Merchant Terms of Service

The contractual agreement between a merchant and Cropay may comprise the merchant application, order form or commercial quote confirmation, special commercial schedules, these Merchant Terms of Service, Data Processing Terms, the Acceptable Use & Prohibited Business Policy, and expressly incorporated operational rules. In case of conflict, mutually executed commercial schedules prevail, followed in order by the main service agreement, these standard Terms, and policy documents. Website descriptions or sales communications alone do not constitute service approval.

Unless Cropay expressly confirms alternative arrangements in writing, contracting merchants must be companies validly incorporated and existing under the laws of Hong Kong and apply through an authorized representative. Merchants must provide true, accurate, complete, and current information regarding their corporate entity, beneficial owners, directors, websites or applications, business model, product or content catalog, target regions, and projected transaction volumes.

Cropay may request supplemental documentation, conduct ongoing underwriting reviews, or decline an application based on risk assessment, partner institution requirements, or applicable laws. Provision of sandbox credentials, technical documentation, or integration support does not constitute final approval for live production services.

Supported jurisdictions, card schemes, payment methods, transaction types, currencies, settlement arrangements, APIs, and risk control features are defined solely by individual commercial schedules, channel capabilities, and written production launch confirmations. Cropay does not provide unconfirmed automated recurring billing, free-trial-to-paid auto-conversion, or self-serve subscription management.

To comply with laws, card scheme rules, or partner institution requirements, address security risks, or maintain platform stability, Cropay may adjust service parameters upon reasonable notice, or take immediate action where urgent security risks, suspected illegality, or mandatory third-party directives arise. Material commercial changes are governed by written agreement between the parties.

• Use the services exclusively for approved websites, applications, products, services, and transaction types, and never process transactions on behalf of undisclosed third parties or resell access.

• Clearly disclose merchant identity, product or service descriptions, prices, currencies, delivery terms, refund and cancellation policies, customer support contacts, and billing descriptors to cardholders.

• Obtain valid cardholder authorization for each transaction and retain authentic, verifiable order, fulfillment, customer communication, and refund records.

• Comply with applicable laws, app store and platform rules, card scheme rules, content policies, and the Acceptable Use & Prohibited Business Policy.

• Safeguard merchant portal credentials, certificates, API keys, webhook secrets, and systems, and never store CVV codes or handle full card data in an unapproved manner.

• Promptly notify Cropay in advance of any material change to corporate ownership, beneficial owners, websites, product catalog, target regions, transaction patterns, security incidents, or regulatory status.

An authorization or payment success response does not confer an unconditional or irrevocable right to funds. Merchants must handle succeeded, pending, failed, abnormal, refunded, and cancelled states strictly according to API callbacks and written operational rules, and must prevent duplicate fulfillment or duplicate charges.

Merchants are responsible for establishing and honoring refund and cancellation policies that comply with applicable laws, platform rules, and card scheme requirements, and for resolving customer inquiries promptly. Merchants must cooperate with chargeback, fraud, refund, and dispute investigations and submit authentic compelling evidence within specified deadlines. Chargeback liability, early warning thresholds, fees, and evidence timelines are governed by the executed agreement and applicable scheme rules.

Setup fees, annual fees, transaction fees, refund or chargeback fees, foreign exchange rates, taxes, rolling reserves or security deposits, and other commercial terms are governed by the confirmed quote, order form, or electronic agreement. General descriptions on the website do not replace formal commercial quotes.

Cropay does not perform unconfirmed automatic annual fee deductions. Before an annual fee expires, Cropay may send a reminder via email or account manager; only after the merchant actively confirms renewal will a one-time deduction be made from the merchant account in accordance with the parties’ agreement. This workflow does not constitute an automated recurring billing or subscription product.

Settlement cycles, settlement currencies, minimum payout thresholds, deductions, holds, and reconciliation rules are governed by the individual agreement and actual channel processing. Any reference to T+1 or multi-currency settlement is subject to the specific conditions and exceptions stated in the commercial schedule.

Where suspected illegality or prohibited business activity, inaccurate disclosures, unauthorized transactions, security incidents, abnormal fraud or chargeback ratios, partner institution directives, solvency risks, or refusal to cooperate with audits arise, Cropay may, to the extent permitted by law and contract, decline transactions, request supplemental documentation, restrict features, hold settlement funds, or suspend or terminate services.

Risk control measures shall be proportionate to the identified risk and documented for audit purposes. Except where restricted by law, law enforcement, suspicious transaction reporting obligations ("tipping-off" prohibitions), card scheme confidentiality rules, or the need to prevent circumvention of security controls, Cropay will notify the merchant in a reasonable manner.

Both parties shall comply with applicable data protection laws and the Data Processing Terms, process personal data solely for agreed purposes, and maintain security controls proportionate to risk. Each party owes confidentiality obligations with respect to non-public commercial, technical, customer, and security information obtained during the partnership, except where disclosure is required by law.

If a merchant discovers credential leakage, unauthorized system access, payment data exposure, or any security incident affecting the services, it must immediately notify Cropay, take containment measures, and cooperate with investigations. Neither party may publicly disclose unverified security details or third-party confidential information without authorization.

The contract term and standard termination notice periods are specified in the individual commercial agreement. Material breach, unlawful conduct, prohibited business activity, critical security risk, regulatory or partner institution directives, insolvency, or persistent misrepresentation may constitute grounds for immediate suspension or termination.

Termination does not extinguish accrued fees, refund obligations, chargeback liabilities, indemnification duties, confidentiality obligations, record retention requirements, or dispute resolution provisions arising prior to or after termination. The parties shall return or delete data in accordance with applicable requirements, subject to restricted retention necessary for legal, audit, accounting, or dispute resolution purposes.

The merchant represents and warrants that its business operations, products, content, customer authorizations, and submitted records are lawful and authentic, and that it has full authority to enter into the contract. The merchant is solely responsible for its products or services, customer representations, taxes, content, fulfillment, refunds, and unlawful use, and shall indemnify Cropay and its partner institutions against direct losses and reasonable expenses arising therefrom in accordance with the executed agreement.

Limitations of liability, excluded categories of loss, and liability caps between the parties must be expressly stated in the executed agreement and remain subject to mandatory Hong Kong laws and statutory reasonableness standards. No provision excludes liability that cannot be lawfully excluded.

Contractual notices shall be sent to the registered email addresses, merchant portal notifications, or physical addresses designated by the parties. Merchants are responsible for keeping contact details current. Lawfully valid electronic records, electronic confirmations, and electronic signatures may be used to form or evidence contracts, subject to verification of any statutory exceptions under the Electronic Transactions Ordinance (Cap. 553).

Unless otherwise validly agreed in an individual commercial contract, the agreement is governed by the laws of the Hong Kong Special Administrative Region and disputes shall be submitted to the courts of Hong Kong. The parties may specify escalation, mediation, or arbitration mechanisms in the formal agreement.