Complaints & Dispute Handling Policy

• Inquiries or complaints regarding the Cropay website, merchant onboarding applications, technical integration, settlement, support, or service communications.

• Reports concerning onboarded merchants, prohibited business activities, suspected fraud, content violations, or transaction handling.

• Personal data handling complaints, access control concerns, security incident reports, or statutory privacy rights requests.

• Cardholder inquiries regarding billing descriptors, refund status, unauthorized charges, or difficulty reaching a merchant.

Complaints may be submitted via telephone, Telegram, or WhatsApp at +852 6441 9432, or by email to Steven@cropay.com. Written submissions help ensure accurate logging and investigation. Postal correspondence may be sent to UNIT D, 16/F, ONE CAPITAL PLACE, 18 LUARD ROAD, WAN CHAI, HONG KONG.

Please provide your name and contact details, the organization you represent (if applicable), complaint category, relevant merchant or website URL, date, order or transaction reference number, a clear summary of facts, steps already taken, and the resolution sought. Do not include full card numbers (PAN), CVV codes, passwords, API secret keys, or unrequested identity document images.

1. Logging & Triage: Confirm the complaint subject, urgency, potential conflict of interest, and whether immediate account or data containment is required.

2. Acknowledgment: Our target is to provide an acknowledgment or case reference within two (2) Hong Kong business days.

3. Investigation: Gather relevant system logs, merchant records, partner institution feedback, and complainant evidence on a strict need-to-know basis.

4. Response: Our general target is to provide a substantive response or progress update within fifteen (15) Hong Kong business days; where complex cross-institutional checks or legal restrictions cause delay, we will explain the reason and expected next update window.

5. Closure & Post-Mortem: Record the outcome, remedial actions, escalation options, and any required system or policy improvements.

The timelines above are internal service targets and do not override shorter mandatory deadlines imposed by applicable laws, card schemes, issuing banks, or executed contracts, nor do they guarantee final resolution of every dispute within the target window.

Requests concerning goods, digital content, delivery, cancellation, or refunds should generally be directed first to the selling merchant identified on your statement or receipt. Cropay can assist in identifying the payment processing path, forwarding inquiries to the merchant, or checking payment status, but does not assume the merchant’s retail obligations or guarantee a refund outcome.

If you suspect your payment card has been compromised or used for an unauthorized transaction, contact your issuing bank immediately to block or protect your card and initiate a formal dispute within your issuer’s required timeframe. Do not wait for Cropay’s inquiry response before contacting your issuing bank.

Privacy complaints and personal data access or correction requests are handled in accordance with our Privacy Policy & Personal Information Collection Statement. Where an active account takeover, credential leak, full card data exposure, or ongoing attack is suspected, please mark the subject line "URGENT SECURITY INCIDENT"; Cropay may execute containment measures first before completing investigation and notification steps.

If you are dissatisfied with the initial outcome, you may request an escalated review within fifteen (15) Hong Kong business days of receiving our response, stating the specific facts or evidence contested. Escalated reviews are handled by an appropriate responsible officer who was not directly responsible for the original determination.

Nothing in this Policy restricts any person from seeking assistance from their issuing bank, law enforcement agencies, courts, or competent regulatory authorities. Personal data complaints may also be referred to the Office of the Privacy Commissioner for Personal Data, Hong Kong. Cropay prohibits retaliation against good-faith complainants, but reserves the right to decline abusive, threatening, demonstrably malicious, or repetitive communications that present no new factual information.