Privacy Policy Statement

Effective Date: February 16, 2025

At Evertec® we are committed to provide the highest quality payment processing services and business solutions, adding value and efficiency to the institutions we serve. In doing so, we place the highest importance on respecting and protecting the privacy and confidentiality of the information shared with us. This Privacy Policy Statement applies to the information collected through our webpage www.ebtpr.com and to the application Contigo EBT. We provide this Privacy Policy Statement to inform users what type of information we may collect and also how we collect, use, share and protect your Personally Identifiable Information (PII). We also inform you the choices you can make about the way your information is collected and how that information is used. This information is very important so we hope you can take the time to review the following Privacy Policy Statement carefully.

The application Contigo EBT is owned by Evertec Group LLC, who is responsible for your information and has its principal place of business at Hwy 176 Km 1.3 Cupey, San Juan, P.R. 00926.

DEFINED TERMS

Affiliates - refers to companies controlled by a common owner. These can be financial or non-financial companies. Refers to related companies under the same corporate entity.
Cookie - text files that are stored on your computer or mobile device’s browser to record your preferences. When visiting our websites, we may collect your IP address, among other information, through “cookies”. These cookies do not contain your email address or other personally identifiable information, unless you choose to provide this information to us. However, once you provide your information to the webpage or the application Contigo EBT, the information may be linked to data stored in cookies.
Data Protection Authority (DPA) - independent public authorities that supervise, through investigative and corrective powers, the application of the data protection law. They provide expert advice on data protection issues and handle complaints lodged against violations of the General Data Protection Regulation (GDPR) and the relevant national laws. There is one Data Protection Authority in each EU Member State.
EBT - refers to “Electronic Benefit Transfer”.
EBT card - refers to the user’s Electronic Benefit Transfer card issued in the Commonwealth of Puerto Rico and registered for the service. The EBT card includes, and is limited to the following: “Tarjeta de la Familia”, “Tarjeta Unica”, “Tarjeta de Compensación del Trabajador” o “Tarjeta del Departamento de Educación”.
Non-affiliates - refers to companies not controlled by a common owner. These can be financial or non-financial companies. Refers to entities that are not related between them and do not belong to the same corporate entity.
Personally Identifiable Information (PII) - (common term in the United States) refers to information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc. alone or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. Personal information does not include de-identified data which cannot be associated with a specific individual.
Personal data - (common term in the European Union) refers to information relating to an identified or identifiable natural person. Personal data includes but it is not limited to, name and last name, physical address, email address, national identity card number, internet protocol (IP) address and other factors specific to the physical, physiological, genetics, cultural, religious, location or social identity of that person.
Secure Sockets Layer (SSL) encryption technology - secure protocol developed to ensure that the transmission of data between a server and a user, or vice versa, is completely safe and protected. When you visit a website starting with “https”, the “s” after the “http” indicates the website is secure.
Third party - a person who is not a party to a contract or transaction.

Information we collect from our users

We may collect nonpublic Personally Identifiable Information (PII) from you in order to operate the application Contigo EBT and to be able to provide the services through the application and the webpage www.ebtpr.com. Personal information is data that identifies you or that makes you identifiable. We collect information that you voluntarily provide us when you register as a user. We may also collect transaction information from the EBT system. We do not sell or rent the personal information we collect. The type of nonpublic PII that we may collect includes, but is not limited to:

Information received when you register in the Contigo EBT application: name and last names, email address, username and password (encrypted), EBT card number. You provide us that information when you register. The IP address, model and operating system of your electronic device may be collected when you register, when you log-in to the application. Information like name, last names, email, password (encrypted) and EBT card number is kept in the EBT system database.
Access information related to the application Contigo EBT: we may verify your username and password (encrypted) to authenticate you as user and to provide you with access to the application Contigo EBT.
Biometric information: If the user activates biometrics in the application, they can log-in to the Contigo EBT application with their fingerprint or face. This validation is performed by the device. If the face or fingerprint matches the one configured by the user on the device, then the encrypted credentials on the device are used to log in. If the user has not activated biometrics but wants to do so, they must press the biometrics icon (fingerprint or face) to activate biometric authentication. For security, you must enter your email and password to use biometric authentication in Contigo EBT. By continuing to the Activate Biometrics section in Contigo EBT, the user agrees that any biometric method stored on the device can be used to log into their profile. If the process is successful, the username and password will be saved on the device in encrypted form. Credentials encrypted on the device are deleted when (i) the user disables their biometric authentication in the Contigo EBT app or (ii) when the credentials encrypted on the device are no longer valid (because the password was reset or the password was changed on the Web Portal).
Contact information: we may collect additional information from or about you when you communicate with us, when you contact our Help Desk, or when you respond to a service survey.
Information on the next benefit authorized by the corresponding government agency: this information is obtained from the EBT system.
Transactional information: we may collect payment transaction information related to your EBT card for the last 180 days including the cardholder’s name and the EBT card’s current balance. This information is obtained directly from the EBT system.

Use and sharing of information

Information collected for a specific purpose will be used for that purpose only and in accordance with applicable contracts, laws and regulations. Generally, we use your information to be able to effectively provide our services. For example, to allow you to initiate a session in the Contigo EBT application and to provide you with access to view your transactions. Your credentials are validated on the EBT system and are used to authenticate your access to the application. Your email may be used to send you a security code to be used while registering, to restore your password and to communicate with you to provide information related to the Contigo EBT application. Your EBT card number and your personal identification number (PIN) are validated through the EBT system to verify that you are authorized to have access to the EBT account information. Information like cardholder’s name, EBT card balance, information on the next benefit authorized by the corresponding agency and transaction history for the last 180 days is obtained from the EBT system and will be available to the user after access to the application has been granted. Once in the application, a user will have access to information related to the EBT card registered under the user’s profile.

We may share your PII in order to carry out our daily operations, within the EBT system’s components. We may also share personal information to comply with law enforcement authorities pursuant to a subpoena, a court order or any other legal process or requirement. There are Federal laws that grant consumers the right to limit some, but not all, of the information that may be shared. Federal law only grants you the right to limit:

The sharing of information between affiliates for the purpose of daily operations which pertain to your credit capacity, (In Evertec, we do not ask you for, nor do we maintain, this type of personal information).
The sharing of information with affiliates to be used for marketing products and services. (Evertec does not share your personal information with affiliates for marketing purposes.)
The sharing of information with non-affiliates to be used for marketing products and services. (Evertec does not share you personal information with non-affiliates for marketing purposes.)

If you wish to limit the sharing of your personal information, please send your request to everteccompliance@evertecinc.com.

The following sets forth the ways in which we may share your personal information and whether or not you may limit what is shared according to Federal law:

Ways in which we may share your personal information:

1. We may share your personally identifiable information in order to carry out our daily operations; such as processing transactions, offering service related information and responding to court requests and legal investigations.

Does Evertec share your personal information? Yes

Can you limit what we share? No

2. For the purpose of conducting our affiliates’ daily operations - information about your transactions and experience with us.

Does Evertec share your personal information? Yes

Can you limit what we share? No

3. Sharing of information between affiliates for the purpose of daily operations which pertain to your credit capacity.

Does Evertec share your personal information? Information on credit capacity is not collected by Evertec for daily operation purposes

Can you limit what we share? We do not share

4. We do not share your personal information for marketing purposes, for our affiliates or non-affiliates to send you marketing offers.

Does Evertec share your personal information? No

Can you limit what we share? We do not share

If you live in California, California law gives you the right to ask if we disclose your personal information to third parties for their direct marketing purposes (we do not disclose your personal information for others’ direct marketing purposes). It also gives you the right to ask if we sell your personal information to third parties (we do not sell your personal information). California residents have a right to request access to certain personal information collected about them over the past 12 months, or to request deletion of their personal information, subject to certain exceptions, and may not be discriminated against because they exercise any of their rights under the California Consumer Privacy Act (CCPA).

Sharing with third-party service providers. We may share personal information with third-party service providers who perform services on our behalf as part of our daily operations. We have contractual agreements with our service providers that prohibit third parties from disclosing or using the shared information other than to carry out the business purposes for which it was shared. Our service providers are also required to maintain information security programs in place that include administrative, technical and physical safeguards to protect the security and confidentiality of personal information.

Sharing when required by law. We may disclose personal information to law enforcement and government authorities, if Evertec is compelled to do so by a subpoena, court order or similar legal procedure, or as otherwise required by law.

Sharing information for safety reasons and fraud prevention. We may share personal information to protect or prevent against actual or potential fraud, unauthorized transactions, claims or similar risks.

Your information may be transferred to and maintained in whole or in part on computer networks which may be located outside of the state, province, country or other governmental jurisdiction in which you reside, and may be stored on equipment or in facilities leased or licensed from third parties. Unless required to be disclosed in response to a legal process, such as a court order or subpoena, or to a law enforcement agency’s request, we will not share the collected information with third parties other than as set forth in this notice.

We use appropriate technology and well-defined employee practices to process the PII promptly and accurately. We will not keep personal data longer than is necessary, except as otherwise required by applicable law. If your Contigo EBT account has been closed, we reserve our right to retain access to the account’s information for as long as needed to comply with applicable laws. We will continue to use and disclose such personal information in accordance with this Privacy Policy Statement.

Access to your personal data

You have a right to request a copy of the personal information we collect from you through our Contigo EBT application or the webpage www.ebtpr.com. You may send your request through the email everteccompliance@evertecinc.com. We will require proof of your identity before providing any personal information. You can also review your personal information in your account settings at any time by logging in to your account.

Where appropriate, you may have the personal data erased, corrected, amended or completed. We reserve the right to refuse to provide our users with a copy of their personal data but will provide the reasons for our refusal. You will be able to challenge our decision to refuse to provide a copy of your personal data.

Use of cookies

In order to better serve you through the internet, we may use Cookies in our Contigo EBT application or the webpage www.ebtpr.com. A Cookie is a small piece of information which a web server may place on your device when you visit a web site. This is useful for having your browser remember some specific information which the web server can later retrieve. A Cookie allows your browser to remember you as a previous visitor and could improve the way you use the site because it remembers your preferences while you visit the site. When accessing some of the restricted areas at our website, your web browser sends an identifier of your device to our web servers. This information is collected to identify your device. If you wish to disable these Cookies, the “help” portion of the toolbar on most browsers will tell you how. However, if you set your browser to disable cookies, you may not be able to access certain areas or features of our webpages.

About security

Once we receive your PII, Evertec has security measures in place to help protect against the loss, misuse, unauthorized modification or destruction of the information under our control. We use industry-recognized security safeguards, such as firewalls, anti-virus, intrusion detection systems, and operational procedures to detect and preclude unauthorized parties from accessing our systems. We urge you to take adequate precautions to protect your personal information as well, including never sharing your personal or access information with anyone.

Our operational procedures include restricted access to customer’s non-public PII to those employees who have been trained to manage and safeguard this type of information. All employees, agents and contractors who have access to your PII are required to protect this information in compliance with our Privacy Policy. We hold our employees responsible for complying with our Privacy Policy and its principles, and we take the appropriate measures to enforce our employees’ responsibilities, as specified in our Code of Ethics. Additionally, we use internal and external resources to review the adequacy of our security procedures.

We use Secure Sockets Layer (SSL) encryption technology to safeguard the information shared with us in the restricted areas found in our website. SSL is the standard security technology for creating an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and intact. Adding SSL encryption to our web pages ensures end-to-end encryption for the duration of the session. You can verify this by looking for a lock icon in the address bar and looking for “https” at the beginning of the webpage’s internet address.

While we use encryption to protect sensitive information transmitted online, we also protect your information offline. Only employees who need the information to perform a specific job are granted access to PII. We also maintain physical and electronic security measures necessary to safeguard the confidentiality of your PII as required by law and by our Privacy Policy. These measures include restricting access to computers, archives and buildings. The computers and servers in which we store PII are kept in a secure environment.

Training and enforcement

The Contigo EBT application and Evertec employees may only process your personal information in accordance with this Privacy Policy Statement. We conduct training and periodic reviews of our compliance. Employees who do not comply with our Privacy Policy may be subject to disciplinary action, up to and including employment termination. Employees are expected to report any violations to our Privacy Policy to their managers, the Privacy Officer, the Compliance Director or Compliance Officer, the Legal Department or through the confidential Ethics Line at www.evertecethicsline.com.

No spam

Evertec will not send unsolicited text messages, or emails, requesting usernames, passwords, or any type of sensitive information. We will use e-mail to respond to e-mail messages received from you, for information purposes, or to engage in other communications which you have expressly permitted.

Links to other web sites

Our Contigo EBT application and/or webpage www.ebtpr.com may contain links to other webpages whose information sharing practices may be different from ours. We encourage our users to be aware when they leave our sites and/or applications and to review the terms and conditions and privacy notices of any other webpages and/or applications since we cannot assume any responsibility for the content or privacy policies of those other sites and/or applications.

Children’s privacy

Evertec is committed to the protection of children’s online privacy under the Children’s Online Privacy Protection Act (COPPA). We encourage parents and guardians to take an active role in their children’s online activities and interests. Evertec does not knowingly collect information from children under 13 years of age. Our application Contigo EBT and webpage www.ebtpr.com, are not targeted to children under 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, the parent or guardian should contact us at everteccompliance@evertecinc.com. Once notified, we will delete such information from our files as soon as reasonably practicable unless we are legally obligated to retain such data. Please contact us if you believe that we have mistakenly or unintentionally collected information from a child under the age of 13. If you are a child under 13, you may not use our services. Our services are not directed to children under the age of 13. If we unintentionally collected your data and later learn you are a child under the age of 13, we will delete the data as soon as possible.

Changes to this privacy policy statement

We review our Privacy Policy Statement regularly and may modify it from time to time when necessary. Some of the changes will be in response to changes in our business, our website www.ebtpr.com, our Contigo EBT application, our services, or applicable laws and regulations. The amended Privacy Policy Statement will be posted on our website and Contigo EBT application. We encourage you to periodically review this Privacy Policy Statement so that you will be aware of our updated privacy practices. The date when the Privacy Policy Statement was last updated will be included at the top right corner of the Privacy Policy Statement.

Contact Evertec with Questions regarding this Privacy Policy Statement

Individuals may address their privacy related concerns by contacting Evertec at everteccompliance@evertecinc.com. Please note that said email should only be used for privacy related concerns. For any other comments or concerns related to our services, or the Contigo EBT application, you may contact our Customer Service Call Center at the number located on the back of your EBT card or through the email ebtadmin@evertecinc.com. Please contact us if you have any questions about this Privacy Policy Statement, our privacy practices, your interactions on our webpages, our services or if you feel we are not complying with this Privacy Policy Statement. Every privacy-related question or comment will be acknowledged, evaluated and investigated, and the results of the investigation will be provided. If a complaint is found to be justified, appropriate corrective measures will be taken.

If you are a resident of the European Union, and have an unresolved privacy or personal information collection, use or disclosure concern that we have not satisfactorily addressed, please be aware that you may address your concern to your local Data Protection Authority, who may decide to further investigate the matter. Evertec will always fully cooperate with any regulatory request.