Data Processing Terms

These Terms apply where one party processes personal data on behalf of the other party, or where both parties independently process transaction-related personal data in connection with the services. Specific data categories, data subjects, processing purposes, durations, roles, and system boundaries shall be documented in the order form, data inventory, or processing schedule.

Data protection roles must not be assumed solely from the labels "payment service provider" or "merchant". Each party may act as an independent data user for its own statutory or risk management obligations, or act as a data processor following documented instructions for specific entrusted activities. Where applicable law requires a party to process data independently, that party remains responsible for such processing.

A party acting as a data processor shall process personal data solely in accordance with documented, lawful instructions, contractual purposes, and applicable law. If an instruction appears to violate applicable law, the processor shall notify the other party to the extent permitted by law and suspend the relevant processing. Neither party shall collect data irrelevant or excessive in relation to the agreed purpose, and both parties shall take reasonable steps to keep personal data accurate and up to date.

• Restrict access strictly to authorized personnel who require access to perform their duties and are bound by confidentiality obligations.

• Implement encryption in transit and appropriate encryption at rest, credential protection, multi-factor authentication, least-privilege access, and environment segregation.

• Maintain access, administrative, error, and security event logs while preventing logs from capturing CVV codes, secret keys, or unnecessary unmasked personal data.

• Operate structured change management, vulnerability management, backup and recovery, vendor oversight, and incident response procedures.

• Regularly review whether security controls remain proportionate to operational risk, system scope, and applicable industry standards.

Before engaging cloud hosting, communications, identity verification, fraud prevention, or other sub-processors, the engaging party shall conduct reasonable due diligence and impose contractual obligations no less protective than these Terms regarding confidentiality, security, purpose limitation, retention, and incident assistance. A verified sub-processor list and change notification mechanism must be established prior to production onboarding and cannot be replaced by this general template.

Before personal data is accessed, stored, or processed outside Hong Kong, the parties shall identify the processing purpose, destination jurisdiction, recipient category, applicable legal restrictions, and security risks, and implement appropriate contractual safeguards, access controls, data minimization, and technical protections. Where laws of other jurisdictions apply, the parties shall complete any required transfer impact assessments or standard contractual clauses separately.

The parties shall maintain procedures to identify and route data access, correction, deletion, restriction, or other statutory requests. A party acting as a processor shall reasonably assist the data user in responding to requests, conducting risk assessments, addressing regulatory inquiries, and demonstrating compliance, without making unauthorized commitments that alter the other party’s legal liability.

Upon becoming aware of any actual or reasonably suspected unauthorized access, disclosure, loss, destruction, or unavailability involving contractual personal data, the affected party shall immediately take containment, evidence preservation, and risk assessment measures, and notify the other party without undue delay. Notifications shall be supplemented as investigations progress with details of the incident nature, categories and approximate volume of affected records, likely consequences, remedial measures taken, and designated contact points.

Decisions on whether to notify data subjects, the Office of the Privacy Commissioner for Personal Data, law enforcement, card schemes, or other authorities shall be made by the party bearing the relevant statutory obligation based on risk and legal requirements; neither party shall issue inaccurate or uncoordinated public statements that prejudice an active investigation.

Upon contract termination or fulfillment of the processing purpose, the processor shall return or securely delete personal data at the data user’s election, except where retention is required by applicable law, accounting rules, dispute resolution, or security investigations. Retained records must be isolated, restricted in use and access, and deleted once the mandatory retention period expires. Data in encrypted backups may expire through normal, controlled rotation cycles.

Subject to reasonable advance notice, confidentiality obligations, and protection of other customers’ data and system security, the processor shall provide policies, audit summaries, or other documentation reasonably necessary to demonstrate compliance with these Terms. The scope, frequency, cost allocation, and alternative assurance methods for on-site audits shall be governed by risk and the executed contract.

In the event of any conflict between these Terms and a specifically executed data processing schedule, the specific schedule prevails; where mandatory law conflicts, mandatory law prevails. Limitations of liability and dispute resolution follow the main service agreement, without reducing non-waivable statutory data protection obligations.