Privacy Policy

PanPay Privacy Policy

Effective date: July 24, 2026

Preamble

The PanPay group entity with which you have a contractual or pre-contractual relationship, and to which you have provided your personal data (the “Company”, “we”, “us”, or “our”), is the controller of your personal data. This Privacy Policy (“Policy”) explains how the Company collects, uses, processes, discloses, transfers, retains, and protects your personal information, and the rights available to you.

Which PanPay entity acts as your data controller, the services it provides, the regulator that authorizes it, the law that governs your relationship, and the contact point for privacy matters are set out in Table 1 below. This is intended to remove any ambiguity about jurisdiction and contracting parties.

Table 1 — Contracting Entities, Regulators, Governing Law and Privacy Contacts

For all entities, group-wide privacy matters and Data Protection Officer (DPO) enquiries may also be directed to customer@panpay.com and dpo@panpay.com. Entity-specific representatives are listed in Section 18.

PanPay UK Ltd. processes personal data in accordance with the UK GDPR and the Data Protection Act 2018, together with applicable UK legislation and ICO guidance. Where data is transferred outside the UK, PanPay UK applies appropriate safeguards (such as the ICO International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses).

PanPay Hong Kong Limited processes personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and guidance from the Office of the Privacy Commissioner for Personal Data, Hong Kong (“PCPD”). PanPay USA Inc. processes personal data in accordance with applicable U.S. federal and state law, including the Gramm–Leach–Bliley Act (GLBA), the Bank Secrecy Act, and, where applicable, the CCPA as amended by the CPRA.

Section 1: Definitions

Key terms used in this Policy have the meanings below; other terms have the meaning given under the applicable data protection law.

Personal data / personal information: information relating to an identified or identifiable natural person.

Processing: any operation on personal data — collection, storage, use, disclosure, transfer, or erasure.

Controller: the entity that determines the purposes and means of processing (here, the entity in Table 1).

Processor / service provider: a third party that processes data on our behalf under our instructions.

Special category / sensitive data: data needing enhanced protection, such as biometric data used for identification.

Data subject: the individual to whom the personal data relates.

Supervisory authority: the competent regulator (e.g., ICO in the UK; PCPD in Hong Kong; CPPA and the Attorney General in California).

Section 2: Purpose and Scope

2.1 Scope of the Policy

This Policy describes the information we collect about you, that you provide, or that third parties provide, and that we process when you visit our website, open or operate a PanPay Account, or use our services. It explains:

• the types of personal information we collect and how it may be used;
• our use of cookies and similar technologies;
• how and why we disclose your personal information to third parties;
• transfers within and outside your home country, and the safeguards applied;
• your rights to access, correct, update, transfer, restrict, object to, and delete your data; and
• the security measures protecting against loss, misuse, or alteration.

2.2 Acknowledgement

Please read this Policy carefully. Your use of our website and services is subject to this Policy and our Terms and Conditions. This Policy is provided for transparency and is not, by itself, your consent to processing. Where we rely on consent, we obtain it separately and clearly, and you may withdraw it at any time (Sections 7 and 12). The legal grounds are in Section 7.

Section 3: How We Collect Information

3.1 Collected automatically

When you register, open an account, browse, contact us, or use our portal, we automatically collect technical information that browsers and servers make available, to understand usage and maintain security — e.g., browser type, domain, operating system, pages viewed, IP address, date/time of requests, time zone, and data volume. We use cookies, web beacons, log files, and similar technologies (Section 12).

3.2 Provided directly by you

You may provide information via forms or by email, chat, or telephone. It may include information about other persons who are beneficiaries of our services; by providing it, you confirm you are authorized and that they have been informed of this Policy. You may decline, but this may prevent us from providing some or all services.

3.3 From external sources

We may collect data from legitimate external sources, such as public and private registers, sanctions and PEP screening providers, fraud-prevention agencies, and credit bureaus, to verify your identity and meet our legal obligations.

Section 4: Types of Personal Information

Some data is mandatory to enter into and maintain a relationship; other data is at your discretion. Failure to supply requested data may prevent onboarding or full access. Categories may include:

• Contact information: name, email, phone, billing/mailing address.
• Bank and payment account information.
• Identity-verification information: photograph, video data, and a copy of a valid ID document.
• Nationality.
• National identification numbers (including taxpayer IDs where required).
• Date and place of birth.
• Transaction details of transactions made using our services.
• Communications: calls, emails, chat, correspondence, and voice recordings.
• Usage and device data: transaction location, IP address, login location, internet usage.
• Corporate / beneficial-ownership information: directors, persons with significant control, and representatives.
• Cookie and tracking data (Section 12).
• Any other information you choose to provide.

4.1 Special category and sensitive data

Biometric data derived from a photo or video compared against an ID may be special category/sensitive data. We process it only where strictly necessary for identity verification and fraud prevention, relying on an appropriate basis (e.g., your explicit consent, legal claims, or substantial public interest such as fraud and AML prevention). We apply enhanced security and retain it only as long as necessary.

4.2 Accuracy

You are responsible for providing accurate, up-to-date information. To the maximum extent permitted by law, except for our gross negligence or willful misconduct, we are not responsible for losses arising from inaccurate or incomplete data you provide.

Section 5: How We Use Your Information

We use data to provide, operate, secure, and improve our services and to comply with the laws applicable to the regulated entity in the USA, UK, and Hong Kong. Specifically to:

5.1 Provide services and process transactions

Open and administer your account and process transactions, including, where applicable, transactions with a connection to mainland China or other jurisdictions that may require transaction, identity, payment-purpose, tax, customs, foreign-exchange, or regulatory information to be processed or disclosed to banks, payment-system operators, service providers, or authorities.

5.2 Comply with legal and regulatory obligations

Perform controls under AML/KYC requirements, FATCA, the Common Reporting Standard (CRS), sanctions screening, bookkeeping laws, and capital-adequacy requirements.

5.3 Protect against fraud and manage risk

Protect our customers, employees, and property — e.g., detect and investigate fraud, harassment, or other unlawful activity, and enforce this Policy and our Terms.

5.4 Improve our services and analytics

Understand how our website and services are used, on an aggregated and individual basis, to administer, monitor, and improve them, and for related research.

5.5 Customer support and communication

Respond to enquiries, provide requested information and support, and send service-related communications (such as security alerts and changes to terms).

5.6 Direct marketing (where permitted)

Where permitted by law and, where required, with your consent, send news, promotions, and information about similar products. You may withdraw consent or object at any time, free of charge. We do not need consent for communications strictly necessary to operate your account.

Section 6: Recording and Monitoring

6.1 Purpose of recording

For evidentiary and compliance purposes, communications relating to business transactions may be recorded and kept for a limited period (no longer than the law allows). We collect this to:

• prove transactions;
• comply with laws and regulations;
• comply with internal policies;
• facilitate administration and support;
• support security and fraud prevention; and
• investigate misuse or abuse of our services or systems.

6.2 Scope of monitoring

To the extent permitted by law, we may record or monitor communications (email, instant messaging, chat, fax, and other electronic communications) between our personnel and external parties for legitimate business purposes.

Section 7: Legal Basis for Processing

We rely on one or more of the bases below, depending on purpose and applicable law (UK GDPR for PanPay UK; PDPO for PanPay Hong Kong; GLBA and state law including CCPA/CPRA for PanPay USA).

7.1 Performance of a contract

To provide services, fulfill your requests, and act on your instructions — account administration, order handling, payment processing, and communication.

7.2 Legal and regulatory obligations

To comply with laws on payment services, KYC, AML/CFT, sanctions, and tax reporting (CRS, FATCA). Provision is mandatory and data may be shared with local and foreign authorities.

7.3 Legitimate interests

For security, risk management, fraud prevention, service improvement, and accounting, and to exercise or defend legal claims. We balance these against your rights; you may object (Section 13).

7.4 Consent

Where you give explicit consent — e.g., for certain sensitive-data processing, optional cookies, or marketing. You may withdraw at any time without affecting prior lawful processing.

Section 8: Disclosure of Personal Information

8.1 Categories of recipients

Group entities and departments: to review applications, for intra-group outsourcing, and to meet legal obligations, under appropriate safeguards.

Service providers (processors): (1) financial-messaging and payment partners (e.g., SWIFT); (2) technology and AI partners for cloud services and document processing.

Authorities and public services: within automatic information-exchange mechanisms and as required by law.

Banks, payment-system operators, brokers: for payments and transactions on your behalf.

Advisers, auditors, and business-transfer parties: e.g., in a merger or reorganization, subject to confidentiality.

8.2 Processors and AI providers

All providers are bound by written contracts and may not use your data for their own purposes. In particular, data processed via AI services is used solely to provide the contracted services (e.g., extraction and verification) and is not used to train the provider’s generative-AI models or other machine-learning algorithms.

8.3 No sale of personal information

We do not sell your personal information for monetary consideration. Where U.S. state laws define “sale” or “sharing” broadly, our practices and opt-out rights are described in Section 14.

8.4 Conditions for disclosure

We share data only where required by law or necessary to provide services. Where required by law or with your consent, we may share data with law-enforcement and authorities for anti-fraud, AML, and counter-terrorist-financing purposes.

Section 9: Storage and International Transfers

9.1 Global operations

Your data may be stored and processed in any country where we operate or engage providers, possibly outside your country of residence, which may have different data-protection rules.

9.2 Safeguards for transfers

We apply appropriate safeguards required by law, which may include transfers to jurisdictions recognized as adequate; the EU Standard Contractual Clauses; the ICO IDTA or UK Addendum; and supplementary measures. You may request details of a specific transfer (Section 18).

9.3 Transactions involving mainland China or other regulated jurisdictions

Where you instruct or undertake a transaction involving mainland China or another regulated jurisdiction, completing it may require processing or transferring relevant transaction, identity, payment-purpose, tax, customs, foreign-exchange, and regulatory information to banks, payment-system operators, service providers, or authorities under applicable laws and rules. This processing or transfer is necessary to perform your instruction and comply with legal, regulatory, bank, or service-provider requirements; where local law requires separate consent, we will obtain it first.

Section 10: Data Retention

We retain personal data only as long as necessary for the purposes in this Policy and to meet legal, regulatory, accounting, and reporting obligations. Principal periods are summarized below.

Once the applicable periods expire, your data is securely deleted or anonymized so it can no longer be associated with you.

Section 11: Security and Breach Notification

11.1 Security measures

Your data is stored on secure servers. We use TLS/SSL so communications are encrypted, and apply industry-standard techniques including encryption in transit and at rest, access controls, and monitoring. No internet transmission is fully secure; transmission is at your own risk. You must keep your credentials safe.

11.2 Personal-data breaches

We maintain procedures to detect, investigate, and respond to breaches. Where a breach is likely to risk your rights and freedoms, we will notify the competent authority and, where required, affected individuals, without undue delay and within the legal timeframes.

Section 12: Cookies and Similar Technologies

12.1 Types of cookies

Session cookies: remain only until you leave the site; required for operation; deleted when the browser closes.

Persistent cookies: remain longer; help recognize returning visitors and understand usage.

12.2 Your control

By default, only strictly necessary cookies are enabled. We use optional cookies (analytics, marketing) only with your explicit consent via the cookie banner. You can manage or withdraw consent anytime via “Cookie Settings”. Blocking some cookies may limit functionality.

Section 13: Your Rights

Subject to applicable law, you have the rights below. We do not charge a fee unless a request is manifestly unfounded or excessive, where we may charge a reasonable fee or decline.

13.1 Access

Confirm whether we process your data and obtain access to it and related information.

13.2 Rectification

Have inaccurate data corrected and incomplete data completed.

13.3 Erasure (“right to be forgotten”)

Request erasure where: the data is no longer needed; consent is withdrawn with no other ground; you object with no overriding grounds; it was processed unlawfully; or erasure is legally required. Erasure may be impossible where we must retain data (AML, tax); we then restrict processing instead.

13.4 Restriction

Request restriction where accuracy is contested, processing is unlawful but you prefer restriction, we no longer need the data but you need it for claims, or verification of overriding grounds is pending.

13.5 Data portability

Where processing is based on consent or contract and is automated, receive your data in a machine-readable format and transmit it to another controller.

13.6 Objection

Object to processing based on public interest or our legitimate interests; we stop unless we show compelling grounds. You may object to direct marketing at any time.

13.7 Automated decision-making

We do not currently make solely automated decisions producing legal or similarly significant effects. If we introduce them, we will give notice, explain the logic, and provide rights to human intervention and to contest (see Section 17).

13.8 Complaint

Without prejudice to other remedies, you may complain to a competent supervisory authority (Section 18).

Section 14: U.S. and California Residents

This Section applies where PanPay USA Inc. is your controller. Much data is subject to GLBA financial-privacy rules. Where the CCPA/CPRA applies and data is not exempt, California residents have the rights below. This Section does not expand the scope of services offered by PanPay USA Inc. under the applicable customer agreement.

14.1 GLBA financial-privacy notice

As a financial-services provider, we collect nonpublic personal information to provide services and as permitted by law. We do not sell it. We share it only to operate accounts, comply with law, prevent fraud, and with contracted providers — consistent with GLBA-permitted disclosures.

14.2 California rights (CCPA/CPRA)

• know the categories and specific pieces, sources, purposes, and recipients;
• request deletion, subject to legal exceptions;
• request correction of inaccurate information;

opt out of any “sale” or “sharing” and limit use of sensitive information; and

not be discriminated against for exercising these rights.

14.3 Sale and sharing

We do not sell personal information for monetary consideration and do not knowingly “share” it for cross-context behavioral advertising. If this changes, we will update this Policy and provide a “Do Not Sell or Share” mechanism.

14.4 Exercising U.S. rights

Submit requests using Section 18 contacts. We verify identity before responding and do not discriminate. You may use a verified authorized agent.

Section 15: Hong Kong

This Section applies where PanPay Hong Kong Limited is your controller. We handle data under the PDPO (Cap. 486) and its data-protection principles. You may request access to and correction of your data and be informed of our practices. We will not use your data for direct marketing without consent, and you may opt out at any time at no charge. Requests and complaints may go to Section 18 contacts or to the PCPD.

Section 16: Children’s Data

Our services are intended for individuals at least 18 (or the age of majority in their jurisdiction) and are not directed at children. We do not knowingly collect children’s data; if we learn we have, we will take reasonable steps to delete it. Please contact us (Section 18) if you believe a child provided us data.

Section 17: AI and Automated Processing

We use AI tools for specific tasks such as extracting and verifying information from identity and transaction documents and detecting fraud. These operate under human oversight and support — not replace — human decisions that significantly affect you.

As noted in Section 8, data processed via AI services is used solely to provide the contracted services and is not used by providers to train AI models. If we ever introduce solely automated decisions with significant effects, we will provide the notice and safeguards in Section 13.7.

Section 18: Contact and Complaints

Exercise your rights or raise any privacy question via the contact for your controller in Table 1, or email customer@panpay.com or our DPO at dpo@panpay.com.

We aim to respond within one month of verifying your identity. For complex or numerous requests, we may extend by up to two further months and will notify you of the extension and reasons. We may verify your identity and may decline or charge for manifestly unfounded or excessive requests.

18.1 Supervisory authorities

United Kingdom: the Information Commissioner’s Office (ICO).

Hong Kong: the Office of the Privacy Commissioner for Personal Data (PCPD).

California, USA: the California Privacy Protection Agency (CPPA) and the Attorney General.

18.2 Representatives

Where required by applicable law, PanPay will identify its appointed UK/EU representative and any other statutory representative, together with contact details, on our website or by notice.

Section 19: Changes to this Policy

We may update this Policy as our services evolve or as required by law. We will post the revised Policy and update the version above. Where a change is material or required by law, we will give at least 30 days’ prior notice of the effective date (e.g., website notice and/or email) and, where required, seek your consent or give you the chance to object.

Where continued use after the effective date is treated as acceptance of non-material changes, this does not apply to any change requiring your separate, freely given consent. If you disagree with a change, you may close your account at any time, free of charge, subject to settlement of outstanding obligations.