Cards General Terms and Conditions

Date of issue 30/04/2025

PAYABL. BUSINESS DEBIT Mastercard® (the “Card”), the associated account (the “Account”), and the additional services specified herein (together with the Card, referred to hereafter as the “Services”) are developed and provided by DiPocket UAB (“DiPocket”, “we”, “us”) under its electronic money institution license, for PAYABL. CY LIMITED, registered in the Republic of Cyprus (company number HE289380), situated at Olympion 23, Libra Tower, 5th floor, 3035, Limassol, Cyprus (the “Partner” or “payabl.”).

You will only be able to access the Services via the mobile application and/or web application and/or other user interface (together, the “App”) provided by the Partner or by DiPocket for usage by the Partner’s Customers, provided however that, if the App is not available and/or you have a complaint about the Services, you have the right to contact DiPocket directly.

These terms and conditions (“General Terms and Conditions”), the Card Terms and Conditions – if they were attached to or distributed with the Card (“Card Terms and Conditions”), which include the Tariff Table (“Tariff Table”) and the Limits Table (“Limits Table”), together referred to as the “Terms & Conditions”, are applicable upon your acceptance of the Terms & Conditions. In case of any contradiction between the General Terms and Conditions and Card Terms and Conditions, the Card Terms and Conditions shall prevail.

You may access a copy of the Terms & Conditions in the App. Upon your request, the Terms & Conditions shall be sent to you by e-mail free of charge.

By accepting these Terms & Conditions you confirm that you had sufficient time to read and acquaint yourself with the Terms & Conditions, understood it, and agree to comply with the provisions set therein. In case you do not understand or do not agree to specific provisions of the Terms & Conditions, you shall not conclude the Terms & Conditions or shall express your comments and/or disagreement in writing by sending us a notice to the e-mail address indicated below in these Terms & Conditions so that we can clarify and discuss particular provisions of the Terms & Conditions with respect to which you have expressed your comments and/or disagreement. For the avoidance of doubt, not all functionality described in the Terms & Conditions may be available for the Account. In case of doubt, you shall contact us prior to accepting the Terms & Conditions.

DiPocket and/or the Partner will review your application, the acceptance of which by DiPocket and/or the Partner will be promptly notified to you via the App. Only after acceptance of your application by DiPocket and/or the Partner, the Terms & Conditions will enter into force, and you will be able to use the Services.

DiPocket UAB is a Financial Institution authorized and regulated by the Lithuanian financial supervisory authority - the Bank of Lithuania (BoL), which is located at: Gedimino avenue 6, LT-01103, Vilnius, the Republic of Lithuania, telephone No. +370 800 50 500. Further details of the Bank of Lithuania are available at its official website: https://www.lb.lt/en/. DiPocket UAB operates on the basis of the E-Money Institution License (Number 75) issued in the Republic of Lithuania on November 10, 2020. The electronic money institution license authorizes DiPocket UAB to provide services that are listed in the license. The license may be found following the link: https://www.lb.lt/lt/frd-licencijos/view_license?id=1985.

DiPocket UAB’s legal entity code is: 305599375, registered address is: Lvivo str. 25-104, 09320, Vilnius, the Republic of Lithuania (the “DiPocket Address”). You can also contact DiPocket UAB via e-mail: contact@dipocket.org, or telephone number: +370 5 2084858.

As an E-Money Institution, DiPocket can receive and hold customer funds and process payments upon a User’s request. In case of DiPocket UAB, it holds customer funds in segregated accounts held with banks operating in the EEA and with the Bank of Lithuania, meaning customer funds are segregated from DiPocket’s own funds. However, funds entrusted to us are not covered by the Lithuanian deposit insurance scheme www.iidraudimas.lt/en/.

Notwithstanding the above, please note that under these Terms & Conditions, DiPocket does not issue electronic money to you, does not open you an E-Money account, does not provide E-Money wallets, nor does it store your funds or engages in any similar activity. Under these Terms & Conditions, DiPocket only issues the Card and provides the Services to you. The Card only has spending limits pursuant to the arrangements you have in place with the Partner, but no funds or E-Money are being stored on the Card or the Account opened with DiPocket.

DiPocket is a Principal Member of Mastercard® Inc.

The language of communication with reference to these Terms & Conditions and the Services is English.

These Terms & Conditions are governed by Lithuanian law. Any legal terms implied by law will also apply to these Terms & Conditions Rights and duties related to the provision of Services that are not discussed under these Terms & Conditions shall be regulated by the Law on Payments of the Republic of Lithuania for DiPocket UAB`s Customers. Any dispute arising out of the Terms & Conditions between you and DiPocket (the “Parties”), which we are unable to resolve to the Parties’ joint satisfaction through our complaint procedure, shall be settled by the Courts of the Republic of Lithuania.

SCOPE OF DIPOCKET SERVICES

The scope of Services provided to you by DiPocket is limited to Card issuing and processing and its role is ancillary to the provisions of services by the Partner, the usage of which is governed by separate terms and conditions which you must agree with. If you are reading these Terms & Conditions, this means that you have decided to use the services provided by the Partner.

DEFINITIONS

Account means a set of records held by us and containing User’s personal and financial data.

You (User) mean an individual in whose name the card has been issued, and who is authorized to use the Card in accordance with these Terms & Conditions.

Company means a legal entity which is a customer of the Partner. The Company provide you a Card and funding it on your behalf.

Mastercard® Inc. means the payment network that facilitates transactions between merchants, banks, and cardholders.

Registering as a User

Registering as a User you do not become a customer of DiPocket. To register as a User (the “User”) and open the account with the Partner (the “Account”) you must be aged at least 18 and you must be the EEA or UK citizen or resident.

If you've obtained the Card through a third-party provider to whom you've already supplied the necessary registration information and consent to share that information with us, you may already be registered when you receive the Card. By establishing the Personalized Security Features (as defined below) and making use of the Card, you are affirming your intention to become a registered User and your acceptance of the terms outlined in the Terms & Conditions.

By law, we must check your identity prior to registering you as a User and we do this based on the information you provide to us during the registration process.

If we are unable to confirm your identity and/or any relevant registration information based on the information provided, we are entitled to seek or ask for any further evidence of your identity and to ask you to hold a short live phone interaction with our operators and/or carry out such further checks as it deems necessary to establish your identity. If we are unable to do this, we may refuse to serve you or enable the extra functionality reserved to registered Users and/or inform the appropriate authorities without your knowledge or consent. We will register you only if the results of the KYC process allow us to on-board you as a User.

As part of your eligibility to use a DiPocket account, you agree and confirm that you are an individual acting solely on your own behalf, in an individual capacity, and you are not acting in a business capacity or for any other commercial purpose.

Furthermore, it is not permitted to use the Account:

• to organize and/or conduct sweepstakes, gambling, cryptocurrency purchases, sales or trading;
• for copyright infringement;
• for testing other financial services providers or to generate transactions for the purpose of benefitting from other financial service providers' loyalty offers;
• to discredit individuals or legal entities;
• in a way that can lead to complaints, disputes, refunds, and the emergence of other obligations to DiPocket, other users or third parties;
• to receive or send funds obtained by fraud or in violation of the law;
• to carry out any activity in violation of the law;
• to circumvent DiPocket’s policies, including but not limited to attempts to create additional accounts to exceed usage limits or circumvent blocking by DiPocket of an existing Account.

If you give us false or inaccurate information and/or we identify fraud, we will record this with fraud prevention agencies, including but not limited to the Bank of Lithuania, the Financial Crime Investigation Unit of the Republic of Lithuania, the Financial Crime Unit of the Republic of Cyprus (MOKAS), and other competent institutions, including law enforcement as the case may be. Law enforcement agencies may access and use this information. The fraud prevention agencies will share records with other organisations. We and other organisations may access and use the information recorded by fraud prevention agencies across borders. We may also block or cancel the Card and terminate the Terms & Conditions.

Personal Data

We carefully safeguard the information we hold about you (the “Personal Data”). The Partner is the data controller of your Personal Data, provided to us. If you wish to contact us about the processing of your Personal Data, please contact our Data Protection Officer at dpo@dipocket.org or Partner`s Data Protection Officer at dataprotection@payabl.com.

What data do we collect?

DiPocket collects the following data:

User profile:

• Personal identification information (name, surname, address, e-mail address, telephone number, etc.);
• Additional data required by money laundering and terrorist financing prevention legislation (personal identification number and/or date of birth, citizenship, facial image, identity document data, copies of the documents provided, details of the device used, IP address, etc.);
• Location data, where you sign up to use the Services as well as your location when using the Services;
• Your communication with us (correspondence by e-mail, conversations by phone, etc.).

Payment services:

• Transaction data (transaction amount, date and time, merchant, acceptance details (e.g., confirmed by PIN);
• Card data (PAN, expiry date, etc.);
• Sender or beneficiary data (bank account number, IBAN, beneficiary or sender, etc.).

Account information and payment initiation services:

• Transaction data (transaction amount, date and time, bank account number, IBAN, beneficiary or sender, etc.);
• Select User account information for account information services (balance of funds, bank account number, etc.).

If you give us Personal Data about other people, including minors, which we use to provide the Services, then you confirm that (i) you have ensured that they agree to our holding and use of that Personal Data or that you are otherwise allowed to give us this information and consent on their behalf to our holding and use of it, and (ii) you have provided them with all the information regarding the processing of Personal Data as required under the applicable laws.

How do we collect your data?

You directly provide DiPocket with most of the Personal Data we collect. We collect such data and process it when:

• You provide us with your Personal Data during the registration process. Information you provide at registration is both a statutory requirement and necessary for us to enter into the Terms & Conditions. You provide us with your Personal Data voluntarily. If you do not provide us with the necessary information and documents, we will not be able to perform the Services;
• You use DiPocket Services (e.g., information about payments you make or receive);
• You interact with DiPocket (customer service, or engage with us on any social media platform, etc.).

DiPocket may also receive your Personal Data indirectly from the following sources:

• From DiPocket Partner who perform User onboarding, including, where applicable, financial institutions or other obligated entities that we rely on for verifying user identity;
• When it is compliant with the applicable law, we may receive it from third parties such as credit reference agencies (who may check the Personal Data against other databases – public or private – to which they have access), official registers and databases or fraud prevention agencies;
• In order to carry out enhanced due diligence procedures we also collect publicly available information about you (including information on the internet, social media, etc.);
• In case of open banking, upon receiving your consent, DiPocket process Personal Data from accounts you hold with third party financial institutions.

How will DiPocket use your data?

DiPocket use the Personal Data to properly fulfill the Terms & Conditions:

• For contractual reasons, in order to provide you with the Services (e.g., to produce cards for use with the Account, to provide you with payment services and Account-related communications, etc.);
• For purposes where we have a legal obligation, including for tax and accounting, to perform “Know your client”, to prevent and detect fraud, money laundering and other crime (such as identity theft), to carry out regulatory checks, including PEP (Politically Exposed Persons) screening, sanctions screening, and adverse media monitoring, and meet our obligations to our regulators, etc;
• On the basis of your consent, where you agree in a clear and unambiguous way with processing of your Personal Data for marketing purposes or when processing special category personal data, etc.;
• On the basis of our legitimate interests, where the processing is necessary for the intended purpose, such processing can be reasonably expected and it is balanced with your interests and fundamental rights and freedoms;
• On the basis of substantial public interest to support you if you fall under the vulnerable User category;
• If you instruct us to process Personal Data in a particular way (e.g., open banking);
• E-mailing you with offers on other products and services where these are related to those you already use.

We will never pass Personal Data to a third party for them to market to you without your consent.

Profiling

Profiling carried out by DiPocket involves processing of Personal Data by automated means for the purposes of risk management and ongoing monitoring of transactions in order to prevent fraud, money laundering and terrorist financing. It is based on legal obligations applicable to DiPocket as financial institution.

Who we can share the Personal Data with

We will keep the Personal Data confidential but we may share it with other entities (who are also bound to keep it secure and confidential) if we have a duty to disclose it, if it is required for the provision of our Services to you.

In particular, if this is compliant with applicable laws, we may share the Personal Data with:

• Other DiPocket group companies and/or our distributors (where applicable) in order to provide you with the Services, to fulfil our obligations to identify you and prevent money laundering, terrorist financing and fraud;
• Our suppliers (including their sub-contractors) such as providers of data center, card processing, cards bureau (if we issue a physical card for you) and SMS messaging services, and other suppliers who provide IT and payment services;
• Other third parties (including their sub-contractors) who perform part of the Services or support your transactions, such as Mastercard, SWIFT, CENTROlink and our partner banks who provide payment execution;
• Other financial institutions when providing account information services or making outbound payments;
• Regulators and supervisory authorities in connection with their duties (such as crime prevention);
• Fraud prevention agencies, in particular, we will always tell fraud prevention agencies if you give us false or fraudulent information. They will also allow other organisations (in Lithuania or other countries), including law enforcement agencies, to access this information to prevent and detect fraud, money laundering or other crimes. You can write to us at MLRO@dipocket.org or banking.support@payabl.com for the details of the fraud prevention agencies with which we share the Information;
• Anyone to whom we transfer or may transfer our rights and duties in the Terms & Conditions including any third party after a restructure, sale or acquisition of any DiPocket Group company, provided that they use the Personal Data for the same purposes as it was originally given to us and/or processed by us.

Transfer of Personal Data outside of the EEA and United Kingdom

We may process the Personal Data abroad, within or outside the European Economic Area and the United Kingdom, provided we comply with the applicable laws and regulations. Where we are sharing the Personal Data with organisations outside of the EEA and the United Kingdom, we will ensure they agree to apply equivalent levels of protection as we do. We use legal mechanism, such as standard contractual clauses as indicated in General Data Protection Regulation (2016/679) art. 46 to implement the cross-border transfer of your personal data; or implement security measures like anonymization on the data before the cross border data transfer. For any inquiries on means that safeguards data transfer outside EU please contact us at DPO@dipocket.org or Partner`s Data Protection Officer at dataprotection@payabl.com.

Open-Banking

We will transfer data to any entity who you authorise us to share information about your Account with, provided that they are listed as a suitably authorised entity at the time of your request. We will rely upon your instructions to the third party to access your account information from us, as evidence of your consent to share your data.

How do DiPocket store your data?

DiPocket has established technological, physical, administrative and procedural safeguards in line with the industry accepted standards to protect and ensure the confidentiality, integrity or accessibility of the Personal Data processed, to prevent the unauthorized use of or unauthorized access to the Personal Data, and to prevent a Personal Data breach (security incident) in accordance with DiPocket’s instructions, policies and applicable laws. All our staff receives data protection training and are instructed to strictly follow our data protection policies.

DiPocket securely stores your data in data centers located exclusively in European Union and United Kingdom.

The period for which we are required to retain your information, according to applicable legislation of the Republic of Lithuania, is required to keep your Personal Data related to your identification and services provided for eight years after our business relationship with you ends. Correspondence with you shall be stored for five years from the date of termination of transactions or business relationships with you. These time limits may be additionally extended for up to two years upon a reasonable instruction of a competent authority.

We may keep your Personal Data for longer because of a potential or ongoing court claim or another legal reason.

Once the relevant time period has expired and the Personal Data is no longer required for the abovementioned reasons, we will delete your data.

Please note that if you cancel or we decline your registration or you decide not to go ahead with it, we will keep the Personal Data for as long as we are required to do so under applicable laws (to help prevent fraud and other financial crime, and for other legal and regulatory reasons).

What are your data protection rights?

Every User is entitled to the following:

The right to access – You have the right to request us for copies of your Personal Data. We may charge you a small fee for this Service. If you wish to obtain a confirmation as to whether or not Personal Data concerning you is being processed by us, you can request a free copy of it by requesting this at DPO@dipocket.org.

The right to rectification – You have the right to request us to correct any information you believe is inaccurate. You also have the right to request us to complete the information you believe is incomplete.

The right to erasure – You have the right to request that we erase your Personal Data, under certain conditions. Where you make this request we will apply your instructions to any third parties who are processing your Personal Data on our behalf, and we will consider your request in light of our legitimate interests. Where a request to erase Personal Data is received on behalf of a minor, we will take extra care to consider the impact on them of any decision we make.

The right to restrict processing – You have the right to request that we restrict the processing of your Personal Data, under certain conditions.

The right to object to processing – You have the right to object to DiPocket’s processing of your Personal Data, under certain conditions.

The right to data portability – You have the right to request that we transfer the Personal Data that we have collected to another organizations, or directly to you, under certain conditions.

Where you have given us your explicit consent for the processing of Personal Data, you also have the right to withdraw this consent at any time by contacting us at DPO@dipocket.org. Such withdrawal will not affect the lawfulness of the processing carried out before the withdrawal was submitted.

If you feel your rights and freedoms in relation to processing your Personal Data have been infringed in any way, please let us know so that we can attempt to resolve the issue.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email: DPO@dipocket.org or dataprotection@payabl.com.

You also have a right to lodge a complaint with your national Data Protection Authority. Please see a list provided (https://edpb.europa.eu/about-edpb/about-edpb/members_en).

Requirement to update your Personal Data

You must notify us immediately of any and all data and circumstances that have changed with regard to the data set out in the Terms & Conditions, or the documents submitted to us (e.g., changes in personal or contact details, residency or tax residency, loss or theft or other reason for change of an identity document) as well as of any and all circumstances that may affect the fulfilment of your obligations towards us (e.g., commencement of bankruptcy procedures of a natural person). We may request documentary evidence of the changes, which you must provide. This notification obligation applies even if the above changes have been made public (e.g., registered in a public register or published through the mass media). If you fail to fulfil the notification obligation, DiPocket is entitled to assume the correctness of the data at DiPocket’s disposal, unless otherwise prescribed in the jurisdiction of your residency.

Notices and exchange of information

We may provide you with all information electronically via the App, e-mail or mobile phone, unless otherwise established in the applicable laws. We are entitled to use third party services for processing or delivering electronic notices and information to you.

If, in accordance with the applicable laws and/or the Terms & Conditions, you have the right to terminate the Terms & Conditions, you shall send the termination notification to cards.support@payabl.com or contact@dipocket.org.

Unless otherwise stipulated by the applicable laws, any notice given by DiPocket must be considered to have been received if sent by e-mail or via the App or other electronic means of communication, on the day of technical dispatch.

Unique User Identifier

Your Unique User Identifier is your mobile number. It is important you keep it updated with us at all times as we may use it to verify it is you when you make a transactions or access your Personal Data.

Your mobile number is also used by other authorised Users within DiPocket's systems to transfer or request funds to/from you.

Privacy policies of other websites

When we include links to other websites, please bear in mind they will have their own privacy and cookies policies that will govern the use of any information you submit. We recommend you read their policies before accessing their sites.

Payment Services

The Services may include some or all of the below payment services:

• Issuing of payment cards;
• Card payments, including card purchases, cash withdrawals at ATMs, card to card transfers;
• Account information services.

The User shall be free to decide which of the available Services to use (all or only part of them). Terms and conditions specifying the provision of payment initiation and account information services will be made available to you before each transaction. Account information and payment initiation services will be provided to you only under your explicit consent.

Transferring money to the Account

Your Card can only be funded by the Company that provided it to you.

Using the Card

The Card is a Mastercard Business debit card. It is valid until its expiry date, which is visible on the front of the Card - or on the Card image accessible online for virtual cards and payment bands.

You can use the Card at all locations that display the Mastercard Acceptance Mark: for purchases in physical stores – including contactless, and at automated teller machines (“ATM”) for cash withdrawals (daily limit applicable) as well as for online and telephone purchases. You can also enroll it in Apple Pay and Google Pay. It allows you to receive cash-back when making purchases in physical stores and is Mastercard Send enabled, however it cannot be used for other cash transactions such as withdrawing cash from a bank and purchasing traveler's cheques or foreign exchange from a bureau de change. Limits and fees apply.

The Card is automatically registered for Mastercard Identity Check, to enhance security. When using the Card for online purchases, you may be required to authenticate yourself using the App’s biometric features or entering on the merchant site a code (the “Code”) that will be sent to your mobile phone number.

To activate plastic cards please follow the instructions provided with the Card. Also, you must:

• Not allow anyone else to use the Card;
• Not reveal your PIN or the Code;
• Not maintain a written record of your PIN, unless you do this in a way that would make it impossible for anyone else to recognize it;
• Only release the Card, card number, PIN or the Code to make (or try to make) a transaction with a merchant or ATM displaying the Mastercard Acceptance Mark.

In so far as this is not a result of our negligence, we will not be responsible nor liable for a retailer’s failure to or delay in accepting the Card nor for an ATM failing to issue cash. In these circumstances, we will not be liable for the way in which you are told about any refusal or delay.

All transactions require authorisation. Authorisation is also your Instruction for us to carry out a transaction. We will not normally authorise a transaction if the balance on the Card is insufficient to cover the transaction and any related transaction fee. If, for any reason whatsoever, you are able to make a transaction when there are insufficient funds on the Card (the “Shortfall”), we will seek reimbursement of the Shortfall from you immediately.

You may ask us to provide you with information about transactions for up to 5 years from the date of the transaction.

A Card transaction will be regarded as authorised by you when you authorise the transaction by following the instructions provided by the merchant, retailer or ATM, which may include:

• Entering your PIN or providing the Code;
• Providing the Card details and/or any other details as requested;
• Waving or swiping the Card over a card reader for the purpose of making a payment.

For a contactless transaction (using a plastic Card or an Apple Pay/Google Pay enabled device):

(a) below the limit applicable in the country where you are using the Card (“Contactless Limit”), which is outside the control of DiPocket, a transaction is deemed authorized upon transmission of the details of the Card that are required to execute the transaction, by placing the Card in the proximity of the device that allows for reading the data saved in the Card contactless module; and

(b) In excess of the Contactless Limit, the transaction is deemed authorized by entry of the PIN number on the acceptance terminal. Please note that in certain countries contactless transactions with PIN are not available.

When we suspect there may be an attempt to use the Card fraudulently, we may ask you to confirm a transaction prior to or after authorising it.

In so far as this is not a result of our negligence, we are not obligated to authorise a transaction where a system problem occurs or events outside our reasonable control arise. In addition to that we are not obligated to authorise a transaction where we are concerned about misuse of the Card. We shall not be liable to you when a transaction is not authorised in these circumstances and/or if we cancel or suspend use of the Card.

If the Card is lost or stolen, or someone else finds out the PIN, or if you think the Card, card number, or PIN may be misused, you must:

• block the Card immediately using the App, contact us by phone at +357 25272300, or report about the lost or stolen card to cards.support@payabl.com between 9.00 to 18.00 Eastern European Time (EET) (UTC+02:00) or Eastern European Summer Time (EEST) (UTC+03:00), so that we can block the Card for you;
• stop using the Card, card number or PIN immediately.

We will block or restrict the Card or PIN on justified grounds relating to:

• the security of the Card, card number or PIN. For example: when the wrong PIN is entered several times in a row;
• the suspected unauthorised or fraudulent use of the Card or PIN. For example: where we detect that another person uses the Card, if we consider the activity suspicious or abnormal, etc. We will, if possible, inform you before blocking, or restricting the Card or PIN that we intend to do so and the reasons for doing this. If we are unable to do so, then we will inform you immediately afterwards. The requirement to inform you does not apply where it would compromise reasonable security measures, or it would be unlawful to do so;
• AML transaction monitoring. In line with the mandatory requirements for the prevention of money laundering and terrorist financing, we have implemented an automatic transaction monitoring system where algorithms check all transactions and may automatically block accounts, so that our compliance team may perform the necessary checks;
• situations where it is not possible for the supplier to obtain online authorisation to confirm that you have sufficient balance for the transaction. For example: transactions on certain trains, ships, and some in-flight purchases, and
• purchases at service stations when the merchant verifies your PIN with us without providing the final amount of your purchase.

Authorisation for a transaction may not be withdrawn or revoked by you.

You may demand from us the return of the amount of an authorized transaction initiated by or via the recipient, if such transaction was already executed while:

(a) the amount of the transaction was not determined precisely when it was being authorized; and

(b) the amount of the transaction is higher than the amount you could expect, taking account of the type and value of previous transactions, provisions of the Terms & Conditions and any significant circumstances of the case.

You may request such refund within 8 weeks from the date of the transaction.

Using the Card in foreign currencies

If you make a payment with the Card in a currency different from the currency of the Card, the purchase amounts will be converted to the main Card currency by Mastercard on the date they process the transaction, using the exchange rate they use for all such currency conversions. This an the rate of exchange may differ from the rate on the date you made the card payment, if the payment is processed by the card scheme after that date. The foreign exchange rate used by Mastercard can be found on www.mastercard.co.uk/en-gb/consumers/get-support/convert-currency.html. We also charge a fee based on the payment amount, as shown in the Tariff Table.

Card terminals may offer you the option of seeing the payment amount or withdrawal in the currency of the Card or in a currency other than the cash withdrawal or purchase currency and allow you to choose to pay that amount in that currency. The exchange rate used for this will generally be provided by the operator of the terminal or ATM, so it won’t be under our control and won’t be covered by our Tariff Table. Please check the exchange rate at the ATM, the terminal or with the respective operator before authorizing the transaction.

As soon as practical after you make a Card transaction in foreign currency we will display as part of the transaction information we provide in the App, details of the amount of the conversion to the currency of the Card and how the exchange rate applied by us compares to reference rates published by the European Central Bank.

Restrictions on the functionality of the Account

You may only use the DiPocket account to make purchases of goods and services, and to receive and send funds in accordance with applicable legislation and these Terms & Conditions.

If we have reasonable cause to believe that you have violated the requirements of Terms & Conditions or applicable legislation, DiPocket may take measures to protect ourself, our customers and Users or third parties. In this case, DiPocket may, amongst other things, do the following:

• restrict, suspend or close access to the Account or to any of its services;
• notify Users who have mutual settlements with you, their bank, their issuer or law enforcement authorities;
• require you to update any incorrect or incomplete information that you have provided;
• cancel the Services (in which case we will give you notice in accordance with these terms).

Keeping the Card and Account safe

You must keep safe at all time the Card details – including PAN (the 16 digits number displayed on the front of the Card), expiry date, CVV (the 3 digits number, displayed on the back of the Card), PIN (Personal Identification Number), and any passwords and devices you use to access security details of the Card and/or Account by any method (together the “Personalised Security Features”). This also includes any Card details, on retailer’s websites, or on devices such as mobile phones. If you have registered a Card on a device or within an e-wallet this will include passwords and security processes used to access your device or e-wallet (device ID, passcodes, or passwords) and any fingerprints or other biometric or identification methods stored in your device. Please note that not all Personalized Security Features may be applicable to the Card.

We will never contact you to request any of your Personalised Security Features and we will not ask anyone else to do so on our behalf. If you receive such a request, it is likely to be fraudulent and you must not supply any of your Personalised Security Features in any circumstances. You should report any such activity to us or the Partner immediately. Treat emails received from senders claiming to be us with caution and be wary of emails asking you for any Personalised Security Features.

When you call us, we may need to identify you, depending on the nature of your query. We may do this by asking for certain information (such as answers to questions) known only to you and requesting random digits of certain passwords, but we would never ask you for a full PAN, PIN, Code or password. You must not give these to anyone who asks for them, even if that person appears to be an official.

You are responsible for the quality, safety, legality or any other aspect of any goods or services that you buy with the Card. Unless otherwise stipulated in applicable laws, any disputes about purchases or payments made with the Card must be settled with the goods or service provider concerned.

If you become aware of the loss, theft or misappropriation of the Card or of its unauthorized use, block the Card immediately using the App or report about the lost or stolen card to cards.support@payabl.com between 9.00 to 18.00 Eastern European Time (EET) (UTC+02:00) or Eastern European Summer Time (EEST) (UTC+03:00), so that we can block the Card for you.

Balance and statements

To view the available balance and transaction history please visit the App. By accepting the General Terms and Conditions you specifically agree not to receive paper statements.

Upon your request additional statements and/or transaction records, on paper or otherwise will be provided to you. You may ask us to provide you with information about transactions for up to 5 years from the date of the transaction, even after termination of the Terms & Conditions, and we will provide it to you free of charge in electronic form, as well as paper form if you so wish. Fees may apply in case you ask us for information more often than once a month, however, only to the extent of our incurred costs.

We will also provide you an annual statement of Fees paid to us, as well as a statement of fees incurred year to date upon closing the Account.

Fees

You must pay all relevant fees for the Services. The applicable fees are established in the Tariff Table.

Fees and other amounts payable by you shall be debited to the Account, unless otherwise specified in the Tariff Table.

If there are no funds on the Account or if the funds are insufficient to cover the fees, other claims and the debts arising from the Terms & Conditions, we are entitled to suspend provision of the Services to you until such fees and indebtedness are covered. Notwithstanding the above, we will only charge applicable monthly fees until there is a positive balance on the Account and we will not charge uncollected monthly fees retroactively.

Changes to the Fees shall be communicated with 60 days’ prior notice, following the same procedure as provided in section “Changes to the Terms & Conditions” below.

Taxes

We may recover from you taxes imposed upon us by any competent Authority in relation to the provision of the Services to you – in particular taxes on payment transactions and/or account balances, if and when applicable.

If something goes wrong

If you suffer loss because of an unauthorised Card transaction occurring as a result of:

• the use of a lost or stolen Card; or
• where you have failed to keep safe the Personalised Security Features and,
• you failed to tell us about the loss of the Card or compromising of the Personalized Security Features.

Please refer to the Card Terms & Conditions for any charges, fees you may need to pay, plus any Card scheme charges that may apply from time to time, for each instance of loss, theft or misappropriation, and dispute.

Where you have either deliberately or with gross negligence:

• failed to keep the Personalized Security Features safe, or
• failed to tell us as soon as possible that you have lost the Card (especially if you think someone else might have been able to find it).

If we can show that you have acted fraudulently in incurring a loss as a result of an unauthorised transaction, you may not benefit from any of the liability limitations set out above.

If the Card is used without your permission, or is lost, stolen or if you think the Account may have been misused, we may ask you to write us within seven days to confirm the loss, theft or possible misuse at the DiPocket Address. We may disclose to law enforcement agencies any information which we reasonably believe may be relevant.

If you believe you have been misled into transferring money to the account of a third party you don’t know or have transferred money in good faith from the Account but have not received the goods or services contracted for (the “Authorised Push Payment scams”), you can contact us and we will investigate for you and try to recover the money, however, we will bear no liability save that which may be imposed upon us by applicable laws and regulations at the time of the Authorised Push Payment scam.

You have 13 months to notify us of an unauthorised, non-executed or incorrectly executed transaction. Provided you notify us within this timeframe and the payment was unauthorised, non-executed or incorrectly executed, we will promptly, as appropriate and in accordance with our regulatory obligations, refund the amount of the transaction to the Account. In case of errors or disputes about transactions, contact us via cards.support@payabl.com.

Our liability towards you

Within the limits permitted under the applicable laws, and subject to the limitations defined in the Terms & Conditions, we are liable for due performance of our obligations set out in the Terms & Conditions.

You cannot claim a loss or damage from us if:

• you are claiming for loss of business, loss of goodwill, loss of opportunity or loss of profit – we will not be liable for these in any circumstances;
• you have acted fraudulently or with gross negligence;
• you are in breach of the Terms & Conditions, or provided DiPocket with any incorrect information if there is a clear causal link with the damage;
• our failure was due to abnormal and unforeseeable circumstances outside our control, which meant we couldn’t follow our obligations under the Terms & Conditions despite our best efforts to do so, for example, a hardware breakdown, strike, or a major problem with a payment system;
• you are claiming for consequential loss which is not reasonably foreseeable as a result of our breach of the Terms & Conditions.

None of these exceptions will apply, and nothing else in the Terms & Conditions will stop us being liable, if:

• we acted fraudulently;
• we acted with gross negligence; or
• we are at fault and the law does not allow us to exclude or limit liability.

Changes to the Terms & Conditions

Provided we give you 60 days’ notice, we can change any part of the Terms & Conditions, only to the extent necessary, if at least one of the below material circumstances occurs:

• A change of requirements to the creation of reserves or the enactment of allowances not provided for in the legislation at the date of the Terms & Conditions;
• Fees or taxes or other costs are imposed, that were not provided for in the legislation at the date of conclusion of the Terms & Conditions;
• A change in the legal provisions governing the financial sector or a change of recommendations on good practices by supervising institutions, which impact the mutual rights and obligations of the parties to the Terms & Conditions that were not in force at the date of conclusion of the Terms & Conditions;
• The introduction of new services or removal or change of features of the existing Services as well as introduction or change of the trade name of such Services (in the case of a change of the scope or manner of providing the Services consisting in changing the features of the existing Services or the introduction of new products, the User will not be obliged to use such services and incur the associated costs unless its submits a separate declaration of will in this respect);

save that the amendment of the Terms & Conditions will be effected solely within the scope and direction arising from the reason that has occurred and no later than within 1 month from the occurrence of a prerequisite for such change.

If you are not happy with the change, you can either:

• take the steps set out below to cancel the Card and terminate the Terms & Conditions with an immediate effect and without any charges, or
• let us know that you are not happy with the change and would like to cancel the Card and terminate the Terms & Conditions without any charges, so that the Terms & Conditions will cease on the day before the date on which the changes take effect.

If you do not terminate the Terms & Conditions by taking the steps above, you will be deemed to have accepted the changes after the end of the 60 days’ notice.

DiPocket may assign its rights or obligations under the Terms & Conditions to an associated company at any time, provided we give you not less than one month’s notice and without requiring your specific consent. If you object to the assignment, you can cancel the Card and terminate the Terms & Conditions without any charges, so that the Terms & Conditions will cease on the day before the date of assignment. You may not assign your rights or obligations under the Terms & Conditions.

Cancelling the Services

The Terms & Conditions expire on the Card expiry date unless, prior to expiry, we issue a replacement Card in accordance with our Card reissue policy as specified in the Card Terms and Conditions, provided however that we may send you a replacement card prior to the Card expiry date free of charge and with no obligation for you to continue to use the Services.

Whilst a Card remains unexpired, the Terms & Conditions will be of indefinite duration and will continue unless terminated at any time by you, or by us for a reason and in accordance with the processes set out below.

After termination of the Terms & Conditions, access to the Account may be limited.

Our Services are ancillary to the Partner's services and termination of the relationship with the Partner by a User will automatically terminate the relationship with DiPocket for the Services.

When you can cancel the Services

If you wish to, you can cancel the Services at any time.

In addition, as a consumer, you have a period of 14 days from the date you have concluded the Terms & Conditions to tell us that you would like to withdraw from it, without giving any reason, and without incurring any charges or fees other than for the Services commenced upon your request or Services already provided. If you withdraw from the Terms & Conditions, the Terms & Conditions are considered not concluded.

There is no cost to you for cancelling the Services.

When we can cancel the Services

We may terminate the Terms & Conditions with immediate effect (and cancel the Card) if we have reasonable grounds to suspect you have committed any of the following things, which you must not do:

• Put us in a position where we might be deemed to be in breach of any applicable law, regulation, directive, statute or other duty that applies to us if we maintain the Card and Account;
• Refused to cooperate with DiPocket’s and/or the Partner’s legitimate requests, e.g., by not providing information to confirm your identity or the source of funds/wealth;
• Have given us any false information or attempted to mislead us at any time;
• Committed (or attempted) fraud against us or someone else;
• Used (or allowed someone else to use) the Card or Account illegally or for criminal activity (including receiving proceeds of crime on the Card);
• Inappropriately let someone else use the Card or Account.

In the event of termination under the above clause, you agree and confirm that we are not required to disclose the exact reason(s) or grounds for termination.

We can also end the Terms & Conditions immediately and cancel the Services if:

• we reasonably believe that maintaining the Services might expose us (or another DiPocket group company) to action or censure from any government, regulator or law enforcement agency;
• we find out that you are no longer eligible for the Services (for example, through residence status). We will try to tell you in advance if this happens, but if by continuing to offer you the Services we would break any rules or laws, we will have to cancel or block your Account immediately.

We can terminate the Terms & Conditions by sending you 60 days` advance notice if:

• there are no transactions (other than fee charges) on the Account for a continuous period of 12 months;
• we discontinue the Services, e.g., when the Services were offered in cooperation with a Partner and our relationship with them is terminated, or because we are no longer able to provide them, or for reasonable commercial considerations.

Complaints Policy

If you are unhappy in any way with the Card or the Services, or if you experience any problem, please contact us. Complaints may be submitted via email cards.support@payabl.com.

In the complaint, you will need to specify:

• Date of submission of the complaint;
• Your name and surname or company name (in case of business accounts);
• Your contact details (e.g., phone number, address, e-mail address associated with the Account);
• Circumstances of the issue in detail (e.g., what rights or legitimate interests you think have been violated);
• When the problem arose, which should be no later than within 3 months of learning about the problem;
• What your preferred outcome would be;
• Available documents related to the complaint.

If the information provided in the complaint is incomplete, unclear or we need additional information, we may request further clarifications.

We acknowledge all complaints, without any exceptions, including those regarding our personnel. We strive to acknowledge all complaints received within 24 hours of receipt. If a complaint is received during a bank holiday or weekend period, the complaint will be acknowledged within 24 hours of the return to work of staff, i.e., if a complaint is received by e-mail on a Sunday, it will be deemed to have been received on the following Monday.

We will send our final response within 15 business days. In exceptional cases, where it is not possible to respond within 15 business days, we may extend the deadline for submitting a final response to you to 35 business days, but we will inform you of this, stating the reasons for the extension.

A response to you shall be provided via the same channel the complaint has been received from, unless otherwise indicated by you.

Handling of complaints is free of charge. The Parties agree that complaints shall be submitted, handled, and responded to in English or other language agreed upon.

Should you not be satisfied with the final response of DiPocket, or should we fail to respond to you within 15 business days, or 35 business days respectively, from receiving the complaint, you can refer the complaint to the BoL for out of court settlement within 1 year of contacting DiPocket. Examination of the complaint by the BoL is free of charge. More information on application to the BoL and different procedures you can find here: Complaints against a financial service provider | Bank of Lithuania. With regards to the services provided by the Partner, you can find further information on the responsibilities of the Central Bank of Cyprus and rights of clients and employees of supervised institutions https://www.centralbank.cy/en/licensing-supervision/financial-conduct.<