PRIVACY POLICY

At NomuPay, we put your privacy first

Read this privacy statement to learn more about the way NomuPay and its group of companies collect and process your personal data

Version as at September 1, 2022

Nomu Pay (“NomuPay”) Hong Kong Privacy Policy

1. General

NomuPay (“NomuPay”, “we”) operates in accordance with the provisions of the Hong Kong Personal Data (Privacy) Ordinance.

2. Your personal data

We may collect information about you or which can be used to ascertain your identity (“personal data”). Any personal data collected from you on this website or otherwise will only be used for the specific purposes mentioned at the time of collection or for purposes directly related to those specific purposes.

If you have any questions about how we collect, store and use your personal data or would like a copy of the data we hold about you, then please either write to the address noted on the main page of this website or e-mail us at: data.privacy[@]nomupay.com.

3. Cookies

Cookies are small text files which are stored locally in your internet browser‘s cache memory, in order to be able to recognise it. NomuPay uses different types of cookies, and we provide further information on these cookies here. In general, we use cookies that are necessary for the operation of the website and you cannot opt out of the use of these cookies. In addition, we use cookies that enhance the functionality and use of the website (as further described below in section 4), such as to make use of the website easier for visitors, and in order to be able to design it in a more customized manner. You may choose to accept or reject cookies. If you reject the cookies, you may not be able to use some of the functions of this website.

4. Processing of personal data and other data by NomuPay during visits to our website

4.1 Information automatically collected when you access our website

We may collect some information about you when you visit our website. You may also be presented with opportunities to provide some personal data on various pages of the website.

4.2 Transfer of your personal data

Your personal data will be used only to the extent necessary to achieve the purposes named in this data privacy statement. Your data will be forwarded to third parties, if at all, only within the limits of statutory regulations. Personal data will be forwarded to government institutions and authorities only within the limits of compulsory national legal provisions, or if those data must be forwarded for legal or criminal prosecution because abusive or fraudulent actions have been committed. Forwarding for any other purpose, especially for address trading, is excluded.

4.3 Information on Web Analysis Tools

4.3.1 Google Analytics

This NomuPay website uses Google Analytics, a web analysis service from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies that are stored on your computer and make it possible to analyse how you utilize the site. The information generated by the cookie (including the IP address) is transferred and stored on a Google server located in the United States. On this website, Google Analytics is extended by the code “gat._anonymizeIp():” to ensure anonymized collection of IP addresses (so-called IP-Masking). This means that Google will truncate/anonymize the IP address. Only in exceptional cases, the full IP address is sent to and shortened by Google servers in the USA.

Google uses the information on our behalf to evaluate how this NomuPay website is used to create reports about the activities on the site for the site operators, and to perform additional services regarding website and internet utilization. Further, Google may pass this data on to third parties, if required by law or if using their services to analyse this data. Google will not associate IP addresses with any other information held by Google.

Further information concerning the terms and conditions of use for Google are available under this link:

https://marketingplatform.google.com/about/analytics/terms/gb/

Further information concerning the data privacy of Google can be found under this link:

https://policies.google.com/?hl=en&gl=uk

5. Data retention

We store your personal data for as long as it is needed to fulfil the purpose for which they were collected notwithstanding any statutory retention obligations, in particular according to tax or accounting law.

6. Data safety

We have installed security systems to protect your personal data against unauthorised access.

6. Data subject rights

Under certain privacy laws, visitors as data subjects have certain rights in particular the right to access, correct, update, or request deletion of your personal data that we store about you.

You can object to processing of your personal data, ask us to restrict processing of your personal data or request portability of your personal data by sending us an email to the email address above.

Similarly, if we have collected and processed your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.

You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact us at data.privacy[@]nomupay.com.

Version as at September 1, 2022

Nomu Pay Malaysia Sdn. Bhd. (“NomuPay”) Privacy Policy

(formerly known as Wirecard Payment Solutions Malaysia Sdn. Bhd.)

1. Personal data protection notice

This Personal Data Protection Notice (“Notice”}is issued pursuant to the Personal Data Protection Act 2010 (“Act”}. It explains the type of data we collect or have collected and how we collect the data, the purposes of processing such data, the parties we disclose or have disclosed the data to and the choices available to you including how to access and correct such personal data.

By communicating with us, using our services or by virtue of your engagement with us, you acknowledge that you have read and understood this Notice and agree and consent to the use, processing and transfer of your personal data by us as described herein.

2. Collection and use of information

“Personal data” means information about you from which you are identified, including but not limited to name, identification card number, passport number, nationality, mailing, billing, shipping and email address, phone number, fax number, bank account information, credit and debit card information, date of birth, your designation in your company, your company details, any information about you or your company which you have provided to us in your application form, registration forms or any other similar forms and/or information about you that has been or may be collected, stored, used and processed by us from time to time.

3. Sources from which personal data may be obtained

In addition to the personal data you provide to us directly, there are variety of sources in which we may collect your Personal Data from, such as:

Fill up and completing application or registration forms or any other similar forms via online or otherwise;
When you complete a sale or purchase transaction online using our e-commerce service;
When you register at our website as a user;
From social media platforms’ pages, if you subscribe, follow, like or are a fan of our pages;
When you enter contests organized by us
From cookies used on websites;
When you interact with us at any events, activities or social media platforms.

4. Purposes of collection and processing

NomuPay collects personal data to set up and manage accounts for our ecommerce services and to handle orders of goods and services from NomuPay which shall include, without limitation the following:

Website registration, enabling sales and other transactions, processing payments and settlement, sending payouts, handling orders, providing receipts, performing credit checks;
Providing customer service, providing dispute resolution, chargebacks, refunds, or related issues;
Marketing and surveys, sending service update notices;
Recovering debt and collections, detecting and preventing fraud, detecting and preventing violations of our legal agreements;
Measuring, improving and customizing our services;
Fulfilling other technical, logistical, financial, tax, legal, compliance, administrative, or back office functions for and/or in connection with all other purposes necessary and/or incidental to our business and all purposes necessary for or related to any of the above purposes.

In the course your dealings with us, we may also use and process your personal data for other purposes such as:

To send alerts, newsletters, updates, promotional materials from us or our partners;
To invite you to events or activities organized by us or our partners;
To share your personal data amongst our holding companies, affiliates or subsidiaries for promotion, events or activities organized by the same; and
for and/or in connection with all other purposes necessary and/or incidental to our business and all purposes necessary for or related to any of the above purposes.

5. Transfer of Personal Data

We may transfer your personal data to places outside Malaysia when carrying out any of the purposes stated herein.

6. Disclosure to Third Party

Your personal data may be disclosed and transferred amongst our holding companies, affiliates, subsidiaries, associate companies and jointly controlled entities which may include companies in different jurisdictions.

When processing your personal data, we may disclose the same to the following persons including but without limitation to:

Our business partners which shall include parties with whom we collaborate;
Merchants concerned on a need-to-know basis to complete the sale transaction and handling orders;
Credit Reporting Agencies, Third Party Service providers;
Our auditor, lawyers, consultants, insurers, advisers, bankers, and agents; and
All other persons or bodies who provide us with services necessary and/or incidental to our business.

7. Data protection and security

NomuPay protects your personal data against unauthorized access, use or disclosure. Your personal data will be stored either in hard copies in NomuPay’s office or stored in servers operated by NomuPay or any of its service providers.

All internet communication is secured using up-to-date technology with high security encryption. Some of our security features include the following:
Hardware firewall
DoS Attack Prevention
3D-Secure Compliance (“Verified by Visa” & “MasterCard SecureCode’)

NomuPay is PCI DSS compliant. However, you are advised to follow certain security practices yourself. You must never share your account or login details with anyone. If you are concerned that any of your login details have been compromised, you can change them any time you like once you are logged on, and immediately contact our Customer Service department.

8. Notification of Changes

If NomuPay decides to change our privacy policy, NomuPay will post those changes on its website so the users are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If, at any point, NomuPay decides to use Personal Data in a manner different from that stated at the time it was collected, NomuPay will notify users by way of an e-mail.

User will have a choice as to whether we use their information in this different manner. NomuPay will use information in accordance with the privacy policy under which the information was collected.

9. Right of access and correction to personal data

Under the Act, you have the right to access and the right for correction to your personal data which might have been out-of-date, inaccurate or incomplete. You may also withdraw your consent or restrict the purpose for the processing of your personal data as set out in this Notice. Please note that notwithstanding the withdrawal of your consent, we may still process your personal data under circumstances permitted by law.

You may send the above request to the following address:

Attn: Compliance Officer
Address: Lot No 19-01, Level 19, Menara 2, Menara Kembar Bank Rakyat, No 33, Jalan Rakyat, 50470 Kuala Lumpur, Malaysia
Email: data.privacy[@]nomupay.com

You may also unsubscribe to our marketing materials by clicking the unsubscribe link contained in the email we send to you and following the instructions therein.

10. Personal data of third parties

You hereby confirm that you are authorized to provide personal data relating to other individuals and you have obtained their consent for their personal data to be processed and used in the accordance with the purposes as stated in this Notice.

11. Changes to this notice

NomuPay may update this Notice from time to time, and the changes will be effective after posting at the website or notice to you. Continued use of our website indicates your re-acceptance of the revised notice. The most recent revision date for these terms is identified above.

12. Third-party links

In an attempt to provide increased value to our users, NomuPay may link to sites operated by third parties. However, even if the third party is affiliated with NomuPay, NomuPay has no control over these linked sites, all of which have separate privacy and data collection practices, independent of NomuPay. These linked sites are only for your convenience and therefore you access them at your own risk.

Version as at September 1, 2022

Nomu Pay (“NomuPay”) Philippines Privacy Policy

1. General

NomuPay (“NomuPay”) recognizes and values your privacy, and we seek to uphold your data privacy rights in accordance with the law, including the Philippine Data Privacy Act of 2012 (the “Act”). In this Privacy Notice, ‘personal data’ refers to any information that identifies you as a person.

2. Your Data Privacy Rights

The Act provides you with data privacy rights with respect to your personal data, including the following:

The right to be informed: You have the right to be informed that your personal data will be, are being, or were, collected and processed.
The right to access: You have a right to obtain a copy of any information relating to you that we have on our computer database and/or manual filing system.
The right to rectify incorrect data: You have the right to correct any error in your personal data and, if warranted, request immediate rectification.
The right to erase or block: You have, based on reasonable grounds, the right to suspend, withdraw or order the blocking, removal or destruction of your personal data from our filing system, without prejudice to NomuPay continuing to process personal data for commercial, operational, legal and regulatory purposes.
The right to secure data portability: Where your personal data is processed by electronic means and in a structured and commonly used format, you have the right to electronically move, copy or transfer your personal data in a secure manner.
The right to be compensated for damages: You may claim compensation if you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, considering any violation of your rights and freedoms as data subject.
The right to object: Right to object if the personal data processing involved is based on consent or on legitimate interest. We will honor your objection or withholding of your consent to the processing of your personal data, unless the processing is pursuant to a subppoena, for obvious purposes (contract, employer-employee relationship, etc.) or a result of a legal obligation.
The right to file a complaint: You may file a complaint or exercise your rights above by emailing us at: [Insert email address].

3. Collecting and Using Your Personal Data

We may collect your personal data when you use our websites or become our vendor, supplier, employee or contractor. The personal data we collect from you may include the following:

Name, age, sex, civil status, date and place of birth, nationality and citizenship
Address and other contact information
Employment or business information
Bank account details
Government-issued identification numbers
Other information we may request in connection with reviewing and maintaining an existing or potential business relationship with you

We may also ask for personal data from other sources whom you have authorized to share your information with us. These sources may include credit bureaus or aggregation agencies, government and other regulatory bodies, and other third parties.

We may use your personal data for:

Marketing, providing, administering, and servicing our products and services to help you meet your needs
Assessing your suitability for products and services
Complying with applicable laws, regulations, directives, issuances by, or agreements and obligations of NomuPay to any competent authority, regulator, supervisory body, enforcement agency, court or tribunal
Identifying, investigating, and preventing financial crimes, including fraud, bribery, money laundering and terrorist financing
Recognizing other lawful or legitimate commercial or business purposes necessary for the performance of, or in relation to, a contract or service in which you are part of
The context of establishing, maintaining and terminating an employer-employee relationship
Enabling NomuPay to manage its businesses and ensuring that we are able to identify, measure, and mitigate risks

We may use manual and technology-enabled data processing systems in connection with account opening, underwriting and other processes.

4. Protecting Your Personal Data

We will use reasonable physical and technical measures to protect your personal data against loss, theft, unauthorized access, disclosure, copying, use and modification. We may disclose and share your personal data based on your consent, legitimate business interest, and lawful processing, with any member of the NomuPay group of companies here and abroad, as well as their directors, officers, employees and other duly authorized representatives, any authority, regulator, supervisory, enforcement agency, exchange, court, quasi-judicial body or tribunal, and any other third party we consider necessary for purposes of providing you products and services and other lawful purposes mentioned above.

5. Retaining Your Personal Data

Your personal data will be retained in accordance with industry standards, laws and regulations. The retention period will be counted from account closure until destruction, deletion or anonymization of records, unless withdrawn in writing.

6. Updates and Changes

NomuPay reserves the right to update or change sections of this Privacy Notice at any time and without prior notice.

Version as at September 1, 2022

Nomu Pay (“NomuPay”) Thailand Privacy Policy

We, NomuPay (hereinafter referred to from time to time as “we”, “us”, “our”), value your privacy and strive to protect your personal data in compliance with the laws and regulations governing personal data protection, including those that are enforceable in Thailand, which impose legal obligations upon us.

This privacy notice (“Privacy Notice”) explains:

what kind of personal data we collect and why we collect it; this includes what you tell us about yourself and what we learn by having you as a customer, and the choices you give us about what marketing materials you want us to send you;
how we use your personal data;
who we disclose your personal data to;
how long we keep your personal data; and
what your privacy rights as a data subject are and how the law protects you.

1. Collection of Personal Data

We use many different kinds of personal data. The type of customer data that we collect depends on the circumstances of the collection, the nature of requested service(s), and the transaction(s) performed.

We collect personal data about you from various sources as follows:

Information that you provide to us, namely:

Personal details: these include any information concerning your identity, such as your given name(s), preferred name(s), gender, date of birth, marital status, personal identification number or information, passport number(s) and other government issued number(s), tax identification number(s), nationality, images of passports, driving licenses, signatures, authentication data (e.g. passwords, your maiden name, PINs, e-signatures, facial and voice recognition data, and fingerprints data); photographs and visual images, details of your education and employment, names and contact details of your family members and dependents, or other identification information;
Personal contact information: this includes any information you provide to us that would allow us to contact you, such as postal address, email address, social network details, or landline and mobile numbers;
Details of others provided by you: these include any information that you have provided us about other persons with whom we may or may not have direct legal relationship, such as their personal details or personal contact information; such details of others could include your guarantors, trustees, the beneficiaries of your insurance policy, joint account holders, people appointed to act on your behalf, your business partners, officers, or agents, and individuals whom you have referred to us, etc.;
Information from digital device: any information about the computer system or other technological device that you use to access any of our or third parties’ channels, applications, websites/sites or social media, as the case may be (collectively the “Sites”), in order to contact, communicate, visit or interact with us, such as IP addresses, operating system type, network information, web browser type and version, cookies, activity logs, online identifiers, unique device identifiers, geo-location data, photographs, videos, and voice recordings, among others;
Website/communication usage information: as you use or navigate through and interact with our Sites, we use automatic data collection technologies (i.e. cookies, web beacon, or third party tracking for analytics and advertising purposes) to collect certain information about you and your activities, such as the links you click on, the pages or content you view, the content response times, the download errors and the length of visits. (Please refer to our Cookies Policy published on our website for more information);
Account login information: any information that is required to give you access to your specific account profile, for examples, your login ID/email address, subscription data, screen name, password in unrecoverable form, security question and answer, login credentials for phone and/or online applications;
Demographic information and interests: any information that describes your demographics or behavioral characteristics; for examples, your date of birth, age or age range, gender, geographic location, favorite products, hobbies and interests, household or lifestyle information, the way you use products and/or services, including information about payments you make or receive, such as the dates, amount, currency, and the details of your counterparties for the transactions, or your personal preferences relating to such transactions.
Market research & feedback: any information that you voluntarily share with us about your experience of using the products and/or services offered by us, such as your needs and interests, information and opinions expressed when participating in a market research and/or survey, or contact information that you provide to us in order to receive news and updates from us;
Customer-generated content: any content that you create and then share with us on third party social networks or by uploading it to one of our Sites, such as photographs, videos, personal stories, or other similar media or content;
Our customer support services: any communications with our officers, such as record of contact, complaints and/or disputes, emails or letters you send to us, record of your feedback, and record of advice that we may have given you; and
Special categories of personal data (sensitive personal data): any sensitive data which is necessary for us to consider granting you products and/or services and to perform customer due diligence as required by law, e.g. information about criminal convictions and offences and biometric data.

Information we collect or generate about you, namely:

Financial information: any of your financial information and information about your relationship with us, including any of our products and/or services or those offered by us(e.g. acquiring products, or other electronic payment products), that you apply for or hold or have had in the past, the channels you use and your ways of interacting with us, your ability to get and manage your credit, credit and borrowing history, your payment history, instruction records, transactions records, market trades, payments into your account, including salary details and information, billing address, account numbers, credit or debit card numbers, cardholder or accountholder name and details, credit information, risk rating information, counterparty details, client relationship information, payment and trade transactions information, personal wealth, assets, and liabilities, proof of income and expenditures, and other financial information;
Marketing and sales information: such as details of the products and/or services that you receive and your preferences;
Investigations records: such as due diligence checks, sanctions and anti-money laundering checks, external intelligence reports, content and metadata relating to relevant exchanges of information between and among individuals, organizations, including emails, voicemail and live chat;
Records of correspondence and other communications: such as email, live chat, instant messages and social media communications;
Regulatory obligations: any information that we need to support our regulatory obligations, such as information about transaction details, detection of any suspicious and unusual activity and information about parties connected to you or these activities; and
Audio-visual information: such as recordings from surveillance videos on our premises and/or branches, or recordings of phone or video or chats with our officers or staff.

Information we collect from other sources, namely:

Specific information: any information you have asked us to collect for you, such as information about your accounts or holdings with other companies including transaction information and information on your preferences from other organizations where they have rights to share this information;
Third party social network information: any information that you share publicly on a third-party social network or information that is part of your profile on a third-party social network and that you allow the third-party social network to share with us, such as your basic account information (e.g. name, email address, gender, birthday, current city, profile picture, user ID, list of friends, etc.) and any other additional information or activities that you permit such third-party social network to share;
Third-party providers: any information from third-party providers, such as information that helps us to combat fraud or that relates to your social interactions (including your communications via social media, between individuals, organizations, prospects and other stakeholders acquired from companies that collect combined information);
Credit reference agencies: such as information received from the credit reference agencies and from other reference databases; and
Public sources: any information from other publicly available sources.
If you do not provide the necessary data or consent to the processing of data, which we indicate to you is mandatory, we may not be able to provide you with the products and/or services you require, or meet all our obligations we have with you, enter into a contract with you, or fulfil legal duties imposed on us by law. In such cases, our service to you may be limited, restricted, suspended, cancelled, prevented or prohibited, as the case may be.

If you give us personal data of other persons, or you request us to share their personal data with third parties, you confirm that such persons understand the information in this Privacy Notice about how we will use their personal data and that you have the rights to share their personal data to us.

We collect your personal data for the purposes that are within the scope of one or more lawful grounds described in Section 2, below.

2. Use of Personal Data

We may only collect, use and share (collectively “process”) personal data fairly and lawfully and for specified purposes (“lawful grounds”). The applicable data protection law restricts our actions regarding personal data to specified lawful purposes. These restrictions are not intended to prevent the processing of personal data, but to ensure that we process personal data fairly and without damaging your interests.

The lawful grounds for processing available under the applicable data protection law vary depending on the nature and purpose of the processing activities and the types of data being processed.

We will rely on one or more of the following lawful grounds when processing personal data:

when it is necessary to fulfil a contract or perform obligations we have with you or to act upon your request before entering into any contractual relationship with you;
when it is our legal duty;
when it is in our legitimate interest;
when you consent to the processing of your personal data;
when it is necessary to prevent harms to your life, body, or health; and
when it is within the public interest of substantial importance.

In the case of sensitive personal data or special categories of personal data under the applicable data protection laws, in addition to the lawful grounds above, we will process such data in accordance with any other additional requirements as prescribed by such data protection laws.

Some processing activities may fall under more than one lawful ground. In such case, we may rely on any of the applicable grounds for our processing activities.

The purposes for which we may process personal data, subject to the applicable law, and the legal bases on which we may perform such processing includes:

Purpose of personal data processing	Lawful grounds
Provision of products and/or services
to verify and authenticate your identity; to deliver our products and/or services to you; to manage our relationship with you or your business; to execute your instructions (we may monitor or record any communications between you and us, including phone calls); to perform credit reference checks; to collect and recover monies owed to us; to study how you use products and/or services from us and other organizations; to provide service notifications or reminders of your benefits; to communicate with you about our products and/or services;	when it is necessary to fulfil a contractual duty or perform obligations that we have with you or to act upon your request before entering into any contractual relationship with you; or when it is in our legitimate interest
Customer support
to make and manage customer payments; to manage fees, charges, and interest due on customer accounts; to improve the performance and functionality of our websites (website cookies).	when it is necessary to fulfil a contractual duty or perform obligations that we have with you or to act upon your request before entering into any contractual relationship with you; when it is our legal duty to process your personal data; or when it is in our legitimate interest.
Marketing activities
to conduct targeted advertising; to personalize marketing messages sent to you; to give you information about our and/or our group and/or our partners’ products and/or services that you may be interested in; to let our trusted partners send you information about our products and/or services that you may be interested in; to use third party cookies to give you offers that you may be interested in; to communicate with you via any means (including via email, telephone, text message, social media, post or in person) subject to ensuring that such communications are provided to you in compliance with applicable laws; and to maintain and update your contact information where appropriate.	when you consent to the processing of your personal data; or when it is in our legitimate interest.
Sharing your personal data to third parties for their marketing
to allow our business partners to offer you their products and/or services (we will not share your personal data for this purpose unless you explicitly give us consent to do so)	when you consent to the processing of your personal data
Business improvement
to understand and develop products/services to meet our customers’ needs and to improve our business performance; to test, research, analyze and develop new features, products and/or services; to understand and analyze needs and your satisfaction; to identify issues with existing products and/or services; to plan improvements to existing products and/or services; to analyze your data, including credit and behavior scoring; to manage your complaints; to understand your spending behaviors in order to help you manage your saving plans; to do statistical reports or market research; to do internal audits and reports; and to conduct surveys or to hear from you about our products and/or services.	when it is necessary to fulfil a contractual duty or perform obligations that we have with you or to act upon your request before entering into any contractual relationship with you; when it is our legal duty to process your personal data; or when it is in our legitimate interest.
Fulfillment or our legal obligations
to verify and authenticate your identity; to prevent fraud and money laundering/combating the financing of terrorism; to submit regulatory reports to relevant authorities; and to comply with applicable laws and regulations.	when it is our legal duty to process your personal data when it is within the public interest of substantial importance.
Security and risk management
to prevent crimes and manage the security of our premises (for example, we may use closed circuit television (CCTV) in and around our premises, which may collect photographs, videos or voice recording of you and the individuals connected to you or your business); to detect, investigate, report, and seek to prevent fraud and financial crime; to manage risk for us, our related companies, and our customers; and to sell or to buy our assets, business, or portfolios to or from third parties.	when it is necessary to fulfil a contract or perform obligations we have with you or to act upon your request before entering into any contractual relationship with you; when it is our legal duty to process your personal data; or when it is in our legitimate interest. when it is within the public interest of substantial importance.
Provision of products and/or services
to verify and authenticate your identity using your biometric data	when you consent to the processing of your personal data; or when it is our legal obligation to achieve the substantial public interest.
Fulfilment of our legal obligations
to verify your identity; to prevent fraud and money laundering/combating the financing of terrorism; and to comply with applicable laws and regulations.	when it is our legal obligation to achieve the substantial public interest; or when it is necessary to establish or defend a claim, or exercise our claim.
Collection and retention of documents for evidentiary purposes
to retain documents for evidentiary purposes (for example, we may keep copies of your national identification card as a piece of supporting document for your transaction with us; national identification cards issued by the Government of Thailand may contain sensitive personal data, e.g.religion and blood type); as such, without further consent from you, we may mask such sensitive personal data to the extent appropriate in order to protect your information; and to retain documents, agreements and application forms prescribed by the relevant authorities (for example, the Land Department prescribes forms that may contain information pertaining to race.)	when it is our legal obligation pertaining to substantial public interest; or when it is necessary to establish or defend a claim, or to exercise our claim.
Other relevant processing activities
to conduct any processing activities in relation to the purposes set out in this table.	same as the lawful ground applicable to such activities

3. Disclosure of personal data

We may share your personal data or personal data relating to the individuals connected to your business with third parties where it is lawful to do so, including where we or they:

need to have access to your personal data in order to provide you with the products and/or services you have requested (e.g. fulfilling a payment request);
have a public or legal duty to do so (e.g. to assist with detecting and preventing frauds, tax evasion and financial crime);
need have access to your personal data for the purpose of regulatory reporting, litigation or to assert or defend their or our legal rights and interests;
have a legitimate business reason for doing so (e.g.to manage risk, verify identity, enable another company to provide you with services you have requested, or assess your suitability for products and/or services);
need to prevent harms to your life, body, or health; and/or
have asked you or the individuals connected to your business for the permission to share the personal data, and you (or they) have agreed.

In case of sensitive personal data or special categories of personal data under the applicable data protection laws, in addition to the lawful grounds above, we will share such data in accordance with additional requirements as prescribed by such data protection laws.

Some disclosure activities may fall under more than one lawful ground. In such case, we may rely on any of the listed grounds for our disclosure activities.

We may share your personal data or personal data relating to the individuals connected to your business for these purposes with others, including:

other NomuPay group companies and any sub-contractors, agents or service providers who work for us or provide services to us or other NOMUPAY group companies (including their employees, sub-contractors, service providers, directors and officers);
cloud service providers;
any trustees, beneficiaries, administrators or executors;
people who give or will potentially give guarantees or other security for any amounts you owe us;
people you make payments to and receive payments from;
your beneficiaries, intermediaries, correspondent and agent, clearing houses, clearing or settlement systems, market counterparties, and any companies the investment services of which you receive through us;
our business partners with whom we provide services (e.g. airline or hotel partners, co-branding partners, card scheme partners or loyalty program partners), including their agents and service providers;
our trusted partners (e.g. social media companies or advertisement agencies)for the purpose of conducting direct marketing activities on our behalf or other third parties for marketing purposes;
other financial institutions, lenders and holders of security over any property or assets you provide to us, tax authorities, trade associations, credit reference agencies, payment service providers and debt recovery agents;
insurance providers, including underwriters, brokers, agents, re-insurers, claims handlers and other relevant third parties;
any people or companies where required in connection with potential or actual corporate restructuring, merger, acquisition, takeover, assignment, transfer, participation or sub-participation, including any transfer or potential transfer of any of our rights or duties under our agreement with you;
law enforcement, government, courts, dispute resolution bodies, our regulators, fraud prevention agencies, credit reference agencies, tax agencies, auditors and any party appointed or requested by our regulators to carry out investigations or audits of our activities, either having jurisdiction in Thailand or elsewhere;
other parties involved in any disputes, including disputed transactions;
fraud prevention agencies who will also use your personal data or personal data relating to the individuals connected to your business to detect and prevent fraud and other financial crime and to verify your identity;
anyone who provides instructions or operates any of your accounts, products and/or services on your behalf (e.g. Power of Attorney, lawyers, intermediaries, etc.);
your advisors (e.g. accountants, auditors, legal advisors, professional, financial or tax advisors) who you have authorized to represent you, or any other person of whom you have informed us is authorized to give instructions on your behalf; and/or
any other person with whom we have been instructed by you to share your personal data, or any other person who provides instructions or operates any of your accounts on your behalf.

Under some circumstances, the recipients of your personal data listed above may be located outside of Thailand. We will ensure that the cross-border transfers of your personal data comply with Section 4, below.

The purposes for which we may share personal data, subject to the applicable law, and the legal bases on which we may share personal data are set out in Section 2, above.

There may be instances which we may share your personal or non-personal data to third parties, such as advertising identifiers or one-way coding (cryptographic hash) of a common account identifier (such as a contact number or email address) to enable the conduct of targeted advertising.

We will not use personal data for any other purpose other than for the purposes as described to you. Should we intend to collect or use additional data, which is not described in this Privacy Notice; we will notify you and/or obtain your consent prior to the collection, use or disclosure in order to comply with relevant data protection laws.

4. Transfers of personal data outside of Thailand

Your personal data may be transferred to and processed in all countries where NomuPay group companies or its service provider have established a business presence or have to meet compliance obligations. We will take all steps that are reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Notice as well as with the applicable data protection laws, including, where relevant, by entering into applicable standard contractual clauses (or equivalent measures) with parties outside of Thailand.

5. Opting out of direct marketing

You have the right to object to direct marketing activities.

If you do not wish to receive marketing information from us, you may click on the ‘unsubscribe’ link, which can be found in our marketing emails and/or newsletters which are sent to you email our customer service team at data.privacy[@]nomupay.com.

6. Retention of personal data

We collect your data for as long as it is necessary to carry out the purposes for which it was collected, for business, legal and legitimate interest purposes or compliance with applicable laws.

We may keep your data for up to 10 years after you stop being our customer (that is, after our relationship with you has ended) to ensure that contractual disputes can be processed within that time. However, for legal, regulatory or technical reasons, we may keep your data for longer than 10 years. This includes circumstances where we keep records of any person exercising the rights under the applicable data protection laws; for example, where a person has opted out from our direct marketing, or has requested us to erase personal data. If we do not need to retain personal data for longer than the period that is legally necessary, we will destroy, delete or anonymize your personal data.

Where you receive products and/or services from third parties who we has introduced you to, those third parties may keep your personal data, or personal data relating to the individuals connected to your business, in line with additional terms and conditions that apply to their product and/or services.

7. Accuracy of your personal data

We need your co-operation to ensure that your personal data is current, complete, and accurate. Please inform us of any changes to your personal data by contacting us at np.custservice@nomupay.com.

We will occasionally request updates from customer data and we may, in certain circumstances, proceed with such updates without your request to ensure the personal data we use to fulfil the purposes of the collection, use and disclosure is updated, complete and accurate.

8. Your data subject rights

Subject to the conditions and exceptions set out in the applicable data protection law, you enjoy the following rights:

Right to Withdraw Consent: This enables you to withdraw consent that you have already given to us. The withdrawal of your consent will not affect any processing of your personal data carried out prior to your withdrawal being effective.

Where your consent is not mandatory, the withdrawal thereof may partially or completely impede our ability to provide you with full benefits or experience relating to the products and/or services you receive.

Where your consent is mandatory, the withdrawal thereof may render our service limited, restricted, suspended, cancelled, prevented or prohibited, as the case may be.

For either case, we will not be liable to you for any losses incurred, and our legal rights are expressly reserved in respect of such limitation, restriction, suspension, cancellation, prevention or prohibition.

Right to Access: This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Right to Correct: This enables you to have any incomplete or inaccurate data we hold about you corrected.
Right to Deletion: This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to the processing of your personal data (see below).
Right to Object: This enables you to object to the processing of your personal data where we are relying on a legitimate interest (or that of a third party) and your particular circumstances justify your objection to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
Right to Restrict Processing: This enables you to ask us to suspend the processing of personal data about you; for example, you may want us to restrict the use of your personal data which is under our correction process.
Right to Portability: Request the transfer of your personal data to another party.

Please complete the “Consent Withdrawal” form or “Data Subject Rights” form np.custservice@nomupay.com. Please also note that we will ask you to provide a proof of identity to us before responding to any requests to exercise your rights. We will respond to your request to exercise such rights without delay; we will notify you in advance if we require more time to process your request.

If you become or have become our customer before 1 June 2022 we will maintain and continue using your personal data based on the consent you previously given to us. Your right to withdrawal of consent also applies to consents that were given to us before the Personal Data Protection Act B.E. 2562 (2019), as amended, came into force, i.e. before 1 June 2022. If you wish to withdraw such consent, you may do so by completing the “Consent Withdrawal” form np.custservice@nomupay.com.We will process your request accordingly.

Please note that the above mentioned rights are not absolute, as they should be balanced against legal requirements and our legitimate interest.

9. Handling of complaints

In the event that you wish to make a complaint about how we process your personal data, please contact us and we will try to consider your request as soon as possible. Your complaint filing that is made with us does not prejudice your right to file a complaint with a government authority with the mandate to enforce data protection law.

10. Security of your personal data

We value your privacy; therefore, we place great emphasis on ensuring the security of your personal data. We regularly review and implement reasonable and appropriate physical, technical and organizational security measures when processing your personal data.

Our employees are trained to handle the personal data securely and with respect, failing which they may be subject to disciplinary actions.

11. Cookies

We use cookies in some of our webpages and applications to collect information about users of our website (for example, store users’ preferences and record session information). A cookie is a small text file that a website or application can send to your browser, which stores certain information on your system. We use different types of cookies for different purposes. This includes the purposes of improving your online experience and customizing the ads you see online. You can adjust the settings on your browser or within your mobile device so that you will be notified when you receive a cookie. You may, at any time, disable the cookies by changing the settings on your browser or via your mobile device. However, by doing so, you may not be able to use certain functions or enter certain part(s) of our websites.

For more information on how we use cookies, please refer to our Cookies Notice published on our website for more information.

12. Contact us

Please contact us via email at data.privacy[@]nomupay.com, if you have any questions regarding the protection of your personal data.

You can also contact our Data Protection Officer, who is responsible for overseeing the protection of your personal data, by writing to:

The Data Protection Officer
NomuPay
900 12th Floor Zone A, Tonson Tower, Pleonchit road, Lumpini, Pathuwan, Bangkok, Thailand

Or you can send an email to data.privacy[@]nomupay.com

13. Revision of our Privacy Notice

You can request for a copy of this Privacy Notice using the contact details in Section 12, above. However, we keep this Privacy Notice under regular review; thus, this Privacy Notice may be subject to changes. The date of the last revision of the Privacy Notice can be found at the top of the page.