This privacy statement explains how Geldmaat B.V. (hereinafter “Geldmaat”, “we” or “us”) handles your personal data. When you use our services, contact us, or are recorded by one of our cameras, you share personal data with us. We value your privacy and ensure that your data is processed in accordance with applicable laws and regulations.

What personal data do we process?

We collect personal data in various ways:

Through use of our services or when you contact us:

• Name and address
• Telephone number and email address
• International Bank Account Number (IBAN)
• Credit card number
• Permanent Account Number (PAN)
• Camera footage
• Recordings of phone calls
• Information you provide to us

When visiting a Geldmaat office:

• First and last name
• Last 4 letters/numbers of your ID
• Email address
• Camera footage

From other sources:

• Camera surveillance at ATMs, offices, and stores
• Cookies when visiting geldmaat.nl (see Cookie Statement for more information)
• Public sources
• Trade Register and Land Registry
• Other organizations such as financial institutions and suppliers

Why do we process your personal data?

We process your data for the following purposes:

• Identification
• Executing and recording financial transactions
• Security of ATMs, stores, and offices
• Visitor registration
• Providing our services
• Analyses to improve our services
• Compliance with legal obligations
• Preventing and addressing fraud and crime
• Protecting your and our interests
• Responding to questions and complaints
• Employee training
• Obtaining external advice

On what basis do we process your data?

We process your personal data based on:

• Your consent (which you can withdraw at any time)
• Performance of a contract
• Legal obligations
• Legitimate interests of you, us, or third parties

With whom do we share your data?

We may share your data with:

• Service providers such as IT support and security
• Financial institutions
• Government authorities such as regulators and the Tax Authority
• Legal and financial advisors
• Parties for which you have given consent
• Potential buyers/investors in case of reorganization or sale We always ensure appropriate security measures when sharing data.

International data transfers

In some cases, data is shared with parties outside the European Economic Area (EEA). We then provide additional safeguards, such as:

• Legal requirements
• EU adequacy decisions
• EU model contracts

How long do we keep your data?

We do not keep your data longer than necessary. After that, it is deleted or anonymized. Examples:

• Camera footage: 28 days (longer in case of incidents)
• Visitor registration: 3 months
• Phone recordings: 30 days (longer for ongoing complaint handling)

Your rights

You have several rights regarding your personal data that we process. These rights include:

• Access to your data
• Correction of incorrect or incomplete data
• Deletion of data in certain cases
• Objecting to processing
• Requesting restriction of processing
• Withdrawing consent
• Data portability If you wish to exercise these rights, please contact us using the details at the end of this statement. In some cases, we may not be able to comply with your request, for example if the law does not allow it.

How do we secure your data?

We take appropriate technical and organizational measures, such as:

• Access control
• Monitoring
• Regular evaluation of security measures

We process data according to the following principles:

• Lawful, fair, and transparent
• Only for the intended purpose
• As limited as possible
• Accurate and up-to-date
• Not longer than necessary
• Confidential and with integrity

Children’s data

Our services may also process data of persons under 16 years of age. We do this carefully and in accordance with the law.

Changes to this statement

We may update this privacy statement. The most current version is always available at www.geldmaat.nl/nl/privacy-statement/.

Contact details

If you have questions, comments, or concerns about this privacy statement, how we process your personal data, or if you want to exercise your rights, please contact us:

Geldmaat B.V. CJ van Houtenlaan 36-c, 1381 CP Weesp Email: privacy@geldmaat.nl

We have a Data Protection Officer (DPO). If you have questions and/or complaints regarding your privacy, you can contact our DPO. Our DPO works for Lumen Group and can be reached by phone at 030 - 889 65 75 or by email at fg@lumengroup.nl. The DPO is also available via the secure website https://www.lumengroup.nl/contact-fg/.

Lumen Group B.V. Reactorweg 47, 3542 AD Utrecht If you believe that Geldmaat’s processing of your personal data does not comply with applicable data protection laws, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can contact the AP via their website (www.autoriteitpersoonsgegevens.nl) or by writing to: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ The Hague.

Last updated: 26 November, 2025