Privacy Policy

This policy explains how KukoPay ("KukoPay", "we"), a company incorporated in Hong Kong, handles personal data when you visit our websites, open a merchant account, use our API or pay through a checkout we host for a merchant. It is written to meet the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), and also the EU General Data Protection Regulation ("GDPR") and the PRC Personal Information Protection Law ("PIPL") where they apply to you.

Our role

• Merchants, their staff and website visitors: we decide how your data is used and are responsible for it (a data user under the PDPO, a controller under the GDPR, a personal information handler under the PIPL).
• Buyers paying a merchant: we process your data on the merchant's behalf to complete the payment. The merchant is responsible for it; contact the merchant first about how it uses your data. The Terms of Service set out what we may do with it.

What we collect

Account data — name, email address, password (stored only as a hash), language, team role, sign-in times and IP addresses.

Verification data for merchants applying for live payments — company name, registration and licence documents, business address, website and business description; the name, nationality and identity document type, number, expiry date and images of the legal representative or, for an individual merchant, of the merchant; a photo of the person holding the document; and contact details. Identity document numbers and the holding photo are sensitive personal data. Document numbers are stored encrypted and shown masked; the full number can be viewed only by an authorised operator who records a reason.

Settlement data — the name, bank and account number of the account you are paid to (account numbers are stored encrypted).

Transaction data — order and refund amounts, currencies, statuses, descriptions and metadata supplied by the merchant, payment method type and limited payment method details returned by our Payment Partners, the buyer's email address if the merchant asks us to send a receipt, the language shown at checkout, dispute records and the evidence a merchant uploads.

Card details are entered into the checkout and processed in line with card network security standards. They are never shared with the merchant.

Technical data — IP address, user agent and request identifiers for API calls and portal use; records of webhook deliveries; security and fraud signals.

Website analytics — only if you accept analytics cookies, see the Cookie Policy.

Why we use it

We do not sell personal data and do not use it for advertising profiles. We make no decision with legal effect on you based solely on automated processing.

Who receives it

• Payment Partners — banks, card networks, acquirers, payment service providers and the payment method a buyer chooses — to verify merchants and to process, settle, refund and dispute payments. Some of them use the data as independent controllers under their own privacy policies.
• Infrastructure providers that host and store data for us, listed with their locations at Sub-processors.
• The merchant you pay, for your own transaction.
• Authorities, courts and professional advisers where the law requires it or to establish, exercise or defend legal claims.
• A buyer or successor in a merger or acquisition, under equivalent protection.

Where it is stored

We are based in Hong Kong. Our servers are in the European Union, and some providers process data in other countries, as listed at Sub-processors. Where the GDPR applies, transfers out of the European Economic Area rely on an adequacy decision or the European Commission's standard contractual clauses. If you are in mainland China, your personal information, including sensitive personal information, is transferred to Hong Kong and the European Union to provide the Services. We ask for your separate consent to this, and to processing sensitive personal information, when you submit verification materials. The names and contact details of the overseas recipients are available on request at the address below.

How long we keep it

We keep data longer only where a law, an investigation or a legal claim requires it.

Security

We encrypt credentials, webhook secrets, bank account numbers and identity document numbers at rest, use encrypted connections, restrict staff access by role and record operator actions. Merchant uploads are stored in a private bucket and are readable only by members of that merchant account and authorised operators. No system is perfectly secure; if a breach is likely to harm you, we will tell you and the relevant regulator as the law requires.

Your rights

You may ask to access or correct your personal data. Where the GDPR or PIPL applies you may also ask us to delete it, restrict or object to its use, receive it in a portable format, withdraw consent (without affecting earlier processing) and ask for an explanation of our processing rules. Records we must keep by law cannot be deleted until the retention period ends. We answer a data access request within 40 days. You can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, or to your local data protection authority.

Buyers: for data held for a merchant, contact the merchant; we will help the merchant answer.

Children

The Services are for businesses and adults. We do not knowingly collect data from anyone under 18 except as part of a payment they make.

Changes

We will post changes here and, for material changes, tell merchants through the portal or by email. The date and version above identify the text in force.

Contact

Privacy requests and questions, including to our personal data officer: [email protected].