COMPLIANCE

Privacy Policy

Last updated 25, December 2023

Information we collect and how we use it

PayCools, operated by PayCools Hong Kong Limited ("PayCools", "we", "our" or "us"), providing payment related technical service("PayCools Service") to our customers (the "merchants"). During this payment processing, PayCools will need personal information to process specific transactions. This PayCools Privacy Policy describes how we collect, use, store and disclose personal information. PayCools may process personal information of the following categories of individuals in the provision of PayCools Services: (a) individuals employed or associated with merchants, such as representatives, suppliers or end-users; (b) vendors or business partners or individuals employed or associated with such organisations that assist us in the provision of PayCools Service; and (c) visitors that log on or use our website https://www.paycools.com/. We collectively refer to the individuals listed above as "you" in this Privacy Policy. We process the personal information of end-users of merchants on behalf of the merchants. We are not responsible for and have no control over the privacy or security practices of the merchants, which may differ from those explained in this Privacy Policy. If your personal information has been submitted to us by or on behalf of the merchants and you wish to exercise any rights you may have under applicable data protection laws, please inquire with them directly. Your use of PayCools Service is governed by the PayCools Terms of Service, which describes in more detail the PayCools Service covered by this Privacy Policy. Capitalized terms not defined in this PayCools Privacy Policy shall have the meaning ascribed to them in the PayCools Terms of Service.

Sources of information

We process personal information that you provide to us in a number of ways, including: • When you make or receive a payment from the merchants who using PayCools Service • When you make an inquiry about our PayCools Service or otherwise interact on our website • When you interact with us by telephone, email and other electronic communication • When you attend an event with us or a third party we are working with or sign up to receive publications from us • When we onboard you as a merchant and interact regarding our service • When you provide services to us or seek to provide such services We may also process your personal information from third-party sources as necessary for the provision of PayCools Service. We may obtain this information from your organisation, from public sources or third parties, depending on the relevant circumstances. For example, we may obtain certain personal information about you from: • Third-party licensed payment provider or bank, such as your transaction information, as necessary to provide PayCools Service; or • third parties, such as government agencies, information service providers, or from publicly available records to carry out due diligence and other legally required compliance checks, such as those related to knowing your customer (KYC), anti-money laundering (AML) and Specially Designated Lists.

Type of personal information

When you use our website or when we interact with you to provide PayCools Service or to receive services from you as a vendor, the personal information we receive, collect and process may include: • Contact information, such as your name, email, phone number, billing address. In addition to the information listed above, we may collect information about the transaction from you depending on which payment method you choose to make or receive a payment, including: • Bank card information such as the name on the card, card type, card number, card verification value, and expiration date, or the information about the account you open with other licensed payment channels to process the payment; • Identification information, such as your ID number or tax number, Customer ID generated by merchants to verify the process the transactions or conduct anti-money laundering and/or fraud prevention checks; • Transaction information, such as amount and time of transaction, currency and language you used; We collect the following personal information from your device when you use PayCools Service to carry out data analysis for advertising, and to protect you from fraud, phishing or other misconduct: • IP address, app version, system version and type, device model, system language, network type, carrier, android ID, Mac address, IMEI, advertising identifier number and browser system. You may provide your personal information to us voluntarily. However, there are circumstances in which we may not be able to assist you, or an organization with which you are associated, unless you provide us with your personal information. For example, your personal information may be required for legally required compliance checks, for security and other reasons to allow you to access PayCools Service. In these cases, without the relevant personal information, we may be unable to assist you, and we would inform you that this is the case. We do not knowingly collect personal information from or about children under the age of 18( or other age which is defined as "minor" under the applicable laws, same as follows). If you are under 18, please do not use PayCools Service or send any personal information about yourself to us. If we learn that we have collected personal information from a child under 18, we will delete that information as soon as possible. If you believe that a child under 18 may have provided us personal information, please contact as using details provided in section 8 below.

Legal justification for our use of your personal information

We may process your personal information in connection with any of the purposes set out above on one or more of the following legal grounds: • To perform our obligations under a contract with you or your organization; • To comply with our legal obligations, as well as to keep records of our compliance processes or tax records; • To pursue our legitimate interests, or those of a third-party recipient of your personal information, provided that those interests are not overridden by your interests or fundamental rights and freedoms. Specifically, we have legitimate interests in promoting and marketing our services to existing and potential customers, in maintaining customer accounts for efficient operation of our business, in keeping our information, trade secrets and confidential data safe and secure, in handling complaints and claims to protect our business; or • Based on your consent to process your personal information in that manner.

Information we share

We will only share your personal information with third parties in the following circumstances: • A merchant. If we have collected your personal information in the course of providing PayCools Service to that merchant, and where permitted by law to others for the purpose of providing PayCools Service. For example, when you make a purchase or transaction with that merchant, we make certain personal information about you available to the merchant you purchase from or transact with;; • Licensed payment service provider. We may exchange certain personal information about you to enable the provision of PayCools Service, such as your transaction information with the licensed payment service provider or bank as necessary to provide PayCools Service;; • Third parties providing services for AML/KYC checks, credit risk reduction, and other fraud and crime prevention purposes, or similar services, including financial institutions, credit reference agencies, and regulatory bodies with whom such personal information is shared;; • Courts, law enforcement authorities, regulators, government officials or other competent authorities where it is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim, including in order to protect the legitimate rights and interests of you and others. Such disclosures may be necessary for us to comply with mandates from FATF and local AML/CFT requirements. We may provide your Customer ID, contact information, and any other transaction information to competent authorities;; • Service providers which we engage to process personal information for any of the purposes listed above on our behalf and in accordance with our instructions only, such as licensed payment service providers, cloud storage providers; and/or; • Prospective sellers or buyers of any of our business or assets to which we might assign or novate any of our rights and obligations; in such case we may disclose your personal information to the prospective seller or buyer of such business or assets.; • Affiliates: We may share your personal information with affiliates to provide you with payment services. Any information you provide directly to a third-party merchant, website or application is not covered by this PayCools Privacy Policy. We are not responsible for the privacy or security practices of merchants or other third parties with whom you choose to share your personal information directly. We encourage you to review the privacy policies of any third party to whom you choose to share your personal information directly.; The personal information we collect may be transferred to and stored outside of the country you use PayCools Service for the purposes specified in this Privacy Policy. For example, we store all of our data, including personal information, with the Cloud Service Provider.; Any international transfers of your personal information will be made according to appropriate safeguards under the applicable laws and regulations. If you wish to enquire further about these safeguards used, please contact us using the details set out in section 8 of this Privacy Policy. We may transfer your personal information outside of the country where you use PayCools Service, and where we do so we will protect personal information as required by applicable laws.

How long do we keep your personal information?

Your personal information will be retained only for as long as necessary for the purposes for which the information was collected, except where necessary to meet our legal obligations (for example, in relation to KYC/AML requirements) or to establish, exercise or defend potential legal claims or to pursue our legitimate interests.

Your rights

Your rights will depend on the laws which apply to you and us, but you may have: • the right to obtain access to your personal information, • to have your personal information we hold rectified or deleted, • to restrict our processing of that information, • to object to our processing of personal information, • to have your personal information transferred to you or another organisation, and • to lodge a complaint with a relevant data protection authority. Where you have provided us with consent for the processing, you may be able to withdraw it. Please note that even after you have chosen to withdraw your consent, we may be able to continue to process your personal information to the extent required or otherwise permitted by law, in particular in connection with exercising and defending our legal rights or meeting our legal and regulatory obligations. To withdraw your consent or to exercise any of the rights above, if they are applicable, you should use our contact details set out in section 8 below. We must ensure that your personal information we hold is accurate and up to date, where relevant. Therefore, please advise us of any changes to your information by emailing us.

Security

We are concerned about safeguarding the confidentiality of your information. We employ administrative, physical and electronic measures designed to protect your Information from unauthorized access and use. Please be aware that no security measures that we take to protect your information are absolutely guaranteed to avoid unauthorized access or use of your information which is impenetrable.

Sensitive Information

We ask that you not send us, and you not disclose, any sensitive personal information (e.g., information related to your e-wallet password, credit or debit card password, racial or ethnic origin, political opinions, religion or other beliefs, health, sexual orientation, criminal background or membership in past organizations, including trade union memberships) through PayCools to us, unless such information is required by us for legal compliance checks, such as KYC/AML.

Contacting Us

If you have any questions, complaints or comments about this PayCools Privacy Policy or our privacy practices, or to report any violations of the PayCools Privacy Policy, please contact us at: [email protected].

Changes to This Privacy Policy

We may revise this PayCools Privacy Policy from time to time to reflect any changes to the way how we process your personal information or changing legal requirements. The most current version of the policy will govern our use of your information. Please check back frequently to see any updates or changes. This Privacy Policy was last updated on the date provided at the top of this page.

Supplemental Terms

The following additional or amended terms shall apply to you if you are a user in the relevant jurisdiction specified below.

Thailand

If the Service are used or accessed from within Thailand, then the following supplemental terms shall apply and override any conflicting provisions in the Privacy Policy. Personal Data "Personal Data" means the information relating to a person, which enables the identification of such person, whether directly or indirectly, but not including the information of the deceased persons in particular, such as name-surname, identification card number, address, telephone number, financial transaction. Personal Data may consist of sensitive information and at risk of being treated unfairly (Sensitive Personal Data) such Personal Data includes but not limited to biometrics data, data relating to religious. In this regard, such Personal Data includes any information provided by you to the Company and/or being in the Company's possession and/or lawfully collected by the Company from any other sources or any other persons. In case where necessary for the Company to collect, use or disclose your Personal Data which is out of the scope as specified in this Privacy Policy, the Company will inform you regarding such different characteristics at the time or prior to the collection, use or disclosure of your Personal Data. By using the Services, it is considered that you have read and understood this Privacy Policy. Otherwise, please immediately stop using the Service. Type of Personal Data Collected, Used or Disclosed by the Company Information on identification card, passport and/or other evidence issued by government authorities such as identification card number, name, surname, name prefix; Necessary contact information such as contactable address, telephone number, e-mail; Particular personal characteristics such as status, biometrics data; Education and/or career information; Financial information such as records of transactions made through PayCools accounts or other Services, credit card information, deposit account information; Information relating to your devices, system, and usage behaviors, including but not limited to device identity number in relation to network connection (such as IP address, MAC address, Device ID), Advertisement ID, mobile device operating systems, mobile network service provider, location, device usage details, cookies, phonebook, application usage, technical information, model and type of devices, photo, image and photo album. For the necessity of providing additional services apart from fundamental Services or the collection, use, disclosure of Sensitive Personal Data other than those specified above, the Company will perform the processing under legal basis as prescribed by law only. In this regard, the Company will inform the purpose and type of Personal Data required to be collected, used or disclosed prior to or at the time of such processing. Basis of the Collection, Use and Disclosure of your Personal Data and the Purposes of such Processing The Company will collect, use or disclose your Personal Data under legal basis and in accordance with the following purposes: 1. For necessity for the performance of the contract to which you are the contractual party, or for the performance in accordance with your request prior to entering into the contract, including but not limited to: - Consideration of account registration requests; - Any other necessities for providing the best Services from the Company; - Providing support service, contact and request for information, accept request, receiving news or to inquire about the Services; - Enhancing and improving the Services' quality, increasing the Services efficiency, and facilitating you in using the Service; - Processing data in order to render the Services; - Any purposes in relation to the provision of Services that possibly be the interest or benefit to you via the notification on Application or contact channel that you have provided to the Company, and that the Company has legitimate rights regarding the provision of Services; and - Any other processing related to the Services and possibly benefiting you. 2. For compliance with the laws, including but not limited to: To Comply with relevant laws in which the Company is subjected to, in compliance with laws, regulations, rules, codes of practice or guidelines issued by authorities or regulatory agencies, such as the Notification of the Bank of Thailand, Anti-Money Laundering Act and etc. In this regard, the Company may transfer your Personal Data to internal/external auditors, government agencies or other related juristic persons. 3. Consent, including but not limited to: For the purpose of analysis or forecast your preferences or behaviors including conducting research, development, products improvement and marketing strategy to provide you with products and services, privileges, promotional campaigns or proposals, that are analyzed and selected, to you; and Other legitimate purposes in which the Company has obtained consent from time to time such as to facilitate you in using the service of other service providers via the Application. 4. For legitimate interests of the Company or any other companies other than the Company, except that such interests are overridden by the fundamental rights of your Personal Data, including but not limited: Prevention of crime and fraud; Enabling security systems and networks to meet international standards; and Fraud prevention and security management of your PayCools account. 5. For substantial public interest which the Company has provided suitable measures to protect your fundamental rights and interest, including but not limited to: Identification/verification of the identity in order to prevent crime and fraud; and Suspicious of financial support for terrorism or money laundering. Apart from the abovementioned legal basis and purposes, the Company may collect, use or disclose your personal under other legal basis, such as preventing or suppressing a danger to your life, body or health, or for the achievement of the purpose relating to the preparation of the historical documents or the archives for public interest. Where the collection, use or disclosure falls under other purposes in accordance with the mentioned basis, the Company will notify you afterward. The Disclosure of Your Personal Data to Third Parties and the Collection of Personal Data from Other Sources. For the processing pursuant to the purposes under abovementioned legal basis. The Company may collect from and/or use, send, transfer, process and/or disclose the Personal Data to the following persons: Juristic persons having control over the Company or under the control of the Company including other companies under the same control of the Company; Other juristic persons or persons in which the Company is a contractual party, or having the legal relationship with the Company, including other service providers having power in making decision to take any action related to your Personal Data both within and outside the country such as external service providers, cloud service providers or other business partners of the Company. In this regard, the Company shall ensure that those service providers will process your Personal Data in accordance with this Privacy Policy and the applicable laws; The auditors, external examiners of the Company, government authorities, transferee of the right of claim, and any other persons or juristic persons that the Company is required to transfer the Personal Data as necessary to comply with the laws; and Business/enterprise transferee in case the Company has merged, transfers, sells its assets and/or business whether entirely or partially. Retention Period for Your Personal Data The Company will retain your Personal Data for a period necessary to fulfill the purposes of providing services, or for as long as necessary in connection with the purposes set out in the contract or legal relation to be enforced between you and the Company. Unless it is required by applicable laws or regulations enforcing to the Company, to comply with internal practices of the Company, to comply with legal claims, or as requested by regulatory authorities, the Personal Data may be further retained for a period as reasonable and as necessary for each category of Personal Data. The Company will erase or destroy or anonymize Personal Data to be an unidentifiable data by following the Company's data destruction standards, when it exceeds the retention period or when the Company has no right or no other legal basis allows the Company to process your Personal Data. Your legal rights under the Personal Data Protection Act B.E. 2562 (the "PDPA") As the data subject under the PDPA, you have the legal rights as the following: 1. Right to withdraw your consent You have the right to withdraw your consent which you have provided to the Company for the processing of the Personal Data during the time of such Personal Data possessed by the Company. 2. Right to access to and obtain a copy of the Personal Data You have the right to request access to the Personal Data which you have provided to the Company or to obtain a copy of such Personal Data in the format which is readable or commonly used by the ways of automatic tools or equipment, or can be used or disclosed by automated means (if provided by the Company), or request the Company to send or transfer such Personal Data to other data controllers (unless it is impossible to do so because of the technical circumstances), including to request the disclosure of the acquisition of the Personal Data obtained without your consent. 3. Right to rectify the Personal Data You have the right to request the Company to rectify any inaccurate Personal Data which you have provided to the Company, or to complete any data during the time of such Personal Data possessed by the Company. 4. Right to erase or destroy the Personal Data or anonymize the Personal Data to become the anonymous data which cannot identify the data subject You have the right to request the Company to erase, or destroy, or anonymize the Personal Data which you have provided to the Company to become the anonymous data which cannot identify the data subject for some reasons. 5. Right to restrict the use of Personal Data You have the right to request the Company to restrict the use of the Personal Data which you have provided to the Company for some reasons prescribed by laws. 6. Right to object the processing of Personal Data You have the right to object the Company for the processing of the Personal data which you have provided to the Company for some reasons prescribed by laws. 7. Right to file complaint for the violation of the PDPA by the Company You have the right to file complaint to the Personal Data Protection Committee if the Company, including its employees or contractors have violated or not complied with the PDPA. In this regard, you may send your request to the Company's Data Protection Office for exercising your abovementioned rights via email. The Company will proceed in accordance with your request at its full effort within the reasonable time required by the PDPA. In addition, the Company will notify you the possible effect from processing of such request. However, the Company is entitled to deny any of your request if there is any specific legal ground allowing the Company to do so. Moreover, the Company reserves the right to charge for any expense from serving your request based on administrative cost and the Company's internal policy. Personal Data of person without fully legal competence If you are considered as a person without fully legal competence, which includes a minor (age below 20 years old or not sui juris), an adjudged quasi-incompetent or incompetent person by the court, in case of necessity to collect, use or disclose your Personal Data, the Company shall conduct only in accordance with the procedures and standard as prescribed by the laws.

Indonesia

If the Services are used or accessed from within Republic of Indonesia, then the following supplemental terms shall apply and override any conflicting provisions in the Privacy Policy: Consent from third parties. If you provide any personal data or information of third party individuals and/or parties, you represent and warrant that you have obtained the necessary consent to do so. Data sharing. We will not share your information with third parties for any purposes other than the provision of PayCools Service specified herein, without your consent. Governing Language. These Privacy Policy are made in English and Indonesian language versions. In the event of any discrepancy between the English and Indonesian language versions, the English language version shall prevail. Parental or Guardian Consent. If you are under the age of 21, you hereby represent that you had the consent of your parent or legal guardian to use the PayCools Service. Waiver. For the purpose of termination and/or dissolution and/or rescission of the Privacy Policy, we and you hereby waive the applicability of the provisions under Article 1266 of the Indonesian Civil Code, to the extent that the court order and/or decision would otherwise be required to validly terminate and/or dissolve and/or rescind the Privacy Policy.

Philippines

If the Services are used or accessed from within Philippines, then the following supplemental terms shall apply and override any conflicting provisions in the Privacy Policy: Clause 1 (Information we collect and how we use it), add: If you have provided us with personal information of third party individuals, you are required to obtain the individual's prior consent and you represent and warrant that you had or have their consent or are otherwise entitled to provide their personal information to us. By providing us with personal information of third party individual(s), you also warrant that the individual(s) is informed of and consents to the terms of this Privacy Policy. Clause 3 (Information we share), combine bullets 3 and 5 as follows: Service providers which we engage to process personal information for any of the purposes listed above on our behalf and in accordance with our instructions only, such as local licensed payment service providers, cloud storage providers as well as companies providing services for AML/KYC checks, credit risk reduction, and other fraud and crime prevention purposes, and companies providing similar services, including financial institutions, credit reference agencies, and regulatory bodies with whom such personal data is shared; and/or Clause 5 (Your rights) insert following clause: Where you have provided us with consent for the processing, you may be able to withdraw it. Please note that even after you have chosen to withdraw your consent, we may be able to continue to process your personal information to the extent required or otherwise permitted by law, in particular in connection with exercising and defending our legal rights or meeting our legal and regulatory obligations or for any of the purposes set out in this Privacy Policy where the processing of your personal information is not based on consent.

Malaysia

If the Services are used or accessed from within Malaysia, then the following supplemental terms shall apply and override any conflicting provisions in the Privacy Policy: Retention of Personal Data. Your personal data will be stored for only the period as necessary to fulfill the purposes stated above (unless a legal obligation requires us to keep it for a longer period) after which we proceed to ensure that your personal data is destroyed, anonymized or permanently deleted if it is no longer necessary to store. Reasons to further store your information even after the fulfillment of the purposes include: to satisfy legal, regulatory, or accounting requirements; to protect the interest of PayCools. Rights of Access and Correction. Under PDPA, you reserve the right to access your personal data and request for correction of the personal data that might be inaccurate, obsolete, incomplete, or misleading. In respect to this, you may: Request to check and access your personal data in our records; Request that we correct any of your inaccurate, obsolete, incomplete, or misleading personal data; Request copies of the data from us. Once we receive a request, we will acknowledge the receipt of such request. For data amendment and correction, we will consider if the information requires amendment. If there is any disagreement, then we specify the reason in clearly stated terms such as where the rights of others will be violated, or regulatory functions will be affected. In accordance with the PDPA, and to the extent not limited by any other applicable law, we may: Charge an administration fee for processing your request for access or correction to the Personal Data, in compliance with the fees stated in PDPA sub-regulation; and Refuse to comply with your request for access or correction to the Personal Information and give you a written reason for such an action. Governing Language. As per Section 7(3) of the PDPA, this Policy and consent form is issued in both English and Bahasa Malaysia. In the event of any inconsistency, the terms of the English version shall prevail.