The controller of the personal data processed in accordance with this notification is Eligma Ltd. ("Eligma"), company registration number 8106452000, with business address at Letaliska cesta 33F, 1000 Ljubljana, Slovenia.

The data protection officer at Eligma is Luka Planinc, available at the e-mail address [email protected]. Please feel free to contact him for further explanations and information regarding personal data processing.

In accordance with the applicable legislation on the prevention of money laundering and terrorist financing (the Prevention of Money Laundering and Terrorist Financing Act or ZPPDFT-1), you must be identified and verified before you start making payments with the use of the Elly service. For this purpose, we collect and process the following data (“know-your-customer data” or “KYC data”) in addition to your name and surname: permanent and temporary residence address; date and place of birth; personal identification number or tax number; citizenship; gender; the number, type and issuer of your identification document; the photo of the front and back of your identification document (in the case of passport, its photo page); the photo (selfie) of you holding your identification document; e-mail address; telephone number and possibly additional data (e.g. information on your business activity, source of funds, annual income, etc.) that Eligma may require for providing the Elly service.

In accordance with Item (c) of Article 6 (1) of the GDPR, the processing of data is necessary for compliance with the legal obligation stated in Item 1 of Article 17 (1) of ZPPDFT-1.

We are obliged to keep the aforementioned data for a period of 10 years after you stop using the Elly service.

In order to provide the Elly mobile application services, we require your personal data for several purposes, primarily to provide you with a digital wallet where your virtual currencies as well as digital value vouchers Euro Token are kept (“Elly Digital Wallet”), carry out approved payments, keep records of your past transactions and exchanges between virtual currencies and/or digital value vouchers, providing the ability to store your payment card information, supply information on nearby points of sale, provide technical support, send important notifications essential for the use of the Elly mobile application, and ensure the technical functioning of the application. To be able to ensure the operation of the Elly mobile application, we process your name and surname, e-mail address, payment data, the data on your Elly Digital Wallet, the data on your payment card (card number, expiration date, card security code, personal data of the cardholder (name, surname, residence address, e-mail address)), your location, the use of the Elly mobile application (the frequency of use, used features, etc.), operating system type, browser version, Elly mobile application version, and IP address data.

In accordance with Item (b) of Article 6 (1) of the GDPR, the processing of data is necessary for the performance of the agreement on using the Elly mobile application, into which you entered by accepting the General Terms of Use of the Elly Service of Payments when creating your user account in the Elly mobile application.

Your personal data necessary for the operation of the Elly mobile application will be processed until you terminate your Elly user account or until the credit in your Elly Digital Wallet is transferred to your digital wallet with a different provider at the termination of your Elly user account. After the termination of the user account, we will only keep the personal data that we are legally obliged to keep or that we might need for evidence or defence purposes in case of a possibility of legal claims.

We periodically e-mail you to keep you informed on technical, functional and other updates to the Elly mobile app and on new or upgraded locations where you can use the Elly mobile app. For this kind of communication, we process your name, surname and e-mail address.

We process the above personal data on the basis of legitimate interests in accordance with Item (f) of Article 6 (1) of the GDPR.

We will process your personal information to e-mail you about updates and upgrades until you terminate your Elly user account.

On the basis of your freely given preliminary consent in accordance with Item (a) of Article 6 (1) of the GDPR, we process your personal data in order to send you e-mail notifications on new products and services, promotions, special offers and events.

For the purpose of sending such notifications, we process your name, surname and e-mail address.

The personal data that we process to send offers and notifications on novelties is kept until your consent withdrawal or, in any case, for a maximum period of 5 years from your consent. After that period, we will again ask you for your consent.

For statistical analysis of Elly mobile application use in order to improve the Elly mobile application and the user experience as well as to develop our products, your personal data will be anonymised and used for the aforementioned purposes in anonymised form.

Your personal data will only be revealed to those third parties that will process your personal data on our behalf. The third parties are our contract partners performing payment card processing, use analysis, e-mailing, consulting, direct marketing as well as data collecting and storing services on our behalf.

Where we transfer your personal data outside the European Economic Area, we will ensure that it is protected and transferred in a manner consistent with the legal requirements applicable to personal data. This can be done in a number of different ways, for instance:

• - the country to which we send your personal data was approved by the European Commission;
• - the recipient of your personal data signed a contract based on “model contractual clauses” approved by the European Commission, obliging them to protect your personal data.

In other circumstances, the law may permit us to otherwise transfer your personal data outside the European Economic Area. In all cases, however, any transfer of your personal data will be compliant with the applicable data protection legislation.

In the scope of our legal obligations, we may communicate your personal data to the regulatory authorities for the purposes of discovery and prevention of money laundering and terrorist financing as well as for prevention and investigation of abuse or fraud in connection with the use of the Elly mobile application.

You may exercise the following rights at any time:

• 1. the right of information whether your personal data is processed and, when this is the case, the right of access to your personal data and the relevant explanations,
• 2. the right to check the accuracy of your data and the right to rectification or change,
• 3. the right to restriction of processing or the right to erasure of your personal data,
• 4. the right to object at any time to the processing of personal data concerning you,
• 5. the right to data portability.

When data processing is based on your consent, you may withdraw your consent at any time; however, the withdrawal of your consent does not affect the lawfulness of the processing of your personal data on the basis of that consent for the period prior to the withdrawal.

You may exercise your rights directly at the e-mail address [email protected]. We will notify you if your request affects the possibility of further use of the Elly mobile application.

Your requests will be fulfilled without undue delay, but in any case within one month of the receipt of your request unless otherwise provided by the applicable legislation. In the event of complexity and a large number of requests, this time limit may be extended by up to two months. We will notify you of any such extension within one month of receiving your request, together with the reasons for the delay.

In the event of a violation of protection of your personal data, we will notify you in accordance with the conditions laid down by the applicable legislation.

If you believe that we do not process your personal data in accordance with the applicable legislation, you can file a complaint with the Slovenian Information Commissioner at the e-mail address [email protected] or by regular mail to Dunajska cesta 22, 1000 Ljubljana, Slovenia. Nevertheless, we will greatly appreciate it if you communicate your misgivings, comments or suggestions to us prior to contacting the Information Commissioner.

This notification may be changed at any time if this is necessary due to a change of personal data processing or due to a new interpretation, decision or opinion in connection with the personal data processing legislation. Any notification changes will be communicated to you in advance.