Ding.com Privacy Notice

We recognise that protecting personal information is very important to you and that you have an interest in how we collect, use, store and share such information. We always respect our users' privacy and personal information and we take this matter very seriously. We have worked very hard to earn our users’ trust and keeping it is our top priority. That’s why we comply with the obligations that are laid out under data protection laws.

This privacy notice sets out how we, as a data controller, will use and protect your information. We will use your personal information only for the purposes and in the manner set out in this privacy notice. We recommend that you read this privacy notice carefully.

Please note: you have the right to object to the processing of your personal data where that processing is carried out for our legitimate interests or for direct marketing purposes

1. About us

www.ding.com and its subsidiary sites (including www.ezetop.com and www.recargasacuba.com) and any associated Ding mobile applications, present or future (each the “Applications”), are operated by; Ezetop Unlimited Company t/a Ding (“Ding”, “we” or “us”). Ding provides services that allow you to purchase prepaid mobile phone top-up (“Top-Up”) and prepaid gift cards (together the “Products”) and to send and receive dingMoney on the Applications. Ding is registered in Ireland with registered number 422514 and has its registered office at 3 Shelbourne Buildings, Crampton Avenue, Shelbourne Road, Ballsbridge, Dublin 4, D04C2Y6, Ireland. Our VAT number is 9576713i. Ding is a registered business name of Ezetop Unlimited Company.

All correspondence in relation to any Ding company should be sent to 3 Shelbourne Buildings, Crampton Avenue, Shelbourne Road, Ballsbridge, Dublin 4, D04C2Y6, Ireland.

2. How can you get in contact with Ding?

If you have any questions about this privacy notice or any other queries or complaints, our customer care team is here to help – please contact us using one of the following options:

Email us: [email protected]

Live chat: https://support.ding.com

3. Scope of Ding’s privacy notice?

This privacy notice applies to any users who visit our Applications and to any users who register an account on our Applications, purchase our Products, send and receive dingMoney, join the Ding Rewards Club, contact our customer care team or otherwise interact with the Applications (the “Services”).

Personal data is information that identifies a person or can be used to identify a person. For us to provide our Services to you, we need to collect and process personal data about you. Without this information, we may not be able to provide our Services to you. This privacy notice will apply to personal data about you collected by us directly from you through the Applications or otherwise.

Any personal data you provide about your family and friends while using the Services who are non-Ding users in respect of which we are a data controller will be subject to our ‘Friends and Family Privacy Notice’. You acknowledge that you have informed any such person that their personal data may be collected and processed by Ding and made them aware of our ‘Friends and Family Privacy Notice’.

4. What data does Ding collect?

We may collect and process the following personal data about you when you use the Services:

• Identity and Contact Details:

  name; email address; telephone number; passport or national identification details (in limited circumstances); social media identifiers; or verifying selfie video

• Payment Details:

  cardholder name; credit or debit card details (however, we only retain certain parts); chargeback information; billing address; PayPal ID; utility bill (in limited circumstances)

• Transaction Details:

  transaction amount and currency

• Electronic Identifying Details:

  IP address; SMS content; cookies; pixels; activity logs (e.g. user session recordings); online identifiers; device identifiers (e.g. the mobile device and/or the internet browser that you use) and geolocation data

• Correspondence and Complaints:

  any correspondence that you choose to send to Ding (including complaints); any information you provide to our customer care team; any information you publish about Ding (including on the app stores)

• Transaction History

  :

  details of your visits to the Applications; details of the Products you purchase (including the recipient’s phone number (if applicable), date and time and relevant operator/provider) and any points earned or redeemed in the Ding Rewards Club if applicable; and details of the Products you receive (including the name or phone number of the user who purchased the Product, date and time and relevant operator/provider).

We may also collect and process the following additional personal data about you when you send/receive dingMoney:

• Identity and Contact Details:

  first and last name; date of birth; home address; country; National identity number (required for non-USA residents) Social Security number (required only for USA residents); occupation; employment status; or ID verification (optional for US residents with minimal payment activity)

• Account and Payment Details:

  proof of address (utility bill or bank statement); source of funds (in limited circumstances); primary purpose of account (in limited circumstances)

• Transaction Details:

  expected monthly amounts to be sent or received (in limited circumstances); intermediary status (in limited circumstances)

• Transaction History:

  details of the dingMoney you send or receive (including the name or phone number of the sender or recipient).

We collect the mobile phone number, (or the email associated with a permanent Nauta access account) of the person to whom you wish to send the Products or dingMoney.

If you choose to grant the Applications access to contact information through your device, we may collect this information, including names, telephone numbers, email addresses and social media identifiers. We use this information to help us deliver the Services to your family and friends in the most efficient manner and for the other purposes listed below.

5. How does Ding collect your personal data?

You provide us with your personal data when you register for, or use, our Services. We also collect information about you through your use of our Services. When you visit our Applications, your device and/or browser may automatically disclose certain information (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connection to an Application or other technical communications information), some of which may constitute personal data.

For more information on the cookies we use, please see our Cookie Policy.

We may also collect personal data about you from third parties (e.g. in the event of chargebacks or through third party direct marketing services).

6. Why do we process your personal data and what is our legal basis for doing so?

We will inform you in advance if we intend to further process your personal data for a purpose other than as set out above. We will also seek your specific consent if we carry out any processing of personal data that legally requires us to obtain such consent. You will have the right to withdraw such consent at any time.

7. Do we carry out any automated processing of your personal data or use AI?

We may use artificial intelligence (“AI”) and automated processing technologies to support and improve our products, services, operations, and customer experience. This may include the use of AI-enabled tools and systems for purposes such as:

• customer support and service assistance;

• fraud detection and prevention;

• transaction monitoring and security;

• compliance and risk management;

• service personalisation and optimisation;

• analytics, reporting, and operational efficiency.

Where personal data is processed using AI-enabled systems, we take steps designed to ensure such processing is carried out in accordance with applicable data protection laws and subject to appropriate technical and organisational safeguards. We may also use trusted third-party service providers that incorporate AI functionality into the services they provide to us. Where such providers process personal data on our behalf, they are subject to contractual confidentiality and data protection obligations.

When we make solely automated decisions that affect you in a legal or a significant way, you have the right to provide your point of view and have those decisions reviewed by a member of our staff.

8. What happens if you do not provide us with your personal data?

If you do not provide us with your personal data or object to the use of certain personal data, we may not be able to provide the Services to you.

9. Who do we disclose your personal data to?

We share your personal data, where necessary, with the following recipients:

• any third party you ask us to share it with, including friends and family;

• mobile operators and other providers of Products (directly or via third parties);

• anti-fraud service providers and KYC service providers

• governmental, legal, regulatory, or similar authorities, on request or, where required, including for the purposes of reporting any actual or suspected breach of applicable law or regulation;

• law enforcement authorities, where responding to valid requests to assist in the prevention, detection, investigation or prosecution of a criminal offence;

• third party payment processors;

• in the case of dingMoney, our third-party digital wallet provider Bridge Ventures LLC and its affiliates;

• direct marketing service providers;

• data analytics service providers (e.g. Google Analytics);

• third party service providers used for the delivery of some aspects of the Services (e.g. via messaging apps (e.g. WhatsApp), email delivery, web notifications, app notifications and phone number lookup);

• hosting infrastructure companies based in the EEA;

• legal and financial advisors, and auditors;

• potential purchasers or bidders.

In addition, if you purchase a Product for your friends and family, they may be able to view your name or mobile number when you send them Products. They may also be able to view your name or mobile number if they register an account on our Applications and use the Services (e.g. when they view their transaction history or they avail of the option to send you a thank you message). If you purchase a Product, you can control whether you wish to share your name or mobile phone number with your friends and family through the account settings in your Ding account here.

Our Applications may, interface with third party services that you have previously interacted with (e.g. Facebook and Google) or contain links to third party content (e.g. service provider content). Please note that Ding is not responsible for such services or content, or the privacy policies associated with those services or content. We recommend that you review any third party’s privacy policy before accessing such services or content.

10. Does Ding transfer your personal data outside the EEA?

Ding may be required to transfer your personal data outside the EEA for the purposes of providing the Services. To ensure that your personal data receives an adequate level of protection and is treated securely, and where a specific derogation does not apply, we put the appropriate safeguards in place to protect the privacy and integrity of such personal data when being transferred outside the EEA (e.g. EU-approved standard contractual clauses / binding corporate rules).

12. What if Ding is bought by another company?

We reserve the right to transfer information (including your personal data) to a third party in the event of a merger, liquidation, receivership or transfer of all or substantially all of the assets of our company. The third party must only use your personal data for the purposes that you provided it to us in the first place and as set out in this privacy notice. You will be notified in the event of any such transfer.

13. Data Security

We have implemented appropriate technical and organisational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful or unauthorised forms of Processing, in accordance with data protection laws.

You are responsible for ensuring that any personal data that is sent to us is sent securely.

14. How long do we keep your personal data?

We will keep your personal data only for so long as is necessary to carry out the purposes set out above and to comply with any legal obligations. The criteria for determining the duration for which we retain your personal data are whether it is necessary:

• to maintain an ongoing relationship with you (e.g. to provide our Services to you or where you are lawfully included in our direct marketing lists and have not unsubscribed);

• in connection with the purposes set out in this notice and where we have a valid legal basis; or

• to comply with any applicable limitation period under applicable law, and a reasonable amount thereafter.

Once the periods above have concluded, we will either:

• permanently delete or destroy the relevant personal data;

• archive your personal data so that it is beyond use; or

• anonymise the relevant personal data.

15. Where does Ding hold your personal data?

Your personal data is held by us on secure servers which are hosted by Ding or by a third party hosting infrastructure company located within the EEA.

16. Will Ding use your personal data for direct marketing purposes?

We may use your personal data to send you information by SMS, messaging apps (e.g. WhatsApp), email or app notifications relating to our products and services which may be of interest to you or similar products and services to those you have previously purchased from Ding with your consent or where otherwise permitted to do so by local law.

17. Can you opt-out/unsubscribe from direct marketing?

You will be provided with an opportunity to opt-in at the point of registration. You can also opt-out at any time, free of charge, by: (i) for SMS, messaging apps (eg WhatsApp) and email, by using the unsubscribe facility in the SMS, messaging app or email that Ding sends to you; (ii) for push notifications, by following the steps in the guide available at support.ding.com; or (iii) by sending an email to [email protected].

Ding does not sell or share your personal data with subsidiary companies or third parties for marketing or profit purposes.

18. Your Rights

You have a right to obtain a copy of, and the right to rectify any inaccuracies in, the personal data we hold about you by making a request to us in writing. You also have the right to request erasure, restriction, portability, or object to the processing, of your personal data or not to be subject to a decision based on automated processing, including profiling. You should inform us of any changes to your personal data. Any requests made under this section can be made using the contact details set out below. We will respond to your request in writing, or orally if requested, as soon as practicable and in any event not more than one (1) month after receipt of your request. In each case, these rights are subject to restrictions as laid down by law.

If you are unhappy with any aspect of processing or your data protection rights please contact Ding in the first instance and we will be happy to listen to your concerns. We can be contacted as follows: [email protected] or Data Protection Officer, 3 Shelbourne Buildings, Crampton Avenue, Shelbourne Road, Ballsbridge, D04C2Y6, Dublin 4, Ireland

At all times, you have the right to lodge a complaint with the Office of the Data Protection Commission if you are unhappy with how your personal data is being handled by us. Their contact details are as follows:

Data Protection Commission 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

Telephone: +353 (01) 765 0100

LoCall Number: 1800 437 737

Email: [email protected]

If we are relying on your consent to allow us to process your information, you can withdraw your consent at any time. From that point on we would no longer be able to carry out the processing we were carrying out with your consent. Any processing we carried out before you withdrew your consent would remain valid. We do not generally rely on consent for processing personal data.

Please contact us at [email protected] or Data Protection Officer, Ding, 3 Shelbourne Buildings, Crampton Avenue, Shelbourne Road, Ballsbridge, D04C2Y6, Dublin 4, Ireland to exercise any of your rights under this section.

19. Changes to this privacy notice

We may update this privacy notice from time to time. If we make any material changes, we will notify you by posting a notice on our Applications and/or, where appropriate, by sending you a notification.