Midaspay Privacy Policy

We take reasonable steps to ensure third-party recipients outside Australia handle your information consistently with Australian privacy law, though we do not control or accept liability for their acts/omissions.

Dissatisfied with our complaint response? Contact the Office of the Australian Information Commissioner (Tel: +61 1300 363 992, enquiries@oaic.gov.au).

By accepting this Privacy Policy, you expressly authorise us to collect, use, store, and process your personal information — including disclosure to third parties — to the extent provided herein.

Applies to California residents under the CCPA/CPRA. "Personal information" and "sensitive personal information" have the meanings given in the CCPA.

Collection & disclosure (past 12 months)

• Identifiers — name, Open ID/user ID, IP, phone, mailing/billing address, email (collected directly from you/your device).
• Internet/electronic network activity — device & network information.
• Other §1798.80(e) categories, incl. credit card number/financial information.

Purposes

• Provide Midaspay, process transactions, verify identity; card binding; improve the Service; fraud prevention/detection and verification.

Disclosed to: group companies; service providers (contractually restricted); merchants; regulators/law enforcement; business acquirers. We have not sold/shared California residents' personal information (as defined by CCPA) in the past 12 months, and have no knowledge of selling/sharing information of users under 16.

Your CCPA rights

• Free disclosure of categories collected/disclosed, sources, purposes, specific pieces (past 12 months).
• Deletion of personal information collected from you, subject to exceptions.
• Correction of inaccurate personal information.
• Freedom from discrimination for exercising your rights.

We aim to fulfil verified requests within 45 days (extendable by 45 more, with explanation). Manage your data via your account, or contact us per Section 8.

To obtain written information about our policies for service providers outside Canada, contact us per Section 8. We require such providers to maintain comparable privacy/security standards via contracts and other measures.

Your authorisation for processing may be written, oral, or via unequivocal conduct (e.g. accepting this Policy). We may keep evidence of authorisations while respecting confidentiality/privacy principles. Contact us per Section 8 to exercise your rights.

You may give general or specific instructions on retention, deletion, and communication of your data after death. Specific instructions require specific consent and apply only to the activities mentioned; you may amend/revoke anytime.

You may designate a person to implement your instructions (informed on your death, entitled to request implementation). Absent designation, your heirs have the right to be informed and request implementation. Contact us per Section 8.

Sensitive Personal Information includes passwords, financial (bank/card) information, biometric data, health/sex life/sexual orientation, and medical records — excluding information in the public domain or provided under laws like the Right to Information Act, 2005.

Sharing: where third parties may collect/use this data, we take reasonable measures to prevent further disclosure beyond what law requires.

Withdrawal of consent: contact us per Section 8; withdrawing consent may mean we cannot provide the expected service.

By accepting this Policy, you agree we may collect, use and share your data as revised from time to time. If you disagree, do not access/use our services; we may refuse access.

If confidentiality is breached, we will notify you via your contact details or Midaspay, as required by local law.

You must ensure your details are accurate; we may verify this anytime. You represent you have secured consent before providing another person's information to us (e.g. referral promotions), and are responsible for related claims.

By clicking "accept", you consent to transfer of your information to third parties (if any), including cross-border transfer to any country where we have databases/affiliates (see Section 4), which may include "special care-required personal information" under applicable law.

We have appointed a data protection officer responsible for management and safety of your personal information and handling complaints. Tel: +603-22872388 · Email: see Section 8.

Some processing purposes (see Section 3) are voluntary, e.g. personalised recommendations/advertising. Transfers under Section 4 generally do not require consent; using Midaspay means you agree to any transfers that do.

Contact us per Section 8 to exercise your rights. You may register with the Public Registry to Avoid Advertising ("REPEP") to opt out of advertising to your phone number.

We take reasonable steps to ensure third-party recipients outside New Zealand handle your data consistently with NZ privacy law, though we do not control or accept liability for their acts/omissions.

Dissatisfied with our complaint response? Contact the Office of the NZ Privacy Commissioner (www.privacy.org.nz).

We have appointed a Data Protection Team responsible for managing/protecting your data and handling complaints. Contact: see Section 8.

By consenting to this Policy, you consent to: (i) our collection/processing per Section 3; (ii) sharing with third parties, group companies, business acquirers as described; and (iii) transferring/storing your information outside the Philippines per Section 4.

We provide your personal information to the following third parties for the stated purposes:

Retention and further details for each recipient are set out in their respective privacy policies.

For performance of the services described in this Policy, we delegate processing to Centauri Dynamic Pte. Ltd. and Tencent Cloud International Ltd, who provide technical infrastructure.

Overseas transfer

Personal information may be transferred to the recipients above (and their countries/regions) for the purposes and retention periods in each of their privacy policies.

Data destruction

Retained per Section 6. Once its purpose is fulfilled and retention ends, data is irreversibly destroyed — electronic files by secure deletion, printed materials by shredding/incineration.

Certain records must be retained under Korean law: labelling/advertising (6 months), contract execution/withdrawal (5 years), payment & supply records (5 years), customer service/dispute records (3 years) under the E-Commerce Consumer Protection Act; log records/IP (3 months), telecom date/time/frequency (12 months) under the Protection of Communications Secrets Act.

You may exercise access, correction, deletion, or processing-suspension rights under PIPA directly or via an authorised representative (power of attorney), and may withdraw consent or demand suspension at any time.

Additional use/provision of personal information

Per PIPA, we may use/provide personal information within scope reasonably related to the original purpose, considering relevance, foreseeability, impact on your interests, and whether safeguards (e.g. pseudonymisation, encryption) were applied.

Domestic privacy representative

Per Network Act Art. 32-5 and PIPA Art. 39-11: Tencent Korea Yuhan Hoesa, 152 Taeheran-ro, Gangnam-gu, Seoul, Korea. Tel: +82-2-2185-0902. Email: see Section 8.

By clicking "accept", you consent to cross-border transfer of your information to any country where we have databases/affiliates, particularly the locations in Section 4.

Our designated data protection officer for the Personal Data Protection Act 2012 can be contacted per Section 8.

Where you are located in Switzerland, the UK, or the EEA, the legal bases described in Section 3 apply to our processing of your personal information, and cross-border transfers rely on appropriate safeguards as described in Section 4.

You have the right to lodge a complaint with your local supervisory authority if you believe our processing infringes applicable data protection law.

Where required by the Personal Data Protection Act, we rely on your consent, or another lawful basis such as contractual necessity or legitimate interest, for the processing described in Section 3. You may exercise your rights by contacting us per Section 8.

If you are a resident of a U.S. state with a comprehensive privacy law (e.g. Virginia, Colorado, Connecticut, Utah), you may have rights similar to those described for California in this policy, including rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of certain processing. Contact us per Section 8 to exercise these rights.

Where required by Vietnamese law, we obtain your consent prior to processing your personal information, and will notify you of any material changes to the purposes of processing. You may withdraw consent at any time by contacting us per Section 8, subject to any legal or contractual restrictions.