Privacy Statement

1. About this Privacy Statement

This Privacy Statement explains how the Fourthline Group (as defined below) collects and processes your personal data. It describes what personal data we process, for what purposes, on what legal grounds, how long we retain it, and what rights you have.

This Privacy Statement applies when you:

• visit or interact with our websites, portals, or applications (together: "Websites");

• use our Services (as defined below);

• visit our offices;

• are onboarded as a client through companies who use our Services ("Business Partners") whose financial services you want to use; or

• are a representative of one of our Business Partners, prospects, vendors or suppliers.

This Privacy Statement contains the following topics:

1. About this Privacy Statement

2. Who we are

3. Applicable law

4. How we collect your personal data

5. Processing purposes, categories of personal data, and legal grounds

6. Automated decision-making

7. Use of Artificial Intelligence

8. Minors

9. Who we share your data with and why

10. Cookies

11. Your rights

12. Your duty to provide data

13. How long we keep your personal data

14. How we protect your personal data

15. How you can help keep your data safe

16. Contact us

We may update this Privacy Statement from time to time to reflect changes in applicable law or in our processing activities. The most current version is always available on our Website. We recommend checking this page periodically.

2. Who we are

2.1.1 Fourthline Group

The Fourthline Group provides identity verification, fraud prevention and related services (the "Services"), helping financial institutions verify the identities of their clients to meet their regulatory obligations under applicable AML legislation.

For the purposes of this Privacy Statement, the “Fourthline Group” refers solely to the following two entities, each of which acts as an independent controller of your personal data, depending on the context:

Fourthline Payments is a regulated payment institution licensed by the Dutch Central Bank (De Nederlandsche Bank N.V. (DNB)) to provide payment Services. It also enables other financial institutions to rely on the customer due diligence performed by Fourthline Payments. in accordance with Dutch AML legislation.

Fourthline also provides identity verification, fraud prevention and related Services on an outsourcing basis to its Business Partners. In those cases, Fourthline generally acts as a data processor on behalf of the relevant Business Partner, and the processing of personal data in that capacity is not covered by this Privacy Statement. However, where Fourthline processes personal data as an independent controller for the purpose of improving its Services, such processing is covered by this Privacy Statement as further detailed under section 2.1.2 below.

Where this Privacy Statement refers to "we", "us", or "our", it refers to either or both of these entities, as the context requires. Where a specific section applies to only one entity, this is explicitly stated.

2.1.2 Which entity is responsible for your data?

• Fourthline Payments is the controller for all processing of your personal data related to your onboarding as a client of Fourthline Payments and/or providing payment Services ("Client").

• Both Fourthline and Fourthline Payments are independent controllers for the processing of your personal data related to the improvement of their respective Services.

3. Applicable law

The Fourthline Group treats personal data that it receives through its Websites and any other means, with due care. We process personal data in accordance with:

• the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"); and

• the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming).

4. How we collect your personal data

We may receive your personal data in the following ways:

• directly from you, when you use our Services or communicate with us by email, telephone, or other electronic means;

• from Business Partners, i.e. companies whose financial services you wish to use and who engage Fourthline to verify your identity; and

• from third-party data providers, such as providers of sanctions lists, terrorism financing lists, and politically exposed person (PEP) lists.

5. Processing purposes, categories of personal data, and legal grounds

Personal data refers to any information that relates to you or that can be linked to you. Below we describe for each purpose what personal data we process and on what legal ground.

5.1 Identity verification and AML screening

5.1.1 Processing purpose

As a licensed payment institution, Fourthline Payments is legally required to verify the identity of its Clients and screen them against applicable watchlists before and during a business relationship. This obligation flows from, amongst others, the Dutch Prevention of Money Laundering and Terrorism Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme, "Wwft") and the Dutch Sanctions Act (Sanctiewet 1977). This includes the use of AI for this purpose, please see section 8 for more information.

In practice, these requirements consist of two distinct but related checks:

1. Identity verification - confirming that you are who you say you are:

   • Who are you? We check that you are who you say you are. You do this by taking a photo of your identity document (such as a passport or ID card) and a selfie and/or short video of your face. We compare these to make sure the document belongs to you, and that you are physically present during the check. In addition, we assess whether the document is fully visible, legible and verify whether the document contains the expected (security) features.

   • Is your document genuine? We check that your identity document is real and has not been tampered with or forged. We also look at certain features of the document, such as the layout and printed details.

   • What is your identity verification risk score? Based on the identity and document checks described above, we calculate an overall risk score for your verification. This score is the result of several checks covering factors such as your identity, document authenticity, geographic indicators, and compliance signals. Each check contributes a weighted value to the total score. The final score determines whether you are classified as low, medium, high, or unacceptable risk, and on that basis we determine whether we can accept you as a Client.

2. AML screening - assessing whether you pose a financial crime risk:

   • Are you on a (watch)list? We check whether your name and personal details match those of a person on applicable sanctions lists, politically exposed persons (PEP) watchlists or adverse media articles. If your details match someone on one of these lists, we investigate further to determine whether you are actually the same person.

   • What is your AML screening risk score? When your personal details appear to match those of an individual on a watchlist, we separately assess the likelihood that you are actually the same person as that listed individual. We do this by comparing your personal details (such as your name, date of birth, age, location, nationality, gender, and place of birth) against those of the listed individual. Each data point is assigned a weighted score depending on how closely it matches, producing an overall hit risk score which determines whether we can accept you as a Client.

5.1.2 Personal data used

Depending on the Business Partner whose financial services you wish to use, we may process the following personal data:

• Basic identity data: full name, date of birth, place of birth, nationality, gender, selfie photographs and video recordings, address, email address and phone number;

• Identity document data: document type, document photo (front and back), document number, issuing date, expiry date, issuing country, issuing authority;

• Biometric data: facial geometry extracted from selfie photographs and video recordings and derived facial similarity score (special category data under Art. 9 GDPR);

• AML screening data: PEP status, any presence on a sanctions list, any adverse media articles related to you. Data points related to you (such as your name, date of birth, nationality, gender, location, and place of birth) are compared against watchlist databases, including sanctions lists, PEP lists, and adverse media articles.

• Derived and inferred data: KYC risk scores, verification outcomes, and other results generated by Fourthline's algorithms or analytical processes;

• Communication data: correspondence between you and Fourthline.

5.1.3 Legal ground and special categories of data

The legal ground for the processing of your personal data for identity verification and AML screening purposes depends on the type of data processed:

• The processing of your identity and document data, AML screening data, and derived and inferred data is based on a legal obligation, specifically our obligations under the Wwft and the Sanctiewet 1977 to conduct client due diligence and screen clients against applicable watchlists.

• The processing of your biometric data is based on performance of contract. Biometric verification is necessary to establish your identity as part of the process of entering into a relationship with you as a Client. While the Wwft requires us to verify your identity, it does not prescribe the method by which we do so. We use biometric verification because it is the most reliable and proportionate method for verifying identity in a remote onboarding context.

As biometric data constitutes a special category of personal data under Article 9 GDPR, we additionally rely on the exception of substantial public interest (Art. 9(2)(g) GDPR) for the processing of your biometric data, specifically for the purpose of authenticating your identity in connection with our legally required client due diligence obligations and for related security purposes.

5.2 Payment services

5.2.1 Processing purpose

When Fourthline Payments provides payment services to you as a Client, it is necessary to process certain personal data in order to execute and administer payment transactions. This includes initiating, processing, and recording payment transactions on your behalf.

5.2.2 Personal data used

• First name, last name, and address;

• International bank account number (IBAN); and

• Transaction indicators and related information.

5.2.3 Legal ground

The legal ground for the processing of your personal data for this purpose is the performance of a contract: this data is necessary to execute the payment services you have requested. No special categories of personal data are processed for this purpose.

5.3 Fraud detection and prevention

5.3.1 Processing purpose

Criminals who want to use bank accounts and other financial systems for illegal activity sometimes try to access a financial account in a fraudulent manner. To protect our own interests and those of our Business Partners and their clients, and the integrity of the financial system more broadly, we process personal data to detect and prevent identity fraud, which includes back-ups of this data. We use AI for this purpose, please see section 8.

In practice, this means we carry out the following checks:

• Does this application look suspicious? Our systems automatically analyse each verification to detect patterns that are commonly associated with fraud attempts. These patterns include things like signs of document tampering, inconsistencies between the photo on the document and the selfie, device, or location data.

• Has this person or document been seen before? We check whether an identity document or a combination of personal details has previously been flagged or used in a suspected or confirmed fraud attempt. This helps us detect cases where the same fraudulent document or identity is being used multiple times across different onboarding attempts.

• Is a human review needed? If our systems indicate that a verification may be fraudulent, trained Fourthline analysts review the case manually. The analyst assesses whether the file is genuinely fraudulent or whether it was incorrectly flagged. Only a human will make the final determination.

• What happens if fraud is confirmed? If our analyst confirms that fraud has taken place and that the personal data involved belongs to a perpetrator, we record and retain this information. This allows us to protect against future fraud attempts using the same identity, and to support any legal proceedings that may follow. We retain this data for up to eight years.

5.3.2 Personal data used

This may involve the following personal data:

• Document characteristics;

• Selfie and video characteristics;

• Network and connectivity data;

• Location data;

• Nationality and geography;

• Device characteristics;

• Device motion sensor data;

• Cross-check results;

• Risk and compliance signals;

• Risk scores; and

• Client IDs and timestamps;

5.3.3 Legal ground and special categories of data

The legal ground for the processing of data for this purpose is legitimate interest, which is threefold:

• Fourthline Payment's own interest: protecting itself against fraudulent use of its platform and Services, including financial and reputational harm;

• Business Partners' interest: protecting financial institutions from onboarding fraudulent clients, which could expose them to regulatory sanctions and financial crime; and

• Broader public interest: preventing financial crime and identity fraud more generally, which aligns with the objectives of AML/KYC legislation.

Our justification to process personal data relating to a criminal offense is to determine whether or not to provide a Service to you as a (prospective) Client and to protect our interests with regard to criminal violations that have been or may potentially be committed against Fourthline Payments.

The applicable exception for the processing of your biometric data for this purpose is a substantial public interest, specifically to protect the broader public interest in preventing crime and identity fraud more generally, which aligns with the objectives of AML/KYC legislation.

To ensure the accuracy of personal data relating to offences, our Quality Assurance Team regularly performs sample checks.

5.4 Personal KYC Vault

5.4.1 Processing purpose

As part of its Services, Fourthline Payments offers a secure Personal KYC Vault. This is a secure storage facility in which your verified personal data is retained on your behalf, so that it can be reused for future identity verification processes without you having to go through the full verification process again.

5.4.2 Personal data used

For this purpose we process the following personal data:

• Basic identity data: full name, date of birth, place of birth, nationality, gender, selfie photographs and video recordings, address, email address and phone number;

• Identity document data: document type, document photo (front and back), document video, document number, issuing date, expiry date, issuing country, issuing authority;

• Biometric data: facial geometry extracted from selfie photographs and video recordings and derived facial similarity score (special category data under Art. 9 GDPR); and

• Derived and inferred data: KYC risk scores, verification outcomes, and other results generated by Fourthline's algorithms or analytical processes.

5.4.3 Legal ground and special categories of data

The legal ground for the processing of your personal data for this purpose is the performance of contract with you: the storage of your verified identity data is necessary to provide the KYC Vault service that you have requested. No special categories of personal data are processed exclusively for this purpose beyond what has already been collected and verified as part of the identity verification process described in section 5.1.3.

5.5 Training and improvement of AI systems

5.5.1 Processing purpose

As criminals adopt ever-more sophisticated techniques to abuse the financial system, the Fourthline Group continually works to improve the accuracy, security, and reliability of its Services. A central part of this is the training and improvement of the AI systems that underpin our identity verification and fraud detection capabilities.

Both Fourthline and Fourthline Payments use personal data from real verifications to train and improve its AI models, including models for:

• Document Authentication: detecting whether an identity document is genuine or fraudulent;

• Document Recognition: identifying document types and extracting relevant fields;

• Liveness Detection: verifying that the person presenting the document is physically present;

• Face Recognition: matching a selfie photograph to the photo on an identity document;

• Fraud Detection: identifying patterns associated with fraudulent onboarding attempts.

This process involves human analysts (annotators) who review and label identity data, for example by marking regions of interest on a document photos or assessing whether a document appears authentic. The resulting annotated datasets are then used to train and validate the AI models. Access to data used for training purposes is strictly controlled and limited to authorised personnel only.

5.5.2 Personal data used

We use the following personal data for these purposes:

• Your first name, last name, date of birth, place of birth, and address;

• Your (selfie) photographs and video recordings;

• Your identity document, including the document photo and video, machine-readable zone (MRZ), visual inspection zone (VIZ), document number, issue date, expiration date, and issuing country and authority;

• Location data; and

• Technical metadata associated with your verification session, such as device operating system, browser details, and device sensors.

5.5.3 Legal ground

The legal ground for the processing of data for this purpose is a legitimate interest: our interest in maintaining and improving secure, accurate, and fraud-resistant identity verification Services. This applies to both Fourthline and Fourthline Payments.

5.6 Marketing and communication

5.6.1 Processing purpose

We may use personal data of Business Partner representatives, prospective business customers, and other professional contacts to send information about our products, Services, and updates, such as newsletters, event invitations, and similar communications. This marketing is not directed at individual end users of our Services.

5.6.2 Personal data used

We use the following personal data for these purposes:

• Name, surname, e-mail address, job title.

5.6.3 Legal ground

The legal ground for the processing of personal data for this purpose is consent or legitimate interest, depending on the nature of the communication and applicable rules under Dutch telecommunications law.

You may object to receiving marketing communications at any time by using the unsubscribe option in our messages or by contacting us at dpo@fourthline.com.

5.7 Back-ups and business continuity

5.7.1 Processing purpose

As a licensed payment institution, Fourthline Payments is required under Article 12 of the Digital Operational Resilience Act (Regulation (EU) 2022/2554, "DORA") to develop, document, and maintain back-up policies and procedures to ensure the restoration of its ICT systems and data with minimum downtime, disruption, and loss in the event of an incident. Fourthline carries out this obligation on behalf of both entities as part of its role as ICT service provider within the Fourthline Group.

Back-up data is stored in systems that are physically and logically segregated from primary systems, subject to the same access controls, encryption standards, and security measures as the original data, and is not used for any purpose other than restoration and recovery. Back-up procedures and restoration methods are tested periodically in accordance with our ICT business continuity obligations under DORA.

Back-up data is retained for the same period as the original data to which it relates, in line with our Information Retention Policy, and is deleted when the underlying data reaches the end of its retention period.

5.7.2 Personal data used

In order to meet our obligations under DORA, we maintain back-ups of all data that is critical to the restoration of our Services and the fulfilment of our regulatory obligations. This includes all personal data mentioned under chapter 5.1.

5.7.3 Legal ground and special categories of data

The legal ground for the processing of personal data mentioned under 5.1 for this purpose is a legal obligation under DORA.

The applicable exception for the processing of biometric data for this purpose is a substantial public interest, consistent with our AML and identity verification obligations.

5.8 CCTV monitoring

5.8.1 Processing purpose

Fourthline operates CCTV cameras at its office premises for the purpose of securing its facilities, protecting the safety of employees, visitors, and assets, and preventing and detecting unauthorised access, theft, or other security incidents. CCTV footage is only accessed in the event of a security incident or upon a legitimate request from law enforcement authorities.

5.8.2 Personal data used

• Video footage and photos of individuals present at Fourthline's premises, including visitors and employees.

5.8.3 Legal ground

Our legal ground for this processing is legitimate interest, namely our interest in securing our premises and ensuring the safety of persons and assets present therein.

5.9 Sales and lead generation

5.9.1 Processing purpose

Fourthline processes personal data of representatives of prospective Business Partners in the context of sales activities, including identifying and approaching potential clients, responding to inbound enquiries, preparing commercial proposals, and managing the sales pipeline. The aim is to establish new commercial relationships with financial institutions and other regulated entities that may benefit from Fourthline's Services.

5.9.2 Personal data used

• Name, job title, employer, and business contact details (email address, phone number, LinkedIn profile, business address) of representatives of prospective Business Partners;

• Records of sales interactions, meetings, calls, and correspondence; and

• Information shared by the prospective Business Partner in the context of exploratory discussions.

5.9.3 Legal ground

Our legal ground for this processing is legitimate interest, namely our interest in growing our business and identifying organisations that may benefit from our Services.

5.10 Contract management and negotiation

5.10.1 Processing purpose

In the context of negotiating, entering into, executing, and managing contracts with Business Partners, vendors, and suppliers, Fourthline processes personal data of the natural persons acting as contact persons or representatives of those organisations. This includes managing correspondence, maintaining contract records, and following up on contractual obligations.

5.10.2 Personal data used

• Name, job title, and business contact details (email address, phone number, business address) of contact persons at Business Partners, vendors, and suppliers;

• Correspondence and communication records related to contract negotiation and execution; and

• Signatures on contracts and related documents.

5.10.3 Legal ground

Where the data subject acts as a representative or contact person of a legal entity that is party to the contract, our legal ground is legitimate interest, namely our interest in being able to execute and administer our contractual relationships.

5.11 Website visitors

5.11.1 Processing purpose

When you visit the Fourthline website, we collect certain technical and behavioural data to ensure the proper functioning of the website, to analyse how visitors interact with our content, and to improve the user experience. This processing is further described in the cookie policy set out in section 8 of this Privacy Statement.

5.11.2 Personal data used

• IP address and approximate location derived therefrom;

• Browser type, operating system, and device information;

• Pages visited, time spent on pages, click patterns, and referral source; and

• Cookie identifiers and similar tracking data (subject to consent where required).

5.11.3 Legal ground

Our legal ground for strictly necessary processing is legitimate interest, namely our interest in the proper functioning and security of our website. For analytical and tracking cookies, our legal ground is consent, obtained via the cookie banner presented upon your first visit.

6. Automated decision-making

The calculation of your risk score and the initial determination of whether it requires further investigation may be performed in an automated manner, including through the use of AI systems (see the next chapter).

In certain cases, your verification may be automatically concluded without further human review. This is the case where:

• your verification results in a sendback, meaning the submitted photos or data do not meet the required quality standards and you are invited to try again. A sendback does not constitute a rejection and has no negative consequences for you;

• you do not meet mandatory eligibility requirements imposed by applicable law, such as where you are located in a country subject to sanctions or other legal restrictions. In such cases, Fourthline does not make a decision: the outcome is a direct legal consequence of applicable law, and Fourthline has no discretion to decide otherwise; and

• the financial services you are applying for are not available in your country, because the relevant Business Partner has not made those services available there. In such cases, the outcome reflects the scope of the services offered by the Business Partner, not a decision made by Fourthline about you personally.

In all other cases where your risk score indicates that rejection may be warranted, the final decision is always made by a human analyst. Article 22 GDPR, which gives you the right not to be subject to a decision based solely on automated processing, does not apply to sendbacks or legally mandated outcomes, as these either have no negative legal effect on you or do not constitute a decision by Fourthline.

7. Use of Artificial Intelligence

We use artificial intelligence (“AI”) as part of our identity verification and fraud prevention Services, as described under sections 5.1, 5.2 and 5.3. We want to be transparent about how this works in practice.

We do not use Large Language Models (“LLMs”) or generative AI, such as ChatGPT, Gemini, or similar tools, in any part of our identity verification process. Your personal data is not processed by, or used to train, any publicly available or commercially operated AI model. This means that your personal data is not ingested into or retained within a large general-purpose AI model.

Instead, we operate narrowly scoped, proprietary AI models, each developed in-house for one specific, well-defined task. Examples include:

• determining whether an identity document is authentic;

• verifying that a selfie matches the photo on an ID document; or

• detecting whether a video was recorded live.

Each model receives only the data it strictly needs for its specific task, and produces a fixed, deterministic output — such as a pass/fail result or a bounded score. No model is capable of performing tasks outside its defined scope.

Your data is processed within this closed, controlled environment. Our AI systems are entirely self-hosted and are never made available to third parties as standalone models. Access to personal data is restricted, logged, and governed by strict role-based controls.

AI outputs serve as signals within a broader verification system. Depending on the outcome of the verification process, your verification may be completed automatically or escalated for review by a trained human analyst in accordance with our controlled procedures. Any determination of ID document tampering, spoofing, deepfakes or other identity fraud is confirmed by such a trained human analyst.

8. Minors

Our Services are not directly targeted at minors (persons under the age of 18). However, depending on the nature of the financial services offered by a Business Partner, we may process personal data of minors — for example where a Business Partner offers financial products or services that are accessible to minors and requests that we perform identity verification accordingly. In such cases, the processing of the minor's personal data takes place on the same legal grounds and in accordance with the same standards as described in this Privacy Statement.

9. Who we share your data with and why

We only share your personal data where necessary and always ensure that appropriate safeguards are in place. Where we share data with parties outside the EEA, we rely on adequacy decisions, the EU-US Data Privacy Framework, or EU Standard Contractual Clauses.

9.1 Within the Fourthline Group

For the purposes of this Privacy Statement, the Fourthline Group includes two entities that share personal data with each other for operational, regulatory, and reporting purposes. The legal basis and nature of such sharing depends on the context.

9.1.1 Identity verification purposes

Fourthline Payments acts as the controller for identity verification and AML screening. Personal data collected in this context is processed by Fourthline Payments and is shared with Fourthline to the extent necessary for the provision of the identity and verification services, including the provision of technical infrastructure and support services required for that purpose. In this context, Fourthline acts as a processor on behalf of Fourthline Payments, under an intra-group services agreement.

9.1.2 AI model training purposes

Fourthline is responsible for the development and training of the AI systems that underpin the Fourthline Group's Services (see 5.2 for more information). To enable this, personal data collected by Fourthline Payments in the context of identity verification is transferred to Fourthline for use as training data. Upon receipt of this data, Fourthline acts as an independent controller for the purpose of AI model training, as it independently determines the purposes and means of that processing.

This intra-group transfer is formalised through an intra-group data sharing agreement and is carried out on the basis of Fourthline's legitimate interest in maintaining and improving secure, accurate, and fraud-resistant identity verification Services. The transfer does not result in your personal data being used for any purpose other than those described in section 5.2 of this Privacy Statement.

9.1.3 Safeguards

All intra-group transfers of personal data are governed by an intra-group agreement that includes appropriate data protection safeguards. Personal data shared within the Fourthline Group is subject to the same technical and organisational security measures as described in section 14 of this Privacy Statement, and is not used for any purpose beyond those described herein.

9.2 Business Partners

We share your personal data with the Business Partner through whom you are being onboarded, to the extent necessary for the provision of our Services and the Business Partner's own regulatory obligations.

9.3 Government authorities and regulators

As a licensed payment institution, Fourthline Payments is subject to supervision by the Dutch Central Bank (De Nederlandsche Bank, DNB) and other competent authorities. Both Fourthline and Fourthline Payments may be required or permitted to share your personal data with the following parties:

• Supervisory and regulatory authorities, including DNB as the prudential supervisory authority for Fourthline Payments, the Dutch Authority for the Financial Markets (Autoriteit Financiële Markten, AFM), other national supervisory bodies within the EEA where required under applicable law, and data protection authorities including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens);

• Judicial and investigative authorities, including courts, arbitration and mediation bodies, public prosecutors, and law enforcement authorities, upon their lawful request or in the context of legal proceedings;

• Financial intelligence authorities, including the Dutch Financial Intelligence Unit (FIU-Nederland), to the extent we are required to report unusual transactions under the Wwft;

• Legal and financial professionals, such as lawyers, trustees, or auditors, where disclosure is required by law or necessary in connection with the above.

We will only disclose your personal data to the above parties to the extent required or permitted under applicable law, and solely for the purposes for which such disclosure is legally justified.

9.4 Third-party service providers (processors)

We work with third-party service providers who process personal data on our behalf. We only share personal data that is necessary for the specific service they provide.

9.5 Business transfers

In the event of a merger, acquisition, or sale of (part of) the Fourthline Group's business, personal data may be transferred as part of that transaction. In such case, we will update our Privacy Statement accordingly.

10. Cookies

Our Websites use cookies and similar technologies (together: “cookies”) to enhance your experience, analyse usage, and support third-party integrations. When you first visit our Websites, you are presented with a cookie banner allowing you to accept, reject, or manage non-essential cookies. Strictly necessary cookies are deployed without consent as they are required for the operation of the Website.

Please see our Cookie Policy for more information about the cookies we use.

11. Your rights

The GDPR grants you a number of rights in relation to your personal data. Below we explain each right, when it applies, and when it may be limited. To exercise any of these rights, please contact us at dpo@fourthline.com and inform us on the Business Partner through whom you were onboarded using our identity verification services. We aim to respond within one month. In some cases we may deny your request, in which case we will inform you of the reason within a reasonable timeframe, where legally permitted. Please do not send us an unredacted copy of your ID document via regular e-mail.

11.1 Right to object

You have the right to object to processing of your personal data based on our legitimate interest. We will assess whether our legitimate interests are overridden by your interests or fundamental rights and freedoms.

You also have the right to object at any time to the use of your personal data for direct marketing purposes. We will immediately cease processing your data for this purpose upon receipt of your objection.

You cannot object to processing that is based on a legal obligation. If we are required by law to process your data, your objection will not result in us stopping that processing.

11.2 Right of access

You have the right to request an overview of the personal data we hold about you and how we process it.

We may restrict access where providing it would adversely affect the rights and freedoms of others, or where we are legally prohibited from disclosing certain information, for example in the context of an ongoing fraud investigation or AML reporting obligation.

11.3 Right to rectification

If your personal data is incorrect or incomplete, you have the right to request that we correct or complete it. Where we have shared incorrect data with third parties, we will notify them of the correction.

Personal data contained in read-only records such as audit logs and action trails cannot be modified as a result of a rectification request.

11.4 Right to erasure

You have the right to request that we erase your personal data where:

• we no longer need it for the purpose for which it was collected;

• you withdraw your consent and there is no other legal ground for processing;

• you object to processing based on legitimate interest and there are no overriding grounds;

• the processing is unlawful; or

• erasure is required by EU or national law.

This right does not apply where processing is necessary for us to comply with a legal obligation. In particular, Fourthline Payments is legally required to retain your personal data for five years after the end of our business relationship or five years after the execution of a transaction pursuant to the Wwft. In cases of fraud, we may retain personal data relating to an offence for up to eight years. In such cases we will inform you that we cannot fulfil your erasure request and explain why. Personal data in read-only records such as audit logs cannot be deleted as a result of an erasure request.

11.5 Right to restriction of processing

You have the right to request that we restrict the processing of your personal data where:

• you contest the accuracy of your data (for the period we need to verify it);

• the processing is unlawful but you prefer restriction over erasure;

• we no longer need the data but you need it for legal claims; or

• you have objected to processing and we are assessing whether our legitimate interests override yours.

11.6 Right to data portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transferred to another controller, where:

• the processing is based on consent or performance of a contract; and

• the processing is carried out by automated means.

This right does not apply to processing based on legal obligation or legitimate interest. As most of our processing of Client data is based on legal obligation, this right will in practice be of limited application in the context of our Services.

11.7 Rights related to automated decision-making

Where automated systems are used to make decisions that significantly affect you, you have the right to obtain human review of the decision, to express your point of view, and to contest the decision. See section 8 for more information on the existence of automated decision-making.

11.8 Right to withdraw consent

Where we process your personal data on the basis of consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

11.9 Right to lodge a complaint

If you are dissatisfied with how we handle your personal data, you can:

• contact our Data Protection Officer at dpo@fourthline.com; or

• file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at www.autoriteitpersoonsgegevens.nl, which is our lead supervisory authority, or with the data protection authority in your country of residence.

12. Your duty to provide data

There is certain information that Fourthline Payments is legally required to collect about you before we can enter into a relationship with you as a Client, in order to comply with our obligations under the Wwft. Without this data, we may not be able to provide our Services to you or enter into an agreement with you.

13. How long we keep your personal data

The Fourthline Group stores and processes your personal data only as long as it is necessary to perform our obligations under the agreement with you, or as long as the law requires us to store such data. Fourthline Payments is legally required to store your personal data pertaining to your onboarding as a Client for five years after termination of our business relationship with you, or five years after execution of a transaction pursuant to the Dutch Prevention of Money Laundering and Terrorism Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme). There may be circumstances (such as fraud, anti-money laundering requirements, law enforcement investigation, or exercise of legal claims) whereby we are obliged to store your personal data even longer. In cases of fraud, we may store your personal data relating to an offence for up to eight years.

14. How we protect your personal data

The Fourthline Group applies a framework of internal policies, procedures, and technical and organisational measures to keep your data safe. This includes:

• clean-room policies and strict access controls;

• encryption and pseudonymisation where appropriate;

• regular testing and evaluation of security measures, including backup and restoration testing;

• confidentiality agreements for all employees with access to personal data;

• separation of backup facilities from primary data storage

Despite our best efforts, no data transmission over the internet can be guaranteed to be fully secure. Any transmission to our Websites is at your own risk. Once we have received your data, we apply strict controls to prevent unauthorised access.

15. How you can help keep your data safe

You can help protect your personal data by:

• using up-to-date endpoint protection software (such as antivirus) and network protection (such as firewalls);

• choosing strong passwords and multi-factor authentication where available, and keeping them confidential;

• safeguarding your physical identity documents, devices, and payment instruments;

• Staying alert while using online services where unusual or fraudulent activity or attempts against your data may occur.

16. Contact us

For any questions about this Privacy Statement or about how we handle your personal data, or to request a copy of our international transfer safeguards, please contact our Data Protection Officer:

dpo@fourthline.com

Please note that this email address is reserved exclusively for data privacy inquiries. All other messages will not be processed.

Version October 2026.