AML

§ 1 [Definitions]

The terms used in this document, written with a capital letter, in the singular, as well as their plural equivalents, have the following meanings:

1. Speedy AG – Speedy AG spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, at Plac Europejski 2, 00-844 Warsaw, Poland, entered into the register of entrepreneurs of the National Court Register under KRS number: 0000907361, NIP: 7831838519, e-mail address legal @speedy.pl, having the status of a domestic payment institution and supervised by the Polish Financial Supervision Authority (Komisja Nadzoru Finansowego) (UKNF Register: IP60/2024), an institution obliged under the AML/CFT Act to conduct the AML/CFT Process and providing the service of executing Transactions ordered on the Website.

2. Customer – a registered user of the Service: a natural person over 18 years of age who has successfully completed the AML/CFT Process and who may order Transactions on the Website.

3. Partner – the owner or operator of the Website or the supplier of an external tool (software) for KYC verification integrated with the Website, to which the Website redirects a Potential Customer and the Customer.

4.Potential Customer – a registered user of the Website: a natural person over 18 years of age who intends to undergo or is in the process of undergoing the AML/CFT Process in order to be able to order Transactions on the Website.

5.AML/CFT Process – the process of identifying, verifying and assessing the risk of the Potential Customer or Customer, carried out directly by Speedy AG or by the Partner on behalf of Speedy AG, in accordance with the regulations on counteracting money laundering and terrorism financing; this process includes verifying the personal data of Potential Customers and Customers with information obtained from external sources.

6. Payment Services Terms & Conditions – terms and conditions for payment services provided by Speedy AG sp. z o.o. made available to the Customer on the Website for acceptance before ordering the execution of each Transaction.

7.GDPR / RODO – Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), implemented in Poland as RODO (Rozporządzenie o Ochronie Danych Osobowych)

8. Website – a website or mobile application through which the Customer can place a payment order to execute a Transaction transferred to Speedy AG and which operates in accordance with the regulations for the provision of electronic services relating to it.

9. Transaction – a payment transaction being a payment service, defined in detail in the Payment Services Terms & Conditions.

10. AML/CFT Act – the Polish Act of 1 March 2018 on counteracting money laundering and terrorist financing (Ustawa z dnia 1 marca 2018 r. o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu).

11. Rules for Conducting AML/CFT Verification – these Rules for Conducting AML/CFT Verification by Speedy AG spółka z ograniczoną odpowiedzialnością.

§ 2 [Subject Matter and Purpose]

1. The subject matter of these Rules for Conducting AML/CFT Verification, made available by Speedy AG, is to define the rules and conditions for carrying out the AML/CFT Process in relation to the Potential Customer and the Customer, directly by Speedy AG or by the Partner on behalf of Speedy AG, as well as determining the moment of establishing and terminating business relationships between Speedy AG and the Customer.

2. The necessity to carry out the AML/CFT Process results from the provisions of law applicable to Speedy AG. Thanks to the AML/CFT Process, the Customer does not have to undergo identity verification before each order to execute a Transaction on the Website, subject to § 4 section 2 of the Rules for Conducting AML/CFT Verification.

§ 3 [AML/CFT Process in Relation to the Potential Customer]

1. Speedy AG carries out the AML/CFT Process in relation to the Potential Customer in accordance with the applicable regulations on counteracting money laundering and terrorism financing, and in particular in accordance with the AML/CFT Act.

2. The Potential Customer acting on their own behalf will be able to order Transactions on the Website only after having previously accepted these Rules for Conducting AML/CFT Verification and having successfully completed the AML/CFT Process.

3. In order to carry out the AML/CFT Process, the Potential Customer is obliged to provide Speedy AG or the Partner acting on Speedy AG’s behalf via the Website or via the Partner’s external KYC tool (software), to which the Website will redirect them:

a) a copy of their valid identity document (ID card, passport, residence card),

b) their image in the form of a photo or recording,

c) data referred to in § 5 section 2 of the Rules for Conducting AML/CFT Verification,

d) other documents, data or information (including answers to questions) that are necessary to carry out the AML/CFT Process – in accordance with the instructions provided on the Website or in the Partner’s external KYC tool (software).

4. Speedy AG or the Partner may also contact the Potential Customer in order to carry out the AML/CFT Process using the email address provided by them.

5. The Potential Customer undertakes to provide only true, current, complete and accurate documents, data and information during the AML/CFT Process and to notify as soon as possible of any changes in this regard by contacting Speedy AG via email at customer-support@speedy.pl.

6. The Potential Customer is also obliged to ensure appropriate lighting and legibility of data when taking photos or recordings.

7. The verification of the Potential Customer’s identity is carried out automatically using software that includes biometric techniques or additionally manually.

8. Partners may define additional or more detailed verification rules in their external KYC tool (software), the acceptance of which by the Potential Customer is necessary to carry out the AML/CFT Process.

9. When conducting the AML/CFT Process, Speedy AG creates a profile of the Potential Customer in its database, in which the data of the Potential Customer are particularly protected and are not subject to independent editing by the Potential Customer.

10. Information about the result of the AML/CFT Process is made available on the Website or in the Partner’s external KYC tool (software).

11. A positive result of the AML/CFT Process means that Speedy AG has established business relationships with the Potential Customer (who from that moment on becomes a Speedy AG Customer), consisting in enabling them to permanently order the execution of Transactions on the Website by activating their profile in the Speedy AG database.

12. If the Potential Customer does not complete the AML/CFT Process positively, e.g. as a result of providing false data or failure to provide the required documents, data or information (which means that it is not possible to apply all financial security measures to the Potential Customer) or if the Potential Customer is identified on sanctions lists, Speedy AG shall not enter into business relationships with them, pursuant to Article 41 paragraph 1 item 1 of the AML/CFT Act.

§ 4 [AML/CFT Process in Relation to the Customer]

1. Speedy AG carries out the AML/CFT Process in relation to the Customer in accordance with the applicable regulations on counteracting money laundering and terrorism financing, and in particular in accordance with the AML/CFT Act, including the GDPR and the AML/CFT Act..." → "...including the GDPR/RODO and the AML/CFT Act

2. Speedy AG shall be entitled, at any time it chooses, and in particular at cycles established by it, to carry out renewed or supplemental AML/CFT Processes in relation to the Customer. A supplemental AML/CFT Process may consist, for example, of asking the Customer to provide a new, valid identity document when their existing identity document has expired.

As part of the ongoing AML/CFT Process, Speedy AG continuously monitors Transactions carried out within the business relationship to ensure that they are consistent with Speedy AG's knowledge of the Customer and their risk profile, pursuant to Article 34(1)(4) of the AML/CFT Act. Customers are hereby informed that their individual Transactions are subject to continuous automated and manual monitoring, which may result in the suspension of a Transaction

In cases justified by circumstances, in particular where a Customer is classified as high-risk or identified as a PEP, Speedy AG may apply enhanced due diligence measures, including examining the origin of assets available to the Customer, pursuant to Article 34(4)(b) of the AML/CFT Act

3. During the carrying out of a renewed or supplemental AML/CFT Process in relation to the Customer, the Customer may not be able to order Transactions on the Website.

4. The provisions of § 3 sections 3–9 of the Rules for Conducting AML/CFT Verification shall apply to the Customer in the same way as to the Potential Customer in the case of a repeated or supplemental AML/CFT Process.

5. If the Customer does not complete the AML/CFT Process positively or if the Customer is identified on sanctions lists, Speedy AG shall terminate the business relationships with them, pursuant to Article 41 paragraph 1 item 4 of the AML/CFT Act.

6. In the event of disclosure of transactions that are: (1) complex; (2) large and not justified by the transaction circumstances; (3) conducted in an unusual pattern; or (4) do not appear to have a lawful or economic purpose — Speedy AG shall take steps to clarify the circumstances in which these transactions were carried out and, in the case of transactions conducted as part of business relationships, shall enhance the application of the customer due diligence measure referred to in Article 34(1)(4) of the AML/CFT Act, pursuant to Article 43(4) of the AML/CFT Act.

§ 5 [Protection of Personal Data]

1. Speedy AG is the controller of the personal data of Potential Customers and Customers. Speedy AG processes personal data in accordance with data protection regulations, including the GDPR and the AML/CFT Act as an obligated institution.

2. Provision of personal data by the Potential Customer and the Customer to the extent necessary to carry out the AML/CFT Process, including:

a) name and surname;

b) nationality;

c) identification number (PESEL) or date of birth – if no identification number has been assigned, and country of birth;

d) the series and number of the person’s identity document;

e) residential address – if Speedy AG has this information;

f) email address;

g) other data contained in the identity document (ID card, passport, residence card);

h) image (biometric data);

i) information about professional situation;

j) information on planned Transactions;

k) other data that proves necessary for the AML/CFT Process –

l) source of funds and source of wealth – in the case of high-risk Customers or Customers identified as PEPs, pursuant to Article 46(3)(2) of the AML/CFT Act

m) information on planned Transactions, including the objective and intended nature of the business relationship, pursuant to Article 34(1)(3) of the AML/CFT Act

is voluntary but is a necessary condition for completing the AML/CFT Process.

3. Speedy AG has appointed a Data Protection Officer who can be contacted at the following email address: gdpr@speedy.plin matters relating to the processing of personal data by Speedy AG.

4. Speedy AG processes the personal data of Potential Customers and Customers for the purpose of:

a) fulfilment of legal obligations in connection with the need to apply appropriate financial security measures and fulfilment of other obligations specified in the AML/CFT Act (pursuant to Art. 6 section 1 letter c of the GDPR and Art. 9 section 2 letter a of the GDPR – in the scope of biometric data);

b) establishing, pursuing or defending against claims – based on Speedy AG’s legitimate interest in exercising the above rights (Article 6 section 1 letter f of the GDPR).

5. Personal data of Potential Customers and Customers may be transferred to the Partner and authorised state bodies on the basis of generally applicable legal provisions.

6. Personal data of Potential Customers and Customers may be subject to profiling within the meaning of the GDPR in order for Speedy AG to apply the obligations imposed on it by the AML/CFT Act. In such a case, automated processing applies to the Customer and the Transaction ordered by them on the Website. The consequence of profiling may be the refusal or suspension of the execution of the Transaction, blocking the possibility of ordering the execution of Transactions in the future and submitting appropriate notifications to state authorities provided for in the AML/CFT Act.

7. Every person whose personal data is processed by Speedy AG has the right to access their data, the right to rectify, correct, request the restriction of processing, transfer, delete, object to their further processing by Speedy AG, and in the case of consent to the processing of data, to withdraw it at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal, by writing to the email address: dpo@speedy.pl. However, the exercise of the above rights cannot affect the rights and obligations of Speedy AG specified in section 4 letter b of this paragraph.

8. Personal data are processed to the extent necessary for the purposes of preventing money laundering and terrorism financing for the period resulting from applicable legal provisions and to the extent necessary to establish, pursue or defend against claims for the limitation period for claims arising from these Rules for Conducting AML/CFT Verification and for the duration of the ongoing proceedings.

9. Every person whose personal data is processed by Speedy AG has the right to lodge a complaint regarding the processing of their data by Speedy AG to the supervisory authority responsible for the protection of personal data – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO).

10. Other information on the protection of personal data, as well as on the principles of using cookies, is included in the Speedy AG Privacy Policy available on our website.

§ 6 [Term of the Rules for Conducting AML/CFT Verification]

1. The business relationships established between Speedy AG and the Customer based on these Rules for Conducting AML/CFT Verification shall be binding on Speedy AG and the Customer for an indefinite period of time.

2. The Customer is entitled to terminate the Rules for Conducting AML/CFT Verification at any time with immediate effect by:

a) sending a notice of termination from the email address used by them during the AML/CFT Process to the following address: customer-support@speedy.pl;

b) sending a notice of termination in writing (on paper) to the following address: Speedy AG sp. z o.o., Plac Europejski 2, 00-844 Warsaw, Poland;

– which results in the termination of Speedy AG’s business relationships with the Customer at the Customer’s initiative.

3. Speedy AG is entitled to terminate the Rules for Conducting AML/CFT Verification at any time with immediate effect:

a) when Speedy AG cannot apply one of the financial security measures or when the Customer is listed on sanctions lists;

b) in the case of providing false or inaccurate data by the Customer, in the absence of updating these data, as well as in the case of using false, forged, counterfeit documents or documents attesting something that is untrue;

c) in the event of the Customer taking actions or activities contrary to generally applicable law, including in particular suspicion of fraud or intent to commit fraud when ordering a payment transaction;

d) in the event that Speedy AG acquires information from state authorities about the commission or suspicion of a crime by the Customer using the Website;

e) if the obligation to terminate the Rules for Conducting AML/CFT Verification by Speedy AG results from legal provisions or regulations of payment organisations – which results in the termination of Speedy AG’s business relationships with the Customer at Speedy AG’s initiative.

4. Speedy AG may serve a notice of termination by:

a) sending a notice of termination in electronic form to the email address provided by the Customer on the Website;

b) sending a notice of termination in writing (on paper) to the residential address provided by the Customer on the Website.

§ 7 [Amendments to the Rules for Conducting AML/CFT Verification]

1. Speedy AG has the right to amend the Rules for Conducting AML/CFT Verification only for the following important reasons:

a) in the event of a change in the legal status resulting in the need to introduce amendments to the Rules for Conducting AML/CFT Verification;

b) in the event of a ruling by a common or administrative court or a decision, recommendation, position or other binding act for Speedy AG by a public administration body, resulting in the need to introduce amendments to the Rules for Conducting AML/CFT Verification;

c) in order for Speedy AG to improve and implement the AML/CFT Process or the security and protection of personal data.

2. Speedy AG also has the right to correct stylistic errors, numbering inconsistencies, or eliminate ambiguities, inconsistencies and logical flaws in the Rules for Conducting AML/CFT Verification.

3. The Customer’s lack of consent to the amendment of the Rules for Conducting AML/CFT Verification means the termination of Speedy AG’s business relationships with the Customer.

§ 8 [Final Provisions]

1. Failure to establish business relationships by Speedy AG with the Potential Customer, as well as the termination of business relationships with the Customer on the basis of these Rules for Conducting AML/CFT Verification, means that Speedy AG may not provide such Potential or former Customer with payment services, including the execution of payment transactions ordered by them.

2. The AML/CFT Process is free of charge for the Customer and the Potential Customer.

3. The rules and conditions for ordering the execution of Transactions on the Website and other issues related to the execution of Transactions are specified in the Payment Services Terms & Conditions available on the Website.

4. These Rules for Conducting AML/CFT Verification are subject to Polish law. In matters not regulated in the Rules for Conducting AML/CFT Verification, the generally applicable provisions of Polish law shall apply, in particular the AML/CFT Act.

5. If any provisions of the Rules for Conducting AML/CFT Verification are for any reason invalid or ineffective in whole or in part, the remaining terms and provisions of the Rules for Conducting AML/CFT Verification shall remain in force.

6. Subject to mandatory regulations, the competent court for disputes arising in connection with the Rules for Conducting AML/CFT Verification shall be:

a) in cases with Customers who are not consumers, the court with local jurisdiction for the registered office of Speedy AG;

b) in cases with Customers who are consumers, the court with local jurisdiction for the consumer’s place of residence, and in the event that the action is brought against Speedy AG, also the court with local jurisdiction for the registered office of Speedy AG.

Speedy AG spółka z ograniczoną odpowiedzialnością — Plac Europejski 2, 00-844 Warszawa, Poland | KNF no. IP60/2024 | KRS: 0000907361 | NIP: 7831838519§