PRIVACY NOTICE FOR OUR VENDORS, SUPPLIERS AND BUSINESS PARTNERS

Please take the time to read the following information carefully so that you fully understand our views and practices regarding your personal information, how we will use it, who we will share it with and what rights you have in relation to your personal information. We recommend that you download and store this document in a safe place.

This privacy notice (this Notice) applies to business contact information that we process in relation to third parties (current, prospective and former) who supply goods, services and/or software to us. Please ensure that your staff who we may communicate with are aware of this Notice. There are however certain data protection laws that:

• do not regard business contact information as personal information provided it is only used for business-to-business communications/transactions (for example Singapore’s Personal Data Protection Act 2012);
• do regard business contact information as personal information but those provisions are not in force yet (for example the California Consumer Privacy Act 2018 (as amended)); or
• do not require us to provide a privacy notice prior to or at the time of collection of any personal information (for example most States within the USA).

This Notice was last updated on November 14, 2023.

In addition to this Notice, we may provide other privacy notices on specific occasions when we are collecting or processing personal information about you so that you are fully aware of how and why we are using your personal information. This Notice supplements those other privacy notices and is not intended to override them.

This Notice is provided in a layered format so you can click through to the specific areas set out below:

• WHO ARE WE?
• CONTACTING US AND YOUR RIGHT TO MAKE A COMPLAINT
• CHANGES TO THIS NOTICE
• HOW DO WE COLLECT, USE AND SHARE PERSONAL INFORMATION?
• INTERNATIONAL TRANSFERS
• YOUR RIGHTS AND CHOICES
• HOW WE PROTECT PERSONAL INFORMATION
• DIRECT MARKETING

1. WHO ARE WE?

Any personal information provided to or gathered by us is controlled by the following entities within the Remitly group:

Australia
Remitly Australia Pty Ltd
Governor Phillip Tower Level 61,
1 Farrer Place, Sydney, 2000

Canada
Remitly Canada Inc (British Columbia corporation)
250 Howe Street, 20th Floor,
Vancouver, BC V6C 3R

EEA (except Poland)
Remitly Europe Ltd
7th Floor Penrose Two, Penrose Dock
Cork, Ireland T23 Yy09

New Zealand
Remitly NZ Limited
Level 30, Vero Centre
48 Shortland Street
Auckland Central
1052 New Zealand

Poland
Remitly Poland SP. Z O.O
Ul. Pawia 17
31-154
Krakow, Poland

Singapore
TMF SINGAPORE H PTE LTD.
38 Beach Road, South Beach Tower, #29-11
Singapore 189767

UAE DIFC
Remitly DIFC Limited
Level 15 Unit Gd-Gb-00-15-Bc-23, Gate District Gate Building
Dubai International Financial Centre, Dubai,
United Arab Emirates

UK
Remitly UK Ltd
90 Whitfield Street
London W1t 4ez United Kingdom

USA
Remitly Inc (Delaware corporation)
1111 3rd Avenue, Suite 2400
Seattle WA 98101

When we refer to Remitly, we, us or our in this Notice, we are referring to the relevant Remitly entity who you are communicating with.

2. CONTACTING US AND YOUR RIGHT TO MAKE A COMPLAINT

If you have any issues, queries or complaints regarding our processing of your personal information, please email DPO@remitly.com. Our Data Protection Officers are:

Australia
N/A

Canada
DPO (contact via DPO@remitly.com)

EEA
Jessica Hennessy (contact via DPO@remitly.com)

Singapore
Robson Chia (contact via DPO@remitly.com)

UK
Gabriela Galazka (contact via DPO@remitly.com)

USA
Mariana Paonessa (contact via DPO@remitly.com)

You also have the right to complain to your data protection regulator about our processing of your personal information. We would, however, appreciate the chance to deal with your concerns before you approach your data protection regulator so please contact DPO@remitly.com in the first instance. The contact details for relevant data protection regulators are as follows:

Australia
OAIC
www.oaic.gov.au
Email: enquiries@oaic.gov.au
Phone: 1300 363 992

Canada
OPC
www.priv.gc.ca
Phone: 1-800-282-1376

EEA
This will depend on where in the EEA you reside: www.edpb.europa.eu/about-edpb/board/members_en

Singapore
PDPC
www.pdpc.gov.sg
Phone: +65 6377 3131

UK
ICO
https://ico.org.uk/
Phone: 0303 123 1113

USA
This will depend on where in the US you reside: www.usa.gov/state-attorney-general

3. CHANGES TO THIS NOTICE

We may amend this Notice at any time, and whenever we do so we will notify you by posting a revised version on our Site and App. If, however, we plan to make a material change in the way we collect, use, or store your personal information, we will provide prior notice on our website and by email.

If you do not agree with any of this Notice, or any change, please email us at DPO@remitly.com.

4. HOW DO WE COLLECT, USE AND SHARE PERSONAL INFORMATION?

Personal information we collect: If you or your staff contact us (by phone, email or otherwise), we will hold the following personal information:

• Name, job title and contact details (such as email address(es), work address and phone number(s)), and any other details you or they give us when you or they correspond with us; and
• information and documentation that we obtain about you and your staff from publicly available information (e.g. your website, social media and Companies House) when we carry out research (this is to ensure that we understand you, your staff and your business).

If your staff visit our website, we will also process certain personal information about their visit. Please see our Cookie Policy.

We may also collect information about your staff from social media platforms (for example LinkedIn) including when or if they interact with us on those platforms or access our social media content (the information we may receive is governed by the privacy settings, policies, and/or procedures of the applicable social media platform, and we encourage you and your staff to review them).

Using your personal information for business purposes: We will use all of the above information to:

• provide you with the information you have requested from us so that we can discuss the potential supply to us in the pursuit of our legitimate interests;
• enable us to perform our contract with the third party who is providing services, goods and/or software to us or to take steps to enter into such contract;
• manage payments, fees and charges due in connection with any relevant contract(s) we have entered into with the third party who is providing services, goods and/or software to us;
• manage our relationship with the third party who is providing services, goods and/or software to us, including notifying changes to our terms or this Notice and keeping our records updated;
• pursue the following other legitimate interests: (i) protecting the rights, property, or safety of Remitly, our customers, vendors, suppliers, business partners and other professional contacts (ii) maintaining records of potential suppliers or to make recommends (or otherwise); (iii) improving our services and/or products; (iv) exercising, establishing or defending our legal rights; and/or (v) sending information or materials that we think may be of interest or which have been requested; and
• comply with our legal obligations (for example if we are required to disclose personal information to any competent law enforcement body, regulatory, government agency, court or other third party such as but not limited to, the police, the financial supervisory authorities, tax and social security agencies, data protection regulators, as well as the courts).

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please email DPO@remitly.com. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Sharing your personal information: We will only share personal information with third parties in the following instances:

• other companies within our group (see section 1) including our staff (but their use shall be limited to the performance of their duties and in line with the reason for processing);
• vendors, service providers and partners (under contract with us) who provide services such as:
  • platform, database and website hosting;
  • information technology and related infrastructure (for example email, instant messaging, document management and file-sharing);
  • legal, tax and auditing; and
• third parties in the event of the sale, acquisition or merger of some or all of our assets if your personal information is part of the transferred assets (we shall notify you in the event of such an occurrence, as well as any choices you may have regarding your personal information).

Retaining your personal information: If we both decide:

• to enter into a contract and/or other arrangement with each other, this information about your staff will be kept for the duration of your relationship with us plus 7 years for the purposes of exercising, establishing or defending our legal rights; or
• not to enter into a contract and/or other arrangement with each other, this information about your staff will be kept for the duration of your enquiry and for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements; or if we are required by law to retain for longer, we will retain it for the required period and/or where the information is being used in connection with legal proceedings (including prospective legal proceedings) it will be retained for the duration of those legal (and any enforcement) proceedings.

5. INTERNATIONAL TRANSFERS

We may transfer your personal information to various jurisdictions to perform our obligations under this Notice and related agreements including (without limitation) countries in which we operate (see section 2). The applicable data protection laws of those jurisdictions may differ from the data protection laws of your country of residence and, in some cases, may not be as protective. Whenever we transfer your personal information outside your country of residence, we will ensure a similar degree of protection is afforded to it as the data protection laws of your country of residence. For example, if you are based in the UK or EEA, your personal information may be transferred to countries that have been deemed to provide an adequate level of protection for personal information by (as applicable) the UK Government or the European Commission. In other instances, we will ensure at least one other lawful safeguard is implemented, which may include the use of specific contracts approved by (as applicable) the UK Government or the European Commission.

Please contact DPO@remitly.com if you want further information on the specific mechanism used by us when transferring your personal information.

6. YOUR RIGHTS AND CHOICES

In relation to personal information we hold about you, regardless of where you reside, you can:

• get access to your personal information and information about our processing of it;
• ask us to correct the record of your personal information maintained by us if it is inaccurate r to complete incomplete personal information;
• ask us, in certain limited instances, to erase your personal information or cease processing;
• object to us processing your personal information for direct marketing purposes;
• challenge us processing your personal information which has been justified on the basis of our legitimate interests;
• ask us, in certain limited instances, to restrict processing personal information to merely storing;
• ask us, in certain limited instances, to transfer your personal information to another online provider; and
• object to decisions based solely on automated processing, including profiling.

If you would like to exercise any of these rights, please contact DPO@remitly.com (we may ask you to verify your identity - please cooperate with us in our efforts to verify your identity). Please note that we may need certain personal information to enable us to work with you and/or provide information to you, so changes you make to your preferences, or restrictions you ask us to make on how we use personal information, may affect what information we can provide.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a fee where we are permitted to do so by applicable data protection laws. For example, if you reside in the UK or EEA, we can charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

Please also note that sometimes we may not be able to stop using your personal information when you ask us to (for example, where we need to use it because the law requires us to do so or we need to retain the information for regulatory purposes). We will tell you if we are unable to comply with your request, or how your request may impact you, when you contact us.

7. HOW WE PROTECT PERSONAL INFORMATION

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

8. DIRECT MARKETING

You have the right to ask us not to process your personal information for marketing purposes. You can exercise this right simply at any time by carrying out 'unsubscribe' actions which are made available to you (such as clicking on the 'unsubscribe' link in each promotional email we send you). We will honour your choice and refrain from sending you such communications. Please note that if you ask us not to contact you by email at a certain email address, we will retain a copy of that email address on a 'suppression list' in order to comply with your no-contact request. You are free to change your marketing choices at any time.