any of Your Personal data. We ask for Your assistance to keep Your Personal data up to date by informing us of any changes to Your Personal data. By providing Your Personal data or using the Available Channels, You trust us and voluntarily accept the terms and conditions of this Privacy Policy. If You provide information about another person on their behalf, You shall ensure that that person has been provided with this Privacy Policy and that the requirements of the applicable laws have been complied with before providing the information.

1. CONTROLLER

1.1 Each Controller is responsible for the correct and lawful processing of Personal data that we have lawfully obtained about You.

1.2 The joint controllers have concluded a joint controller agreement that governs the responsibilities of each party as per GDPR requirements. IutePay SHPK oversees operational processing, while Iute Group AS provides strategic oversight and ensures compliance. Both parties share accountability for data subject rights and security.

1.3 The joint Data Controllers are IutePay SHPK, IuteCredit Albania SHA and Iute Group AS (hereinafter jointly referred to as “Controller” or “Controllers”):

Joint controller	Data protection contact
IutePay SHPK, Registry Code M02209002O Rruga “Andon Z. Cajupi”, Ndërtesa Nr. 3, Hyrja Nr. 2, kati 3-të, Tiranё, Albania	Klea Tafili
IuteCredit Albania SHA, Registry Code L42011023U Rruga “Andon Z. Cajupi”, Ndërtesa Nr. 3, Hyrja Nr. 2, kati 3-të, Tiranё, Albania	Anila Vasili
Iute Group AS, Registry Code 11551447 Maakri tn 19/1, Tallinn, 10145, Estonia	Carol Annuk

2. TERMS AND DEFINITIONS USED

2.1 There are a total of 26 definitions listed within the Regulation and it is not appropriate to reproduce them all here. However, the most fundamental definitions with respect to this Policy are as follows:

Ø “Group” – Iute Group AS and its affiliated companies.

Ø “Controller” – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing Your Personal data.

Ø “Consent” – any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Ø “Personal data” – any information that concerns You, including information obtained from public databases and public channels and information lawfully obtained from third parties, through which You can be identified directly or indirectly, in particular by an identifier such as names, Personal ID No., location data, phone, e-mail or one or more markers specific to Your identity.

Ø “Processing of Personal data” or “Processing” – any action or set of actions that can be performed on Your Personal data by automatic or other means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure or transmission, dissemination, update or combination, blocking, erasure or destruction of data.

Ø “Pseudonymization of Personal data” – the processing of Personal data in such a manner that the Personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal data is not attributed to an identified or identifiable natural person. Pseudonymized data still constitutes Personal data.

Ø “Anonymization of Personal data” – the processing of Personal data in such a manner that the Personal data is altered so a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party. Anonymized data does not constitute Personal data.

2.1.1 “Regulation” – General Data Protection Regulation (EU) 2016/679.

2.1.2 “Law” – Law No. 124/2024 in Albania on Personal Data Protection, dated 17.01.2025.

3. GENERAL PRINCIPLES OF PROCESSING PERSONAL DATA

3.1 We Process Your Personal data pursuant to the principles of the Regulation and by applying applicable local law, including Law No. 124/2024 “On Personal Data Protection”, Law 9917 “On Prevention of Money Laundering and Terrorist Financing”, Regulation 51/2024 “On the operational risk management by banks, payment institutions and electronic money institutions”, Regulation 2/2013 “On risk management in the activity of non-bank financial institutions”, integrated version, Regulation 59/2008 “On Transparency for banking and financial products and services”, amended by Decision No. 11, dated 5.2.2025, this Policy and the terms and conditions of the agreements entered into with You.

3.2 We process Your Personal data in a reliable and confidential way. We respect each person’s right to the protection of their Personal data, and we shall do our best to ensure that Personal data collected by us is well protected. We regularly evaluate the risks associated with the Processing of Personal data and shall apply appropriate mitigation strategies to hedge risks.

3.3 Data protection is an integral part of our services and is overseen by our data protection officer. We ensure that our employees know and comply with the requirements of data protection. We expect, instruct and train our employees to respect our privacy requirements.

3.4 We process Your Personal data lawfully and purposefully. We set clear goals for the Processing of Personal data and process Personal data for these purposes only. We do not collect or process the data that we do not need. We have the right to delete/blur or use other ways to make data/documents presented to us unreadable that are not necessary for the provision of our services.

3.5 We process Your Personal data in a transparent and fair way. We ensure an appropriate secure, honest and lawful manner of processing Your Personal data to prevent the unauthorized disclosure or inappropriate use of Your Personal data.

3.6 We shall store Your Personal data only for as long as the retention of data is required by applicable law or the agreement or is necessary for the provision of our services and/or our legitimate interest. At the end of the retention period, we shall permanently erase Your Personal data or anonymize it.

3.7 We do our best to make sure that Your Personal data which we process is accurate and limited to what is necessary.

4. HOW WE COLLECT YOUR PERSONAL DATA

4.1 We may collect Your Personal data for further Processing in the following cases:

4.1.1 if You contact us via any Available Channels to request information about our products and services;

4.1.2 if you visit and use our Website or Myiute app;

4.1.3 if You provide Your or Your contact persons´ or representatives´ Personal data when opening a payment account through any of our Available Channels;

4.1.4 if, for certain data, a written consent is required by law, the consent will be requested from You either in the offices of the Controller, our partners premises, or in case of channels made

available electronically, by You ticking the appropriate box(es), in which case the consent is considered equivalent to written consent;

4.1.5 By conducting inquiries through public registers such as the Register of Bank Accounts, the National Social Security Institute, the National Population Database, the Ministry of Interior, etc.;

4.1.6 if Your Personal data is made available by You during the validity of an agreement with the Controller for provision of services or products;

4.1.7 if You respond to or give consent for our general or direct marketing campaigns, for example by filling out a questionnaire or submitting data electronically;

4.1.8 if other legal entities, including partners, make a permitted transfer of Your Personal data to us.

5. WHAT PERSONAL DATA WE COLLECT

5.1 For the purposes of concluding and performing a payment account agreement or any other agreement with You, we process Your Personal data regarding Your identity and other necessary data. Without this data, we would not be able to provide the relevant services. If You do not provide us with identification data, we would not be able to enter into a payment account or any other agreement with You.

5.2 The following categories of Personal data may be collected from and of You or Your representative or contact person depending on whether You are our potential, existing or prior customer, or contracting party and which of our services or Available Channels You use:

Identification details	Your name, gender, personal identification code, date of birth, legal capacity and citizenship, as well as Your historic data that may have been stored with us during previous interactions within the retention periods. The name, personal identification number, address, telephone number and other data of Your representative specified in the power of attorney, in case You authorize a third person to represent Yourself before the Company.
Document details	Your or Your representatives document type, issuing country, number, expiry date, information embedded into document barcodes (may vary depending on the document) and security features.
Facial recognition data	Photos, videos and sound recordings, photographs taken from You or Your representative and Your or Your representatives document including video and sound recordings of the verification process.
Contact details	Your or Your representatives´ address, e-mail address, telephone (contact) numbers. Your contact persons´ contact number.
Technical data	Your or Your representatives´ device signature data, including but not limited to, information about the date, time and Your or Your representatives´ activity on our Available Channels, Your or Your representatives´ IP address, cookies You or Your representative have accepted and domain name, Your or Your representatives´ software and hardware attributes as well as Your or Your representatives´ general geographic location (e.g. city, country).

Publicly available	Information about You or Your representative being a politically exposed person (PEP) and checks in public sanctions and watch lists.
data
Data with regards to Due Diligence in continuation Data with regards to	Your place of work (e.g. length of service, position, profession, remuneration, employer data, including registry code, address, phone, sector, industry), insurable income, other income, total monthly income and expenses, property status, health insurance contributions; data from the Register of Bank Accounts on the numbers of Your bank accounts, the persons authorized to dispose of them, data on seizures of the bank accounts, as well as data on safe deposit boxes in banks and their proxies, if any; data from the registers of the National Social Security Institute (gives access to the information of the existence of official employment, pensions, employment income, social security contributions), data on Your civil registration from the National Population Database (Personal ID No., permanent and current address, marital status, number of household members, minor children, date of death); in the Register of Albania identity documents at the Ministry of Interior to confirm the validity of a submitted identity document; data on property status through inquiries in e-Albania.
Due Diligence in
continuation
Economic identity data	Your unique customer number generated by the Company; the unique payment account agreement(s) or an agreement number generated upon conclusion of a payment account agreement or any other agreement; the unique payment account agreement(s) or an agreement number generated upon conclusion of a payment account agreement or any other agreement; data collected within the ongoing monitoring as per Know Your Customer and Know Your Partner requirements (possible third party repayments and suspicious transactions); information about Your chosen method(s) of utilization of a payment account (e.g. bank transfer, cash); repayments You make based on the payment account agreement in place; Your credit or debit card details (in case You choose to pay by direct debit), bank account number or other bank and payment information related to the transactions made in favor of the Company.
Communication data	Data related to Your visits and use of our Website and Myiute, and communication via any other of our Available Channels, the visual and/or audio recordings collected when You visit our branches and other places where we provide services and when You communicate with us by telephone, as well as any other data collected via e-mail, messages, social media and other manners of communication. Additionally, anonymized behavioural and technical metadata is collected through SDKs embedded in applications. This includes device type, operating system, language settings, network data (e.g., IP address, network type), application usage patterns, and engagement metrics. Behavioural metadata, such as session duration, screen navigation, and interaction trends, is processed statistically without personal identification.

6. WHY AND ON WHAT GROUNDS ARE WE PROCESSING YOUR PERSONAL DATA

6.1 The main purposes for which we Process Your or Your representatives´ data are the establishment of customer relationships, conclusion, performance and termination of payment account agreements, performance of the due diligence obligation stipulated by applicable law, providing better customer service to You, making our (including other companies within our Group of companies) or our partners’ offers to You, analysing the usability and effectiveness of our services and development of new services.

6.2 We also process Personal data for marketing, safety and/or analytical purposes, to provide first-class products and services to You now and in the future based on our legitimate interest or consent, whichever is applicable for that specific processing activity.

6.3 We process Personal data for the following purposes and on the following grounds:

Purposes of Processing of Personal data	Legal grounds for processing
We decide whether, and on what conditions to, establish a customer relationship or enter into specific agreements with You and on which conditions to provide our services.	Performance of an agreement: Necessary to determine eligibility and conditions for agreements or services (Art. 6(1)(b) of the GDPR, Art. 7/1(b) of Law No 124/2024 on Personal Data Protection in Albania). Precontractual measures: Evaluating data to make informed decisions before entering agreements (Art. 6(1)(b) of the GDPR, Art. 7/1(b) of Law No 124/2024 on Personal Data Protection in Albania). Legal obligation: Compliance with legal requirements related to agreement formation and service provision (Art. 6(1)(c) of the GDPR, Art. 7/1(c) of Law No 124/2024 on Personal Data Protection in Albania). Legitimate interest: Managing risks and ensuring proper due diligence in customer relationships (Art. 6(1)(f) of the GDPR, Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).
We carry out our risk assessments.	Legitimate interest: Risk management and mitigation of financial risks (Art. 6(1)(f) of the

– We may need your consent to make an inquiry to one or more of the required government registries.	GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania). Consent: Required for inquiries to specific government registries where necessary (Art. 6(1)(a) of the GDPR and Art. 7/1(a) of Law No 124/2024 on Personal Data Protection in Albania).
We process Your personal data for profiling and automated decision-making.	Performance of an agreement: Required for evaluating and finalizing payment agreements (Art. 6(1)(b) of the GDPR, and Art. 7/1(b) of Law No 124/2024 on Personal Data Protection in Albania). Legal obligation: Compliance with legal requirements for financial assessments and anti- money laundering (Art. 6(1)(c) of the GDPR, Art. 7/1(c) of Law No 124/2024 on Personal Data Protection in Albania and ). Legitimate interest: Enhancing efficiency, consistency, and fairness in evaluation and risk management processes (Art. 6(1)(f) of the GDPR and and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).
We will identify You and/or Your representative upon the establishment of the customer relationship and/or during the customer relationship in order to comply with the anti- money laundering and counter-terrorist financing requirements and Know Your Customer principles, incl. identification of Your beneficial owner(s), whether You or Your beneficial owner(s) are politically exposed person(s), whether You or Your beneficial owner(s) are subjects of financial sanctions.	Performance of an agreement: Necessary for the establishment and maintenance of a customer relationship (Art. 6(1)(b) of the GDPR, Art. 7/1(b) of Law No 124/2024 on Personal Data Protection in Albania and Law No. 55/2020 on ‘Payment Services’. Legal obligation: Compliance with anti-money laundering, counter-terrorist financing, and Know Your Customer regulations (Art. 6(1)(c) of the GDPR, Art. 7/1(c) of Law No 124/2024 on Personal Data Protection in Albania, Law No. 9917, Law No. 55/2020 on ‘Payment Services’ Legitimate interest: Ensuring risk management and the integrity of financial transactions (Art.

6(1)(f) of the GDPR, Art. Law No 124/2024, Law No. 55/2020 on ‘Payment Services’
We are performing an agreement entered into with You or guarantee the performance of the respective agreement and realise, waive, and/or protect our rights.	Performance of an agreement: Ensuring the execution and fulfilment of contractual obligations (Art. 6(1)(b) of the GDPR and Art. 7/1(b) of Law No 124/2024 on Personal Data Protection in Albania). Legal obligation: Compliance with applicable legal requirements related to agreement performance (Art. 6(1)(c) of the GDPR and Article 7/1(c) of Law No 124/2024 on Personal Data Protection in Albania). Legitimate interest: Exercising, defending, and protecting legal claims, when necessary (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).
We prevent money laundering and terrorist financing and perform the obligations arising from effective international and national law. This includes the monitoring of Your transactions and behaviour as such during the course of the agreement.	Legal obligation: Compliance with international and national laws on anti-money laundering and counter-terrorist financing, including transaction monitoring and behavioural analysis during the contractual relationship (Art. 6(1)(c) of the GDPR and Art. 7/1(c) of Law No 124/2024 on Personal Data Protection in Albania).
We reduce or prevent risks and damage to You as well as us and protect Your and our interests, study the quality of our services, and collect proof of business transactions or other business communication. This may include video surveillance for other purposes than the verification of Your identity as well as audio recordings of phone calls, chat and online, chat sessions for other purposes than the provision of services. – We may need your consent	Consent: Required for specific processing activities, such as certain forms of video surveillance or audio recording (Art. 6(1)(a) of the GDPR and Art. 7/1(a) of Law No 124/2024 on Personal Data Protection in Albania). Performance of an agreement: Ensures proper documentation and quality assurance in contractual relationships (Art. 6(1)(b) of the GDPR and Art. 7/1(b) Law No 124/2024 on Personal Data Protection in Albania). Legal obligation: Compliance with legal requirements related to service quality and

communication records (Art. 6(1)(c) of the GDPR and Art. 7/1(c) of Law No 124/2024 on Personal Data Protection in Albania). Legitimate interest: Prevention, restriction, and investigation of misuse, unlawful use of services, or service disruptions to guarantee quality (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).
We allow access to, and the use of, our Website.	Performance of an agreement: Ensures the proper functioning and accessibility of the website for users (Art. 6(1)(b) of the GDPR and Art. 7/1(b) of Law No 124/2024 on Personal Data Protection in Albania). Legal obligation: Compliance with applicable regulations related to website accessibility and security (Art. 6(1)(c) of the GDPR and Art. 7/1(c) of Law No 124/2024 on Personal Data Protection in Albania). Legitimate interest: Prevention of unauthorized access and protection of website security and integrity (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).
We develop our systems.	Legitimate interest: Ensuring the functionality, efficiency, and continuous improvement of systems to provide better services and maintain operational security (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).
We carry out statistical research and analyses of the market shares of customer groups, products and services, reporting, and risk management, etc.	Legitimate interest: Improving services, enhancing the user experience, developing new offerings, and managing risks effectively (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).

We develop our existing services and new services.	Legitimate interest: Enhancing and refining existing services, improving the user experience, and creating new services to meet customer needs (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).
We check and, if necessary, improve or update Your Personal data, manage customer relationships, keep data up-to-date and correct by checking and updating data via external and internal sources, and also request updating of data from You.	Performance of an agreement: Ensuring the accuracy of customer data for the effective execution of agreements (Art. 6(1)(b) of the GDPR and Art. 7/1(b) of Law No 124/2024 on Personal Data Protection in Albania). Legal obligation: Complying with regulatory requirements to maintain accurate and updated records (Art. 6(1)(c) of the GDPR and Art. 7/1(c) of Law No 124/2024 on Personal Data Protection in Albania).
We send You our advertisements and offers, incl. personal offers of the products and services of our other Group companies and partners. – We may need your consent.	Consent: Required for sending personalized advertisements and offers, ensuring compliance with marketing regulations (Art. 6(1)(a) of the GDPR and Art. 7/1(a) of Law No 124/2024 on Personal Data Protection in Albania). Legitimate interest: Providing relevant services and offers to enhance customer experience and engagement (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).
We organise or manage consumer games and campaigns. – We may need your consent.	Consent: Required for participation in consumer games and campaigns to ensure compliance with applicable regulations (Art. 6(1)(a) of the GDPR and Art. 7/1(a) of Law No 124/2024 on Personal Data Protection in Albania). Legitimate interest: Enhancing customer engagement and promoting additional services through campaigns (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).

We want to understand Your expectations better (e.g., analysis of Website visits, customer surveys, etc.). For our business goals, such as data analysis, certifications, developing new models, identifying trends in browsing the Website or MyIute, developing a custom environment on the Website or MyIute by introducing products and offers that are customized for Your personal needs or measure the effectiveness of our promotional campaigns. – We may need your consent.

Consent: Required for personalized analysis and targeted promotional activities, such as custom offers (Art. 6(1)(a) of the GDPR and Art. 7/1(a) of Law No 124/2024 on Personal Data Protection in Albania). Legitimate interest: Conducting data analysis, identifying trends, and improving services and user experience to meet customer needs (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).

We use cookies on our website to enhance the user experience, enable essential functionality, analyse site usage, and deliver personalized content and advertisements.

Consent: Required for non-essential cookies such as analytics, marketing, and personalization (Art. 6(1)(a) of the GDPR and Art. 7/1(a) of Law No 124/2024 on Personal Data Protection in Albania). Users can provide or withdraw consent via the cookie management banner. Legitimate interest: Ensures the website functions effectively, including security features and basic site operations (Art. 6(1)(f) of the GDPR and Art. 7/1(dh) of Law No 124/2024 on Personal Data Protection in Albania).

7. PROFILING AND AUTOMATED DECISIONS

7.1 We may also process Your Personal Data based on profile analysis and automated decision-making, which uses Your profile data (personal information, due diligence data and economic identity data). Processing is fair and transparent and takes place without discrimination between You and other customers under grounds of conclusion/fulfillment of an agreement and our legitimate interest.

7.2 We use profile analysis and automated decision making because they potentially allow for greater consistency or fairness in the decision-making process (e.g. by reducing the potential for human error, discrimination or abuse of power), reduce the risk of non-payment by customers for goods or services (e.g. through the use of available ratings) or enable us to make decisions in a shorter period of time and improve efficiency. We also use profile analysis and automated data processing in order to send You direct marketing materials and monitor transactions for the prevention of fraud.

7.3 We follow the Guidelines of Article 29 of the Data Protection working party on individual decisionmaking and profiling based on automated processing, which is available here: http://ec.europa.eu/newsroom/article29/document.cfm?doc_id=49826

8. PRE-FILLING OF FIELDS

8.1 We may use pre-filling of the fields of Your contact details in our digital Available Channels and other systems in order to make the service more convenient. The fields are pre-filled, provided that Your Personal data have been entered in the application fields of our digital channels and other systems, and You are our customer. We will pre-fill the contact details fields with the data You submitted to us when You entered into the last service agreement. You must always check whether the information in the prefilled fields is correct.

8.2 If You do not want the contacts details fields to be prefilled in our digital Available Channels and other systems, You can waive this option. Contact us via our contact details in order to do this.

9. PERSONAL DATA PROCESSING IN MARKETING

9.1 We, our Group companies, or our other partners may process Your Personal data for marketing purposes. If such processing is based on Your consent, You have the right to withdraw the consent at any time. If such processing is not based on a consent, You may refuse to receive such Data processing at any time as well. In order to withdraw Your consent or refuse to receive marketing materials, please send the respective message to our contact details or manage Your consents via our Available Channels.

9.2 The general information about our services and introductory or supplementary information or notices about changes in the terms and conditions or the price list, or information related to the performance of an agreement entered into with You (e.g. notifications about due dates of payments, debts, termination of agreements, etc.) are not deemed marketing. In general, You cannot refuse to receive such information.

10. TRANSMISSION OF PERSONAL DATA TO THIRD PARTIES

10.1 We will disclose and/or transmit Your Personal data:

10.1.1 to companies belonging to our Group in order to: (1) comply with the requirements for risk management and control; (2) organise strategic research and analyses of the market shares of customer groups, products and services and other financial indicators; (3) comply with effective prudential norms, incl. capital and liquidity requirements; (4) enter into and perform agreements and give You information about the agreements You have entered into with persons belonging to the same Group with us; (5) comply with the responsible lending principle; (6) develop and implement information systems of the entire Group; and (7) implement the due diligence measures stipulated in the laws of anti-money laundering and counter-terrorist financing; (8) transmit you marketing related information;

10.1.2 to persons and organisations related to the provision of our services and performance of the agreement entered into with You (e.g. sureties, guarantors, collateral owners; payment intermediaries, credit institutions, international card organisations, translation, communication, IT and postal service providers, call centre service providers);

10.1.3 the registrars of various registers (e.g. population registers, commercial registers, traffic registers) to whom we transmit and from whom we request Your Personal data in order to check and guarantee the correctness and integrity of Your Personal data or for the implementation of pre-contractual measures or for the performance of an agreement entered into with You;

10.1.4 to third parties that receive Your Personal data as a part of the service requested by You;

10.1.5 based on Your consent, to third party partners that process Your Personal data for marketing purposes;

10.1.6 to the service providers to whom we have outsourced activities in part or in full on the terms and conditions stipulated by effective law, provided that such persons comply with the organisational, physical and information technology requirements set by us in respect of the confidentiality and protection of the Personal data;

10.1.7 to other third parties if You have breached the agreement (e.g. provider of debt collection services, courts, trustees in bankruptcy or insolvency trustees).

10.2 In some cases, we may be obliged to disclose and transmit Your Personal data for the performance of the obligations arising from effective law – government and other bodies, institutions and departments, insurance companies, insurance brokers, banks and institutions within the scope of their competence and in compliance with the provisions of the Regulation, the Law No. 124/2024 on Personal Data Protection, Law 9917 on Prevention of Money Laundering and Terrorist Financing legislation. (e.g. transmit data to law enforcement authorities, notaries, trustees in bankruptcy, the Tax and Customs Authorities, Bank of Albania, or the Financial Supervision Authority).

11. DATA TRANSFER TO COUNTRIES OUTSIDE THE EUROPEAN ECONOMIC AREA

We process Your Personal data in the Albanian and European Economic Area (EEA), but there may be cases where we transmit Your Personal data to, and they are processed in, countries outside the EEA. We only transmit Personal data to the kind of third countries or territories (outside the EEA) in respect of which the European Commission has decided that protection is adequate. If there is no such decision, we will only send Personal data outside the EEA if the protection of Your rights in court is guaranteed to You and effective legal remedies are accessible in the respective country or territory. Also, the transmission described above is not done without a legal basis (e.g. performance of a legal obligation or Your consent).

12. HOW WE PROTECT YOUR PERSONAL DATA

12.1 We protect Personal data in strict compliance with the effective Albanian legislation, Law No. 124/2024 in Albania on Personal Data Protection, dated 17.01.2025, and the principles of the framework directives of the European Union on protection of information and Personal data (including Regulation (EU) 2016/679).

12.2 Your information is stored on our secure servers or on secure servers of our subcontractors or business partners (or in certain cases the information is also stored on paper, subject to the necessary protections). The information is available and used in accordance with our security policies and standards (or those of our subcontractors or business partners), always in compliance with the effective legislation and the necessary protection measures.

12.3 Although we cannot guarantee that the transmission of data over the Internet, Website or Myiute is free from the risk of cyber-attacks, we and our business partners work hard to maintain measures for physical, personal and documentary protection and protection of automated information systems with regard to Your data in compliance with the effective legislation. For example, we apply the following measures:

12.3.1 strictly limited access to Your data, provided only on a need-to-know basis and in order to achieve the purposes for which it is processed and, on a need-to-know basis;

12.3.2 Personal data is stored electronically in databases or in shared folders protected by passwords or with different degrees of authorization; monitoring and protection against viruses are carried out; copies and backups are created for recovery purposes; the systems also store history logs of document operations;

12.3.3 at the sites of the Joint Controllers, where processing of Personal data is performed, technical security is carried out (through alarm and security equipment and video surveillance); fire protection; physical access control procedures have been introduced;

12.3.4 the staff of the Controller who processes Personal data is familiar with the requirements of the effective legislation, the policies of the Controller, and the existing risks and the scenarios for their occurrence;

12.3.5 our Data processing information systems are based on regularly tested software. For the purpose of full traceability and timely response, records with information about each access and operations performed in relation to Personal data are maintained by the Controller. The filing of the records is fully automated and is an integral part of Data processing. The Controller, through explicit internal rules, has established technical and organizational measures for collection, processing and storage of Personal data of its customers on paper consisting of rules and procedures, as well as strict rules for monitoring their compliance, said monitoring ensuring the most comprehensive protection against unwanted access;

12.3.6 contractual protection under the agreements with third-party data processors who act on behalf of the Controller has also been envisaged;

12.3.7 when we provide You (or choose to provide You) with a password that gives You access to certain parts of the Website or another portal or service that we manage, You are responsible for keeping that password confidential and for complying with any other security procedures of which we notify You. Please do not share Your password with anyone.

13. HOW LONG WE STORE YOUR PERSONAL DATA

13.1 We process Your Personal data for as long as necessary for the achievement of the purposes of Data processing or performance of obligations arising from effective law. The period of Personal data

retention is based on the agreement entered into with You, our legitimate interest and/or applicable law. If Your data is processed for more than one purpose, we will retain it until the purpose with a longer processing period is achieved; but we will stop processing it for the purpose with a shorter period after the expiration of that shorter period.

13.2 We restrict access to Your data to those parties who must process it for the relevant purpose.

13.3 In certain circumstances, we may retain Your Personal data for longer periods of time in order to have an accurate record of Your relations with us in the event of complaints or disputes or if we reasonably believe that there is a possibility of litigation in view of which Your Personal data will be needed.

13.4 Storage periods are based on our business needs and in accordance with the effective legislation. Personal data that is no longer needed shall be pseudonymized or anonymized or erased/destroyed.

14. COOKIES

14.1 Processing of cookies: Cookies are small text files that some websites store on Your computer or mobile device when you visit that page. They allow a website to remember your actions and settings (such as login, language, font size, and other settings on the screen), so you do not have to enter settings every time you visit that page or browse different pages.

14.1.1 Cookies and Consent Management Our site may use cookies to improve the user experience. Your Internet browser stores cookies on Your computer for the purpose of storing data on page visits. You can choose to decline cookies in Your online browser settings or receive a warning each time cookies are sent. If You select this option, some parts of the website may not work as intended. Additionally, our websites and the Myiute app implement cookie banners and consent options, allowing users to manage their preferences. Non-essential cookies (e.g., analytics, marketing) require explicit consent and can be modified via the banner or settings within the app.

14.1.2 Third-Party Analytics and Marketing Cookies

(a) Analytics Cookies

(i) Google Analytics We use cookies from the Google Analytics platform to collect anonymous statistics on demographics and interests. These reports aggregate data rather than identifying individual users, helping us optimize the content on our site and create targeted ads for specific groups. Visitors can disable Google Analytics from displaying ads and custom ads on the Google Display Network.

Google Analytics cookies allow us to collect anonymous information about user behavior on our site. The information collected does not contain personal data and is transmitted and stored on Google software in accordance with Google’s privacy policy.

14.1.3 Remarketing and Advertising Cookies

(a) Google AdWords Remarketing Platform We use cookies for online advertising through the Google AdWords Remarketing Platform. These cookies enable us to display ads to you after visiting our site, whether on Google Search or the Google Display Network. They also help us analyze the effectiveness of impressions, advertising interactions, and related site visits. You can adjust Google ad display settings through your Google account.

(b) AdForm Remarketing Platform We use AdForm cookies for online advertising, which enables us to show you targeted ads on the AdForm Display Network after visiting our site. These cookies help us analyze the impact of impressions, interactions with advertising, and user behavior. You can manage your AdForm ad preferences through their privacy settings.

(c) Facebook Marketing and Remarketing Platform Our website uses cookies from Facebook for marketing and remarketing purposes. These cookies enable us and third-party vendors, including Facebook, to display advertisements to you after you visit or interact with our site. Ads may appear on the Facebook platform, and cookies are used to analyze interactions with advertisements to improve their relevance.

14.1.4 Engagement and Usability Cookies

(a) Microsoft Clarity We use Microsoft Clarity on our website to analyze user behavior and enhance the usability of our site. Microsoft Clarity sets first-party cookies to gather session data, link multiple page views into a single session recording, and identify first-time visitors. These cookies help us better understand how users interact with our website. If cookies are disabled in your browser, Clarity assigns a unique ID to each page view, which may limit its ability to link page views into a single session. Microsoft Clarity cookies do not collect personally identifiable information and are used solely for performance analysis and usability improvement.

(b) OptinMonster Our website uses OptinMonster cookies to enhance user engagement and deliver personalized marketing campaigns. These cookies track user interactions with pop-ups, forms, and other on-site tools, to deliver tailored content, avoid repetitive campaigns, and ensure messages align with user preferences. While these cookies collect anonymized behavioral data to improve the relevance and timing of promotional messages, they do not collect personally identifiable information unless voluntarily provided by the user (e.g., via form submissions).

14.2 Turning cookies off

14.2.1 You can turn off the remarketing option by visiting the links below:

(a) For Google: https://support.google.com/googleads/answer/2375362?co=ADWORDS.IsAWNCustomer%3Dfalse&hl=en

(b) For Facebook: https://www.facebook.com/ads/website_custom_audiences/

14.3 Managing and deleting cookies:

14.3.1 You may accept or decline cookies by changing Your browser settings. If cookies are disabled, You may be unable to use all interactive features of our website.

14.3.2 Most current browsers allow You to control cookies through the saved browser settings.

14.4 Cookies help us:

14.4.1 To make our website work according to Your expectations;

14.4.2 To remember Your settings during visits;

14.4.3 To constantly improve our website for You;

14.4.4 To improve our advertising efficiency.

14.5 We do not use non-essential cookies for:

14.5.1 the collection of identifiable Personal data – we will always ask for Your explicit permission if we ever want to collect such information;

14.5.2 the collection of Your sensitive Personal data without Your explicit consent.

14.6 The use of cookies falls into several categories:

14.6.1 Cookies for Essential Website and App Features: We use essential cookies to ensure the core functionality of our website and MyIute app. These cookies are necessary for the proper operation of our services and enable critical features such as secure login, navigation between pages, and remembering your preferences during a session. For example:

Ø Essential cookies keep you securely logged in as you navigate through different sections of the website or app, preventing the need to re-enter login credentials for each page.

Ø They help maintain the stability and security of the site, ensuring it performs optimally across devices and browsers.

Ø Certain preferences or selections (e.g., language or region) are temporarily stored to improve your browsing experience during the session.

Ø These cookies do not collect personal information for marketing purposes and are automatically deleted once you log out or close your browser or app session.

14.6.2 Analytical cookies:

Analytics programs use cookies to collect statistical data that help us improve our website. Unless You provide us with explicit information by filling out a form or calling us, all data collected by analytics programs is stored anonymously and we see only general values and not specific individual data. Examples include:

Ø How You got to our website (e.g. from a search engine, advertising, etc.);

Ø The actions that You perform on the website, such as the number of pages viewed, the time spent on a page, on which page visitors left the website;

Ø How often You return to our website;

Ø Technology used by visitors (e.g. browser, operating system, device, etc.).

14.7 To learn more about cookies in general and how to manage them, please visit www.aboutcookies.org.

15. YOUR RIGHTS TO PERSONAL DATA PROTECTION

15.1 You have certain rights regarding Your Personal data, such as the right to:

15.1.1 ask us to provide You with additional details on how Your data is processed;

15.1.2 ask us to give You access to Your Personal data and to provide You with a copy of it;

15.1.3 receive Personal data that concerns You and that You have provided to us in a structured, widely used and machine-readable format and – where technically possible – to transfer this data to another controller without hindrance if the processing of Your data is based on Your consent or agreement and is performed by automated means;

15.1.4 ask us to update any inaccuracies in the data that we store and to correct / update the same;

15.1.5 ask us to erase or anonymize all data about You for which we no longer have a legal basis to process;

15.1.6 when the processing is based on consent and in connection with marketing, You may withdraw Your consent in order for us to stop that particular processing henceforth;

15.1.7 object to any processing for the purpose of automated individual decision-making (including profiling) when it significantly affects You, while You have the opportunity to exercise Your right to request human intervention by the controller, the right to express Your views and to challenge the decision;

15.1.8 ask us to limit the processing of Your data, e.g. while a complaint is being investigated.

15.2 Procedure for exercising these rights:

15.2.1 You may submit a request for exercising Your rights to the Contact Person in one of the following ways: on site, by mail (including e-mail), phone or as referred to in section 1 above.

15.2.2 Each one of Your applications, inquiries or requests is accepted with an incoming number, while it is reviewed, we verify Your identity and the right that You want to exercise, and we answer within one month of receipt. In more complex cases or during the receipt of numerous requests, this period may be extended by another two months, of which we will inform You. In the event that there are reasons to reject the request, we will state these reasons to You in writing.

15.2.3 The exercise of these rights is subject to certain exceptions, for example when public interest must be protected (e.g. in preventing or detecting crimes), or our legitimate interests, or the rights and freedoms of others.

15.2.4 If You have any questions on the processing of Your data, please contact us via the contact details provided in section 1 above (Monday through Friday from 08:00 a.m. to 16:30 p.m.).

15.2.5 If you disagree with our initial response to your request, you may request an internal review by escalating your case within our organization. Our Data Protection Officer will reassess your petition before any further action is taken.

15.2.6 If You are not satisfied with the processing of Your data or with our response in exercising these rights, You have the right to file a complaint to the Commissioner on the Right of Information and for Personal Data Protection at: Rr. “Abdi Toptani”, Nd. 5, Kodi postar 1001, Tiranë, website: https://idp.al/. Please try to resolve the issue with us beforehand, although You have the right to contact the Commissioner on the Right of Information and for Personal Data Protection at any time.

16. AMENDMENT OF PERSONAL DATA AND TERMINATION OF PERSONAL DATA PROCESSING

16.1 Inform Us immediately of any changes and inaccuracies in Your Personal data submitted to us. At our request, submit to us a document that proves the changes in Your Personal data (e.g. name change certificate).

16.2 We endeavour to do our best to regularly check that Your Personal data is complete and correct.

17. POLICY UPDATE

We may make changes to this Policy from time to time. Changes to this Policy will take effect when the revised Policy is published on the Website, and an update notification will be posted on the Website. We notify updates to this Policy exclusively via our website and the Myiute app. Users are encouraged to regularly review these platforms for the latest privacy information.

IUTEPAY SHPK