This Privacy Policy (the “Policy”) explains how we, KPay Merchant Service Limited (“we”, “us” or “ours”), collect, disclose, and protect information about you, the merchant company and its directors, shareholders, employees, contractors, and agents (together, the “Merchant” or “you”, “your” or “yours”) which are users of the Services. By using our Services, you acknowledge and agree to be bound by it. If you do not agree to this Policy, please stop using the Services immediately.
This Policy is applicable to you when you use or interact with our Services anywhere in the world, or our mobile app, or other channel (collectively, “Channels”). Depending on the context, “you” may mean any of the End User or Merchant.
1.1 End User: an individual user who uses our Services.
1.2 In-App Service Provider: the institutions which provide third party service (“In-App Services”) within the KConnect platform. You can register and use the In-App Services pursuant to the Terms & Conditions of KConnect.
1.3 Information: personal Information, and the information specified under section 3.
1.4 Merchant: the merchant company and its Representatives.
1.5 Partner: the institutions with which we partner to provide products and services (together, the “Partner”). We may partner with other institutions to provide product and service jointly. We provide our Partner with an End User's personal data concerning the activities of both the Partner and the respective End User. When you interact with a Partner, your Personal Information will be managed according to the Partner's privacy policies, not this Policy.
1.6 Personal information: information that identifies you as an individual (whether directly or indirectly), such as your basic personal details, including first and last name, date of birth, and copies of your government ID documents (e.g., passport or local ID card), and contact information.
1.7 Representative: the merchant company’s directors, shareholders, employees, contractors, and agents (together, the “Merchant”) which are users of the Services.
1.8 Services: various technologies and services offered by KPay.
1.9 This Policy forms an integral part of KPay Merchant Payment Services Agreement - General Terms and Conditions (the “Terms and Conditions”). The capitalized terms herein shall have the same meaning ascribed to them in the Terms and Conditions, unless otherwise defined.
2.1 As used in this Policy, “we,” “us,” “our,” and “KPay” refer to the KPay Merchant Service Limited that acts as the data controller with respect to your Information, registered at 31/F, Funt Tower, 35 Hung To Road, Kwun Tong, Hong Kong.
3.1 Information you provide directly to us:
3.1.1 Account and Profile Information: In order to use our Services, you must provide certain Personal Information to us necessary to set up an account profile or use the various functions of our Services. We may require you to provide us with additional Personal Information as you use our Services. All such information is crucial for us to fulfil our contracted services with our Partner and to adhere to our legal obligations. Failure or unwillingness to provide this information may result in our inability to provide you with all requested Services.
3.1.2 Transaction Data: To enable you to utilize our Services, we will collect information regarding the transactions initiated on the Channels, including but not limited to the amount, time, currency, payment method, sender’s and recipient’s information.
3.1.3 Customer Support Information: In order for us to perform and improve our customer support, we may retain or request information including voice recordings and other documents as may reasonably requested by us.
3.1.4 Survey, Feedback, and Promotions: Some information you provide to us is voluntarily provided by you and not mandatory. Examples of such information include your opting to respond to our surveys, provide feedback to us about our products and services, participate in promotions or contests or otherwise communicate with us. This information allows us to provide incentives or additional features to you, evaluate our performance and to create a better user experience for you when using our Services. This additional information will be processed based on our reasonable discretion or when applicable, your consent.
3.2 Information automatically collected from your use of Services
3.2.1 When you use our Services, we automatically gather specific data from you based on our legitimate interests (such as preventing fraud or misuse, or enhancing our Services by understanding your usage patterns). This includes: Transaction Data, beneficiary information, card related information; usage data; information about the devices you use to access the Services; recordings; log data; and location information. Please refer to section 4 for more details on how we use your Personal Information.
3.3 Information collected from third parties
3.3.1 Please note that we also obtain information about you from various external sources, which may include our ecosystem and financial partners, payment service providers, service providers, credit bureaus, credit reference agencies, financial institutions, debt collection agencies, official registers and databases, fraud prevention agencies and partners, community forums for ratings or reviews, our business partners, the Partner, or other publicly available records.
3.3.2 The gathering and sharing of such Personal Information with KPay are also delineated in the respective privacy policies of these third parties. Additionally, we may combine information obtained from third parties with data collected directly from you through the Channels.
3.3.3 Irrespective of the collection method, the information we acquire from or about you is always subject to the privacy choices or rights you exercise.
4.1 This section provides more detail on the types of Personal Information we collect from you and the purposes behind it.
4.2 Account and Profile Information: This includes personal identifiers such as your first and last name, registered office address, email address, date of birth, passport number, local ID card number, company’s registration name, corporate registration certificate, average monthly turnover, or other similar identifiers. We use such information:
4.2.1 to facilitate the provision of Services, which includes:
4.2.2 to prevent fraud, misuse or breaches of the terms and conditions of our Services, which includes:
4.2.3 to communicate with you, which includes:
4.3 Identity Verification Documents (Merchant only): To comply with laws and regulations, we may collect copies of your government-issued identification document. This includes details such as your name, date of birth, identification document (including passport or local ID card), address proof, or other authentication information, all of which may include photographs of you. To the extent permitted by applicable law, we may obtain reports about you from public records. In order to obtain such reports, we may use Information or Personal Information you provide to us. We use such information:
4.3.1 to fulfil our legal obligations and provide the Services, which includes:
4.3.2 to prevent fraud, misuse or breaches of the terms and conditions of our Services, which includes:
4.4 Transaction Data: We may collect financial information such as bank account details (account number, routing number), credit or debit card numbers, billing address, payment method information, location, transaction amount, date of transaction or tax information. We use such information for:
4.5 Beneficiary Information: We may collect information about the parties to the transaction, the designated recipient (including the recipient’s bank account information), the source of the funds, the reason for the transaction, the devices and payment methods used to complete transactions. We use such information for:
4.6 Card Related Information: We use card numbers and details for:
4.7 Business Entity Information: If you are using the Services on behalf of a Merchant, we may collect information about the Merchant including: the organisational structure of the company, the company address, the product and service offerings, website domain name used by the business, information about the beneficial owners of the business, tax classification of the business, tax identification number(s), company registration number(s),and its tax residence. We also may collect entity formation documents or other corporate records. We use such information:
4.7.1 to facilitate the provision of Services, which includes:
4.7.2 to prevent fraud, misuse or breaches of the terms and conditions of our Services , which includes:
4.7.3 to communicate with you, which includes:
4.8 Log Data: When you access the Services, we collect server logs which may include information such as access times and dates, pages viewed and other system activities, including the third-party site you were using before accessing our Services. We use such information for:
4.9 Device Information: We may obtain information about the devices you use to access the Services and the Channels including: the device type, operating systems and versions, the device manufacturer and model, preferred languages, and plugins. We use such information for:
4.10 Usage Information: We collect information about how you interact or engage with the Channels and how you use the Services including your user preferences and other settings selected by you. This information may be collected if you visit our Channels and regardless of whether or not you establish an account with us or conduct a transaction. We use such information for:
4.11 Location Information: When you use certain features of the Services, we may collect information about your precise or approximate location as determined by data such as your IP address or mobile device GPS. Most mobile devices allow you to control or disable the use of geolocation services for applications by changing preferences on your mobile device. We use such information for:
4.12 Communications Data: We may collect information related to your interactions and communications with us, which may include email messages, chat sessions, text messages, and phone calls that we exchange with you. We use such information for:
4.13 Call Recordings: We may collect voice recordings of you captured when you contact us or if we contact you, including interactions with our customer service or sales teams. We use such information for responding to your inquiries and customer support requests.
4.14 Various Other Information: We may collect any information you may provide us when you respond to surveys, for running the survey and analysing the results for our internal business purposes.
4.15 We may also collect any information you may provide us when you participate in promotions or request to receive promotional information. We use such information for:
5.1 Transfer of Information to Other Countries
5.1.1 We store and process your Personal Information in Hong Kong and elsewhere in the world. However, we may also transfer and process your Personal Information in jurisdiction outside of your jurisdiction of incorporation, business operations, or residence. These jurisdictions may not have data protection laws substantially similar to Hong Kong's Personal Data (Privacy) Ordinance or laws achieving equivalent objectives. Consequently, your information may not receive the same level of protection as it would in Hong Kong. There may be instances where we are obligated to disclose your Personal Information in accordance with lawful requests from local law enforcement or government authorities. Your continued use of our Services constitutes your consent to the transfer of information. Should you withhold this consent, we will be unable to provide you with the Services.
5.2 Information Sharing and Disclosure
5.2.1 When providing you with Services, we may share your information with third parties including those set out in 5.2.2 to 5.2.7. Situations where this occurs are when we engage a variety of service providers (who act as data processors) to enable us to provide our Services to you and to our Partner. In such cases, Personal Information will be used to facilitate payment processing, support technology or infrastructure, cloud storage, conduct market research, marketing analytics, detect fraud, verify identity and perform audits or other necessary functions. We will share your Personal Information with such service providers only to the extent necessary to allow the performance of their intended engagement. All service providers and business partners that receive your Personal Information are contractually bound to protect and use your information only in accordance with this Policy.
5.2.2 Our Corporate Affiliates: To facilitate or support us in providing the Services to you, we may share your Personal Information within the KPay group of companies. All KPay group companies may only use your Personal Information in accordance with the relevant Intra-Group contracts governing such processing and for the purposes set out in this Policy.
5.2.3 Financial and Ecosystem Partners: The Services may be offered to you in conjunction with or facilitated by other financial institutions, other payment institutions or other ecosystem partners. These partners could include providers of accounting or treasury management services, as well as marketplace payment service providers. For Financial or other payment institutions, the transfers and disclosures are necessary to provide you with the Services. As for ecosystem partners, any disclosures and transfers will be carried out as per your authorization or request, or as described to you, enabling you to utilise the products and services offered by these ecosystem and financial partners. When you grant permission or authorise third-party providers, plugins, widgets, or websites to access your account or receive your Information, it will be considered a formal request or authorization.
5.2.4 Partner: We may also refer you to services provided by our Partner. Our Partner provides services under their own licences or authorisations, will have direct contracts with you and may be independent data controllers of the data you provide to them or data generated from your use of their services. KPay has no responsibility for any Partner services. By using our Services, you agree and acknowledge that we may transfer our Partner any Information that may be required.
5.2.5 Regulatory Authorities: There are situations where we have a legal obligation to disclose information about you to various authorities, including regulators, judicial authorities, courts, law enforcement agencies, tax authorities, and other public or government entities, both domestic and international. These disclosures may be necessary to comply with legal obligations or processes, enforce our terms and conditions of our services, address security or fraud issues, or protect our users. Please note that these disclosures may occur with or without your consent, and with or without prior notice, as long as they are in accordance with valid legal processes, such as regulatory queries, subpoenas, court orders, or search warrants. In many cases, we are prohibited from notifying you about such disclosures by the terms of the legal process. Additionally, we may disclose your information to:
5.2.6 Reorganisation: In the event that our company is engaged in a corporate merger, acquisition, consolidation, reorganisation, sale, joint venture, assignment, transfer, or other disposition of all or part of our business, assets, or stock (including bankruptcy or similar proceedings), we may share data with third parties during the negotiation process. If your Information becomes subject to a different privacy policy as a result, we will make reasonable efforts to notify you in advance. Additionally, there may be situations where we need to disclose Information to a third party in connection with a commercial transaction where we or any of our affiliates are seeking financing, investment, or funding.
5.2.7 In-App Service Provider: Before registering and using In-App Service in KConnect, you should review the privacy policy of any In-App Service Provider that will gain access to your Personal Data. In your use of In-App Services, we may also collect different types of information such as technical information and business information from you depending on your use of the In-App Services, including personal data, and In-App Services Providers may also provide data arising from your usage of the In-App Services to us (collectively referred as “Merchant Data”). We will collect, store and process the Merchant Data in accordance with section 4 of this Policy.
5.2.8 Third Party Requested by You: If you request (as part of the Services provided to you) or provide your consent, we may share your information including your Personal Information with a third party not defined in this Policy.
6.1 We will retain your Information for as long as necessary to comply with relevant laws, fulfil any ongoing obligations to you, or for our internal business needs, as permitted by applicable law.
6.2 Even if you close your account or request the deletion of your Information, we may still retain it for certain circumstances as below:
6.3 Once a relevant retention period has expired, KPay will either destroy the Information or, if applicable, sufficiently anonymize it to remove any identifiable elements.
7.1 If you are located in Hong Kong, you have legal rights concerning the Personal Information we hold about you, to the extent permitted under applicable laws and regulations. You have the right to submit a subject access request to obtain a copy of the data we process about you, request correction of your data, and object to the use of your Personal Information for direct marketing purposes. Please note that there may be a fee charged by us for fulfilling a data access request.
8.1 Device Permissions: Most mobile devices allow you to disable location services or revoke consent for applications to access your camera, photo library, or send you push notifications. You can refer to your device settings to restrict the collection of certain information.
8.2 Notifications: We may occasionally send you notifications that we deem necessary, such as notifications for temporary service suspensions due to maintenance or security, privacy, or administrative-related communications. You cannot opt out of these service-related notifications as they are not promotional in nature.
8.3 Marketing Opt-Out: Marketing Opt-Out: As explained in section 4, we only send promotional communications with your consent. If you wish to opt out of receiving such promotional communications from us, you can contact our customer service to modify your preferences. Please note that if you choose to opt out of marketing-related emails, you will still receive non-promotional messages that are necessary for providing our Services, such as transactional receipts and messages related to your account or our relationship with you.
9.1 We may collaborate with third-party partners to present advertisements to you on websites you visit. These partners utilise cookies and other technologies to collect information about your activities on our websites, as well as other websites you visit. This information is used to deliver targeted advertising based on your browsing history and interests.
10.1 We implement and update technical and physical security measures to safeguard your Information against loss, misuse or unauthorised access on an ongoing basis. Safeguards used to protect your information include firewalls, data encryption, and access controls. Please keep in mind that the transmission of information over the Internet is never 100% secure and no data storage system can be guaranteed safe. Although we will do our best to protect your Information, we cannot warrant the security of data transmitted to our Channels; any transmission is at your own risk. We encourage you to understand the integral role you play in keeping your own Information secure and confidential. Please select passwords that are sufficiently complex and always keep our log-in details secure. If you suspect any unauthorized use or access to your account or information, please contact us immediately.
11.1 Our Services and Channels are not intended for or directed towards children. By “children”, we refer to users under the age of 16, or any different age specified by the applicable country's minimum age for processing Personal Information.
11.2 We do not knowingly collect any information from children. If we become aware that we have unintentionally collected Personal Information from a child, we will promptly delete it, unless we are legally required to retain such information. If you believe that we have inadvertently collected information from a child, please contact us immediately.
12.1 Our websites may contain links to third-party websites or services, including third-party integrations, co-branded services, or services branded by third parties (“Third-Party Channels”). Clicking on these links or enabling such connections may allow third parties to collect or share information about you. We do not own or control these third-party websites. When you interact with these Third-Party Channels, you may be providing information directly to the Third-Party Site, KPay, or both. Each Third-Party Site will have its own policies regarding the collection, use, and disclosure of your information. You should review the policies of these Third-Party Channels for more information.
13.1 We reserve the right to make changes to this Policy at any time by posting a revised version on our website and updating the “Last Updated” date at the top of the Policy. By using our Services following such notice or publication, to the extent permitted by applicable law, you consent to the revised Policy. If you do not agree with any of the changes made, you have the option to deactivate your account with us at any time.
14.1 If you have questions or concerns about this Policy or a specific request related to your Personal Information, please contact us at cs@kpay-group.com and we will endeavour to deal with your request as soon as possible.
14.2 You can also send physical mail to:
KPay Merchant Service Limited
31/F, Fun Tower,
35 Hung To Road, Kwun Tong,
Kowloon, Hong Kong
Attention: Customer Service
15.1 Except as otherwise set out by law, in case of any inconsistency between the English version and translated version of this Policy, the English version shall prevail.
Last updated: 25 July, 2025