Privacy Policy

Last Updated: 2025-08-14

This Privacy Policy is issued by Upay (“Upay”, “we”, “us”). It explains how we collect, use, store, disclose, and protect Personal Information when you visit ubdpay.com (the “Site”), use our products and services (including Upay Global Accounts, Crypto Wallet, Upay U Card, payment APIs and admin console, collectively the “Services”), or otherwise interact with us. It also reflects Apple and Google developer privacy requirements for our iOS/Android/H5 apps and SDKs.

1. Scope

This Policy applies to all “Personal Information” collected via the Site, apps, APIs, SDKs, customer support, or third-party partners. It does not apply to anonymized or irreversibly de-identified data.

2. Information We Collect

Identity Data: name, date of birth, ID/passport details, proof of address, nationality (for KYC/AML).
Contact Data: email, phone, mailing address.
Account & Transaction Data: Upay account details, virtual/physical card data, amounts, timestamps, types, counterparty data, on-chain wallet addresses and transaction hashes.
Device & Technical Data: IP address, device model, OS and version, browser type, device identifiers, language, time zone, approximate location.
Usage & Risk Data: login/logout logs, risk tags, risk assessment results, crash and error logs, diagnostics and performance data.
Cookies & Similar Technologies: necessary, functional, analytics, marketing, and “wallet” cookies (which may store wallet addresses/preferences).
Other User-Provided Data: customer support communications, survey responses, marketing preferences.

3. Purposes & Legal Bases

Purpose	Data	Legal Basis
Provide and perform the Services, process transactions, customer support	Identity, contact, account & transaction, device	Contract performance
KYC/AML, sanctions screening, fraud prevention	Identity, transactions, IP/location, risk	Legal obligation / public interest
Security and risk management	Device, usage, risk	Legitimate interests
Product improvement, debugging, analytics	Device, usage, diagnostics, cookies	Legitimate interests / consent (for non-essential cookies)
Marketing & promotions (including push and third-party ads)	Contact, cookies	Consent (withdrawable at any time)
Legal proceedings and compliance	Any data as necessary	Legal obligation / legitimate interests

4. Sources

We collect data directly from you; from partners such as banks, issuers, payment networks, blockchain providers, and KYC vendors; and automatically via our Site, apps, APIs, and SDKs.

5. Sharing

Banks, issuers, payment and clearing networks, crypto service providers (to process transactions/settlement).
KYC/AML vendors, sanctions-screening and transaction monitoring providers (for compliance).
Cloud and technology providers (infrastructure, backup, security operations).
Regulators, law enforcement, or courts where required by law.
Corporate reorganization, merger, or asset transfers (with required notices and protections).

On-chain records may be permanent and immutable; we cannot delete or alter blockchain data on your behalf.

6. Cookies & Tracking

We use necessary, functional, performance/analytics, marketing, and wallet cookies. You can manage or withdraw consent in your browser or the in-app consent tool. Disabling some cookies may impact functionality.

7. International Transfers

Your data may be transferred outside Hong Kong. We implement appropriate safeguards (e.g., standard contractual clauses) to protect Personal Information.

8. Security

PCI-DSS Level 1, encryption in transit and at rest, access controls, MFA.
Real-time risk controls, intrusion and anomaly detection, backups and disaster recovery.

9. Retention

We keep data for the minimum period necessary to achieve the purposes; statutory records (e.g., transactions and compliance) may be retained up to 7 years or as required by law.
Upon account closure, we delete or de-identify data unless retention is required by law or for legitimate business purposes.
Blockchain data cannot be deleted or rectified due to immutability.

10. Your Rights

Subject to law, you may request access, correction, deletion, restriction/objection, and data portability. You may withdraw consent at any time for consent-based processing. Contact: contact@ubdpay.com. We may request additional information to verify your identity.

11. Minors

The Services are not directed to individuals under 18. If we learn that we collected data from a minor, we will delete it.

12. Third-Party Sites

Links on our Site may lead to third-party websites with their own privacy policies; we are not responsible for their practices.

13. Changes

We may update this Policy from time to time. Material changes will be communicated via the Site, email, or in-app notices. Please review the latest version regularly.

Contact: contact@ubdpay.com