Introduction

The Gramm Leach Billey Act (“GLBA”), enacted in 1999 as the Financial Services Modernization Act of 1999, was comprehensive legislation that provided sweeping changes to the financial services industry. Among other things, it removed the barriers to affiliation among banks and other financial institutions such as insurance companies and securities firms and provided protections for non-public, personal information of individuals.

The Privacy provisions of the GLBA (Title V) and requires financial institutions to provide consumers who use the Triple Play Pay service notices that explain the information collection and sharing practices of the financial institution and the rights of customers to limit the sharing of their personal information. Title V also required the functional regulators of financial institutions to issue regulations to implement the Privacy provisions of the GLBA. Such implementing regulations provide a framework for financial institutions to: (i) develop policies and procedures to ensure the security and confidentiality of customer records (ii) protect against any anticipated threats or hazards to the security or integrity of the records and (iii) protect against unauthorized access to or use of customer records or information which could result in substantial harm or inconvenience to consumers. The GLBA and its implementing regulations, also provide a framework for the processing of personal information by third parties that are not affiliated with the financial institution and prescribes the conditions under which non-affiliated third parties may use and disclose the information that they receive as a result of the processing relationship.

1. Policy Purpose and Development

Triple Play Pay (“Triple Play Pay”) provides technology and services to financial institutions, licensed money transmitters, and others (“collectively “Clients”) to facilitate financial transactions and services which are provided to businesses and consumers, and collects nonpublic personal information for itself and for its Clients in order to verify the identity of the users, prevent or mitigate fraud, and facilitate transactions. Triple Play Pay has a strong compliance culture and this Policy addresses how Triple Play Pay will comply with:

• GLBA;
• any State or local privacy rules and regulations as applicable; and
• provide Privacy Notice disclosures as required.

2. Policy Approval and Administration

Triple Play Pay’s Board of Directors have reviewed and approved this Policy in compliance with the GLBA and implementing regulation. Triple Play Pay’s Chief Compliance Officer has the responsibility of maintaining this policy, the disclosures as required within and effect internal control process to ensure Triple Play Pay’s compliance the regulations.

3. Definitions

For the purpose of this policy, critical terms are defined as follows:

Employee: employee includes all directors, officers, and employees of Triple Play Pay as well as any attorneys, agents, or outside vendors who become privy to customer information.

Client: a financial institution, licensed money transmitter, merchant or other entity for whom Triple Play Pay facilitates the provision of financial transactions or services.

Consumer: An individual who obtains or has obtained a service from an Triple Play Pay Client.

Nonpublic personal information: Personally identifiable information relating to a consumer, except when there is a reasonable belief that the information is publicly available. For example, the fact someone has a customer relationship with an Triple Play Pay Client would presumably be nonpublic personal information. If personally identifiable information relating to a customer is publicly available then such information is not regarded as nonpublic information.

Publicly available information: Any information that Triple Play Pay has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records; widely distributed media; or disclosures to the general public that are required to be made by federal, state, or local law. (For example, a published telephone directory or the public record of real estate transactions.)

4. Responsibilities of Triple Play Pay

Triple Play Pay obtains and retains nonpublic information on behalf our Clients as necessary to allow our technology to facilitate requests transactions and services. Accordingly, Triple Play Pay has an obligation to create an effective Information Security Program* designed to ensure all nonpublic personal information is maintained in a secure manner, including paper and electronic data. The program should also identify procedures for providing initial and updated disclosure notices to consumers, as required by GLBA and other applicable State or local privacy rules and regulations and recognize and enforce the policies of our Clients.

Triple Play Pay recognizes the following vital elements of its privacy policy:

Use, Collection, and Retention of Consumer Information: It is the policy and practice of Triple Play Pay to collect, retain, and use information about consumers only when it reasonably believes the gathering of such information would be useful and allowed by law to facilitate services to be provided to the consumer by our Clients, prevent or mitigate fraud, or complete transactions as requested.

Recognition of Customer’s Expectation of Privacy: Consumers are entitled to assurance that information about their financial circumstances and personal lives, which has been obtained through various means, will be treated by Triple Play Pay with confidentiality and respect. Certain expectations of privacy also contain legal rights that federal and state laws and regulations give to consumers. This policy directs all employees to assure Consumers and Clients of Triple Play Pay’s commitment to preserving the privacy of Consumer information. Employees are required to adhere to a Clean Desk policy, are required to use a virtual private network to access systems holding sensitive Consumer information, and and are required to prevent unauthorized shoulder surfing of devices in use.

General Restrictions on the Disclosure of Customer Information: Neither Triple Play Pay, nor its employees will reveal specific information about customers or other nonpublic personal information without the Consumer’s and the Client’s consent, as applicable, consent, except were allowed by law.

Maintaining Customer Privacy in Business Relationships with Third Parties: Triple Play Pay or it’s Clients may be requested to provide personally identifiable information to a third party, from which the consumer has no right to opt out. If this request is in all respects consistent with other elements of Triple Play Pay’s and the Client’s policies, where applicable, Triple Play Pay will assent to the request only if it believes that the third party adheres to similar privacy principles that are at least as stringent as those set forth in this policy and will keep this information confidential.

OPT-OUT EXCEPTIONS

There are opt-out exceptions when Triple Play Pay provides nonpublic personal information:

• to a third party service provider or joint marketer with whom Triple Play Pay has entered into a contractual agreement where Triple Play Pay or the Client as applicable have provided the initial privacy disclosure;
• as necessary to carry-out a consumer initiated transaction for a Client;
• at the direction of the consumer (provided the consent has not been revoked);
• for certain protective or legal reasons;
• to a consumer reporting agency in accordance with FCRA;
• as permitted or required under other provisions of the law and/or the Right to Financial Privacy Act
• to professional agencies or entities such as:

     o government agencies that are reviewing our policies and procedures for compliance with laws and regulations; or

     o our attorneys, accountants, and auditors.

Triple Play Pay may not, directly or through any affiliate, disclose any nonpublic personal information

about a consumer to a nonaffiliated third party other than as described in the initial notice unless we

have:

• provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;
• provided to the consumer a new opt out notice;
• given the consumer a reasonable opportunity, before it discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
• the consumer does not opt out.

*Refer to Triple Play Pay Information Security Policy, which is owned by Triple Play Pay’s Director of Technology Compliance.

5. Disclosure Requirements

Triple Play Pay is required to provide an initial notice of their privacy policies to consumers who utilize

Triple Play Pay services. The notice includes:

• Notice of what information is collected;
• How the information is used;
• Method for updating contact information;
• How to obtain information regarding changes to the privacy policy notice; and
• Where required by state statute, method for requesting specific information that has been collected and deletion of data.
• Other information as required by applicable State or local privacy rules and regulations

If Triple Play Pay intends to disclose nonpublic personal information about any of its consumers (whether or not they are customers) to a nonaffiliated third party then we must provide the consumer with:

• An initial notice of privacy policies;
• An opt out notice (including, among other things, a reasonable means to opt out); and
• A reasonable opportunity, before we disclose the information to the nonaffiliated third