YBS Policy and Privacy

Data Collection Scenarios

• Browsing Yana Banking Service website (www.ybservice.iq)
• Downloading and utilizing our mobile application (MyYBS)
• Engaging with us through sales, marketing, or events

By law, we are obligated to furnish you with comprehensive details about our data practices, ensuring transparency and empowering you with the knowledge of your rights regarding the data you consent to share with us.

Collected Information Categories

• Name
• Date of birth
• Nationality
• Gender Identity
• Id Photo
• Passport Photo
• Contact Number
• Address
• Email Address
• Location
• Biometrics (Used for authentication only)

HOW WE USE YOUR PERSONAL DATA THAT WE COLLECT

Your personal information will be available only to the company's employees, agents, service providers, and our affiliated entities who have a need to know it. It will not be available for public inspection. Access is given only to those qualified professionals who provide services consistent with your interactions on our website or provide services to YBS. We do not authorize these service providers to use or disclose such data except as necessary to perform certain services on our behalf or comply with legal requirements. We require these service providers by contract to appropriately safeguard the privacy and security of personal data they process on our behalf, and no such data shared with such providers will be used by these third parties without your explicit consent unless necessary to comply with applicable laws.

We may use the personal data we collect as below:

• Provide YBS services to you and respond to your inquiries.
• Validate your payment card information.
• Provide, administer, and communicate with you about products, services, and promotions, including the display of customized content and advertising.
• Protect against fraud and prevent unauthorized transactions, claims, other liabilities, manage risk exposure, and franchise quality.
• Operate, evaluate, and improve our business to meet your expectations.
• Manage our communications.
• Facilitate the functionality of our websites; and perform accounting, auditing, billing, reconciliation, and collection activities.
• Assist third parties in the provision of products or services that you request from third parties.
• Comply with applicable legal requirements and industry standards and our policies, and Perform auditing, research, and analysis to maintain, protect, and improve our services.

Cookies Usage on YBS Website

When using our website to browse products, portal services, and access information, we utilize various cookies for the following purposes:

• To enable the website's functionality.
• To gather useful information about visitors.
• To enhance the overall user experience.

MyYBS Mobile Application

When using our mobile application to upload KYC data, browse services, and access information, data is collected for the following reasons:

• To enable the functions of the mobile application.
• To collect KYC information from users.
• To enhance the user experience.

Enquiries via Website or YBS Support

When submitting an inquiry via our website or contacting YBS support, we request the following information: Name, contact number, and email address. Additional details related to the inquiry. This information is used to respond to queries, provide requested information, and follow up on user interests. We may contact users via email for this purpose, based on our legitimate interest in offering accurate information about our services and products. No automated decisions affecting data safety are made using the provided information.

Disclosure of Personal Data

We may disclose personal data in the following scenarios:

• If required by law or legal process.
• In response to requests from law enforcement or government officials.
• When disclosure is necessary to prevent physical harm, financial loss, or investigate suspected/actual fraudulent or illegal activity.

Additionally

We reserve the right to transfer personal data in the event of selling or transferring our business/assets. Following such a transfer, individuals can contact the entity to which the data was transferred for inquiries about data processing. We may need to share information in specific situations described in this section and/or with the following third parties:

Business Transfers:We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

YOUR RIGHTS AS A DATA SUBJECT

Right to Erase ('Right to be Forgotten'), By law, you have the right to:

• Request information held about you.
• Ask for corrections to inaccurate information.
• Withdraw consent for processing personal data (if applicable).

To exercise these rights, contact YBS Information Security:

• Email: is@ybservice.iq
• Phone: +964 751 171 1791 or +964 66 211 3500 Ext. 220

You can request data erasure, ensuring compliance with applicable laws. If you believe your information is unlawfully used, you can request a temporary halt.

NOTE: Persons under 18 cannot use our services.

Right to Complain

If you have a complaint about information use, contact us directly through email:

• Email: is@ybservice.iq
• Phone: +964 751 171 1791 or +964 66 211 3500 Ext. 220
• Address: Yana Banking Services Company, 4th floor, RT Building - HQ, Gulan Street, Erbil - Kurdistan Region, Iraq.

Submitting a Request

When submitting a request to exercise data protection rights, do so in writing, and include:

• Data owner's name and contact details.
• Clear indication of the right you wish to exercise.
• Precise description of the personal data for which rights are pursued.

SECURITY OF YOUR DATA

YBS is dedicated to respecting your privacy and safeguarding your personal information. This privacy and security statement outlines YBS's current practices in ensuring the security of sensitive information.

To safeguard against loss, falsification, or unauthorized disclosure, YBS has implemented technical and administrative measures:

• Card information and account data are issued, processed, and stored in encrypted form within a database accessible only to authorized staff. This is in strict adherence to PCI-SSC rules (Payment Card Industry Security Standards Council), incorporating various PCI Standards:

  • PCI - DSS (Payment Card Industry - Data Security Standards)
  • PCI - PIN (Payment Card Industry - PIN Security)
  • PCI - 3DS (Payment Card Industry - 3-D Secure)
  • PCI - CPP (Payment Card Industry - Card Production and Provisioning)

• All staff members and individuals involved in data processing undergo security background checks. They are required to comply with the acceptable use policy and all laws related to data protection and banking secrecy as issued by the Central Bank of Iraq.