Privacy Policy & Personal Information Collection Statement

This Policy applies to the Cropay website, contact forms, merchant onboarding applications, compliance reviews, technical support, and business communications with prospective or existing merchants. Unless otherwise agreed in writing, the data user for such personal data is DAYCHECKOUT NETWORK TECHNOLOGY CO., LIMITED, with its registered address at UNIT D, 16/F, ONE CAPITAL PLACE, 18 LUARD ROAD, WAN CHAI, HONG KONG.

Websites, mobile applications, or digital services operated by merchants remain independently responsible for processing their end-users’ personal data. The respective roles of Cropay and the merchant in specific processing activities are governed by the executed service agreement, Data Processing Terms, and verified payment data flows.

We collect personal data only to the extent relevant and not excessive for clearly defined business purposes. Depending on your interaction with us, the data collected may include:

• Contact and identity details, such as full name, job title, company name, work email address, telephone number, and instant messaging identifiers.

• Corporate and due diligence records, such as jurisdiction of incorporation, corporate registration documents, beneficial owner and authorized representative records, website or application URLs, business model descriptions, product catalogs, target regions, and projected transaction volumes.

• Service and transaction management records, such as merchant ID, order reference, transaction amount, currency, transaction status, refund and chargeback records, billing address details, and risk management indicators.

• Technical and security logs, such as IP addresses, device and browser attributes, access logs, error logs, authentication timestamps, and security incident records.

• Communications and support records, such as inquiry messages, complaints, technical support tickets, and telephone or written correspondence.

Do not submit full card numbers (PAN), CVV/CVC security codes, one-time passwords, API secret keys, identity document images, or raw cardholder transaction files through public website contact forms. Full sensitive card data in payment flows must only be transmitted through approved payment interfaces and never through general inquiry or support channels.

• Responding to business inquiries and evaluating merchant eligibility, target markets, transaction types, payment methods, and technical integration feasibility.

• Conducting corporate KYB, beneficial ownership, content compliance, sanctions, and risk due diligence.

• Providing, maintaining, and securing services confirmed in writing, including processing transaction status updates, refunds, disputes, reconciliation, and technical support requests.

• Preventing fraud, unauthorized access, money laundering, terrorist financing, sanctions violations, and other unlawful or prohibited activities.

• Fulfilling contractual, accounting, auditing, tax, regulatory, law enforcement, and dispute resolution obligations.

• Improving website reliability, operational stability, customer support, and internal controls. We will not use inquiry personal data for unrelated direct marketing without proper notice and consent.

General browsing of our public website does not require submitting personal data. Fields marked as required on our contact form are necessary for us to respond to and evaluate your inquiry; if you do not provide such information, we may be unable to reply or proceed with an assessment. Information requested during merchant KYB due diligence and service onboarding may be required to perform a contract, manage risk, or comply with applicable legal obligations; refusal to provide verifiable information may result in rejection, suspension, or termination of onboarding or services.

To the extent necessary to fulfill the purposes above, we may disclose data to the following categories of recipients: affiliated operational teams; acquiring institutions, payment gateways, card schemes, settlement banks, and payment method providers; identity verification, fraud prevention, cloud hosting, communications, auditing, and professional advisory providers; courts, regulators, law enforcement, or government authorities with lawful authority; and successor entities in a lawful corporate restructuring.

Certain recipients or infrastructure systems may be located outside Hong Kong. We evaluate the necessity of cross-border transfers in accordance with applicable requirements and require recipients to protect data through contractual obligations, access controls, data minimization, or other reasonable safeguards. Specific sub-processors and data flows are subject to technical, legal, and compliance verification prior to production launch.

Personal data is not kept longer than necessary for the fulfillment of the purposes for which it is used. General website inquiry records are scheduled to be retained for no more than twelve (12) months after the last substantive contact; order and baseline transaction records are scheduled to be retained for one (1) year on a rolling deletion basis under current operational policy. Where contracts, accounting rules, dispute resolution, fraud investigations, or applicable laws require a longer retention period, that required period applies.

Before production publication, legal and engineering teams must verify the actual retention schedules across databases, application logs, backups, ticketing systems, and third-party processors. Backup data that cannot be immediately overwritten is isolated and expires according to controlled backup rotation cycles.

We implement administrative, technical, and physical controls proportionate to data sensitivity and operational risk, including role segregation, least-privilege access, encryption in transit, audit logging, vulnerability and incident management, vendor due diligence, and personnel confidentiality obligations. No internet transmission or storage system can be guaranteed to be 100% secure.

Under our operational data boundary, Cropay’s general business systems do not store full PAN, card expiration dates, or CVV security codes; where a card identifier is needed for reconciliation or support, only approved masked or truncated digits (such as first 6 and last 4 digits) are retained. This statement must be verified item-by-item against live payment data flows, logs, backups, and the PCI DSS responsibility matrix prior to production release.

To the extent the Personal Data (Privacy) Ordinance (Cap. 486) applies, data subjects may request access to and correction of their personal data held by us. Requests should state the requester’s identity, the relevant data, and the requested action, and be sent to Steven@cropay.com or mailed to our Hong Kong registered address marked "Personal Data Access / Correction Request". We may require reasonable identity verification and may charge a fee not exceeding the direct and necessary cost permitted by applicable law.

Questions or complaints regarding personal data handling may also be submitted through the channels above. Data subjects may additionally consult the Office of the Privacy Commissioner for Personal Data, Hong Kong regarding their statutory rights.

Our use of cookies and similar technologies is detailed in our Cookie Policy. We may update this Policy from time to time to reflect service, technical, or legal changes; material updates will be communicated through reasonable notice together with an updated version identifier, effective date, and last reviewed date. In the event of any discrepancy between language versions, the language version designated in the formally executed agreement between the parties shall prevail; website policy drafts do not substitute for case-specific legal advice.