The purpose of this privacy notice is to explain to you how Arab Banking Corporation (Jordan) (“Bank ABC in Jordan”) acting through the digital mobile only bank “ila” that is powered by Bank ABC in Jordan (“ila”, “we”, “us”, and “our”) may process your personal information.

Who is your data controller? Your data controller is ila with whom you have entered into a banking relationship and operate an account, including through the use of our digital platform. Ila is a digital mobile only bank that is powered by Bank ABC in Jordan. You can find ila’s contact details at the end of this privacy notice. For more information about ila please visit www.ilabank.com.

Definitions and interpretation.

In cases where a customer of “ila” is a personal customer, any reference to “customer” or “you” means that personal customer, and “you” also refers to any individual providing his personal information or, any person acting on behalf of the customer or Any individual submitting personal customer information on behalf of any individual to a company of ila in connection with the provision of products and services, you should ensure that each person concerned receives a copy of this privacy notice before sharing their personal information with ila.

What personal information do we collect about you?

The personal data we collect about you includes information that we collect when we setup, administer, and manage our relationship with you, such as the following.

• Email addresses, biometric data, video selfie images, telephone numbers, identity document, type of identity document submitted, proof of address documents, type of proof of address documents submitted, Identity document number, full name, nationality, date of birth, gender, residential address, country of birth, employment status, employment information, tax status, tax identification number, FATCA forms, details of source of income and source of wealth, information on monthly income, average account financial activity, and engagement data.

• Information that we gather from publicly available sources such as biographies held on the internet or other local trade registers.

• Information relating to customer transactions (such as type, dates, amounts, currencies, payer and payee details).

• Information we learn about you from the way you operate our products and services and use our websites; including the technology you use for this, language preferences, and mobile phone location data.

• Internet online identifiers. These may leave traces which, when combined with unique identifiers and other information received by servers, may be used to identify the user. Internet online identifiers may include internet protocol addresses (IP addresses) and cookie identifiers.

• Internet online identifiers and other technical personal data. These may leave traces which, when combined with unique identifiers and other information received by servers, may be used to identify you. Internet online identifiers may include internet protocol addresses (IP addresses) and cookie identifiers. Technical personal data may include mobile network information, unique device identified, traffic data including web logs.

• Information relating specifically to transactions carried out on our digital platform by users. Whilst our banking relationship is with our customer, we will be collecting information specific to transactions carried out by users. For example, we will be able to inform our customer of details (such as dates, amounts, currencies, payer and payee details) about transactions made on our digital platform and which user initiated the transactions. Some of this may be personal information about the user.

• Security codes, including all confidential codes, user names, user identifications and passwords, PIN/Password and information or a physical device (for example, an ATM card, a debit card, credit card, prepaid card, security token, or electronic key) that the user must use to confirm identity when accessing our digital platform.

Email addresses and telephone numbers used for work purposes and which must be active and accessible to receive digital alerts (meaning an alert by SMS or email which we send to alert users to certain types of transactions or to provide financial information).

You understand and agree and hereby authorize Bank ABC that we may record calls, email, text messages, social media messages and other communications between you and employees of ila.

You understand and agree and hereby authorize Bank ABC that closed-circuit television (“CCTV”) may be used in and around our premises and ATM locations for the purposes of security and preventing crime, therefore we may have images of you captured by our CCTV cameras.

How is the personal information collected?

We collect personal data from a number of sources, including the following.

• Information received and collected via the mobile application named “ila” (the “ila Bank App”).

• Information we receive directly by your engagement with our social media platforms.

• Information that we learn through your use of our services and products such as when you visit our websites or when you speak to us by way of the contact center.

•Information we obtain from third parties such as credit reference, debt recovery, fraud prevention or government agencies, which may have originated from publicly accessible sources.

• Information that we gather from publicly available sources such as the internet and/or other local trade registers.

• Information that we identify through our fraud prevention controls.

• Information provided by affiliates of ila.

• From servers in relation to your use of our digital platform.

• You authorize the Arab Banking Corporation (Jordan) to obtain an absolute and irrevocable authorization to see your identity with the civil status and collect all your personal data through the civil status system and the e-government services portal and exchange it with the Jordan Payment and Clearing Systems Company (JOPAC) and/or with any company Or an entity that may replace it, or any company licensed by government agencies in accordance with the provisions of the law to inquire about the identity of customers and their data,. Thus, you are fully aware, agree and authorize the Arab Banking Corporation (Jordan) to obtain this personal information, and in this regard you waive the obligation of the bank to abide by banking secrecy with regard to all information related to you that was shared with the above company, and you acknowledge that you are aware of the purpose of obtaining this personal information, and that you waive your right to object or to claim any damages from the Arab Banking Corporation (Jordan) of any kind or reason resulting from the bank’s inquiry and access to your personal data, and you absolutely acknowledge that your consent gives the bank the right to inquire and/or disclose and/or exchange your personal information time after time between you and ila employees. With your consent, this authorization is considered permanent and continuous, not restricted or suspended on a condition and is irrevocable for any reason, and the bank has the right to use it whenever it wants without the need to refer to you and without the need for you to sign another form.

How will we use your personal information, with whom will we share it, and what is the legal basis for this?

We will use your personal information for the following reasons as permitted by applicable laws. Processing that is necessary for our own legitimate interests (including those of ila’s affiliates) or those of third parties to do the following.

•To set up, maintain, and administer the contractual relationship that we have with the customer.

• To enable you to manage the customer account with us and to assist you to transact with us.

• To collect due and outstanding debt which may involve passing your personal information to debt collection agencies.

• To keep records of communications in order to evidence what has been discussed, keep a record of your instructions, and to prevent or detect crime.

• To record customer account activities where we have reason to believe that fraud or other crimes are being committed or where we suspect non-compliance with anti-money laundering regulations to which we are subject.

• To test the performance of our products, services, and internal processes to ensure that your personal information is only collected as needed and is held and processed securely.

• To develop statistics and for market research and analysis including to develop and improve our products and services so that we can offer new and enhanced products and services to the customer, which may include converting your personal information into statistical or aggregated data which cannot be used to identify you.

• To administer ila’s internal operational requirements (including credit, compliance, and risk management, market research, system and product development, staff training, quality control, accounting, and for audit purposes).

• To comply with our regulatory obligations under any applicable regulatory regimes.

• For some direct marketing communications from us and/or for ila to inform you of products or services which may of interest to you or your business.

• When sharing personal information with the following third parties.

- Any ila affiliate to allow you to access our products and services. This includes our IT support teams for digital platform services.

- Any introducing broker or other intermediary to whom we provide instructions or referrals.

- Our legal and professional advisers such as auditors and external legal counsel.

- With any party to a transaction acquiring risk in, or assuming risk in, or in connection with, the products and services of ila or Bank ABC Jordan.

- Any sub-contractors, agents, service providers or third parties (including our digital identity service provider) engaged by ila and/or Bank ABC (including their employees, directors, and officers), such as backup and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back office functions.

- Credit reference, debt recovery, or fraud prevention agencies.

- Tax authorities, including those based overseas.

- Persons acting on behalf of the customer, payment recipients, beneficiaries, account nominees, correspondent, and agent banks.

- Financial institutions and trade associations. or any other third party/parties as deemed required by Bank ABC to facilitate and manage banking operations, business services or any other purposes for which customer data is required to be shared."

Processing that is necessary to comply with the following legal obligations.

• To comply with laws that require us to verify the identity of our customers and to detect and prevent financial crime.

• To comply with tax regulations that require us to report the tax status of our customers.

• When enforcing or defending our rights, or those of any ila affiliate or a third party employed by us.

• To keep records of communications and customer account activities (as described above) including (but not limited to) transactions and other activity effected on our digital platform, such as date and time of logging in and for how long the user is logged in.

• When sharing personal information with the following third parties: - any governmental, banking, taxation, or other regulatory authorities or similar bodies with jurisdiction over any part of ila or Bank ABC, or under the rules of a relevant stock exchange, including those which are based overseas; and

• - the courts, and as may otherwise be necessary for the administration of justice, to protect vital interests and to protect the security and integrity of Bank ABC’s business operations or those of ila. Processing based on your consent.

• ila may share your personal information with other persons where you have provided your explicit consent to do that.

• For some direct marketing communications from us and/or Bank ABC, where you have provided your explicit consent to do that.

• ila respects the privacy and data protection rights of its customers and it is committed to protecting their personal data. We collect, process, and use your personal data in order to manage your account, to provide our products and services to you and to meet our legal and regulatory obligations in harmony with the applicable statutory provisions including, without limitation, (LAW NAME IN JORDAN AND NUMBER, IF APPLICABLE). ila may also obtain data, including personal data, information related to you from Jordan Civil Status and Passport Department and eGovernment Authority and/or its affiliates. All the personal data collected, processed, and used under our responsibility are stored exclusively for the purpose of fulfilling our contractual relationship with you, and not longer than is required for this purpose. We may also share your information with our trusted third parties for the purposes mentioned above. Certain features such as “Branch Finder” and “ATM Finder” which may process your geolocation data and share this data with service providers such as Google Maps.

• Is providing your personal information obligatory?

We are unable to enter into or administer the relationship with the customer without some personal information about you (listed in article number 4/ page 1). In cases where providing your personal information is optional, we will make this clear, for instance by explaining in application forms if certain data fields can be left blank. If we are seeking a consent to justify our processing of your personal information, we will make this clear. Updates to your personal information.

If any of the personal information you have given to us should change, such as your contact details, you are required to inform us immediately by contacting us on 0096265100001 or for changing the mobile number you can directly change it through the application Similarly, if we have collected personal information about you that you consider to be inaccurate, please inform us. Our contact details are below.

The people and organizations that we may share your personal information with may be located in a country that does not have data protection laws which provide the same level of protection as the country in which the products and services are supplied. Affiliates of ila are located in other countries. In this way your personal information may be transferred outside of Jordan. Some countries already have adequate protection for personal information under their applicable laws. In other countries safeguards may be applied to maintain the same level of protection as the country in which the products and services are supplied. These safeguards may be contractual agreements with the overseas recipient, or requirements for recipients to subscribe to international data protection frameworks.

How long do we keep your personal information and what is the criteria used to determine this?

We need to keep your personal information for as long as necessary to fulfil the purposes for which it was collected (as described above). Even when you close the customer account with us, we must retain some of your personal information in order to comply with legal and regulatory requirements and in case of claims. We will also keep some of this information in case of queries from you. If our customer has chosen to cease its access to ila’s banking services and products via our digital platform, we will retain personal information about activities and transactions carried out by users on the customer’s account via our digital platform for as long as necessary to comply with legal and regulatory requirements and in case of claims. We will also keep some information in case of queries from our customer about activities and transactions. If you are a Connected Person who is a user, and then no longer work for our customer, we will keep your username only for as long as necessary in case of queries from our customer. We will continue to look after your personal information securely and your rights listed in this privacy notice remain in place until your personal information is safely deleted from our systems. The criteria we use to determine data retention periods for your personal information includes the following.

• Retention in case of queries. We will retain some information in case of queries from you.

• Retention in case of claims. We will retain some information for the period in which the customer might legally bring claims against us.

• Retention in accordance with legal and regulatory requirements. We will retain some information after our agreement with the customer has come to an end and, with respect to access to our digital platform, following the termination of such access, based on our legal and regulatory requirements.

Identity verification and fraud prevention checks.

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment.

How to contact us. If you have any questions about this privacy notice or your personal information, please contact us on 0096265100001 or visit our service center in Abdali Mall, Al Aswaq st 8, Abdali, Amman, Jordan.