Scope

At IRIS, your privacy is important to us, and so is being transparent about our privacy practices.

This Privacy Policy (“Policy”) describes the information we collect from you and how that information is used and shared. It also includes details your choices in relation to that information. If you are a customer of IRIS, this Policy should be read alongside the customer agreement you enter with us (“Customer Agreement”).

Definitions

“IRIS”,“we,”“us” and“our” refers to the following companies: Yellow Iris Tech Limited and www.Iris- ng.

“Personal Information” refers to any information or opinion relating to or about an individual or an individual who is reasonably identifiable.“Online Channels” means:

• Websites operated by us (“Websites”);
• Software applications made available by us for use on or through computers and mobile devices (“Apps”);
• Software applications made available by us for use on or through computers and mobile devices (“Apps”);
• Our social media pages and apps that we control (collectively, our “Social Media Pages”); and
• HTML-formatted email messages that we send to you that link to this Policy or other communications with you.
• Device notifications and other channels we use that are not Websites, Apps or Social Media Pages.

2. Information We Collect

Identification Information

We may collect some or all of the following information: your name, date of birth, title, gender, mailing address, phone number, email address, nationality, occupation and social security number or other tax identification credentials.

To comply with applicable laws and regulations (including anti-money laundering and counter terrorism financing laws (“AML/ CTF Laws”), we may collect identity verification information such as copies of your government-issued identification (including passport, driver’s license, social security card, government health benefits card or national ID card) or other authentication information, all of which may include photographs of you. We may also provide you with the option of using identification verification technologies that analyse your facial imagery or other biometric information provided.

Financial Information

In order to comply with AML/ CTF Laws, manage risk and process payments, we may collect financial information such as bank account details (account number, routing number), credit or debit card numbers.

Transaction Information

When you book transactions with us, we may collect information about the parties to the transaction, you confirm that you are happy for us to collect these information or any other related information.

Business Information

If you are using our services on behalf of a business entity, we may collect information about the business including the organisational structure of the company and individuals involved in the business. We also may collect entity formation documents or other corporate records. IRIS is required under AML/ CTF Laws to collect Personal Information of individuals who ultimately own or control corporate clients, directly or indirectly (“Beneficial Owners”). Such information may include the Beneficial Owner’s name, date of birth, title, gender, mailing address, phone number, email address, nationality, occupation and social security number or other tax identification number. You confirm that you know the Beneficial Owners agree or that you are otherwise allowed to give us this information and will inform the Beneficial Owners of the contents of this Privacy Policy

Background Information

To the extent permitted by applicable law, in the course of providing you with our services, we may obtain background check reports from public records of criminal convictions and arrest records. Some jurisdictions require us to obtain your consent. Where you refuse to provide consent, we may be unable to provide services to you.

Log Data

When you access our Online Channels, we collect server logs, which may include information such as IP address, access times and dates, pages viewed and other system activity, including the third-party site you were using before and after accessing our services.

Device Information

We may obtain information about the devices you use to access our Online Channels including: the device type, operating systems and versions, the device manufacturer and model, preferred languages, and plugins.

Usage and Preference Information

We collect information about how you interact with the Online Channels and how you use our Online Channels, including your user preferences and other settings selected by you. In some cases, we do this by using cookies and other tracking technologies.

Geolocation Information

When you use certain features of our Online Channels, we may collect information about your precise or approximate location as determined by data such as your IP address or mobile device GPS. Most mobile devices allow you to control or disable the use of geolocation services for applications by changing preferences on your mobile device.

Aggregated/Anonymised Data

We may also collect or create aggregated and/or anonymised data about our users with anonymised or deidentified data. This data is used for industry and market analysis, demographic profiling, marketing, and advertising, and other business purposes.

Other Information

We may collect any other Personal Information you may provide to us when you update your account information, respond to surveys, post to community forums, participate in contests or promotions, or use any other feature of our Online Channels or services.

3. How We Collect Information

We collect information about you in a variety of different ways, including the following:

Information You Provide

We collect Personal Information and other information from you when you complete an application or form, register for an IRIS user account, submit to our verification procedures, apply for additional account features or services, conduct transactions, respond to our emails, messages or surveys, communicate with us including by telephone, email and online, provide feedback, participate in promotions or contests, provide referrals, or upload content. We make and store recordings of our telephone communications with you.

IRIS will collect your Personal Information from you unless it is unreasonable or impracticable to do so or is unauthorised by applicable laws.

Information from Your Use of services

When you use our services, we collect Personal Information and other information about you and the devices you use to access the Online Channels. If you connect your social media account to your IRIS account, you will share certain Personal Information from your social media account with us, for example, your name, email address, photo, list of social media contacts, and any other information that may be or you make accessible to us when you connect your social media account to your IRIS account.

Information from Third Parties

We also collect Personal Information about you from third parties and other sources, including government agencies, identity verification and fraud detection service providers and databases, credit bureaus, credit reporting bodies, credit reference agencies, community forums used to post ratings or reviews, social media platforms, advertising, advertising technology and market research companies, contact list, demographic & profile data brokers including companies that publish IRIS marketing and advertising materials that you interact with, IRIS business partners and associates through which you access our services, or other sources of public records.

For corporate clients, we may collect Personal Information about the Beneficial Owners of the business from any person that has represented to us that they have authority to act on behalf of the business entity and provide that information.

4. How We Use Your Information

We use Personal Information we collect from or about you (including credit information) for several purposes, including:

To provide or improve our services.

• To process payments or money transfers.
• To provide customer support.
• To evaluate your application to use our services.
• To develop new products or enhance existing products and services.
• To monitor and analyse trends, usage, preferences, and other user activities on our Online Channels to optimise user experience and to enhance the effectiveness of our promotional campaigns.
• For quality control and staff training.

To ensure safety and security

• To verify your identity or authenticate your right to access an account or other information.
• To conduct manual or automated monitoring to protect against fraud, money laundering and other crimes and harmful activities.

To comply with legal obligations

• To comply with laws, regulations, codes of conduct, stock exchange rules, binding determinations or to respond to legal process or government authorities.
• To address disputes or resolve claims related to use of our services.
• To enforce our terms and conditions and collect fees. To communicate with you
• To respond to your inquiries and support requests.
• To send you technical notices, updates, security alerts and other administrative messages.
• To provide information related to your transactions, including confirmations, receipts, and tracking notices.

To market and advertise our services

• To deliver promotional offers, incentives, and targeted or personalised marketing in a variety of ways including via email, SMS, push messages, telephone, social media or online.
• To provide invitations and information about events held by us or our partners.
• To facilitate promotional contests or sweepstakes.
• For analytics and insights with any Personal Information that we collect or obtain about you, including combining your Personal Information with other personal information and data to use in advertising and marketing that may influence your behaviour or decisions or provide insights and measurement to us in relation to any advertising initiatives that we may run. You can opt-out of receiving marketing at any time through the unsubscribe function available in each marketing communication we send. Alternatively you can update your preferences by logging in to your IRIS account on the Website or contact us at customer.service@IRIS-NG.com or using the “Contact Us” information below.

Other purposes

Any other purpose disclosed at the time of collection.

5. Information Sharing and Disclosure

We will never sell your Personal Information to marketers or other third parties. We may disclose or otherwise provide anonymised/aggregated data to third parties. However, we may share information about you, including Personal Information, with the following third parties if you ask us to, it’s required to provide our services to you, if we have a duty to disclose it or an applicable law allows us to do so for legitimate interests or business reasons:

Our Corporate Affiliates

To facilitate or support us in providing our services to you, we may share your Personal Information with some of our sister companies.

Our Service Providers

We engage a variety of service providers to enable us to provide our services to you. For example, service providers may be used to support technology or infrastructure, analytics, and insights generation, collect debts, determine who we should market and advertise to, distribute marketing materials, conduct market research, perform audits, provide professional advice or other functions.

Payment Processors

To payment processing service providers, intermediary banks, and financial institutions to process your transactions.

Credit Reference and Identity Verification Agencies

To credit bureaus, credit reporting bodies, credit reference agencies, identity verification agencies and other companies and organisations (“Verification Agencies”) to check your details, verify your identity and protect against fraud, money laundering and other crimes and harmful activities.

In some cases, Verification Agencies may need to access third party databases (including without limitation databases of government issuers of identification documents). You provide your authority for Verification Agencies to act as your agent in accessing these databases. Verification Agencies may disclose to third parties any information provided to them for identity verification purposes.

Our Partners, Business Associates or Contractors

To any of our partners, business associates, contractors or your agents that you have authorised to have access to your IRIS account or your Personal Information in connection with the provision of our services. A partner’s, business associate’s or contractor’s access to, and use of any transactional data provided by IRIS will be treated in accordance with that third party’s terms of use.

If you are an online seller receiving funds from a marketplace, we may be required to share your Personal Information and IRIS account information with the marketplace to assist with minimising fraudulent and illegal activity or as required by applicable laws.

Other Authorised Third Parties

If you provide your consent, we may share your information including your Personal Information with other authorised third parties. Such disclosure will only be carried out in the manner described to you at the time you agreed to the sharing. Authorising a third-party application or website to access your IRIS account or participating in certain promotional activities constitutes such consent to share your information.

Government Authorities

If we believe it is necessary or appropriate, we may share your Personal Information with law enforcement officials, government authorities, regulatory bodies or other third parties, including for purposes of: (i) enforcing our Customer Agreement or other applicable agreements or policies; (ii) protecting our rights, property, privacy, or security, or that of others; or (iii) complying with applicable law, legal process, or government orders.

Third-Party Acquirers

If we are the subject of or are involved in any corporate merger, acquisition, consolidation, reorganisation, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business or assets (including in connection with bankruptcy or similar proceedings), we may disclose or transfer data, including Personal Information, with third parties in connection with such events.

6. International Transfers

We collect information globally and may transfer, process and store your information outside of your country of residence, to wherever we, our third-party service providers or any recipients referred to in section 5. Countries to which we are likely to transfer your information are the United States of America, Canada, United Kingdom, countries in the European Economic Area, Australia, New Zealand, Hong Kong and Singapore. Whenever we transfer your information, we take steps to protect it.

7. How long we keep Information

We need to keep your Personal Information so that we can provide our services to you. Under relevant AML/ CTF Laws we need to keep your Personal Information and information about your transactions for up to 7 years from the end of your relationship with us. We also need to keep it for longer for legitimate business purposes (such as transactional information for our accounting purposes) and for other legal and regulatory reasons. Subject to this, we will destroy, erase, or anonymise your Personal Information when it is no longer needed.

8. Choices and Transparency

You have choices regarding how to manage your Personal Information and how we use and disclose your Personal Information.

How Your Information may be Accessed, Updated or Corrected

To ensure the information we hold is accurate, you should tell us as soon as possible if any of the information you have provided us has changed. You may request that we correct or update the Personal Information you provided to us at any time by logging into your IRIS account or by contacting us using the “Contact Us” information below. If you want to access a copy of the Personal Information we hold about you, you can contact us at privacy@IRIS-NG.com or using the “Contact Us” information below.

We will respond to any such request consistent with applicable law. Prior to changing or correcting your information or providing your information to you, we may be required to verify your identity.

There may be situations where we cannot action your request including where the information may impact the privacy of other individuals, the information is subject to legal privilege, the disclosure could threaten the safety, physical or mental health or life of an individual or IRIS is prohibited by applicable law from providing you with access. If this is the case, we will set out in writing to you any reasons for our refusal to provide access to such information.

We will take reasonable steps in the circumstances to ensure that your Personal Information is accurate, complete and up-to-date to minimise the possibility that inappropriate information may be used to make a decision about you. We will not routinely update your Personal Information unless such a process is necessary to fulfil the purposes for which the information was collected.

If you are a Californian resident, please refer to the “Additional Information for Californian Residents” section at the end of this Policy for more information about the requests you may make under the California Consumer Privacy Act.

If you are resident in the UK or European Union, please refer to the “Additional Information for UK/EU Residents” section at the end of this Policy for more information about the requests you may make under privacy legislation.

Restrict Sharing

If you are resident in the UK or European Union, you may request further limits on our disclosure of certain of your Personal Information where such information is not required for delivery of our services by contacting us at privacy@IRIS.com or using the “Contact Us” information below.

If you are a U.S. resident using our Services to conduct transactions for personal, family or other household purposes, you may request further limits on our disclosure of certain of your Personal Information to certain affiliated third parties. Please refer to our Consumer Privacy Notice to learn more about your opt-out rights and how to exercise them.

Device Permissions

Most mobile devices allow you to disable the use of location services, or revoke consent to applications to access your camera and photo library or send you push notifications. Some devices allow you to activate a ‘do not track’ function, reset your device specific advertising identifier. Please refer to your device settings to restrict collection of certain information.

Marketing Opt-Out

You can opt out of receiving our marketing at any time through the unsubscribe function in each marketing communication or by updating your preferences under the “Your Profile” section or “Profile & Settings – Notifications” section when you log into the Website. Please note that if you opt out of marketing-related emails from us, we will continue to send you non-promotional messages that are required to provide our services, such as transactional receipts and messages about your account or our relationship with you.

Testimonials

We display personal testimonials of satisfied customers on our website in addition to other endorsements. With your consent, we may post your testimonial along with your name. If you wish to update or delete your testimonial, you can contact us at privacy@IRIS-NG.com or using the “Contact Us” information below.

9. Security

We take appropriate technical, physical, and administrative measures designed to safeguard your Personal Information against loss, misuse, or unauthorised access.

The way we do this depends on the sensitivity of the information and the format in which it is contained. Security measures include technological measures such as encryption, physical measures like restricted access to offices and strategic measures such as security clearances and limiting access to a “need-to-know” basis.

We cannot warrant the security of data transmitted to us and any transmission is at your own risk.

We encourage you to understand the integral role you play in keeping your own Personal Information secure and confidential, always keep your log-in details secure. You should also take care not to give any security credentials we provide you or you choose (such as a password) to someone who is not an IRIS representative. We will never ask you for your full security credentials. If you are unsure, please end the session. If you suspect any unauthorised use or access to your account or information, please contact us immediately, using the “Contact Us” information below.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to recognise you and to customise your online experience. We do not currently respond to browser do-not-track signals.

11. Advertising, Profiling, non-advertising issues and analytics

We may partner with third parties to display and personalise IRIS advertisements to you and to track and report on the performance of those advertisements. These third-party partners use cookies and other technologies to gather information about your activities on our Online Channels, as well as information from third parties and your activities on other sites or online services on any of your devices, in order to serve you advertising based upon your online behaviours including browsing history and interests. They also use these technologies, along with information they collect about your online use, to recognise you across the devices you use.

To learn more about behavioural advertising and online tracking, including how to opt out of interest-based online advertising delivered by member companies, please visit Your Online Choices, Network Advertising Initiative and DAA’s WebChoices Tool. You may download the AppChoices app here to opt out in mobile apps. For more information about some of our online advertising supplier privacy policies or the cookies that may be served through use of our Online Channels.

12. Social Media Features

Our websites may include social media features, such as the Facebook Like button, and widgets, such as the Share This button or interactive mini-programs that run on our Website. These features may collect information about you and your online activities and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our website. Your interactions with these features are governed by the privacy statement of the company providing it.

13. Third Party websites and services

This Policy does not apply to third party websites, applications, products or services, even when they are linked to our services or Online Channels, as we are not responsible for the privacy, information management, or other practices of third parties. The inclusion of a link on the Online Channels does not imply endorsement. You should review the privacy policies of any third party websites you visit.

14. Children

Our services are not intended for or directed at individuals under the age of 18. We do not knowingly collect Personal Information from individuals under the age of 18.

15. Complaints

IRIS will investigate all complaints. For more information on how we manage complaints see our Complaints Policy in the Legal section of our Website or contact Customer Service at customer.service@IRIS-NG.com.

16. Updates to This Policy

We may change our Policy from time to time. If we make any material changes, we will notify you by means of a notice on our Websites. Any changes will become effective on the date specified in the revised Policy posted on our Websites.

17. Contact Us

If you have questions or concerns about this Policy, need it in an alternative format, have a specific request related to your Personal Information or any complaints about our privacy practices, please contact us at privacy@IRIS-NG.com

Statement of Notifiable Matters – Credit Reporting

Credit reporting bodies are permitted to handle Personal Information relating to credit. Credit reporting bodies may include your Personal Information disclosed by IRIS in reports provided to other credit providers to assist them to assess your creditworthiness.

Details on the kinds of credit information IRIS collects, uses, holds and the purposes for which IRIS discloses credit information is contained within the main body of this Privacy Policy and as such, IRIS’s credit reporting policy is set out within this Privacy Policy.

IRIS may collect information about you that it has obtained from businesses that provide information about the credit worthiness of individuals, including consumer credit reports from a credit reporting body. Applicable laws and regulations outline what IRIS can do with the information we obtain from a credit reporting body. If you fail to meet your payment obligations in relation to the payment services IRIS provides to you, if you commit fraud or try to do so, or if you otherwise commit a serious credit infringement, IRIS may disclose your Personal Information to those credit reporting bodies.

You have a right to access the credit related information that IRIS holds about you, to correct that credit related information and to make a complaint about IRIS’s handling of your credit related information, as set out in section 8 (Choices and Transparency) of this Policy.

You also have a right to request that credit reporting bodies do not use credit related information held by them for the purposes of pre-screening of any direct marketing by credit providers. If you would like to make such a request, please contact the credit reporting bodies directly.

If you believe that you have been a victim of fraud, you have a right to contact the credit reporting bodies and ask them not to use or disclose your credit related information. Please contact the credit reporting bodies directly.

If you have consented to our use of information about you for a specific purpose, you have the right to change your mind at any time, but this will not affect any processing that has already taken place. Where we are using your information because we or a third party have a legitimate interest to do so, you have the right to object to that use though, in some cases, this may mean no longer using our services.

Your rights

Under data protection law, you have rights including:

Your right of access –You have the right to ask us for copies of your personal information.

Your right to rectification –You have the right to ask us to rectify personal information you think is inaccurate or is incomplete.

Your right to erasure –You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing –You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing –You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability –You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

Please contact us at privacy@IRIS-NG.com if you wish to make a request. If you make a request, we have one month to respond to you.

Transfers to third countries

The Personal Information that we collect from you may be transferred to and stored outside of your country of residence, including outside of the UK (for UK residents) and outside of the EEA (for EEA residents). To facilitate our global operations, we transfer information to and allow access by staff in countries in which IRIS owned companies have operations for the provision of our services. Such staff are likely to be involved in, among other things, processing your transaction or payment details and providing support services. We also share information with third parties as described in this Policy. For example, this may involve information being transferred to a banking partner in a country where you have instructed us to send a payment.

Where we share information with an organisation outside of the UK or the EEA, we will take all reasonable steps to ensure that they apply equivalent levels of protection as we are required to provide, including the use of standard contractual data protection clauses which have been approved by the European Commission. If this is not possible, for example, we are required by law to disclose your information, we will make sure that sharing the information is lawful.