OKTO

INFORMATION SHEET AND SUMMARY

Prepared pursuant to the Order of Bank of Italy dated 29 July 2009, as amended (Transparency of Banking and Financial Transactions and Services Fairness of Relations between Intermediaries and Customers)

 Rev. October 2024

Service characteristics and possible risks

Electronic money is a monetary value, represented by a credit against the electronic money institution (EMI) Sureswipe PLC stored on a computerised software application (“Pagaty Wallet”) created and managed by the electronic money distributor (EMD) Oktopay limited on behalf of the service distributor Macao S.r.L. and an electronic device (consisting of a payment card reproduced on both plastic and virtual media), issued by the issuer Paynovate SA. In the name of the Customer through the Pagaty Wallet application upon receipt of funds equal to the chosen subscription plan.

Therefore, the funds made available by Sureswipe EMI PLC through Oktopay LTD in the Pagaty Wallet service for the issuance of e-money do not constitute Customer bank deposits, with the result that, the service distributor, e-money distributor and e-money institution do not pay interest on the funds made available for the issuance of e-money in the name of the Customer and are not covered by the Interbank Deposit Protection Fund. Instead, your money is safeguarded in accordance with the Electronic Money Regulations. Safeguarding means that, by law, all your money is kept in accounts that are completely separate from the Electronic Money Institution’s company operational funds. These funds are called ‘safeguarded funds’.

Each Customer may use electronic money issued in his or her name to make and/or receive payments from other clients as well as to instruct Oktopay Limited (EMD) to make payments on his or her behalf. The Customer may, also, obtain a refund of the unused portion of e-money. The use of e-money by each Customer is done through the use of the plastic medium and the special software application Pagaty Wallet (hereinafter simply “the Application” or “Pagaty Wallet”), owned by Oktopay Limited (hereinafter “the EMD” or “Oktopay”), which is accessed through special security codes that the Customer chooses during the product subscription.

Upon release, the Customer must provide an email address (or credentials) to access the application Pagaty Wallet. The Pagaty Wallet Application can be downloaded from major stores (e.g. Google Play, Apple Store).

With respect to the main risks to be taken into account, the utmost care must be observed in the proper use and safekeeping of security codes to prevent fraudulent use by third parties that allow the use of the electronic money issued in the Customer’s name.

Regarding the possible loss, theft or misappropriation for fraudulent use of the card, if any, or credentials for accessing the application, care should be taken to promptly notify customer service via email to support@oktopayments.com to enable the timely blocking of the Card and/or availability of funds in the account and the subsequent handling of the claim.

The service may be suspended or interrupted due to force majeure or technical reasons and, in any case, for causes beyond Oktopay’s control, such as, but not limited to, power outages.

Who can use the service

The application and associated card, if any, can be used by individuals who are eighteen years of age or older, possess regular valid identity documents, and have their domicile and residence in Italy.

Economic conditions

Usage Limits and User Levels

The Pagaty Wallet application provides 3 User levels. Each of the levels has different usage limits in relation to the data that is provided by the customer through the application.

We summarise through a diagram the various user levels available and the documentation required to access them, subject to review and approval by the department responsible for adequate verification for AML purposes under Art. 18 of Leg. Decree 231/2007.

*Where available

Exchange Rate

For transactions in currencies other than the euro, an exchange rate established by Visa will be used, applied every day of the year and with rates set on each Business Day. Exchange rate changes are based on daily updates. Exchange rates may vary between the time the Customer authorizes a transaction and the time Visa processes the transaction.

Complaints and Withdrawal

The Account holder may withdraw from the service without notice and without penalty, at any time, by registered mail with return receipt to be sent to the Italian headquarters of Oktopay at the address: in Via dell’Arte 25, 00144 Roma (RM), or by sending a PEC to the PEC address: oktopaylimited@cerpos.it- making sure that the Card, if expected, if  has been destroyed by cutting off its magnetic stripe and chip and the Pagaty Wallet application is removed from the Account holder’s mobile device. The communication should contain the following data:

• Accountholder’s personal information
• Card ID (Code available on the front of the card), if expected
• Reason for withdrawal (optional)
• IBAN account identifier for crediting any available balance
• Copy of a valid identification document

Following the receipt by Oktopay of the registered letter or PEC notifying the exercise of the right of withdrawal, the Okto Wallet Card, if any, and application will be blocked and extinguished, and any subsequent use of them will be illegitimate. The refund of any available balance will be made by transfer to the IBAN indicated by the Customer and made out to him/her.

Oktopay may terminate the Contract if any of the conditions specified in the Terms and Conditions in Art.25 apply.

In the event that the Customer has applied for the Card, if any, he/she may exercise his/her right of reconsideration within 14 days of the conclusion of the Contract. The exercise of the right of reconsideration does not involve any costs to the Customer, i.e. by giving notice to the PEC address: oktopaylimited@cerpos.it

For any disputes, the Customer may file a complaint in one of the following ways or by sending a certified email (PEC) to: oktopaylimited@cerpos.it, by sending an email to the address: support@oktopayments.com, by sending a letter by regular mail to the following address: Oktopay, in Via dell’Arte 25, 00144 Roma (RM).

The complaint will be acknowledged within 15 working days of its receipt except for any delays due to force majeure or not directly attributable to the EMD.

The maximum time to close the dispute is 35 (thirty-five) working days from the date of receipt of the registered mail or PEC.

Processing of personal data

The Data Controller is Sureswipe E.M.I. PLC. (Hereinafter: “The Company” or “Sureswipe”).

Sureswipe is committed to protecting the privacy and confidentiality of personal data of Data Subjects that it processes as Data Controller.

This Policy sets out the procedures and measures taken by Sureswipe and Oktopay to protect the personal data and privacy of the Data Subject. In line with this, we aim to collect and process only the data strictly necessary in the context of our relationship with (potential) customers, (future) partners, users/visitors of our website(s) and online resources, in order to provide services and/or information for specific and legitimate purposes.

The Policy can be found on the website, https://www.oktowallet.eu/okto-privacy-policy/ in its most recent version. Please examine it carefully. It contains information about how we collect, use, communicate, and protect customers’ personal data.

Sureswipe collects personal data that Data Subjects voluntarily provide in order to enter into and perform the Contract as well as additional personal data collected as part of the Data Subject’s use of the Services.

Personal data of Data Subjects is processed, taking into account the principle of data minimization, for the following purposes:

a. The conclusion and execution of the Contract concerning the Services.
b. Meeting legal obligations such as, for example, anti-money laundering and anti-terrorism verification activities. To that effect, the Company (as an electronic money institution), the Distributor and its contracted Points of Sale – pursuant to Articles 17 (Obligations of due diligence) and 44 (Compliance by contracting parties and agents) – are required to acquire, in the context of offering the Services, documents proving the identity of the Data Subject and additional data including, but not limited to, profession and income bracket.
c. Marketing activities (however, Sureswipe will only process such data when specifically requested and/or based on appropriate and explicit consent from the Data Subject).
d. Fraud prevention, combating money laundering and/or terrorist financing as well as the misuse of the Services.

The legal bases for the Processing of your personal data are as follows:

• Performance of a contract to which the Data Subject is a party for the activities referred to in (a) above.
• Legal obligations that Sureswipe is required to meet for the activities under (b).
• Your consent for the activities referred to in (c) above.
• The pursuit of a legitimate interest of Sureswipe and/or third parties that the Company uses for the activities referred to in (d) above.

It is understood that for all purposes for which the consent of the Data Subject is required, the Data Subject may withdraw such consent at any time by contacting our Data Protection Officer at dpo@oktopay.eu.

Categories of personal data Processed:

The Company collects personal data provided by the Data Subjects for the purpose of using the Services and, therefore, both for the conclusion and execution of the Contract as well as, for example, when the Data Subject requests activation of the Services; accesses the websites from which the Services can be used and, more generally, whenever the Data Subject provides personal data. The Customer must ensure that the personal data provided is accurate and complete.

By way of example only, such personal data processed by the Company generally belongs to the following categories:

• Identification and contact data (e.g., first name, last name, place and date of birth, email address, social security number, telephone number, username and password used to access the systems that the Controller makes available to you).
• Transaction data (e.g., the amount and dates of transactions, identification details of other banking relationships, including beneficiary identification data, IBAN of the bank account, etc.).
• Financial data (e.g., payment history).
• Connection data (e.g. the IP address of the device used); as well as:
• Data on criminal convictions and reportable offenses within the scope of the Company’s activities for anti-money laundering and anti-terrorism audits required by Law for the purposes of offering the Services.

In furtherance of the above purposes, data may be disclosed to designated entities such as Processors, to whom appropriate operational instructions are given. Such recipients belong to the following categories:

• Third parties for managing telecommunications networks and information systems.
• Third parties for hosting, clouding, housing and placement services.
• Third parties for digital signature, document management, control and verification of identification data, electronic invoicing, certified electronic mail, electronic storage.
• Third parties for printing and mailing communications.
• Third parties for data acquisition, processing and processing.
• Third parties for auditing and tax consulting.
• Supervisory Bodies.
• Public Authorities.

Data may also be processed, in connection with the performance of assigned duties, by the staff of the Company, including interns and temporary workers, all of whom are specially authorised for processing. The data, in any case, will not be disseminated and, therefore, will not be brought to the attention of unspecified parties.

The updated list of third parties to whom data is disclosed is available by submitting a request to dpo@oktopay.eu.

The processing carried out by the Company for the stated purpose is done by extracting from our software used by the computer system i.e. the Pagaty Wallet application, customer identification and contact information. Processing is necessary for the performance of the relationship to which the Data Subject is a party for the performance of the service itself. Prior to the start of the activity, the list is subject to verification and remediation through consultation of processing authorizations and opposition requests included in the public Register of Oppositions. Therefore, processing is carried out only for customers who have given express authorization and who are not listed in the said public Registry. You may request from EMD or the Company to access to your data, their rectification or deletion, the integration of incomplete data, the restriction of processing; to receive your data in a structured, commonly used and machine-readable format, as well as, if technically feasible, to transmit them to another data controller without hindrance in case the conditions for the exercise of the right to portability under Art. 20 of the GDPR (processing is based on consent pursuant to Art. 6.1(a) or Art. 9.2(a) or contract pursuant to Art. 6.1(b) of the GDPR and is carried out by automated means). You also have the right to object at any time, for legitimate reasons, to the processing of your data, even if relevant to the purpose of collection. In such cases, the Company is obliged to refrain from any further processing, except in cases permitted by the Regulation.

Requests can be submitted to dpo@oktopay.eu indicating in the subject line “Privacy – Exercise of Privacy Rights”.

In addition, the Data Subject has the right to file a complaint with the Privacy Authority, as provided for in Art. 77 of the Regulations, as well as to take appropriate legal action pursuant to Articles 78 and 79 of the Regulation.

The data will be retained by the Company for the following periods for a term not exceeding 8 years as of the day of the end of business relationship with the client.

After this period has elapsed, the Data Controller will securely delete the Data, or irreversibly transform them into anonymous form.

Services offered by the Pagaty Wallet application

• Making payments for services and/or goods, on Internet sites and at merchants, associated with the payment circuits indicated in the Application and on both physical and virtual debit cards, if any, that may be associated.
• Making payments for goods and services made available at the Pagaty Wallet service distributor’s network of merchants.
• Loading the Pagaty Wallet application via payment cards.
• Loading the Pagaty Wallet application by Open Banking transfer using the associated personal Bank Account.
• Loading the Pagaty Wallet application with cash at the merchant network of the distributor of the Pagaty Wallet service.
• Making cash withdrawals with the physical debit card at A.T.M.s, in any, bearing the payment circuit marks indicated within the Application and on the card itself.
• Withdrawing cash at the Pagaty Wallet service distributor’s network of merchants.

USE OF THE CARD*

The Card, if expected, is personal and as such should be used only by the Customer who has applied for it. It is not allowed to assign it or give it to any other party. Oktopay Limited cannot be held involved or is exempt from any responsibility regarding the use and custody of the Card. By using the Card together with related control tools (PIN, signature, secure 3ds, identity check, etc.), the Customer authorises the Card to be charged even without the physical presence of the customer and the Card itself. In the case of a payment transaction arranged on initiative of the beneficiary, the consent of the beneficiary is also required for the revocation of the order. Therefore, after the revocation, all executed payment transactions are considered unauthorised. The Customer’s signature in payment orders, if required, must conform to that affixed by the Customer in the space provided on the Card.

Contact

For assistance and information, the Customer can contact Pagaty’s Customer Service via WhatsApp message at +39 392 7369872 from Italy or write to info@macaosrl.it.

For card blocking, if expected, in case of theft or loss, the Customer can block the Card through the appropriate section of the Pagaty Wallet Application “Cards and Account à Physical Card à Settings à Disable Card”. Next proceed, in the same section, to report Theft or Loss or select “Cards and Account à Physical Card à Settings à Theft/Loss Reporting”. Through the Application it is possible to block only the Card, and not the operation of the relevant account.

Any communication that needs to be addressed by the Customer to the Customer Service can be made through the contacts in this Information Sheet. An active phone with network coverage will be sufficient for communication.