This Privacy Policy explains what personal and account information we collect, why we collect it, how we use, share, store, and protect it, and the choices and rights available to you, in accordance with the Bangladesh Bank regulations and guidelines, and other applicable laws relating to data protection and financial services in Bangladesh.

By registering for, or using, the Mukto Pay app, website, or any related service, you agree to the collection and use of information as described in this Privacy Policy. Please read this Policy carefully together with our Terms and Conditions. If you do not agree with any part of this Policy, please do not use our Services.

1. Identity of the Data Controller

Mukto Pay is the data controller (data fiduciary) responsible for determining how and why your personal data is collected, used, stored, shared, and otherwise processed in connection with the Services, in accordance with applicable data protection and financial regulations.

2. Information We Collect

We collect information that you provide to us directly, information generated through your use of the Services, and information obtained from other legitimate sources. The categories of information we may collect include:

Identity Information: Name, date of birth, gender, photograph, parents’/guardian’s names, nationality, occupation, nominee details, and government-issued identification numbers such as NID and other permissible IDs.

• Contact Information: Present address, permanent address, mobile number, and email address.

• Financial and Transaction Information: Account and wallet numbers, balance information, transaction history, payment and settlement records, source of funds/income, and linked bank or card details.

• Biometric Data: Facial recognition or fingerprint data used for identity verification (eKYC), where applicable and permitted by law.

• Usage Data: App access logs, in-app behaviour, feature usage, and customer support interactions.

• Device and Technical Data: Device type, operating system, IMEI number, IP address, browser type, and location data (where you have granted permission).

• Cookies and Similar Technologies: Information collected through cookies and web beacons on our website and app to recognise your device and understand usage patterns.

We only collect information that is reasonably necessary to open your Mukto Pay account and to provide you with the Services you request, and we rely on you to ensure that the information you provide is true, accurate, current, and complete.

3. How We Collect Information

• Directly from you, when you register for a Mukto Pay account, complete KYC/eKYC verification, or use the app or website.

• Automatically, through your use of the Services, including via cookies, log files, and similar technologies.

• From third parties such as partner banks, payment networks, merchants, and regulatory or public bodies, where permitted by law.

4. Purpose of Processing

We collect and process your personal data for specific, explicit, and legitimate purposes, including but not limited to:

• Register, verify, and manage your Mukto Pay account;

• Process transactions, payments, transfers, and other services you request;

• Verify your identity and comply with KYC/AML and other regulatory requirements;

• Detect and prevent fraud, unauthorised access, and financial crime, and to investigate such incidents;

• Provide customer support and respond to your queries and complaints;

• Send you important service updates and notifications about your account;

• Conduct statistical analysis and research to improve our Services and user experience;

• Comply with applicable laws, regulations, and requests from competent authorities; and

• With your consent, send you promotional offers and information about products and services that may interest you.

5. Lawful Basis for Processing

In addition to your consent, we may rely on one or more of the following lawful grounds to process your personal data:

• Contractual Necessity: To provide the services you request, such as transfers, payments, and account management.

• Pre-Contractual Steps: To process applications, eligibility checks, and identity verification before a contract is formed.

• Legal Obligation: To comply with applicable laws and regulatory requirements.

• Legal Claims or Defence: To establish, exercise, or defend legal rights.

• Vital Interests: To protect your life, health, or the safety of others.

• Prevention of Harm: To prevent harm where your consent cannot reasonably be obtained.

• Further Compatible Processing: For purposes compatible with the original reason for collection, as allowed by law.

6. Registration and KYC

To open a Mukto Pay account, you must provide certain mandatory information, including your name, date of birth, NID, Fathers, Mothers Information, Nominee information, and mobile number. We never ask for more information than is reasonably necessary to provide the Services. Once registration is complete, your registered mobile number and PIN will be used by you to access your account. You are responsible for keeping your login credentials, PIN, and one-time passwords confidential and must not share them with anyone.

7. Information Collected by Merchants and Service Providers

Mukto Pay works with independent merchants, distributors, agents, and service providers to deliver certain products and services. Access to your personal information by these parties is limited to what is reasonably necessary for them to perform their services, and they are contractually required to protect your data consistently with this Privacy Policy and applicable laws. We will not sell, lease, or otherwise hand over your personal information to merchants except:

• Where required by law, including AML/CFT and similar legal obligations;

• Where we believe in good faith that disclosure is necessary to protect our rights or your safety, investigate fraud, or respond to a lawful government request;

• In connection with a merger, acquisition, or sale of assets, subject to prior notice where required; or

• With your prior consent.

8. Third-Party Advertising

Third-party advertising partners may use cookies or similar technologies on our website or app to deliver and measure advertisements. Mukto Pay does not share personally identifiable information with these partners without your consent. Their use of your information is governed by their own privacy policies, which we encourage you to review; this Privacy Policy does not extend to their practices.

9. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients, only as necessary for the purposes described above and in accordance with applicable law:

• Partner Banks, Financial Institutions and Payment Networks: To process transfers, bill payments, remittances, and card transactions.

• Authorised Service Providers: Engaged under confidentiality and data-protection obligations to provide services on our behalf.

• Government and Regulatory Authorities: To comply with applicable laws, regulatory reporting, and audits.

• Courts or Tribunals: To respond to legal proceedings or to defend legal claims.

• Dispute-Resolution Partners: To investigate and resolve disputed transactions, chargebacks, or fraud claims.

• Corporate Group and Successors: Our subsidiaries, affiliates, or any company that acquires our business or assets, subject to this Policy or its equivalent.

Any data we share is limited to what is necessary for the stated purpose, and recipients are required to apply appropriate technical, administrative, and organisational safeguards.

10. Consequences of Not Providing Personal Information

Certain personal information is mandatory to open and operate a Mukto Pay account. If you choose not to provide this information, we may be unable to register your account or provide some or all of the Services you have requested.

11. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable laws and regulatory guidelines, including Bangladesh Bank record-keeping obligations that continue even after your account is closed. Once no lawful basis or retention obligation remains, your data will be securely deleted or anonymised. We do not store your online banking PIN or password, and we do not store your card information beyond what is required to process a transaction.

12. Data Security

We apply appropriate technical and organisational measures designed to keep your personal data secure, accurate, and confidential, and to protect it from loss, misuse, unauthorised access, disclosure, or alteration, including:

• Encryption: Sensitive data, including data in transit, is protected using industry-standard encryption such as SSL/TLS.

• Pseudonymisation: Used where appropriate to reduce re-identification risk.

• Access Controls: Access to personal data is restricted through role-based permissions and secure authentication.

• Ongoing Monitoring: We regularly review and update our security controls to address emerging risks.

• Security Audits: We conduct periodic reviews to identify and remediate security gaps.

• Incident Management: We maintain procedures to respond promptly to any security incident.

• Processor Accountability: Third-party service providers must meet equivalent security standards.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We are not responsible for circumvention of privacy or security measures by third parties, and you can reduce risk by using a strong, unique password/PIN and never sharing your login details or one-time passwords with anyone, including anyone claiming to represent Mukto Pay.

13. Server Logs and Cookies

Each time you visit our website or use our app, our servers may automatically collect certain technical information, such as your IP address, login times, operating system, and browser type, together with information collected through cookies. This information is used in aggregate to understand how our Services are used and to improve them; it is not used to identify you personally unless combined with other account information.

14. Cross-Border Transfer of Personal Data

The Mukto Pay app and website are operated from Bangladesh, and your use of the Services is governed by the laws of Bangladesh. Where your personal data is transferred within or outside Bangladesh- for example, to a cloud service provider or a partner in another jurisdiction, we will only do so where the recipient provides appropriate technical, administrative, and security safeguards and the transfer is permitted under applicable law.

15. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Right to Access: Request access to your personal data and receive a copy in a clear, understandable format.

• Right to Rectification: Ask us to correct inaccurate or incomplete data.

• Right to Update: Request that your data be kept accurate and current.

• Right to Erasure: Request deletion of your data, subject to our legal and regulatory retention obligations.

You can view or update most of your account information by logging into the Mukto Pay app, or by contacting our support team using the details below.

16. Consent

By registering for, or using, the Mukto Pay app or website, you consent to the collection, use, storage, and disclosure of your personal information as described in this Privacy Policy. We may update this Policy from time to time; where required by law, we will seek your fresh consent to any material change.

17. Enforcement and Investigation

We may use the information we collect in connection with your use of the Services, including your personal information, to investigate, enforce, and apply our Terms and Conditions and this Privacy Policy, including in relation to suspected fraud, misuse, or unlawful activity. We can also share your data based on the request from appropriate law enforcement agency.

18. Complaints and Dispute Resolution

If you believe that Mukto Pay has not complied with this Privacy Policy, please contact us using the details in Section 20 below, describing your concern in as much detail as possible. We will investigate and respond to your complaint promptly. You also have the right to lodge a complaint with the relevant regulatory or data protection authority if you believe your rights have not been upheld.

19. Changes to This Policy

We may revise this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The updated Policy will be posted on our website and app with a revised “Last Updated” date. We encourage you to review this Policy periodically. Your continued use of the Services after any changes take effect constitutes your acceptance of the revised Policy.

20. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us at:

• Email: support@muktopay.com

• Phone / Call Centre: 16525

• Address: NEO PSP LIMITED, Plot-4, SW(H), Bir Uttam Mir Shawkat Sharak, Gulshan-1, Dhaka-1212, Bangladesh

YOUR USE OF THE MUKTO PAY APP, WEBSITE, OR SERVICES CONFIRMS YOUR AGREEMENT TO THIS PRIVACY POLICY.