Privacy Policy

Pan-Asia Payment Company Limited (泛亞收付通有限公司) ("the Company", "we", "us" or "our") is committed to complying with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and to protecting the personal data we hold. This Privacy Policy explains what personal data we collect, how we use and disclose it, the security measures we take, and the rights available to you. The publication of this Policy is a statutory disclosure obligation under Data Protection Principle 5 of the PDPO and its effect does not depend on any person's consent. In respect of processing activities that we are required by law to carry out (for example customer due diligence and suspicious transaction reporting), we do not rely on your consent as the basis of that processing.

This Policy applies to the following persons: (1) Website visitors: any person who visits the Company's website, in respect of whom the data involved is mainly technical and analytical in nature; (2) Customers and related persons: corporate customers that have submitted a business enquiry or established a business relationship with the Company, together with their directors, shareholders, beneficial owners, authorised signatories, authorised operators and contact persons, in respect of whom the data involved includes identity verification data and transaction records; (3) Payees and other third party data subjects: in executing a customer's payment instruction, the Company must process the personal data of the payee (beneficiary). Such persons are usually not customers of the Company, and their data is provided to the Company by its customer; depending on the business scenario, they may include a customer's employees, freelancers or contractors (cross-border payroll scenarios), a customer's suppliers and their responsible persons (trade payment and supplier payment scenarios), travellers or end consumers (travel and platform settlement scenarios), and other counterparties of a customer.

If you fall within category (3) above (that is, you are not a customer of the Company, but your personal data is processed by the Company because you are the payee of a payment), this Policy applies equally to our processing of your data. For questions concerning your relationship with the payer (the Company's customer) and how that party obtained and uses your data, please enquire with that party.

Where a written agreement executed between the Company and a customer contains more specific terms on the handling of personal data, those terms apply together with this Policy in respect of the matters they cover; in the event of any conflict, the executed agreement prevails, provided that it affords no lower level of protection than that required by the PDPO.

This Policy applies to https://panasiapay.com and https://panasiapayment.com.

The data user in respect of the personal data described in this Policy is:

Pan-Asia Payment Company Limited / 泛亞收付通有限公司 MSO Licence issued by the Hong Kong Customs and Excise Department, Licence No. 19-12-02940 Address: Unit 519, 5/F, East Ocean Centre, 98 Granville Road, Kowloon, Hong Kong Email: [email protected]

Our sources of personal data include:

• Data provided directly by you or by the entity you represent (including account opening forms, due diligence questionnaires and subsequent supporting documents);
• Data collected automatically when you use this website or the Company's platform;
• Data obtained from public sources, including companies registry records, public registers, court records and public media reports;
• Data obtained from third party compliance data providers, including sanctions lists, PEP lists and adverse media databases;
• Data obtained from correspondent banks, agent banks, payment institutions, settlement channels and partners;
• Data provided to us by our customers (in the case of payees and other third party data subjects).

We use personal data for the following purposes:

• Assessing and processing business enquiries, account opening applications and customer onboarding reviews;
• Establishing, managing and maintaining our business relationship with you or the organisation you represent;
• Conducting customer due diligence, enhanced due diligence and ongoing monitoring, including identity verification and identification of beneficial ownership;
• Conducting sanctions, PEP and adverse media screening, and customer risk rating;
• Processing, executing and recording transaction instructions, including remittances and currency exchange;
• Transaction monitoring, identifying and assessing suspicious transactions and, where necessary, filing suspicious transaction reports with the Joint Financial Intelligence Unit;
• Discharging statutory obligations under the AMLO, sanctions legislation and other applicable laws;
• Responding to lawful requests and enquiries from regulators, law enforcement agencies, courts and correspondent banks;
• Providing customer service and handling enquiries and complaints;
• Internal audit, risk management, accounting, legal affairs and dispute handling;
• Maintaining the security of our information systems and detecting and preventing fraud and unauthorised access;
• Sending you promotional information about our services, subject to your explicit consent.

Website visitors are under no obligation to provide any personal data to us. As regards the expression of interest form, the mandatory fields are a precondition for us to process your submission, not a legal obligation on your part.

For customers and related persons, most of the data we request at account opening and during the ongoing relationship is data that we are required by law to obtain. If you fail to provide such data, or if the data provided is incomplete or inaccurate, we will be unable to complete customer due diligence and may therefore be unable to open an account for you, unable to execute particular transactions, or required to suspend or terminate the business relationship.

We keep the personal data we hold confidential. We may disclose or transfer personal data to the following categories of recipients, but only to the extent necessary for the relevant purpose:

• Correspondent banks, agent banks, beneficiary banks, payment institutions and settlement channels (executing transactions, transmitting legally required originator and beneficiary information);
• Third party compliance data and screening providers (sanctions, PEP and adverse media screening, transaction monitoring);
• IT, cloud hosting, system development and maintenance providers;
• Professional advisers (lawyers, accountants, auditors, consultants);
• Regulators and law enforcement agencies including the HK Customs and Excise Department, the Joint Financial Intelligence Unit, the Police, the Inland Revenue Department and courts;
• Group companies and affiliates (if any) for centralised management of compliance, risk and administrative functions;
• Potential transferees in a business transfer, subject to appropriate confidentiality arrangements.

We do not sell, rent or otherwise commercially make available personal data to any third party, except where required or permitted by law.

Given the nature of cross-border payment business, personal data may be transferred outside Hong Kong for processing or storage, including to the location of the beneficiary, the locations of correspondent banks, and the server locations of our service providers.

Section 33 of the PDPO (restricting the transfer of personal data outside Hong Kong) has not come into operation as at the effective date of this Policy. Notwithstanding this, when making cross-border transfers we adopt reasonable safeguards, including:

• Transferring data only to the extent necessary to execute a transaction or discharge a legal obligation;
• Imposing confidentiality and data protection obligations in our contracts with service providers and restricting them to processing data only on our instructions;
• Carrying out a reasonable assessment of the level of data protection afforded by the recipient;
• Applying technical safeguards such as encryption during transmission.

Under Part VIA of the PDPO, before using your personal data in direct marketing for the first time we must notify you and obtain your consent. We hereby notify you:

Kinds of personal data to be used: your name, company name, job title, email address, telephone number and location.

Classes of marketing subjects: the Company's cross-border remittance services, currency exchange services, corporate settlement account services, API and platform integration services, together with events, information and seminars relating to those services.

We will not provide your personal data to any third party for use in direct marketing in return for any gain. You may at any time require us to cease using your personal data in direct marketing by emailing [email protected] or by using the opt-out mechanism set out in the relevant promotional message. We will cease such use within a reasonable period after receiving your request.

Communications sent to you as necessary to perform a contract or discharge a legal obligation (for example transaction confirmations, account notifications, requests for compliance information, notices of changes to terms and service interruption notices) are not direct marketing and fall outside the opt-out described in this section.

This website uses cookies and similar technologies. For details of the categories of cookies we use, their purposes and the choices available to you, please refer to our separately published Cookie Policy, which forms part of this Privacy Policy.

We take all reasonably practicable technical and organisational measures to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, including:

• Access controls and account management applied on a need-to-know basis;
• Encryption of data in transit and at rest;
• System logging, audit trails and monitoring of anomalous access;
• Confidentiality and data protection training for staff, with confidentiality obligations set out in employment contracts and internal policies;
• Contractual security and confidentiality requirements imposed on third party service providers;
• Locked storage and controlled destruction arrangements for physical documents.

We retain personal data only for as long as is necessary to fulfil the purpose of collection, having regard to statutory retention requirements. Our principal retention arrangements are as follows:

• Customer due diligence records and identity documents: not less than five years from the end of the business relationship;
• Transaction records and supporting documents: not less than five years from completion of the transaction;
• Sanctions screening and suspicious transaction assessment records: not less than five years from creation of the record;
• Expression of interest form data (where no account opening process follows): 18 months from our last contact with you;
• Unsuccessful account opening applications and business enquiries: no less than three years from the date the application is declined;
• Website analytics and cookie related data: no more than twenty-six months from the date of collection.

Under the PDPO you have the right to: ascertain whether we hold personal data about you; request a copy of the personal data we hold about you; request correction of inaccurate personal data; require us to cease using your personal data in direct marketing.

Data access or correction requests should be made in writing to [email protected] or posted to the registered office address, marked "Personal Data Access / Correction Request". We will respond within forty days of receiving the request. If we are unable to respond within that period, we will inform you in writing of the reason within forty days and deal with the request as soon as practicable thereafter. We may charge a reasonable fee, not exceeding the direct and necessary costs, for complying with a data access request.

The Company is incorporated and licensed in Hong Kong and our data processing is founded on the PDPO. For customers and related persons located outside Hong Kong, we additionally adopt the following arrangements consistent with internationally recognised data protection principles:

• Purpose limitation and data minimisation: we collect only the data necessary to discharge compliance obligations and provide services;
• Transparency as to the basis of processing: legal obligation for statutory compliance, contract performance for service delivery, and explicit consent for direct marketing;
• Additional data subject requests: you may request erasure of, restriction of, or object to the processing of your data; we will assess such requests case by case consistent with our statutory obligations under Hong Kong law;
• Safeguards for cross-border transfers: contractual terms and technical measures as described in section 8 above;
• Avenues of complaint: you may lodge a complaint with your local data protection authority in accordance with the law applicable in your location.

The Company's services are provided only to corporate customers and to persons aged eighteen or above. We do not deliberately collect the personal data of persons under the age of eighteen. If we discover that such data has been collected inadvertently, we will delete it so far as lawful and practicable.

We may revise this Policy from time to time to reflect legal requirements or changes in our data handling practices. The revised version takes effect upon publication on this website. For material changes we will post a notice prominently on this website and, where appropriate, notify customers separately. This Policy is provided in both Chinese and English. In the event of any ambiguity or inconsistency between the two versions, the Chinese version shall prevail.