F.2 Privacy Policy

PART F.2 — PRIVACY POLICY

This page forms part of Part F (ODIX Euro Virtual IBAN). It explains how the Privacy Policy of our account partner, a licensed electronic money institution in the EU (the "Account Partner"), relates to the ODIX Euro Virtual IBAN and summarises its main points.

Important: this is a summary prepared by ODIX for your convenience. The legally binding document is the Privacy Policy published by the Account Partner, which is made available to you in the App before you accept it and on request from support@odixpay.com. If this summary and the Account Partner's document differ, the Account Partner's document applies.

1. HOW THIS RELATES TO ODIX

ODIX offers the Euro Virtual IBAN under its agreement with the Account Partner. The Account Partner provides the euro account, the IBAN and the payment services, so its documents apply to you when you use them. ODIX gives you access through the ODIX Pay App and remains the company you contact for support.

The Account Partner is the controller of the personal data it processes to provide the euro account and payment services. ODIX processes your personal data under our own Privacy Policy and shares with the Account Partner the information needed to open and run your Euro Virtual IBAN, such as your identity and verification data.

Requests about the data the Account Partner holds can be sent to the Account Partner's Data Protection Officer at the contact details given in the Account Partner's full document (available on request from support@odixpay.com). Requests about the data ODIX holds should be sent to us.

2. WHAT THE ACCOUNT PARTNER COLLECTS AND WHY

Identity data, including ID documents and video recordings, to verify your identity and meet AML law (legal obligation); contact data to contact you (contract); financial data such as IBAN and transaction history to process payments and detect fraud (contract and legitimate interest); technical data such as IP address and device identifiers for security (legitimate interest); regulatory data such as KYC documents, PEP status and sanctions screening (legal obligation); and marketing preferences (consent).

3. IF YOU DO NOT PROVIDE DATA

Without the required data, the Account Partner cannot onboard you or process transactions, and missing data may lead to restrictions or regulatory reporting.

4. RETENTION

KYC and customer data: 8 years after the account is closed. Transaction data: 7 years. Communication records: 5 years. Marketing data: until you withdraw consent.

5. AUTOMATED DECISIONS

The Account Partner uses automated systems for fraud prevention, risk scoring, sanctions and PEP screening and KYC checks. If you are flagged as high risk, your account or transactions may be blocked or delayed. You can ask for a manual review by contacting the Account Partner's Data Protection Officer (contact details available on request from support@odixpay.com).

6. YOUR RIGHTS

You have the rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent under the GDPR, exercised by email to the Account Partner's Data Protection Officer (contact details available on request from support@odixpay.com). You can complain to the data protection supervisory authority in the Account Partner's EU country of establishment or your local EEA supervisory authority.

7. SECURITY AND COOKIES

The Account Partner encrypts data in transit and at rest, uses multi-factor authentication and carries out regular security audits. Its website uses cookies, including third-party analytics cookies, which you can manage in its cookie settings.

8. FULL DOCUMENT AND QUESTIONS

You can read the complete Privacy Policy of the Account Partner in the Account Partner's full document, made available to you in the App before you accept it and on request from support@odixpay.com. The Account Partner may update it; the version it currently publishes is the current one.

Questions about the ODIX Euro Virtual IBAN go to us at support@odixpay.com.