Welcome to Midaspay HK!

This Privacy Policy explains the when, how and why when it comes to the processing of your personal information for facilitating payment transactions and providing any other services to support payment transactions by Midaspay HK (“Midaspay HK Service”), and sets out your choices and rights in relation to that information. Please read it carefully – it will allow you to understand how we collect and use your information, and how you can control it.

Please note that this Privacy Policy only applies to the Midaspay HK Service. If you use any other products or services, please refer to the privacy policy for that particular product or service.

If you do not agree to the processing of your personal information in the way this Privacy Policy describes, please do not provide your information when requested and stop using Midaspay HK. By providing your information through Midaspay HK you are acknowledging how we process your personal information as described in this Privacy Policy.

PLEASE NOTE THAT IF YOU ARE A USER OF A PRODUCT OR PLATFORM THAT INCORPORATES THE MIDASPAY HK SERVICE, YOU SHOULD DIRECT ANY QUERIES REGARDING THE PROCESSING OF YOUR PERSONAL INFORMATION (INCLUDING PAYMENT INFORMATION) TO THAT PRODUCT OR PLATFORM.

Midaspay HK is operated by Harvest Sharp Limited ("we", "our" and "us").

For the purpose of data protection laws, the data controller of your personal information in relation to the Midaspay HK Service is Harvest Sharp Limited, whose registered address is 29th Floor, Three Pacific Place, 1 Queen’s Road East, Hong Kong.

Our data protection officer can be contacted at dpo@centauriglobal.com.

Please reach out to us if you have any questions or concerns regarding the processing of your personal information.

1. The Types of Personal Information We Use

This section describes the different types of personal information we collect from you and how we collect it. If you would like to know more about specific types of data and how we use that data, please see the section entitled “How We Use Your Personal Information” below.

The following is a high-level summary of the types of personal information we use. This information is provided by you directly or generated when you use Midaspay HK.

· Payment information

· Card binding function data (if and to the extent applicable)

· Device and network information

· Sanctions and verification data

· Transaction records

2. Children

Children must not use Midaspay HK for any purpose, except where their parent or guardian has provided lawful consent (to the extent this option is available in your jurisdiction)

By children, we mean users under the age of 18 years old; or in the case of a region where the minimum age for processing personal information differs, such different age. For users located in certain regions we have listed the relevant minimum age as of the date of this policy in the table below. You should in any case refer to the laws in your jurisdiction to ensure you are above the relevant legal minimum age.

Country in which the user is located	Minimum age of the user
Australia	18
Brazil	18
Cambodia	18
Canada	13
Colombia	18
European Economic Area	16
India	18
Indonesia	21
Japan	18
Malaysia	18
Mexico	18
New Zealand	16
Nigeria	13
Philippines	18
Singapore	13
South Africa	18
United Kingdom	13
United States	13
Vietnam	16

Other than as provided above, we do not knowingly collect personal information from children under these ages for any purpose. If you believe that we have personal information of a child under these ages without lawful consent, or if you are the parent or guardian of the user and wish to withdraw consent, please contact us.

3. How We Process Your Personal Information

This section provides more detail on the types of personal information we collect from you, and why. For users who live in Brazil, the United Kingdom, European Economic Area (“EEA”), Switzerland or Thailand (“Relevant Jurisdiction”), it also identifies the legal basis under which we process your data.

Personal Information	Use	Lawful Basis of Processing
Payment information (native or from payment processor/ merchant) such as card number, CVC, CVV, expiry date, card holder's name, user's billing address, region, transaction cost, time and date, user ID/payer ID/Open ID, Order reference ID, and certain browser and device information. Notification of payment and/or transaction status (from payment processor) or alternative payment method, including: country, payment status, device type, currency, funding source, phone number, email address, card hash, card name and details, card issuing bank and country, billing address, expiry date, amount, date, time, payment method, browser code, payment account reference, authentication code, card bin.Notification of payment and/or transaction status (to merchants): transaction details, merchant details, details and status of order, card information, refund information.	We use this information to process your transaction, ensure the validity of your identity and transaction, and for risk control services provided to Midaspay HK.	We process this information pursuant to contracts you have entered into to process payment transactions.
Invoice data: card holder’s personal details, contact details, payment address, transaction information and device information.	We use this information to process your transaction, and to create invoice(s).	We process this information pursuant to contracts you have entered into to process payment transactions.
Card binding function data (if and to the extent applicable): card number (encrypted), expiry date, card holder's name, user’s billing address, CVV (not stored after verification).	We use this information if providing a card binding function for a platform.	We process this information pursuant to contracts you have entered into to process payment transactions.
Device and network information: web browser type and browser version, device fingerprint, location of device, IP address, open ID, operating system version, country, internet connection, page loading time, type of device, number of visits, platform use time, networks, demographic estimate, platform or referral source.	We use this information to process your transaction, improve Midaspay HK and prevent fraud and misuse of Midaspay H, and for risk control services provided to Midaspay HK.	It is in our legitimate interest to maintain and improve the security and integrity of Midaspay HK.
Sanctions and verification data: card hash, card BIN, email address, user's phone number, card number, card type, expiry date, card holder's name, user's billing address, currency, cost, order ID, product ID, merchant user ID, and provider ID.	We use this information to verify the validity of a transaction, and for risk control services provided to Midaspay HK.	We process this information pursuant to contracts you have entered into to process payment transactions. It is in our legitimate interest to maintain and improve the security and integrity of Midaspay HK.
Risk controls data (if and to the extent applicable): transaction and order data, card payment information, card holder’s personal details, identification details, relevant tax details, contact details and location.	We use this information to verify the validity of a transaction, user support, and for risk control services provided to Midaspay HK (including, but not limited to identity verification and transaction monitoring).	We process this information pursuant to contracts you have entered into to process payment transactions. It is in our legitimate interest to maintain and improve the security and integrity of Midaspay HK.
Information that you provide to us (for the use of Mastercard’s Click-To-Pay Service)
User Information Customer Account Information: email address, mobile phone number, OTP value, transaction amount, currency, masked cards (card bin, last four digits, pan expiration year & month, date of card created, masked billing address). Equipment and online transaction information such as the relevant url, referrer and any errors.	We use this information to process and/or facilitate your transaction, and to improve your experience when using our Midaspay HK Service.	We process this information pursuant to contracts you have entered into to process payment transactions.
Card Information Checkout information: transaction details, card details, card holder’s name, billing address, payment token and payment cryptogram. Payment-related information: order details, card details, card holder’s personal details, contact information and billing address, device information, network and connection information, service usage information, network token, and payment cryptogram and token.	We use this information to process and/or facilitate your transaction, and ensure the validity of the transaction.	We process this information pursuant to contracts you have entered into to process payment transactions.
Sanctions and Verification Information: transaction details, card details, card holder’s personal details, contact information and billing address, device information, network and connection information, and service usage information.	We use this information to verify the validity of a transaction, and for risk control services provided to Midaspay HK.	We process this information pursuant to contracts you have entered into to process payment transactions. It is in our legitimate interest to maintain and improve the security and integrity of Midaspay HK.
Payment Notification Information: location of card holder, device information, card details, customer details, status of payment transaction, currency, details and status of transaction, and details of merchant and PSP.	We use this information to notify you of the status of the transaction.	We process this information pursuant to contracts you have entered into to process payment transactions.

4. How We Store and Share Your Personal Information

As part of providing the Midaspay HK Service, we may transfer data outside of the location in which you are based for the purposes described in this Privacy Policy. We have servers for the Midaspay HK Service in Singapore and the Hong Kong Special Administrative Region (“Hong Kong”). The servers applicable to your use of the Midaspay HK Service will depend upon your location. We also have support, engineering and other teams who may support the Midaspay HK Service, including from Singapore.

For EEA/UK users, transfers between our affiliates and to third parties use applicable safeguards, such as incorporating standard contractual clauses, obtaining your consent first or taking into account adequacy assessments.

Only where necessary will we share your personal information with third parties. Situations where this occur are:

· Third parties that provide services in support of Midaspay HK, including third party payment processors for the purpose of processing the credit card payment and facilitating payment in accordance with local regulations. All companies providing services for us are prohibited from retaining, using, or disclosing your personal information for any purpose other than providing us with their services and/or to comply with their legal obligations under applicable laws.

· Companies within our corporate group who process your personal information solely for the purpose of providing the Midaspay HK Service to you. All such group companies may only use your personal information in accordance with this Privacy Policy.

Regulators, judicial authorities and law enforcement agencies, and other third parties for safety, security or compliance with the law. There are circumstances in which we are legally required to disclose information about you to authorities, such as to comply with a legal obligation or processes, enforce our terms, address issues relating to security or fraud, or protect our users. These disclosures may be made with or without your consent, and with or without notice, in compliance with the terms of valid legal process such as a subpoena, court order, or search warrant. We are usually prohibited from notifying you of any such disclosures by the terms of the legal process. We may seek your consent to disclose information in response to a governmental entity’s request when that governmental entity has not provided the required subpoena, court order, or search warrant. We may also disclose your information to:

enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
detect, prevent or otherwise address security, fraud or technical issues; or
protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction).

A third party that acquires all or substantially all of us or our business. We may also disclose your information to third parties if we either: (a) sell, transfer, merge, consolidate or re-organise any part(s) of our business, or merge with, acquire or form a joint venture with, any other business, in which case we may disclose your data to any prospective buyer, new owner, or other third party involved in such change to our business; or (b) sell or transfer any of our assets, in which case the information we hold about you may be sold as part of those assets and may be transferred to any prospective buyer, new owner, or other third party involved in such sale or transfer.

5. The Security of Your Personal Information

We have information security and access policies that limit access to our systems and technology, and we protect data through the use of technological protection measures such as encryption.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will implement and maintain reasonable measures to protect your personal information, we cannot guarantee the security of the information transmitted through the Midaspay HK Service or otherwise via the Internet; any transmission is at your own risk.

6. Data Retention

We do not keep your data for longer than is necessary to fulfil the relevant purpose described above unless we are required or permitted to do so under law. If we retain your information beyond the retention periods set out below, for example to comply with applicable laws, we will store it separately from other types of personal information.

For further details on how long we keep your data, please refer to the time periods set out below.

Personal Information	Retention Policy
Device & Network Information	Fifteen (15) days (unless otherwise required to be retained for the purpose of providing the Midaspay HK Service or required to be retained in accordance with statutory retention requirements)
Other Information	Seven (7) years (unless otherwise required to be retained in accordance with statutory retention requirements); a user may remove their payment information at any time by updating their account information

7. Yo ur Rights

Some jurisdictions’ laws grant specific rights to users of Midaspay HK.

Please refer to the Supplemental Jurisdiction-Specific Terms, or the applicable laws in your jurisdiction for an overview of specific rights that apply to persons subject to data protection lists in the listed jurisdictions and how these can be exercised.

You may have certain rights in relation to the personal information we hold about you. Some of these only apply in certain circumstances (as set out in more detail below). You can exercise some of these rights directly by accessing and updating the information in your account. If you believe we hold any other personal information about you, please contact us.

Access

You may have the right to access personal information we hold about you, how we use it, and who we share it with. You can access the personal information you have made available as part of your account by logging into your account.

Portability

You may have the right to receive a copy of certain personal information we process about you. For example, in certain jurisdictions this can comprise personal information we process on the basis of your consent (e.g., survey information) or pursuant to our contract with you (e.g., account name), as described above in the section “How We Use Your Personal Information”. We will provide further information to you about transferring this data if you make such a request.

Correction

You may have the right to correct personal information we hold that is inaccurate. You can access the personal information we hold about you by logging into your Midaspay HK Service account

Erasure

You may be able to delete your account, or remove certain personal information, by logging into your Midaspay HK Service account. We may need to retain personal information if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or freedom of expression) but we will let you know if that is the case. Where you have requested that we erase personal information that has been made available publicly on the Midaspay HK Service and there are grounds for erasure, we will use reasonable steps to try to tell others that are displaying the personal information or providing links to the personal information to erase it too.

Restriction of Processing to Storage Only

You may have a right to require that we stop processing the personal information we hold about you (other than for storage purposes in certain circumstances). Please note, however, that if we stop processing the personal information, we may use it again if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or for another’s protection). Where we agree to stop processing the personal information, we will take steps to tell any third party to whom we have disclosed the relevant personal information so that they can stop processing it too.

Objection

You may have the right to object to our processing of your personal information. If you wish to do so, please contact us at dpo@centauriglobal.com or using the contact details set out below, and we will consider your request.

Consent Withdrawal

To the extent provided by applicable laws and regulations, you may withdraw consent you previously provided to us for certain processing activities by contacting us at dpo@centauriglobal.com. Where consent is required to process your personal information, if you do not consent to the processing or if you withdraw your consent, we may not be able to deliver the expected service. Please note that the right to withdraw consent is only available if the legal basis for processing information is consent.

Announcements

We may from time to time send you announcements when we consider it necessary to do so (for example, when we temporarily suspend access to Midaspay HK for maintenance, or security, privacy or administrative-related communications). These are essential system and service-related announcements and you are not able to opt-out of these notifications, which are not promotional in nature.

8. Contact

Please get in touch with us if you have any questions. You can reach us in the first instance at:

Email: dpo@centauriglobal.com.

Mailing Address:

Tencent International Privacy & Data Protection Centre

30 Raffles Place #19-01

Singapore

048622

9. We will endeavour to deal with your request as soon as possible. This is without prejudice to any right you may have to launch a claim with a data protection authority in the region in which you live or work where you think we have infringed data protection lawsChanges

If we make any changes to this Privacy Policy, we will post the updated Privacy Policy here and notify you in accordance with relevant legal requirements.

10. Language

Except as otherwise prescribed by law, in the event of any discrepancy or inconsistency between the English version and local language version of this Privacy Policy, the English version shall prevail.

Our representatives for data protection purposes in certain jurisdictions are as follows:

Jurisdiction	Representative	Address	Contact details
UK	Image Frame Investment (UK) Limited	Suite 1, 3rd Floor 11 - 12 St. James's Square, London, United Kingdom, SW1Y 4LB	eudataprotection@tencent.com
EU	Tencent International Service Europe B.V.	Gustav Mahlerplein 2, 1082 MA, Amsterdam, the Netherlands	eudataprotection@tencent.com
Thailand	Tencent (Thailand) Limited	T-One Building, Bangkok, Thailand	localrepresentative@tencent.co.th

SUPPLEMENTAL TERMS – JURISDICTION-SPECIFIC

Some jurisdictions’ laws contain additional terms for users of Midaspay HK, which are set out in this section.

If you are a user located in one of the jurisdictions below, the terms set out below under the name of your jurisdiction apply to you in addition to the terms set out in our Privacy Policy above.

Australia

We take reasonable steps to ensure that third party recipients of your personal information located outside Australia handle your personal information in a manner that is consistent with Australian privacy laws. However, you acknowledge that we do not control, or accept liability for, the acts and omissions of these third party recipients.

If you are dissatisfied with our response to your privacy complaint in respect of your personal information, you may contact the Office of the Australian Information Commissioner (Telephone: +61 1300 363 992 or email: enquiries@oaic.gov.au).

Brazil

BY ACCEPTING THIS PRIVACY POLICY, YOU EXPRESSLY STATE THAT YOU AUTHORISE US TO COLLECT, USE, STORE, AND PROCESS YOUR PERSONAL INFORMATION, INCLUDING, DISCLOSING TO THIRD PARTIES, TO THE EXTENT PROVIDED BY THIS PRIVACY POLICY.

California

This section applies to California residents covered by the California Consumer Privacy Act of 2018 (“CCPA”).

Collection and Disclosure of Personal Information

Over the past 12 months, we have collected and disclosed the following categories of personal information from or about you or your device:

Identifiers, such as your name as it appears on your credit card, Open ID / user ID, IP address, phone number, mailing or billing address, and email address. This information is collected directly from you and your device.
Internet or other electronic network activity information, such as device and network information as described in the main Privacy Policy. This information is collected directly from you and your device.
Other information described in subdivision (e) of Section 1798.80, including your credit card number or any other financial information. This information is collected directly from you in the context of being our consumer.

We collect your personal information for the following purposes:

To provide you with Midaspay HK, to process your transaction and ensure the validity of your identity and transaction.
To provide a card binding function for a platform (if and to the extent applicable).
To improve the Midaspay HK Service.
For security and verification purposes, including to prevent and detect fraudulent activity and misuse of Midaspay HK.

For additional information about what each type of personal information is used for, see Section 3 (How We Process Your Personal Information).

We disclose personal information to the following types of entities:

Other companies within our corporate group who process your personal information in order to operate Midaspay HK.
Other companies that provide services on our behalf in support of Midaspay HK and who are prohibited by contract from retaining, using, or disclosing personal information for any purpose other than for providing their services to us.
Regulators, judicial authorities and law enforcement agencies.
Entities that acquire all or substantially all of our business.

In the past 12 months, we have not sold Personal Information of California residents within the meaning of “sold” in the CCPA.

Canada

If you are located in Canada and wish to obtain written information about our policies and practices with respect to our service providers located outside Canada, you may contact us as specified in Section 8 (Contact). Where we use service providers who might have access to your personal information, we require them to have privacy and security standards that are comparable to ours. We use contracts and other measures with our service providers to maintain the confidentiality and security of your personal information and to prevent it from being used for any purpose other than as provided in this Privacy Policy.

Colombia

Your authorization to process personal information for Midaspay HK may be expressed (i) in writing, (ii) orally or (iii) through unequivocal conduct that allows us to reasonably conclude that your authorization has been granted, such as the act of accepting the Privacy Policy. We may keep evidence of said authorizations, while respecting the principles of confidentiality and privacy of information.

To the extent we process personal data as a data controller, you can contact us to exercise your rights using the information specified in Section 8 (Contact).

France

Instructions for the processing of your personal data after your death. You have the right to provide us with general or specific instructions for the retention, deletion, and communication of your personal data after your death. The specific instructions are only valid for the processing activities mentioned therein and the processing of these instructions is subject to your specific consent. You may amend or revoke your instructions at any time.

You may designate a person responsible for the implementation of your instructions. This person will be informed of your instructions in the event of your death, and be entitled to request their implementation from us. In the absence of designation or, unless otherwise provided for, in the event of the death of the designated person, their heirs will have the right to be informed of your instructions and to request their implementation from us.

When you wish to make such instructions, please contact us as set out in Section 8 (Contact).

India

Where we permit any third parties to collect and use sensitive personal information, we shall use reasonable measures to ensure that the third parties do not further disclose such information to the extent required by applicable laws.

Indonesia

By accepting and consenting to this Privacy Policy, you agree that we may collect, use and share your personal information in accordance with this Privacy Policy, as revised from time to time. If you do not agree to this Privacy Policy, you must not access or use our services and we have the right to not provide you with access to our services.

In the event we fail to maintain the confidentiality of your personal information in Midaspay HK, we will notify you through the contact information provided by you or via Midaspay HK, to the extent required by local laws and regulations.

You are responsible for making sure that any personal details which you provide to us are accurate and current. In order to confirm the accuracy of the information, we may also verify the information provided to us, at any time. You hereby represent that you have secured all necessary consent(s) before providing us with any other person’s personal information (for example, for referral promotions), in which case we will always assume that you have already obtained prior consent, and as such, you will be responsible for any claims whatsoever from any party arising as a result of the absence of such consent(s).

Japan

By clicking “accept”, you consent to the transfer of your personal information to third parties (if any), which may include the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, to the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information).

The categories of personal information specified in to the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information) may include "special care-required personal information" (i.e., sensitive information as detailed under applicable law), and you consent to the collection of such information.

Malaysia

To protect your personal information and handle complaints relating to your personal information, we have appointed the following department responsible for managing and protecting your personal information.

Our data protection officer, responsible for the management and safety of your personal information

Telephone: +603-22872388
Email: as set out in Section 8 (Contact)

Mexico

Some of the purposes of processing specified in Section 3 (How We Process Your Personal Information) are voluntary, which may include to show you personalised recommendations or advertising.

In general, we do not require your consent to carry out the transfers detailed in Section 4 (How We Store and Share Your Personal Information). In any case, by using Midaspay HK and providing us with your personal data, you agree to the data transfers detailed therein that require your consent.

To understand more about and exercise your rights, as well as the applicable means, procedures and requirements to exercise any of your rights as specified in Section 8 (Contact).

You can register with the Public Registry to Avoid Advertising (‘REPEP’) (REPEP (profeco.gob.mx)) to refuse to receive advertising to your phone number.

New Zealand

We take reasonable steps to ensure that third party recipients of your personal information located outside New Zealand handle your personal information in a manner that is consistent with New Zealand privacy laws. However, you acknowledge that we do not control, or accept liability for, the acts and omissions of these third party recipients.

If you are dissatisfied with our response to your privacy complaint in respect of your personal information, you may contact the Office of the New Zealand Privacy Commissioner (www.privacy.org.nz).

While we take reasonable steps to ensure that third party recipients of your personal information comply with privacy laws that are similar to those of your jurisdiction, you acknowledge and agree that we cannot control the actions of third party recipients and so cannot guarantee that they will comply with those privacy laws.

Peru

Data Protection Team, responsible for the management and safety of your personal information
Contact: as set out in Section 8 (Contact)

Philippines

By consenting to this Privacy Policy, you consent to us:

· collecting and processing your personal information as described in Section 3 (How We Process Your Personal Information);

· sharing your personal information with third parties, companies within our corporate group, and a third party that acquires substantially all or substantially all of us or our business, as described in this Privacy Policy and for the purposes stated herein; and

· transferring or storing your personal information in destinations outside the Philippines as described in Section 4 (How We Store and Share Your Personal Information).

Singapore

By clicking “accept”, you consent to the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, the locations specified in Section 4 (How We Store and Share Your Personal Information).

Our designated data protection officer for the purposes of compliance with the Personal Data Protection Act 2012 can be contacted as set out in Section 8 (Contact).

South Africa

You have the right to lodge a complaint with the Information Regulator (South Africa) by emailing it at inforeg@justice.gov.za. The Information Regulator (South Africa)’s physical address is 33 Hoofd Street Forum III, 3rd Floor Braampark, Braamfontein, Johannesburg, South Africa.

Thailand

In certain circumstances, you may request us to discontinue, to restrict the use or provision of, and/or to request for data portability of any and all of your personal information which is stored by us, to the extent provided by the Act on the applicable data privacy laws and regulations in Thailand, including the Thai Personal Data Protection Act. These rights may not be available to all users and some of these only apply in certain circumstances. When you wish to make such requests, please contact us as set out in Section 8 (Contact).

Vietnam

By accepting this Privacy Policy, you expressly agree and authorise us to collect, use, store, and process your personal information, including, lawfully disclosing and transferring it to third parties, as described in this Privacy Policy.

Where we permit any third parties to collect and use your personal information, we shall take reasonable measures to ensure that the third parties do not further disclose the personal information.

*What information* *do we need to provide Midaspay HK*?	· If you use Midaspay HK for payment, then we will process your payment information, card binding function data, device and network information, sanctions and verification data, and transaction records.	*More Information*
*How will we use your information?*	· We use your information in order to process your transaction. We also adopt fraud prevention and security measures to guard against unauthorised transactions.	*More Information*
*Who do we share your information with?*	· We use some third parties (e.g. third party risk control service providers) to help us deliver the best possible experience and to facilitate the payment processing service. When we use a third party, we only do this to process your information for the purposes described in this Privacy Policy. We also have affiliates around the world who help us deliver Midaspay HK and we may be required by a court or legal obligation to disclose certain information in some circumstances.	*More Information*
*Where do we process your information?*	· Our servers are located in Singapore and the Hong Kong Special Administrative Region. Your information may be processed from outside of where you live by our support, engineering and other teams around the world, including Singapore.	*More Information*
*How long do we keep your information?*	· We retain your information for up to seven (7) years, after which time your data is deleted (as further described in this Privacy Policy), unless we are otherwise required to retain such data by applicable laws.	*More Information*
*How can I exercise my rights over my information?*	· Depending on where you are, you may have certain rights with respect to your information, such as rights of access, to receive a copy of your data, or to delete your data or restrict or object to our processing of your data.	*More Information*
*How will we notify you of changes?*	· Please check this page frequently to see if there are any updates or changes to this Privacy Policy.	*More Information*