This privacy statement provides insight into how Geldmaat B.V. (hereinafter “Geldmaat,” “we,” or “us”) collects, stores, modifies, uses, and shares your personal data. By using Geldmaat’s services, contacting Geldmaat, or being captured by Geldmaat’s cameras, you share personal data with us. At Geldmaat, we value your privacy and the protection of your personal data. This privacy statement explains how we collect, use, share, and protect personal data in compliance with applicable laws and regulations.

Scope of this Privacy Statement

This privacy statement applies to all types of personal data processed by Geldmaat:

• When you visit a Geldmaat location;
• When you use a Geldmaat service, such as ATMs (collectively referred to as “Services”);
• If you are captured by a Geldmaat camera;
• When you contact Geldmaat via the contact form on www.geldmaat.nl, by phone, or by mail; and
• When you visit a Geldmaat office.

Personal Data

Personal data includes any information relating to an identified or identifiable natural person. Geldmaat collects your personal data in the following ways:

Personal data collected when you use a service or contact us via the contact form, phone, mail, or email:

• Identification details: such as your name and address;
• Phone number and email address;
• Financial (identification) details: such as International Bank Account Number (IBAN), credit card number, Primary Account Number (PAN), and account holder name;
• Camera footage;
• Telephone call recordings; and
• Other information you provide to Geldmaat.

Personal data collected when you visit a Geldmaat office:

• First and last name;
• The last 4 letters and/or digits of your ID;
• Email address; and
• Camera footage.

Personal data obtained from other sources:

• Personal data obtained via camera surveillance at and around Geldmaat ATMs, offices, and locations;
• Personal data available from public sources;
• Personal data obtained from the Chamber of Commerce and Land Registry; and
• Personal data from other organizations, such as financial institutions and suppliers.

For what purposes does Geldmaat use your personal data?

Processing includes any operation performed on personal data, such as collecting, storing, modifying, transmitting, or deleting. Geldmaat processes your personal data for one or more of the following purposes:

• Identification;
• Executing and documenting financial transactions, such as cash withdrawals or deposits;
• Security and monitoring of Geldmaat ATMs;
• Security and monitoring of Geldmaat locations;
• Visitor registration;
• Providing our services;
• Compliance with legal obligations, claims, and court orders;
• Detecting, investigating, preventing, and addressing fraud, crime, and technical issues;
• Protecting your interests and those of Geldmaat;
• Responding to inquiries, handling complaints and suggestions, and preparing reports;
• Training purposes;
• Ensuring the safety of individuals, premises, and assets of Geldmaat; and
• Obtaining external legal, financial, or other advice.

Legal Basis for Processing

• Geldmaat processes your personal data based on the following legal grounds:
• You have given consent for the processing of your personal data for specific purposes. You have the right to withdraw your consent at any time;
• Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract;
• Processing is necessary for compliance with a legal obligation, claim, or court order to which Geldmaat is subject;
• Processing is necessary to protect vital interests of you or another natural person; or
• Processing is necessary for the purposes of the legitimate interests pursued by Geldmaat, yourself, or a third party.

Sharing of Personal Data

Geldmaat may share your personal data with third parties. In compliance with applicable laws and regulations, Geldmaat takes the necessary measures to ensure the security of your personal data when shared. These third parties may include:

• Service providers offering services on behalf of Geldmaat, such as IT support, security companies, customer support, and analytics services;
• Professional service providers, such as your bank or other parties involved in financial transactions;
• Regulators, tax authorities, and other government bodies to comply with legal obligations, claims, and court orders;
• External legal, financial, and other advisors;
• If you have given consent or as required by law or court order; and
• Potential buyers or investors in the event of a reorganization, merger, or sale of (part of) Geldmaat’s business.

International Transfer of Personal Data

In most cases, your personal data is processed within the European Economic Area (EEA). For certain purposes outlined in this privacy statement, your personal data may be transferred to third parties outside the EEA. In such cases, we ensure appropriate safeguards are in place to protect your personal data, such as:

• Compliance with legal requirements;
• Adequacy decisions; and
• EU model clauses.

Retention Periods

Geldmaat retains your personal data no longer than necessary for the purposes for which it was collected or processed. After this period, we delete or anonymize the data. Retention periods vary depending on the type of data and the purpose of processing, in accordance with legal requirements and business needs.

Examples of retention periods:

• Camera footage: 28 days, unless an incident occurs or longer retention is legally required.
• Visitor registration at Geldmaat offices: 3 months, unless an incident occurs.
• Telephone call recordings: 30 days, unless a customer or employee complaint is filed.

Your Rights

You have certain rights regarding your personal data processed by Geldmaat, including:

• The right to access your personal data;
• The right to correct inaccurate or incomplete personal data;
• The right to request the erasure of your personal data in certain situations;
• The right to object to the processing of your personal data for specific purposes;
• The right to request the restriction of processing in certain situations;
• The right to withdraw consent if processing is based on consent; and
• The right to data portability for your personal data in a structured, commonly used, and machine-readable format.

To exercise your rights, please contact us using the details provided below. In some cases, your rights may be limited due to legal requirements or other justified reasons.

Data Security

Geldmaat takes appropriate technical and organizational measures to ensure the security of your personal data. Measures include access control, monitoring, and regular evaluation of security measures. Geldmaat adheres to internal policies and standards that are regularly reviewed and updated based on legal and market developments.

When processing personal data, Geldmaat adheres to the following principles:

• Personal data is processed lawfully, fairly, and transparently;
• Data is only processed for the specific purpose for which it was collected (purpose limitation);
• Data is only processed when necessary (data minimization);
• Data is processed accurately (accuracy);
• Data is not retained longer than necessary (storage limitation);
• Personal data is handled with integrity and confidentiality (integrity and confidentiality).

Personal Data of Children

Geldmaat's services may also involve processing the data of individuals under the age of 16 to provide its services. Geldmaat strives to collect and process the personal data of individuals under 16 responsibly and in accordance with applicable laws.

Changes to this Privacy Statement

Geldmaat reserves the right to amend this privacy statement at any time. The latest version is always available at www.geldmaat.nl/privacy. Changes take effect as soon as the updated statement is published.

Contact Details For questions, comments, or concerns regarding this privacy statement or the processing of your personal data, or to exercise your rights, please contact us:

Geldmaat B.V. Van Houten Industriepark 4a 1381 MZ Weesp Netherlands Email: privacy@geldmaat.nl

We have appointed a Data Protection Officer (DPO). For privacy-related questions or complaints, you may contact our DPO at:

Lumen Group B.V. Reactorweg 47 3542 AD Utrecht Phone: +31 (0)30 - 889 65 75 Email: fg@lumengroup.nl Secure website: https://www.lumengroup.nl/contact-fg/

If you believe your data has been processed unlawfully, you may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via their website: www.autoriteitpersoonsgegevens.nl or by mail: Postbus 93374, 2509 AJ The Hague.

Last updated: May 2, 2024