This Privacy Policy describes how Priority Technology Holdings, Inc. and its subsidiaries (“Priority,” “we,” or “us”) processes personal data and other information through its websites, platforms, or mobile applications (collectively, the “Services”) by explaining what types of information Priority collects, how that information is used, Priority’s sharing practices, and your choices. Priority is the controller for purposes of this Privacy Policy. Information We Collect We collect information from you directly when you provide it to us, automatically through the Services, and from third parties. Each collection mechanism is described in more detail in this Privacy Policy. Information You Provide Directly Account Registration. When you set up an account with us, we typically request your name, email address, property name, and address. We use this information to provide you with the requested Services. Referrals. When you refer a merchant to us, we request your name, financial institution name, branch name, and your email address. We use this information to keep track of merchant referrals. Sign Up for Alerts. When you sign up for alerts from us, we ask you for your name and email address so that we can provide you with the content you have requested and provide you with information about our products and services that may be of interest to you. Make a Payment. When you make a payment through one of our Services, we ask you to provide your email address, street address, and payment information. We use this information to process your payment and, where required, direct it to the appropriate individual. Register for an Event. When you register for an event, we collect your name and email address. We use this information to communicate with you about the event and related services. Schedule a Demonstration. When you schedule a demonstration of our products, we ask you to provide your name, organization, email address, city, state, and telephone number. We collect this information to communicate with you and provide you with information you requested. Chat. We collect any information that you submit through any chat functionality on our Services in order to respond to your questions. This chat functionality uses some automated processes to assess how we can best support your request(s). Support. We collect any information that you provide in connection with support queries, such as contact data, any supporting documentation reflecting your support needs, and the content of any communications with us. We use this information to respond to your support needs and provide you with information. Apply for a Job With Us. If you apply for a job with us, we collect any information you provide in connection with your application submission, including application information submitted through any third party recruiting platforms used by us. If you register to receive email updates from us about job postings, we collect your email address in order to provide you with this information. Contact Us. When you contact us, we ask you to provide us with your name, email address, company name, job title, phone number, and zip code. We request this information in order to effectively address your comments and questions and provide you with relevant information in response to your inquiry. Other. Other Services we offer may request or require you to provide us with additional information, which will be described at the point of collection. Automatically Collected Information We automatically collect the following types of information when you use our Services, including: Usage Details. We collect information about your use of our Services, including referring/exit pages, date/time stamp, and clickstream data. Other Technical Data. We collect information about the device you use to access our Services, including your internet connection, including your internet protocol (IP) addresses, browser type, referral domain, internet service provider (ISP), and operating system. Cookies and Similar Tracking Technologies. A cookie is a small text file that is stored on your device through your browser. The cookies used by our Services include both session-based cookies, which expire after you close your browser or turn off your computer, and persistent cookies, which remain on your device until you affirmatively remove them. Most web browsers automatically accept cookies, but you can set your browser to decline cookies. We use this automatically collected information to analyze trends, to provide, administer, and improve our Services, to track users’ movements while using the Services, to gather demographic information about our user base, and to market our products and services and monitor interactions with our marketing communications. Mobile Applications We offer certain mobile applications, including iOS and Android applications, for download. These mobile applications may collect additional information from you. For example, our applications may ask you to turn on location services to provide you with more relevant information based on your location. Certain mobile applications may also collect your device’s unique identifier in order to tailor and improve the mobile application’s utility to you. How We Use Your Information In addition to the uses described above, we also use your information: to protect our interests or the interests of third parties; to maintain and enhance the security of our Services; to prevent abuse of our Services; to comply with our legal obligations; to perform or enforce our agreements; for any other purpose with your consent. Bases for Processing The legal bases for our processing activities include: your consent; Priority exercising its rights and performing its obligations in connection with entering into or performing under any contract it makes with you; compliance with our legal obligations; Priority’s legitimate interests that are not overridden by your interests or your fundamental rights and freedoms. Third Parties You may also be able to engage with our Services through social media services and through third- party social media plug-ins, integrations, and applications. When you engage with our content on or through social media services or other third-party platforms, plug-ins, integrations, or applications, you may allow us to have access to certain information in your profile and information about your interaction with our content. For a description on how social media services and other third-party platforms, plug-ins, integrations, or applications handle your information, please refer to their respective privacy policies and terms of use, which may permit you to modify your privacy settings. Third parties may also use cookies or similar technologies on our Services for advertising, retargeting, analytics, and tracking. Please see “More About Analytics and Advertising” and “Your Choices and Rights” below for more information about third party cookies. We share your information: with our affiliates in connection with your use of our Services or our business relationship with you; with contractors, service providers, and other third parties we use to support our Services; to fulfill any purpose for which you provide it; for any other purpose disclosed to you when you provide the information; or with your consent We may also share your information: to comply with any court order, law, or legal process, including to respond to any government or regulatory request; to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets; if we believe disclosure is necessary or appropriate to protect our rights, property, or interests, or the rights, property, or interests of third parties. More About Analytics and Advertising We use third-party analytics providers to help track how users interact with our Services. Third parties may also use cookies or web pixels for online advertising personalization. Third-party tracking technologies are not controlled by us, even if they use our Services to help store or collect data. Statements regarding our practices do not apply to the methods for collecting information used by third-party advertisers and others or the use of the information that such third parties collect. The relevant third party’s terms of service, privacy policy, permissions, notices, and choices should be reviewed regarding their collection, storage, and sharing practices. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly. Google Analytics collects personal data through our websites, including through the use of cookies. For information about how Google Analytics collects and processes data, please visit: https://policies.google.com/technologies/partner-sites. To opt out of having your information used by Google Analytics, please visit: https://tools.google.com/dlpage/gaoptout/. For more information, please visit Google’s privacy policy at: https://policies.google.com/privacy?hl=en&fg=1. Additionally, third parties, including Google, may place and read cookies on your browser, or use web beacons to collect information in connection with ad serving on our websites. Our partners will collect personal information for personalization of ads and use cookies for personalized and non-personalized advertising and measurement. Ad serving may be based on users’ visits to our Website or other websites on the Internet, and your activity may be tracked over time and across websites. For information about how Google collects, shares, and uses data, please visit: https://policies.google.com/technologies/partner-sites. You may opt out of personalized ads from Google by visiting the Google Ads Settings web page at: https://www.google.com/ads/preferences/. For more information, please visit Google’s privacy policy. Third-Party Platforms and Social Media This Privacy Policy applies only to Priority’s Services and not to any other platforms or websites, or mobile applications operated by third parties. Our Services may contain links to other platforms, websites, and mobile applications that we believe may be of interest to you. Our Services also contain links that allow you to connect with us on social media. Priority is not responsible for the privacy practices of any platforms, websites, or mobile applications not controlled by us. We encourage you to review the privacy policies of any platforms, websites, or mobile applications you use outside of our Services before providing any information to or through them. Similarly, with respect to our own mobile applications we are not responsible for any mobile application tracking or monitoring activities by third party providers such as Google, Inc., Apple, Inc., or your wireless or network carrier. You should always read and understand the policies of any third-party provider before downloading or using any mobile applications. Cross-Border Transfers Sometimes we may need to transfer information to countries in which applicable laws may not offer the same level of data protection as the laws of your home country. Individuals in the EEA: When we transfer information from individuals in the EEA to countries that have not received an adequacy finding under Article 45 of the GDPR, we act as a processor and rely on contractual arrangements with controllers under Article 46 of the GDPR or derogations for specific situations set forth in Article 49 of the GDPR in order to transfer your information across international borders. You may contact the applicable controller to request a copy of any applicable Article 46 agreement. When relying on a cross-border transfer mechanism under Article 49, we only collect and transfer your information to third countries: (i) with your consent; (ii) to perform a contract with you; or (iii) to establish, exercise, or defend legal claims. Data Retention We only store information for as long as is needed to fulfill our contractual or legal obligations or any other permissible purpose for which we have collected it, including to prevent fraud or security incidents. When the applicable retention period has expired, we take measures to permanently delete the information, aggregate it, or anonymize it. Security We use commercially reasonable administrative, physical, and technical measures to safeguard your information and help protect it from unauthorized access. However, we cannot guarantee complete protection of your information since transmission via the internet is not 100% secure. You play an important role in keeping your information secure. You should not share your user name, password, or other security information for your account with anyone. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us by contacting us as detailed in the “Contact Us” section. Children Our Services are not directed to children, as defined under applicable law. If you believe that a child has provided their information to us through our Services, please contact us as detailed in the “Contact Us” section, so that we can take steps to delete it. Your Choices and Rights You can control the use of cookies within your browser. However, please note that disabling some or all cookies may affect the functionality of our Services. Our Services do not respond to browser “Do Not Track” signals. You can change the information collected through our mobile application in your device’s settings. Disabling the collection of certain information may decrease the utility of the mobile application. We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI”) on the NAI’s website at https://www.networkadvertising.org. You may also be able to opt out of receiving third-party behavioral ads by visiting the Digital Advertising Alliance (“DAA”) website at http://www.aboutads.info/choices. We are not responsible for effectiveness of or compliance with any third-parties’ opt-out options. To the extent required by law, we provide you with (i) reasonable access to your personal information collected through our Services, and (ii) the ability to review, correct, export, or delete your information, restrict its processing, or object to its processing. You may exercise the foregoing rights by contacting us using any of the mechanisms detailed in the “Contact Us” section. If you are the customer of a merchant or other organization to whom we provide products or services, please direct your request directly to that merchant or organization so that they can address it. Individuals in the EEA: In addition to the foregoing rights, you have the right to lodge a complaint with a supervisory authority if you believe we have processed your information in a manner inconsistent with your privacy rights. We kindly request that you contact us first so that we may address your concern. Nevada Residents: Nevada residents who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A may submit a request to this designated address: privacypolicy@prth.com. However, we do not currently conduct “sale” activities as defined under that statute. California Residents: In accordance with the California Consumer Privacy Act of 2018 (“CCPA”), the below chart reflects the categories of personal information we have collected from California residents both online and offline during the past twelve months, the categories of sources from which the information was collected, the business or commercial purpose for which the information was collected, and the categories of third parties with whom we shared that information. Identifiers Categories of Personal Information Collected: Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. Categories of Sources of Collection: You; Third party sources; Our websites; Publicly available information. Business/Commercial Purpose for Collection: Provide our products and services to you; Respond to questions; Provide you with information about our products and services; Enhance customer experience; Detect security incidents and protect against fraud or illegal activity; Conduct hiring and/or other human resources activities; To evaluate or process a commercial transaction; As required by applicable law or government regulation. Categories of Third Parties Receiving Personal Information: Affiliates; Service providers; Business partners. Personal information categories listed in Cal. Civ. Code § 1798.80 Categories of Personal Information Collected: Personal information categories listed in Cal. Civ. Code § 1798.80 such as name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information Categories of Sources of Collection: You; Third party sources; Our websites; Publicly available information. Business/Commercial Purpose for Collection: Provide our products and services to you; Respond to questions; Provide you with information about our products and services; Enhance customer experience; Detect security incidents and protect against fraud or illegal activity; Conduct hiring and/or other human resources activities; To evaluate or process a commercial transaction; As required by applicable law or government regulation. Protected classification characteristics under California or federal law Affiliates; Service providers; Business partners. Protected classification characteristics under California or federal law Categories of Personal Information Collected: Protected classification characteristics under California or federal law such as age, race, national origin, citizenship, marital status, sex, gender identity, sexual orientation, medical conditions (including pregnancy or childbirth, physical or mental disability or related medical conditions), parental status, veteran or military status. Categories of Sources of Collection: You; Third party sources; Our websites; Publicly available information. Business/Commercial Purpose for Collection: Provide our products and services to you; Conduct hiring and/or other human resources activities. Categories of Third Parties Receiving Personal Information: Affiliates; Service providers; Business partners. Commercial information Categories of Personal Information Collected: Commercial information such as records of real property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Categories of Sources of Collection: You; Third party sources; Our websites and mobile applications. Business/Commercial Purpose for Collection: Provide our products and services to you; Enhance customer experience. Categories of Third Parties Receiving Personal Information: Affiliates; Service providers; Business partners. Internet or other similar network activity Categories of Personal Information Collected: Internet or other similar network activity such as browsing history, search history, information on interactions with an internet website, application, or advertisement. Categories of Sources of Collection: You; Third party sources; Our websites and mobile applications. Business/Commercial Purpose for Collection: Provide our products and services to you; Monitor and improve our Services; Detect security incidents and protect against fraud or illegal activity. Categories of Third Parties Receiving Personal Information: Service providers. Geolocation data Categories of Personal Information Collected: Geolocation data such as physical location or movements. Categories of Sources of Collection: Our mobile applications. Business/Commercial Purpose for Collection: Provide our products and services to you; Monitor and improve our Services. Categories of Third Parties Receiving Personal Information: Affiliates; Service providers. Professional or employment-related information Categories of Personal Information Collected: Professional or employment-related information such as current and prior employment, performance evaluations, and results of background checks. Categories of Sources of Collection: You; Third party sources; Publicly available information. Business/Commercial Purpose for Collection: Provide our products and services to you; To conduct hiring and/or other human resources activities. Categories of Third Parties Receiving Personal Information: Affiliates; Business partners; Service providers. Inferences drawn from other Personal Information Categories of Personal Information Collected: Inferences drawn from other Personal Information to create a profile reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitude, intelligence, ability, aptitude, and any other inferences drawn from your personal information. Categories of Sources of Collection: You; Third party sources; Our websites and mobile applications. Business/Commercial Purpose for Collection: Provide our products and services to you; Monitor and improve our Services. Categories of Third Parties Receiving Personal Information: Affiliates; Service providers; Business partners. In the past twelve months, we have not sold personal information, and we have no actual knowledge of selling the personal information of minors under 16 years of age. California residents have the right to opt out of the sale of their personal information, but because we do not sell personal information, we do not offer an opt out. Right to Know California residents have the right to request that we disclose the categories and specific pieces of personal information we collected, used, and disclosed during the past twelve months, the categories of sources from which their personal information was collected, our business or commercial purposes for collecting their personal information, and the categories of third parties with whom we shared their personal information. Right to Delete California residents have the right to request deletion of the personal information we have collected from them. Request Submission California residents or their authorized agent can submit a request by emailing us at privacypolicy@prth.com or by calling us at 1(800) 935-5961. You will need to provide us with personal information for us to match with information we have on file in order to verify your identity and residency. The personal information that we use to verify your identity and residency will not be used for any other purpose. Right to Non-Discrimination California residents have the right to not receive discriminatory treatment for exercising their CCPA privacy rights. We do not discriminate against California residents who exercise their CCPA privacy rights. Changes to This Privacy Policy We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices. If we make any material changes to our privacy practices, we will notify you in accordance with applicable law prior to the changes becoming effective. Contact Us If you have any questions or comments regarding this Privacy Policy, our privacy practices, or if you wish to exercise your individual rights, please contact us by email at privacypolicy@prth.com or by phone at 1(800) 935-5961. CONSUMER PAYMENTS COMMERCIAL PAYMENTS INSTITUTIONAL SERVICES INTEGRATED PARTNERS About PRTH Investor Relations Careers Privacy Policy Priority Payment Systems is a registered ISO of Wells Fargo Bank N.A.,Concord, CA, a registered ISO/MSP of Synovus Bank, Columbus, GA and a registered ISO of Citizens Bank, N.A., Providence, RI. DISCLAIMER “MX ISO/Agent”, “MX Merchant”, “MX Express”, “MX Invoice”, “MX Insights”, “MX B2B Interchange Optimize”, “MX Enterprise”, “MX Storefront”, “MX Retail”, and “MX Medical” are trademarks and service marks of Priority Payment Systems LLC, which disclaims any affiliation, sponsorship or endorsement of any kind with any other entity using MX or any variation thereof in connection with bank card, credit card, or transaction technology, processing services and merchant services. “VIMAS”, “ACH.COM”, “4 Rings and Resolve” are trademarks and service marks of Priority Payment Systems LLC. “American Express Merchant Financing”, “e|tab”, “Apple Pay”, “Clover”, “ControlScan”, “PAX”, “Verifone”, “Ingenico”, “iMag”, “SecureMag”, “Magtek “First Data”, Poynt, and “TSYS” are trademarks and/or service marks of their respective owners.