This document serves to provide details regarding the collection, processing, and protection of personal data by the electronic money institution Aircash d.o.o. (hereinafter referred to as: “Aircash”) in compliance with the General Data Protection Regulation (GDPR) and other applicable legislation.

The data subjects to whom this communication relates are users of the “Aircash” application (hereinafter referred to as: the “Application”).

Information on the processing of other data subjects is available on the website.

DATA CONTROLLER

Aircash d.o.o.

Ulica grada Vukovara 271, 10000 Zagreb, Croatia

OIB (PIN): 99833713101

Contact Details: +38514573537, [email protected], [email protected]

LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA

All processing of personal data must be lawful, and the data must be collected for precisely defined purposes of processing. The legal bases for the processing of personal data carried out by Aircash are explained below.

a) Processing Is Necessary for Compliance with Legal Obligations

Aircash is subject to the application of special regulations (such as the Anti-Money Laundering and Counter-Terrorist Financing Act, the Payment System Act, the Electronic Money Act, etc.), pursuant to which we are required to collect specific data about the data subject (user of the Application). Aircash may decline to establish a business relationship and provide a service, or terminate an existing business relationship, should the data subject fail to provide the data required by law.

b) Processing Is Necessary for the Performance of a Contract or in Order to Take Steps Prior to Entering into a Contract

Should the data subject decline to provide certain data necessary for the conclusion and performance of a contract to which the data subject is party, Aircash may be unable to provide certain services and, therefore, may refuse to establish or may terminate a contractual (business) relationship.

c) Processing Is Necessary for the Purposes of Legitimate Interests

Aircash has legitimate interests for processing personal data when such processing is necessary for risk management, preventing fraud, achieving the highest level of information security and protection of confidential information, marketing activities and user satisfaction surveys, as well as for administrative and other justified business needs. In determining legitimate interests, Aircash always ensures that these interests do not override the rights and freedoms of the data subjects.

d) Substantial Public Interest

Taking into account that the Anti-Money Laundering and Terrorist Financing Act recognises the processing of personal data for the purposes of implementing measures and actions to prevent and detect money laundering and financing of terrorism, or the processing of personal data on the basis of and in accordance with the provisions of the Anti-Money Laundering and Terrorist Financing Act, as a substantial public interest, in accordance with the Ordinance on enrolling a remote party and the minimum requirements that must be met by a solution that establishes and verifies the identity of a remote party, Aircash processes biometric data of users.

When necessary to identify a user, during the establishment of a business relationship and/or when changing a mobile phone number, and in implementing other measures within the framework of preventing money laundering and terrorist financing, Aircash uses the user's facial image processed by technical means that enable unambiguous identification (biometric processing).

e) Processing Is Based on Consent

By giving consent, the data subject freely and voluntarily agrees to the processing of their data and may withdraw consent at any time without negative consequences. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

CATEGORIES OF PERSONAL DATA PROCESSED BY AIRCASH

For the purpose of easier understanding of this communication, we have grouped the personal data we process into the following categories:

a) Identification Data: Name and surname, date and country of birth, personal identification number, address of residence/domicile, identification document information, copy of an identification document, nationality.

b) Biometric Data: Facial image processed by special technical means which allow or confirm the unique identification of the data subject.

c) Contact Details: Name and surname, email, phone number.

d) Transaction Data: Data concerning transactions related to sending and/or receiving money, payment for services provided by contractual partners, other payments, and cash withdrawals. The data includes the date and time of the transaction, amount, currency, details of the person (legal or natural) to whom payment is made, information about the merchant or ATM linked to the transaction, sender's and recipient's names, and data on the payment instrument used to make payments to Aircash.

Depending on the type of transaction, the above may also include data on the vehicle registration plate, data on the type of utility and other service being paid, including consumption data, metering device codes, unique consumer user codes, and other information contained in the utility or other service bill being paid.

e) Data Necessary for Establishing Identity in the Procedure for Exercising the Rights of the Data Subject under the General Data Protection Regulation: Name and surname, personal identification number, identification document number, the phone number with which the user is registered in the Application, email.

f) Data Necessary for a Secure Transaction Execution: In addition to the transaction data described in point (d) of this section, this information includes, but is not limited to, the postal code, city, email address, telephone number, IP address from which the transaction is initiated, type, model and language of the device, and other data necessary for the secure execution of transactions.

g) Data on Political Exposure: Refers to information on whether the user, a member of their immediate family or a close associate has held a prominent public office in the last 12 months.

h) Data Regarding the Technical Configurations of the System and Application Usage: IP address, operating system used, type of mobile device and/or computer, browser type and version, browser and/or mobile device language, etc.

i) Geolocation: Approximate or precise user location.

j) Application and Website Usage Data: Depending on the type of cookies accepted, this encompasses statistical reports on website visits, analytical reports on interaction with the website and/or Application, advertising options, etc.

k) Audio and Video Recordings: Video recording of a face created during user identification in the process of establishing a user relationship, audio recordings of telephone conversations with the Customer Support Call Centre.

The purposes and legal bases for processing personal data are clarified in the table below:

Promotional activities

Aircash occasionally sends promotional offers tailored to users' interests and the way they use Aircash services. Users can object to such processing at any time.

Personal data of participants in prize draws, prize competitions and other promotional activities organised by Aircash are processed for the purpose of conducting such activities on the basis of the performance of a contract (Art. 6(1)(b) GDPR). The publication of the first name and the first letter of the surname of participants who have won the right to a prize or promotional gift is carried out for the purpose of ensuring transparency, on the basis of Aircash's legitimate interests (Art. 6(1)(f) GDPR), in compliance with the principle of data minimisation.

PERSONAL DATA STORAGE PERIOD

The storage period for specific categories of personal data primarily depends on Aircash's legal obligations.

Pursuant to the Anti-Money Laundering and Counter-Terrorist Financing Act, Aircash is required to retain data, information and documentation collected through the application of the Anti-Money Laundering and Counter-Terrorist Financing Act and the by-laws adopted on its basis for 10 years from the termination of the business relationship.

Data on financial transactions carried out in the Application constitute an accounting document and are retained for 11 years from the end of the year in which the transaction was carried out, in accordance with the Accounting Act.

Other data necessary for the provision of services and uninterrupted use of the Application are retained for the duration of the business relationship between Aircash and the data subject.

Data collected and processed based on Aircash's legitimate interests are retained for a limited period, solely until the purpose for which they were collected is achieved or until the data subject objects, if applicable.

In view of the above, the following periods apply:

●        recordings of telephone conversations with the Customer Support Call Centre are retained for a period of three months;

●        records of data subjects' requests to exercise their rights under the General Data Protection Regulation are retained for five years from the end of the year in which the request was received.

If a data subject objects to the processing of personal data for the purposes of direct marketing and satisfaction surveys, the personal data will no longer be processed for these purposes and will be erased if there is no other legal basis for retaining the data.

If data is processed based on the data subject's consent, withdrawing the consent will result in the erasure of the data, unless there is another legal basis, i.e. justified reason, for retaining the data.

In exceptional cases, data may be processed for a longer period when necessary for the establishment, exercise or defence of legal claims or other legitimate purposes.

RECIPIENTS OF PERSONAL DATA

Personal data will be disclosed to supervisory authorities for the purpose of conducting oversight and other tasks falling within their competence, for example, to the Anti-Money Laundering Office, the Croatian National Bank or the Tax Administration.

In exceptional circumstances, Aircash will, upon request, provide the requested data to other authorised public authorities for investigations and other official procedures, for example, to the Ministry of the Interior.

For carrying out financial transactions, Aircash collaborates with reputable partners for the processing of payment and card transactions.

For the purposes of fraud prevention, or verification of Application users and secure execution of transactions for the benefit of third-party service providers, Aircash will verify a user's identity with a third party using data relating to the user (e.g. first and last name or phone number and other data necessary for the secure execution of a transaction).

When establishing and maintaining a business relationship, Aircash carries out checks to confirm the user's identity and to assess whether there is an increased risk of fraud or misuse. For this purpose, Aircash uses the specialised platform Trustfull.

Aircash also relies on other essential services for its operational needs, including IT support, consultancy and legal services, postal services, and the like, and in specific scenarios, certain personal data may be shared with providers of these and similar services.

Aircash provides its users with access to an online platform operated by Bitpanda, through which users have access to Bitpanda products and services related to investment services and crypto-asset services. For the purpose of conducting party due diligence, or implementing other measures prescribed by the relevant legislative framework to which Bitpanda is subject (Bitpanda GmbH, Bitpanda Financial Services GmbH and other affiliated companies), Aircash will provide the data collected for this purpose to Bitpanda.

Detailed information on the personal data processing by Bitpanda is available to users on the official Bitpanda website and through other communication channels in the manner specified by Bitpanda.

Special contracts on personal data protection and confidentiality and/or confidentiality have been concluded with all business partners and service providers, defining mandatory safeguards to ensure the confidentiality, integrity, and availability of personal data and other confidential information.

PROCESSING OF PERSONAL DATA IN ARTIFICIAL INTELLIGENCE SYSTEMS

In the process of identity verification, when establishing a business relationship and/or in the event of a change of mobile phone number, as well as in the implementation of other measures within the framework of the prevention of money laundering and terrorist financing, Aircash carries out biometric processing of a facial image of the user.

For that purpose, Aircash uses its own artificial intelligence system, which performs automated analysis and comparison of facial biometric features against the photograph from an identification document or other available identification data.

Artificial intelligence is used as a supporting tool in the relevant procedure, while the final decision on the outcome of the verification is made by an authorised Aircash employee.

RIGHTS OF DATA SUBJECTS

Data subjects have the following rights regarding the processing of personal data:

●        Right to access information on the processing and a copy of the personal data;

●        Right to rectification of inaccurate personal data and/or right to have incomplete personal data completed;

●        Right to erasure of personal data (if the legal basis for further data processing or storage no longer exists).

If applicable, depending on the method of data processing and legal basis, data subjects also have the following rights:

●        Right to restriction of processing;

●        Right to data portability;

●        Right to object to processing based on Aircash's legitimate interests;

●        Right to withdraw previously given consent for data processing.

Aircash carries out automated processing of personal data; however, it does not make decisions producing legal effects concerning data subjects based solely on such automated processing. All decisions relating to the establishment or termination of a customer relationship, the blocking or restriction of the use of the service, and other significant decisions are made with human oversight and control by the responsible person at Aircash.

Within the Application, data subjects have the possibility to change or update their personal data autonomously.

The exercise of certain rights may be restricted on the basis of European Union or national law, including the regulations governing the prevention of money laundering and terrorist financing, payment operations and electronic money, taxes and accounting, and the prevention of fraud and protection of the security of the financial system.

In practice, these restrictions relate to, but are not limited to, the following examples:

●        a request to close/delete a user account or erase personal data does not entail the automatic erasure of all of the user's personal data, since Aircash is required to retain certain data, documentation and records within the periods prescribed by law, including data on executed transactions and the user's identity, or other data necessary to fulfil legal obligations or to exercise, establish or defend legal claims;

●        the right to access information on the recipients of personal data may be restricted where the data is provided to public authorities in the context of a specific investigation, or where the disclosure of such information would jeopardise or prevent the prevention, detection or investigation of criminal offences, fraud, money laundering or terrorist financing, or would constitute a breach of a legally prescribed obligation of confidentiality;

●        in cases where, in accordance with the General Terms and Conditions, Aircash decides to extraordinarily terminate a business relationship or temporarily blocks or restricts the use of the service, it is not obliged to disclose internal criteria, risk analyses, results of security checks, or other information whose disclosure could jeopardise the prevention of fraud, misuse, money laundering, terrorist financing, or the protection of the security of the financial system.

For the exercise of available rights or for other related queries and information, data subjects can contact the Data Protection Officer at the following email address: [email protected].

Data subjects can also lodge a complaint with the Croatian Personal Data Protection Agency, at the registered address or email: [email protected].

LOCATION OF PERSONAL DATA PROCESSING

Aircash processes and stores personal data within the European Union and the European Economic Area.

Exceptionally, where an Application user initiates a transfer of funds to recipients located in third countries, Aircash will transfer only the personal data necessary to carry out the transaction to the country of destination. This service is currently available for recipients located in Nepal and Turkey.

When transferring personal data to third countries, Aircash uses the Standard Contractual Clauses as a recognised data protection mechanism. More detailed information on these safeguards is available at the following link: https://commission.europa.eu/publications/publications-standard-contractual-clauses-sccs_en

DOCUMENT VERSION

Latest version date: July 2026.