This privacy policy is to clarify the responsibility of the Company to protect your rights and your integrity. Therefore, this policy explains how we use the personal data that you share with us to enable us to offer you the Company’s services and to give you the best possible experience when using them, the applications, the website and when you are in contact with us. The policy describes what personal data we collect and how we use it under the rules set out in the EU’s new data protection regulation, (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) (“GDPR”). The policy also describes your rights and how you can exercise them. If you don’t approve of how Pipibuy processes your personal data according to this Privacy Policy or if you cannot accept our Terms of Service we ask you to please refrain from using the Services.
Questions or concerns? Reading this privacy policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at contact@pipibuy.com.
This privacy policy applies when DK Innovation Ltd, e-mail: contact@pipibuy.com, (the “Company”) provides payment services through our Pipibuy application (“the Service”). The Company is the controller for the processing of the personal data that is registered or created when you use the Service.
When you as a customer creates an account and/or use the Service, the Company processes your personal data by obtaining and providing information on your mobile phone, tablet or other devices.
The following terms are used in this policy with the meanings stated below:
Personal data refers to all types of information that directly or indirectly can be attributed to a natural person who is alive. This could mean name, personal identity number, address etc. Encrypted data and several types of electronic identifiers (such as IP addresses) are considered personal data if they can be linked to natural persons.
Processing of personal data refers to everything that happens to the personal data. Every action taken with personal data represents processing, irrespective of whether it is performed in an automated manner or not. Examples of common forms of processing are collection, registration, organizing, structuring, adaptation or alteration, transmission and erasure.
Registration information, including your first and last name, date of birth, profile picture, contact information (address, e-mail address and telephone number) and country, that you provide when you sign up with Pipibuy and the anonymized customer ID that is generated when you register. The photo or photos you specifically choose when you create a sticker with Pipibuy.
Enhanced customer due diligence – to comply with the rules that we as a payment institute must follow, we will from time to time ask for further information about you, i.e. in which country you were born, in which countries you hold a citizenship, in which country you are resident for tax purposes, what your occupation is and if you or someone in your family or a person known to be a close associate with you is or has been a politically exposed person.
The processing of this data is a prerequisite for you to be able to use the Service and is undertaken to enable us to fulfil our agreement with you, as well as to enable us to fulfil statutory obligations.
Your specific location: We will never gather or use your specific device location (for example by using GPS) without first getting your explicit consent. This information enables us to automate the input of an address when you create a sticker for a pick-up or delivery at Pipibuy. This information also enables us to provide you with features, information, ads and other content depending on your current location and your location in relation to other Pipibuy users. If you choose to share your specific location but later change your mind, you will always have the possibility to withdraw your consent by changing your settings in your device’s operating system.
In addition to the data that you provide us with, we may also collect personal data from another source (third party). For example, the Company collects address information from public registers.
The processing of this data is a prerequisite for you to be able to use the Service and is undertaken to enable us to fulfil our agreement with you, as well as to enable us to comply with our statutory obligations.
We store user data when you visit or use our Services, including our applications, websites and our platform technologies (for example add-ons outside of the website), such as when you visit or click on content and install or update one of our mobile applications. We use logins, cookies, device information and IP addresses to identify you and to log your use of the Service.
Besides the use of cookies, the processing of this data is a prerequisite for you to be able to use the Service and is used to enable us to fulfil our agreement with you, as well as to enable us to fulfil our statutory obligations. Read more about the conditions for using cookies in section 3.4 below.
When you download the Company’s application on your mobile phone, tablet or other device the Company needs to store and obtain certain technical information from your device to be able to provide and update the Service. By downloading the application, you agree to the Company storing and obtaining certain technical information from the device. The processing of this data is a prerequisite for you to be able to use the Service and the information is stored to enable the Company to fulfil the agreement with you to provide to Service. If you no longer want the Company to store and obtain the technical information, you must uninstall the application.
Our services are dynamic and we introduce new functions continuously that sometimes demand that we collect additional information. If we collect personal data that substantially differs from already obtained information, or if we materially change the using of your personal data, we will notify you on the changes before such further processing is initiated. If needed, the content of this privacy policy may also be changed.
As stated above, the Company process your personal data for several purposes based on various legal grounds. The Company mainly processes personal data to provide, administrate, develop and adjust the Service and its functionalities to fulfil our agreement with you. The personal data is also processed to ensure customer due diligence, to administrate the customer relationship with you, and to meet requirements related to security and other statutory obligations, to fulfil the Company’s legal obligations. The personal data in sections 3.1-3.5 above may also be used for market- and customer analysis, market surveys, statistics, business follow-up and business development and method development, which is based on either a consent that is obtained from you when you register to create an account at the Company, or on the Company’s legitimate interest to market itself and its services, and to develop and provide the customers an improved supply of services.
The Company also processes your personal data to give you better and more personal offers and service. Personal data and information on positioning data may for example be processed, merged, segmented and analysed, through targeted marketing, to provide information, offers or recommendations about our own or our partners goods or services, based on the user’s preferences, behaviours, needs or lifestyle. Such processing is based on either a consent that is obtained from you when you register to create an account at the Company, or on the Company’s legitimate interest to market itself and its services, and to develop and provide the customers an improved supply of services. Personal data/Cookies may be used for personalization of ads. Link to Google’s privacy policy and terms of use (https://policies.google.com/technologies/partner-sites)
Furthermore, personal data may be processed to protect the Company’s legal interests or to discover, prevent or draw attention to fraud and other problems related to security or technology, which all constitute legitimate interests for the Company to perform the processing.
If you do not wish for the Company to process your personal data for direct marketing, you may announce this to the Company in writing through the contact information in section 10.
Personal data may be shared if it is necessary to comply with requirements provided in law or by authorities, in order for the Company to comply with legal obligations.
Furthermore, the Company may share your data to other parties in order to enable the processing of your transaction and to facilitate payments, enable updates of your transaction status and to send offers from the Company and the Company´s partners through SMS, e-mail or other direct marketing. This processing is performed to fulfil the agreement that you have entered with the Company and, in terms of marketing, based on a consent or a legitimate interest.
To be able to provide the Service the Company will share your personal data to partners, such as Stripe Limited, for the management of your card data and information.
Where it is necessary to enable the Company to offer you the Service, we share your personal data with companies that act as processors for the Company. A processor is a company that processes the information on behalf of The Company and in accordance with the Company’s instructions. The Company has processors that assist the Company with IT-services, as well as companies that conduct marketing activities on behalf of the Company. However, the Company is always responsible for ensuring that your personal data is processed correctly. When your personal data is shared with processors, it is only for purposes that are compatible with the purposes for which The Company has obtained the information (for example to be able to fulfil The Company’s commitments in accordance with the agreement with you as a customer). The Company checks all processors to ensure that they can provide sufficient guarantees regarding the security and secrecy of personal data. The Company has written agreements with all processors (data processing agreements) under which they guarantee the security of the personal data processed and undertake to fulfil The Company’s security requirements and requirements regarding international transmission of personal data.
Your personal data is in general processed only within Hong Kong.
Your personal data may be transmitted to or stored in a country outside Hong Kong, on the condition that there is a legal ground, i.e. a legal obligation or consent from you, and that there are appropriate safeguards or that The Company and its processors have taken adequate precautions. Appropriate safeguards are that an agreement is in place that covers EU standard agreement clauses or other approved clauses, codes of conduct, certifications, etc. approved in accordance with GDPR. See ec.europa.eu/info/law/law-topic/data-protection_en for further information. It is also required that the country outside the EU/EEA where the recipient is located has a reasonable level of data protection which is established by the European Commission, and that the recipient is certified in accordance with Privacy Shield (applicable to recipients in the United States).
Further information on transmission of personal data to countries outside Hong Kong can be obtained on request.
Data storage personal data is normally not stored for longer period of time than what is necessary to fulfil the purposes for which the data was collected. The Company will erase or de-identify the data collected that may be traced back to you when you terminate your account at The Company, except for such information that The Company is obliged to keep in accordance with law, normally ten years after you have terminated your account at the Company. The personal data is stored only to comply with such legal obligations or to protect the Company’s legal interests, such as if there is a pending legal process.
The right to access and control your personal data
Regarding personal data that we store about you: (1) Delete personal data: you can request erasure of all or some personal data (for example if the data is no longer necessary to provide the Services). (2) Change or correct personal data: you can edit some of your personal data through your account. You can also request that we edit, update or correct your personal data if, for example, the personal data is inaccurate.
The Company may charge an administrative fee in case of unfounded or implausible requests (for example if they are made repetitively). You will then be notified about this in advance. The Company will normally answer your request within one (1) month. Requests are made through contact@pipibuy.com.
We have appropriate safeguards designated to protect your information, such as encryption of your data during all processing. We supervise our systems regularly to discover possible weaknesses and attacks. We can, however, not guarantee the security of all information that you provide us. There is no guarantee that information cannot be accessed, exposed, changed or destructed through attacks on our physical, technical or administered firewalls.
The Company will only process your personal identity number when it is clearly warranted in consideration of the purpose, necessary for a reliable identification or if there is any other notable reason. The Company always minimizes the use of your personal identity number as far as possible through, when it is sufficient, using a User ID that does not contain your birth date.
We will only collect and process your personal data when there is a legal ground for it. These legal bases include consent (when you have given us your consent), agreement (when processing is necessary for the execution of the agreement (for example to deliver the Services from the Company that you have requested)) and legitimate interests, such as to protect you, us or others from security threats or frauds, to improve your experience with the Service or to comply with the statutory obligations that apply to us.
If the processing of personal data is based on your consent, you have the right to withdraw your consent at any time. If the processing is based on legitimate interests, you have the right to object to our processing. If you have any questions about the legal grounds on which we collect and use your personal data, you may contact us in accordance with section 10 below.
The Company reserves the right to make changes in this policy at any time. The Company shall, with reasonable notice through website or application, inform users that hold an account at the Company in case of upcoming changes of the policy. If you do not accept the changes, you have the right to terminate the agreement with the Company before the revised policy enters into force. You terminate your agreement with the Company by terminating your account at the Company.
The Company is the controller and responsible for ensuring that your personal data is processed in accordance with applicable law.Do not hesitate to contact the Company if you have any questions regarding the processing of your personal data or any complaints. Written or verbal questions and complaints are primarily directed to:
DK Innovation Limited
ROOM 603，6/F，HANG PONT COMMERCIAL BUILDING
31 TONKIN STREET，CHEUNG SHA WAN
KL, HONG KONG
Phone: +852 8192 6918
contact@pipibuy.com