CUSTOMER PRIVACY NOTICE

This notice was updated on 23.09.2025.

The platformwww.digitap.app is operated and managed by RMATM EUROPE LIMITED (“DIGITAP”). Whilewww.digitap.app functions as a technology integrator specializing in financial technology solutions, the financial services available through the platform are provided by Joint Development Bank (JDB), a licensed financial institution based in Lao PDR.

What is this document about?

We’re committed to protecting and respecting your privacy. We will:

always keep your personal data safe and private
never sell your personal data
allow you to manage and review your marketing choices at any time

1. About us

The DIGITAP company providing you with a product or service will be responsible for processing your personal data for that product or service. This DIGITAP company is known as the ‘controller’ of your personal data.

2. Why do I need to read this notice?

We collect your personal data when you use:

our website atwww.digitap.app
the DIGITAP app
any of the services available to you through the DIGITAP app or website When we say ‘personal data’, we mean information which:
we know about you (for example, we know when you use your DIGITAP card to pay for things)
can be used to personally identify you (for example, a combination of your name and postal address)

This notice explains what information we collect, how we use it, and your rights over your personal data.
Sometimes, we may also provide you with ‘just in time’ privacy explanations in the DIGITAP app. When you use a new DIGITAP product or service for the first time:

these explanations will help you to understand what specific personal data DIGITAP collects, uses or shares about you for that product or service
where relevant, you will be prompted to review your in-app privacy preferences

We may provide privacy notices and explanations in languages other than English. If there are any discrepancies between other language versions and the English language version, the English language version is authoritative.

If you have concerns about how we use your personal data, you can contact us at using the designated channels mentioned on www.digitap.app.

3. What personal data do you collect about me?

The table below explains what personal data we collect and use.

Type of personal data	Details
Information you give us	We collect information you provide when you: ✓ fill in any forms ✓ correspond with us ✓ respond to any of our surveys ✓ register to use the DIGITAP app ✓ open an account or use any of our services ✓ give us access to your other financial accounts ✓ take part in online discussions or promotions ✓ speak with a member of our social media or customer support teams (either on the phone or through the DIGITAP app) ✓ enter a competition or share information with us on social media ✓ contact us for other reasons We will collect the following information: ✓ your name, address, and date of birth ✓ your email address, phone number and details of the device you use (for example, your phone, computer or tablet) ✓ your DIGITAP username which is known as your ‘UserID’ (this is random and is automatically assigned to you when you first join but you will be able to change it) ✓ your registration information ✓ details of your DIGITAP debit cards and credit cards (or other debit or credit cards you have registered with us) including the card number, expiry date and CVC (the last three digits of the number on the back of the card) ✓ copies of your identification documents (for example, your passport or driving licence) and any other information you provide to prove you are eligible to use our services ✓ your country of residence, tax residency information, and tax identification number ✓ information you provide when you apply for credit, including details about your, or your spouse’s, income and financial obligations ✓ records of our discussions, if you contact us or we contact you (including records of phone calls) ✓ your image in photo or video form, and facial scan data extracted from your photo or video (known as ‘biometric data’), to verify your identity during onboarding as part of our Know-Your-Customer (KYC) checks, to authenticate you as an authorised user of our services, or to detect and prevent fraud If you give us personal data about other people (such as a joint account holder, your spouse or family), or you ask us to share their personal data with third parties, you confirm that you have brought this notice to their attention beforehand.
Information collected from your use of our products and services	Whenever you use our website or the DIGITAP app, we collect the following information: ✓ technical information, including the internet protocol (IP) address used to connect your computer to the internet, your login information, the browser type and version, the time zone setting, device language, the operating system and platform, the type of device you use, whether your device uses a virtual private network (VPN), a unique device identifier (for example, your device's IMEI number, or the mobile phone number used by the device), mobile network information, your mobile operating system and the type of mobile browser you use ✓ information about your visit, including the links you’ve clicked on, through and from our website or app (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling and clicks), and methods used to browse away from the page ✓ information on transactions and your use of DIGITAP products (for example, payments into and out of your account), including the date, time, amount, currencies, exchange rate, beneficiary details, details of the merchant or ATMs associated with the transaction (including merchants’ and ATMs’ locations), IP address of sender and receiver, sender's and receiver's name and registration information, messages sent or received, details of device used to arrange the payment and the payment method used ✓ information stored on your device, including if you give us access to contact information from your contacts list. The DIGITAP app will regularly collect this information in order to stay up to date (but only if you have given us permission)
Information about your location	If you turn location services on in the DIGITAP app, we may track your location using GPS technology.
Information from social media	Occasionally, we’ll use publicly available information about you from selected social media websites or apps to carry out enhanced due diligence checks.

4. What is your legal basis for using my personal data?

We must have a legal basis (a valid legal reason) for using your personal data. Our legal basis will be one of the following:

Keeping to our contracts and agreements with you We need certain personal data to provide our services and cannot provide them without this personal data.
Legitimate interests We sometimes collect and use your personal data because we have a legitimate reason to use it and this is reasonable when balanced against your human rights and freedoms.
Substantial public interest Where we process your personal data, or your sensitive personal data (sometimes known as special category personal data), to adhere to government regulations or guidance, such as our obligation to prevent fraud or support you if you are or become a vulnerable customer.
Consent Where you've agreed to us collecting your personal data, or sensitive personal data, for example when you tick a box to indicate you’re happy for us to use your personal data in a certain way.

5. How do you use my personal data?

Explore the ways in which we may use your personal data using this table:

What we use your personal data for	Our legal basis for using your personal data
Providing our services Whenever you apply for or use a DIGITAP product or service, we’ll use your personal data to: decide whether or not to approve your application meet our contractual and legal obligations relating to any products or services you use (for example, making payments into and out of your DIGITAP account, withdrawing cash or making payments with your DIGITAP card) help you understand your spending behaviour, how you use DIGITAP products and services, and to help you save money (for example, by providing you with product usage and spending insights) recover debt and exercise other rights we have under any agreement with you provide you with customer support services. We may record and monitor any communications between you and us, including phone calls, to maintain appropriate records, check your instructions, analyse, assess and improve our services, and for training and quality control purposes	Keeping to contracts and agreements between you and us Legitimate interests (we need to be efficient about how we meet our obligations and we want to provide you with good products and services) Legal obligations
Protecting against fraud We use your personal data to check your address and identity, protect against fraud, keep to financial crime laws and to confirm that you’re eligible to use our services. We also use it to help us better understand your financial circumstances and manage fraud risks related to your DIGITAP account.	Legitimate interests (to develop and improve how we deal with financial crime and meet our legal responsibilities)
Marketing and providing products and services that might interest you We use your personal data to do the following: to personalise your in-app experience and marketing messages about our products and services so they’re more relevant and interesting to you (where allowed by law). This may include analysing how you use our products, services and your transactions if you agree, provide you with information about our partners’ promotions or offers which we think you might be interested in if you agree, allow our partners and other organisations to provide you with information about their products or services ask your opinion about our products or services Remember, you can ask us to stop sending you marketing information by adjusting your marketing choices section below explains how to do this).	Legitimate interests (to send direct marketing, ensure our direct marketing is relevant to your interests, develop our products and services, and to be efficient about how we meet our legal and contractual duties) Consent (where we’re legally required to get your consent to send you direct marketing about our products or services, or partners’ promotions or offers, or for you to receive marketing from other organisations)
To keep our services up and running We use your personal data to manage our website and the DIGITAP app, (including troubleshooting, data analysis, testing, research, statistical and survey purposes), and to make sure that content is presented in the most effective way for you and your device. We also use your personal data to: authenticate you as an authorised user of our services when necessary (for example, if you contact our customer support or social media teams) allow you to take part in interactive features of our services tell you about changes to our services help keep our website and the DIGITAP app safe and secure	Keeping to contracts and agreements between you and us Legitimate interests (to be efficient about how we meet our obligations and keep to regulations that apply to us and to present content as effectively as possible for you) Consent (where required by law)
Helping with social interactions We use your personal data to help with social interactions through our services, or to add extra functions in order to provide a better experience. For example, if you give us permission, we'll use the contacts list on your phone so you can easily make payments to, or message, your contacts using the DIGITAP app.	Legitimate interests (to develop our products and services and to be efficient in meeting our obligations) Consent (to access information held on your phone, for example, contacts in your contacts list, to track you when you have location services switched on)
Providing location-based services If you turn location services on in the DIGITAP app, we use your personal data to: provide you with products and services provide relevant advertising to you (for example, information about nearby merchants) protect against fraud	Keeping to contracts and agreements between you and us Legitimate interests (to develop and market our products and keep to regulations that apply to us) Consent (to track you when you have location services switched on)
Preparing anonymous statistical datasets We prepare anonymous statistical datasets about our customers’ spending patterns: for forecasting purposes to understand how customers use DIGITAP to comply with governmental requirements and requests These datasets may be shared internally or externally with others, including non-DIGITAP companies. We produce these reports using information about you and other customers. The information used and shared in this way is never personal data and you will never be identifiable from it. Anonymous statistical data cannot be linked back to you as an individual. For example, some countries have laws that require us to report spending statistics and how money enters or leaves each country. We’ll provide anonymised statistical information that explains the broad categories of merchants that DIGITAP customers in that country spend their money with. We’ll also provide information about how DIGITAP customers top up their accounts and transfer money. However, we won’t provide any customer-level information. It will not be possible to identify any individual DIGITAP customer.	Legitimate interests (to conduct research and analysis, including to produce statistical research and reports) Legal obligations
Improving our products and services We use your personal data to help us develop and improve our current products and services. For example, we may include you in a focus group to test and develop new products because we think you will be interested based on how you spend or use other DIGITAP products. This allows us to continue to provide products and services that our customers want to use.	Legitimate interests (to understand how customers use our products so we can develop new products and improve the products we currently provide)

6. How do you use my personal data for marketing?

If you sign up to our services, and where national laws allow, we’ll assume you want to be contacted by post, push notification, email and text message with information about DIGITAP products, services, offers and promotions. Where national laws require us to get your consent to send marketing messages, we’ll do so in advance.

We use your personal data to personalise marketing messages about our products and services so they are more relevant and interesting to you (where allowed by law). This may include analysing how you use our services and your transactions.

You can object to profiling for direct marketing purposes. You can also adjust your preferences or tell us you don't want to receive direct marketing at any time. Just use the privacy settings in the DIGITAP app or tap the unsubscribe links in any marketing message we send you.

If you do not want to receive personalised marketing messages, and opt out from receiving them, you will not receive any marketing communications. However, you may still receive generic information about our products and services in the DIGITAP app.

We won't pass your details on to any organisations outside the DIGITAP group of companies for their marketing purposes without your permission.

Our legal basis is:

consent (where we are required by law to collect your consent)
legitimate interests (to send you marketing and to provide information relevant to your interests)

7. What are my rights?

Your right	What it means
You have the right to be told how we use your personal data	We provide this privacy notice to explain how we use your personal data.
You have the right to ask us for a copy of your personal data	If you ask, we’ll provide a copy of the personal data we hold about you. We can’t give you any personal data about other people, personal data which is linked to an ongoing criminal or fraud investigation, or personal data which is linked to settlement negotiations with you. We also won't provide you with any communication we've had with our legal advisers.
You can ask us to correct your personal data if you think it's wrong	You can have incomplete or inaccurate personal data corrected. Before we update your file, we may need to check the accuracy of the new personal data you have provided.
You can ask us to delete your personal data	You can ask us to delete your personal data if: ✓ there's no good reason for us to continue using it ✓ you gave us consent (permission) to use your personal data and you have now withdrawn that consent ✓ you have objected to us using your personal data ✓ we have used your personal data unlawfully ✓ the law requires us to delete your personal data Just to let you know, we may not be able to agree to your request. As a regulated financial services provider, we must keep certain customer personal data even when you ask us to delete it (we've explained this in more detail below). If you've closed your DIGITAP account, we may not be able to delete your entire file because these regulatory responsibilities take priority. We’ll always let you know if we can't delete your personal data.
You can object to us processing your personal data for marketing purposes	You can tell us to stop using your personal data, including profiling you, for marketing.
You can object to us processing other personal data (if we’re using it for legitimate interests)	If our legal basis for using your personal data is 'legitimate interests' and you disagree with us using it, you can object. However, if there is an overriding reason why we need to use your personal data, we will not accept your request. If you object to us using personal data which we need to provide our services, we may need to close your account as we won’t be able to provide the services.
You can ask us to restrict how we use your personal data	You can ask us to suspend using your personal data if: ✓ you want us to investigate whether it’s accurate ✓ our use of your personal data is unlawful but you don’t want us to delete it ✓ we no longer need your personal data, but you want us to continue holding it for you in connection with a legal claim ✓ you have objected to us using your personal data (see above), but we need to check whether we have an overriding reason to use it
You can ask us to transfer personal data to you or another company	If we can, and are allowed to do so under regulatory requirements, we’ll provide your personal data in a structured, commonly used, machine-readable format.
You can withdraw your permission	If you’ve given us the consent we need to use your personal data, you can withdraw it at any time by changing your privacy settings in the DIGITAP app or sending an email at the contact information found onwww.digitap.app (Please note, it will have been lawful for us to use the personal data up to the point you withdraw your permission.)
You can ask us to carry out a human review of an automated decision we make about you	If we make an automated decision about you that significantly affects you, you can ask us to carry out a manual review of this decision.

Your ability to exercise these rights will depend on a number of factors. Sometimes, we won’t be able to agree to your request (for example, if we have a legitimate reason for not doing so or the right does not apply to the particular information we hold about you).

8. How do I exercise my rights?

To exercise any of your rights set out in the previous section, you can contact us through the DIGITAP app or send us an email at the contact information found on www.digitap.app

For security reasons, we can't deal with your request if we’re not sure of your identity, so we may ask you for proof of ID.

When you exercise one of your rights, or update your privacy settings in the DIGITAP app, it may take us up to one month to respond or implement your changes.

DIGITAP will usually not charge you a fee when you exercise your rights. However, we’re allowed by law to charge a reasonable fee or refuse to act on your request if it is manifestly unfounded or excessive.

9. Do you share my personal data with anyone else?

DIGITAP group companies

We share your personal data within the DIGITAP group of companies to:

provide you with the best service
protect you, other customers and our systems from fraud or harmful behaviour
facilitate you quickly signing up to use other DIGITAP products or services
improve existing, or develop new, products or services
send you information about DIGITAP products and services we think you’ll be interested in hearing about

DIGITAP group companies

We’ll ask you to let us sync your mobile phone contacts. This will help you to identify which of your trusted mobile phone contacts are DIGITAP customers. Your ‘trusted contacts’ will also be able to see if you’re a DIGITAP customer through our in-app discoverability settings.

In-app discoverability gives you access to DIGITAP features like requesting money from your friends, splitting bills, group pockets, paying other DIGITAP customers or chatting to your ‘trusted contacts’.

We use technological safeguards to ensure a ‘trusted contact’ is somebody you already know and who knows you (for example, you have each other saved in each other’s mobile phone contacts lists or have already received or given money through a peer-to-peer payment with them).

Both you and your trusted contact must have synced your mobile phone contacts lists with DIGITAP to be viewable to each other in the DIGITAP app.

If you have synced your mobile phone contacts, we show basic details about you in the DIGITAP app to your trusted contacts who are also DIGITAP customers (for example, your name (as saved in your friend’s contacts list), mobile phone number, UserID, DIGITAP membership plan, and DIGITAP profile photo (if you have one)).

You can, of course, choose not to sync your contacts list with DIGITAP. This means that you won’t be able to identify which of your mobile phone contacts are DIGITAP customers.

You can also change your discoverability preferences through the privacy settings in the DIGITAP app.

Other DIGITAP customers will be able to search for you through the DIGITAP app using your UserID.

When they input your UserID, they will be able to see your name and profile photo (if you have one). You can turn off being discoverable by your UserID through the privacy settings in the DIGITAP app.

People or companies that you transfer money to

Where you make a payment from your DIGITAP account, we’ll provide the recipient with your details alongside your payment (for example, your name and IBAN). This is because, like all payment institutions, we’re required by law to include certain information with payments.

People or companies that transfer money to you

When you receive a payment to your DIGITAP account, we’ll provide the payer with your details (for example, your name and IBAN). This is necessary to confirm that the payment has been made to the correct account.

Suppliers

The table below explains which suppliers we normally share your personal data with:

Type of supplier	Why we share your personal data
Suppliers who provide us with IT, payment and delivery services	To help us provide our services to you
Our banking and financial services partners and payments networks, including Visa and Mastercard	To help us provide our services to you. This includes banking and lending partners, banking intermediaries and international payment service providers
Identity verification and KYC service providers	To help us verify your identity so we can provide our services to you
Card manufacturing, personalisation and delivery companies	To create and deliver your personalised DIGITAP card
Analytics providers and search information providers	To help us improve our website or app
Customer-service providers, survey providers and developers	To help us provide our services to you
Communications services providers	To help us send you emails, push notifications and text messages
Debt collection agencies	To manage and recover debts that you owe or may end up owing (including if you have a DIGITAP credit product)

Partners who help to provide our services

We may share your personal data with our partners to:

provide certain services you’ve asked us for (for example, when we offer insurance as part of our membership plans)

Make sure you get any reward we have promised you (for example, if you make a purchase with a partner, we will share limited information about you to make sure you get the right cashback) We’ll only share your personal data in this way if you’ve made a qualifying purchase, asked for the relevant service or if it’s provided as part of our membership plans

From time to time, we may work with other partners to offer you co-branded services or promotional offers, and we’ll share some of your personal data with those partners. We will always make sure you understand how we and our partners process your personal data for these purposes.

Joint account holders

If you have a joint account with us, we will share account and transaction information between joint account holders. For example, your co-account holder will see any transactions you make from your joint account.

Other third parties

We may share your personal data with other third parties where necessary to facilitate you receiving payments to your DIGITAP account.

If fraud is detected, you could be refused certain services by DIGITAP or other companies.

Social media and advertising companies

When we use social media for marketing purposes, your personal data (limited to only your name, email address and app events) may be shared with the social media platforms so that they can check if you also hold an account with them. If you do, we may ask the advertising partner or social media provider to:

use your personal data to send our adverts to you, because we think that you might be interested in a new DIGITAP product or service
not send you our adverts, because the marketing relates to a service that you already use
send our adverts to people who have a similar profile to you (for example, if one of our services is particularly useful to people with similar interests to the ones on your social media profile, we may ask our advertising partner or social media partner to send our adverts for that service to those people)

We may share your personal data with our advertising partners in the ways described above, but the personal data is hashed before we send it, and the advertising partner we share it with is only allowed to use that hashed personal data in the ways described above.

Our legal basis is:

legitimate interests (to ensure DIGITAP’s advertising is as effective as possible)

You can contact us at any time, either through the DIGITAP app or by emailing at the contact information found on www.digitap.app if you don’t want us to share your personal data for advertising purposes. You can also use the privacy settings in the DIGITAP app to opt out from having your personal data shared in this way.

Remember you can also manage your marketing preferences directly with any social media provider that you have an account with.

Where you ask us to share your personal data

Where you direct us to share your personal data with a third party, we may do so. For example, you may authorise third parties to act on your behalf (such as a lawyer, accountant or family member or guardian under a power of attorney). We may need to ask for proof that a third party has been validly authorised to act on your behalf.

10. How do you protect my personal data?

We recognise the importance of protecting and managing your personal data. Any personal data we process will be treated with the utmost care and security. This section sets out some of the security measures we have in place.

We use a variety of organisational and technical measures to:

maintain the confidentiality, availability and integrity of your personal data
make sure your personal data is not improperly used or disclosed

We have detailed information security and data protection policies which our employees are required to follow when they handle your personal data. Our employees receive data protection and information security training. Personal data is stored on secure computer systems with access management controls in place to limit physical, system and information access to only authorised employees.

DIGITAP has strict policies in place that control how we share your personal data with other companies. Before sharing personal data with any company, we thoroughly:

vet the company in advance
assess the security controls the company has in place to protect your personal data

While we take all reasonable steps to ensure that your personal data will be kept secure from unauthorised access, we cannot guarantee it will be secure during transmission by you to our app, our website or other services we may provide. We use HTTPS (HTTP Secure), where the communication protocol is encrypted through Transport Layer Security for secure communication over networks, for all our app, web and payment-processing services.

If you use a password, PIN or generated authorisation code or prompt to use the DIGITAP app, our website or other services, you will need to keep it confidential. Please do not share it with anyone. DIGITAP will never ask you for this credential.

When you use our public services, which includes our social network accounts and the DIGITAP Community forum, do not share any personal data that you don't want to be seen, collected or used by other customers, as this personal data will become publicly available.

11. How long will you keep my personal data for?

We will keep your personal data:

for as long as necessary to achieve the original purpose we collected it for
in line with relevant laws

We may keep your personal data for a longer time period because of a potential or ongoing court claim, or for another legal reason.

12. How will you keep me updated about how you use my personal data?

If we change the way we use your personal data, we’ll update this notice and, if appropriate, let you know by email, through the DIGITAP app or through our website.

13. How do I contact the DigiTap privacy team?

If you have questions, feedback, or concerns about how we handle your data, contact our Privacy Team: privacy@digitap.app