This Privacy Policy (the “Policy”) explains how we, KPay Merchant Service (Australia) Pty Ltd (“we”, “us” or “ours”), collect, hold, use, disclose, and protect Personal Information about individuals whose Personal Information we handle in connection with the Services , including End Users, sole traders, a Merchant’s customers or cardholders, and a Merchant’s directors, shareholders, employees, contractors and agents (together, "you", "your" or "yours"). If you do not agree to this Policy, please stop using the Services immediately.
This Policy is applicable to you when you use or interact with Services provided by KPay Merchant Service (Australia) Pty Ltd through our website, mobile app, or other channel (collectively, “Channels”). Depending on the context, “you” may mean an End User (including a Merchant’s customer or cardholder), a Merchant who is an individual or a Representative.
1.1 End User: an individual user who uses our Services or whose Personal Information is handled in connection with the Services, including a Merchant’s customer or cardholder.
1.2 Information: Personal Information, and the information specified under section 3.
1.3 Merchant: the merchant company and its Representatives.
1.4 Partner: the institutions with which we partner to provide products and services (together, the “Partner”). We may partner with other institutions to provide products and services jointly. We provide our Partner with an End User's personal data concerning the activities of both the Partner and the respective End User. A Partner may handle Personal Information for its own purposes under its own privacy policy.
1.5 Personal Information: information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not, such as your basic personal details, including first and last name, date of birth, and copies of your government ID documents (e.g., passport or local ID card), and contact information.
1.6 Representative: An individual director, shareholder, employee, contractor or agent of a Merchant who uses or interacts with the Services.
1.7 Services: various technologies and services offered by KPay.
1.8 This Policy forms an integral part of the KPay Merchant Payment Services Agreement - General Terms and Conditions (the “Terms and Conditions”). The capitalized terms herein shall have the same meaning ascribed to them in the Terms and Conditions, unless otherwise defined.
2.1 As used in this Policy, “we,” “us,” “our,” and “KPay” refer to the KPay Merchant Service (Australia) Pty Ltd which is responsible for handling Personal Information under this Policy , registered at Suite 19.01, Level 19, 2 Market Street, Sydney NSW 2000.
3.1 Information you provide directly to us:
3.1.1 We collect Personal Information only where it is reasonably necessary for our functions or activities and by lawful and fair means. Account and Profile Information: In order to use our Services, you must provide certain Personal Information to us necessary to set up an account profile or use the various functions of our Services. We may require you to provide us with additional Personal Information as you use our Services. All such information is crucial for us to provide the Services, fulfil our contracted services with our Partner and to adhere to our legal obligations. Failure or unwillingness to provide this information may result in our inability to provide you with all requested Services.
3.1.2 Transaction Data: To enable you to utilize our Services, we will collect information regarding the transactions initiated on the Channels, including but not limited to the amount, time, currency, payment method, sender’s and recipient’s information.
3.1.3 Customer Support Information: In order for us to perform and improve our customer support, we may retain or request information including voice recordings and other documents as may reasonably be requested by us.
3.1.4 Survey, Feedback, and Promotions: Some information you provide to us is voluntarily provided by you and not mandatory. Examples of such information include your opting to respond to our surveys, provide feedback to us about our products and services, participate in promotions or contests or otherwise communicate with us. This information allows us to provide incentives or additional features to you, evaluate our performance and to create a better user experience for you when using our Services. We will handle this information for the purposes described above or as otherwise permitted by law.
3.2 Information automatically collected from your use of Services
3.2.1 When you use our Services, we automatically gather specific data from you where reasonably necessary for the purposes described in this Policy (such as preventing fraud or misuse, or enhancing our Services by understanding your usage patterns). This includes: Transaction Data, beneficiary information, card related information; usage data; information about the devices you use to access the Services; recordings; log data; and location information. Please refer to section 4 for more details on how we use your Personal Information.
3.3 Information collected from third parties
3.3.1 Where reasonable and practicable, we collect Personal Information directly from you. Please note that we also obtain information about you from various external sources, which may include our ecosystem and financial partners, payment service providers, service providers, credit bureaus, credit reference agencies, financial institutions, debt collection agencies, official registers and databases, fraud prevention agencies and partners, community forums for ratings or reviews, our business partners, the Partner, or other publicly available records.
3.3.2 Those third parties may handle Personal Information under their own privacy policies. Additionally, we may combine information obtained from third parties with data collected directly from you through the Channels.
3.3.3 Irrespective of the collection method, the information we acquire from or about you is always subject to the privacy choices or rights you exercise.
3.4 Information about other individuals:
If you provide us with Personal Information about another individual, you should be authorised to do so and should make this Policy available to that individual.
3.5 How we hold Information:
We hold Personal Information in KPay systems and in systems operated on our behalf by service providers, and may also hold limited physical records where necessary. We apply the security measures described in section 10.
4.1 This section provides more detail on the types of Personal Information we collect from you and the purposes behind it.
4.2 Account and Profile Information: This includes personal identifiers such as your first and last name, registered office address, email address, date of birth, passport number, local ID card number, company’s registration name, corporate registration certificate, average monthly turnover, or other similar identifiers. We use such information:
4.2.1 to facilitate the provision of Services, which includes:
4.2.2 to prevent fraud, misuse or breaches of the terms and conditions of our Services, which includes:
4.2.3 to communicate with you, which includes:
4.3 Identity Verification Documents (Merchant only): To comply with laws and regulations, we may collect copies of your government-issued identification document. This includes details such as your name, date of birth, identification document (including passport or local ID card), address proof, or other authentication information, all of which may include photographs of you. To the extent permitted by applicable law, we may obtain reports about you from public records. In order to obtain such reports, we may use Information or Personal Information you provide to us. We use such information:
4.3.1 to fulfil our legal obligations and provide the Services, which includes:
4.3.2 to prevent fraud, misuse or breaches of the terms and conditions of our Services, which includes:
4.4 Transaction Data: We may collect financial information such as bank account details (account number, routing number), credit or debit card numbers, billing address, payment method information, location, transaction amount, date of transaction or tax information. We use such information for:
4.5 Beneficiary Information: We may collect information about the parties to the transaction, the designated recipient (including the recipient’s bank account information), the source of the funds, the reason for the transaction, the devices and payment methods used to complete transactions. We use such information for:
4.6 Card Related Information: We use card numbers and details for:
4.7 Business Entity Information: If you are using the Services on behalf of a Merchant, we may collect information about the Merchant including: the organisational structure of the company, the company address, the product and service offerings, website domain name used by the business, information about the beneficial owners of the business, tax classification of the business, tax identification number(s), company registration number(s), and its tax residence. We also may collect entity formation documents or other corporate records. We use such information:
4.7.1 to facilitate the provision of Services, which includes:
4.7.2 to prevent fraud, misuse or breaches of the terms and conditions of our Services, which includes:
4.7.3 to communicate with you, which includes:
4.8 Log Data: When you access the Services, we collect server logs which may include information such as access times and dates, pages viewed and other system activities, including the third-party site you were using before accessing our Services. We use such information for:
4.9 Device Information: We may obtain information about the devices you use to access the Services and the Channels including: the device type, operating systems and versions, the device manufacturer and model, preferred languages, and plugins. We use such information for:
4.10 Usage Information: We collect information about how you interact or engage with the Channels and how you use the Services including your user preferences and other settings selected by you. This information may be collected if you visit our Channels and regardless of whether or not you establish an account with us or conduct a transaction. We use such information for:
4.11 Location Information: When you use certain features of the Services, we may collect information about your precise or approximate location as determined by data such as your IP address or mobile device GPS. Most mobile devices allow you to control or disable the use of geolocation services for applications by changing preferences on your mobile device. We use such information for:
4.12 Communications Data: We may collect information related to your interactions and communications with us, which may include email messages, chat sessions, text messages, and phone calls that we exchange with you. We use such information for:
4.13 Call Recordings: We may collect voice recordings of you captured when you contact us or if we contact you, including interactions with our customer service or sales teams, where permitted by law and after providing any notice required by law. We use such information for responding to your inquiries and customer support requests.
4.14 Various Other Information: We may collect any information you may provide us when you respond to surveys, for running the survey and analysing the results for our internal business purposes.
4.15 We may also collect any information you may provide us when you participate in promotions or request to receive promotional information. We use such information for:
5.1 Transfer of Information to Other Countries
5.1.1 We may hold or process Personal Information in Australia and may disclose it to KPay group companies and service providers located overseas for the purposes described in this Policy. An overseas disclosure may include giving a separate overseas KPay entity or service provider remote access to Personal Information. Before disclosing Personal Information to an overseas recipient, we take reasonable steps in the circumstances to ensure that the recipient does not breach the Australian Privacy Principles (“APPs”) in relation to the information. The countries in which overseas recipients are likely to be located include Hong Kong and Singapore.
5.2 Information Sharing and Disclosure
5.2.1 When providing you with Services, we may share your information with third parties including those set out in 5.2.2 to 5.2.7. Situations where this occurs are when we engage a variety of service providers to enable us to provide our Services to you and to our Partner. In such cases, Personal Information will be used to facilitate payment processing, support technology or infrastructure, cloud storage, conduct market research, marketing analytics, detect fraud, verify identity and perform audits or other necessary functions. We will share your Personal Information with such service providers only to the extent necessary to allow the performance of their intended engagement. Where appropriate, our agreements with service providers require them to protect Personal Information and use it only for authorised purposes.
5.2.2 Our Corporate Affiliates: To facilitate or support us in providing the Services to you, we may share your Personal Information within the KPay group of companies. All KPay group companies may only use your Personal Information in accordance with the relevant Intra-Group contracts governing such processing and for the purposes set out in this Policy. Where a separate overseas KPay group company receives or remotely accesses Personal Information, section 5.1 applies.
5.2.3 Financial and Ecosystem Partners: The Services may be offered to you in conjunction with or facilitated by other financial institutions, other payment institutions or other ecosystem partners. These partners could include providers of accounting or treasury management services, as well as marketplace payment service providers. For Financial or other payment institutions, the transfers and disclosures are necessary to provide you with the Services. As for ecosystem partners, any disclosures and transfers will be carried out as per your authorization or request, or as described to you, enabling you to utilise the products and services offered by these ecosystem and financial partners. When you grant permission or authorise third-party providers, plugins, widgets, or websites to access your account or receive your Information, it will be considered a formal request or authorization.
5.2.4 Partner: We may also refer you to services provided by our Partner. A Partner may provide services under its own licence or authorisation, contract directly with you and be independently responsible for Personal Information it collects or uses for its own purposes. We may disclose Personal Information to a Partner where reasonably necessary to provide Services requested by you, at your direction or with your consent, or where otherwise permitted or required by law.
5.2.5 Regulatory Authorities: There are situations where we have a legal obligation to disclose information about you to various authorities, including regulators, judicial authorities, courts, law enforcement agencies, tax authorities, and other public or government entities, both domestic and international. These disclosures may be necessary to comply with legal obligations or processes, enforce our terms and conditions of our services, address security or fraud issues, or protect our users. Please note that these disclosures may occur with or without your consent, and with or without prior notice where required or authorised by law or in accordance with valid legal processes, such as regulatory queries, subpoenas, court orders, or search warrants. In many cases, we are prohibited from notifying you about such disclosures by the terms of the legal process. Additionally, we may disclose your information to:
5.2.6 Reorganisation: In the event that our company is engaged in a corporate merger, acquisition, consolidation, reorganisation, sale, joint venture, assignment, transfer, or other disposition of all or part of our business, assets, or stock (including bankruptcy or similar proceedings), we may share data with third parties during the negotiation process, where reasonably necessary and permitted by law and subject to appropriate confidentiality and access restrictions. If your Information becomes subject to a different privacy policy as a result, we will make reasonable efforts to notify you in advance. Additionally, there may be situations where we need to disclose Information to a third party in connection with a commercial transaction where we or any of our affiliates are seeking financing, investment, or funding.
5.2.7 Third Party Requested by You: If you request (as part of the Services provided to you) or provide your consent, we may share your information including your Personal Information with a third party not defined in this Policy.
6.1 We will retain your Information only for as long as reasonably necessary for the purposes described in this policy or to comply with relevant laws or to fulfil any ongoing obligations to you.
6.2 Even if you close your account or request the deletion of your Information, we may still retain it in the circumstances below:
6.3 When KPay no longer needs Personal Information for any purpose for which it may be used or disclosed under the APPs, and is not required by or under an Australian law or a court or tribunal order to retain it, KPay will take reasonable steps to destroy it or ensure that it is de-identified.
7.1 You may request access to Personal Information we hold about you. Subject to exceptions under the Privacy Act 1988 (Cth) (“Privacy Act”), we will respond within a reasonable period and provide access in the manner requested where it is reasonable and practicable. We will not charge you for making an access request, but may charge the reasonable costs of giving access, provided the charge is not excessive. If we refuse access, we will give written reasons where required and explain the available complaint mechanisms.
7.2 Correction: You may request correction of Personal Information we hold about you if it is inaccurate, out of date, incomplete, irrelevant or misleading. We do not charge for a correction request or correction. If we refuse a request, we will give written reasons where required and explain the available complaint mechanisms. At your request, we will take reasonable steps to associate a statement with the information recording that you consider it to be incorrect.
7.3 Anonymity and pseudonymity: Where lawful and practicable, you may deal with us anonymously or using a pseudonym for general enquiries. We will usually need to identify you to provide payment services, comply with identification obligations, give access to account-specific information or resolve a matter concerning you.
7.4 Privacy complaints: If you believe we have breached the Privacy Act, the APPs or this Policy, contact us using section 14 and provide details of your concern. We will acknowledge the complaint, investigate it and respond within a reasonable period.
8.1 Device Permissions: Most mobile devices allow you to disable location services or revoke consent for applications to access your camera, photo library, or send you push notifications. You can refer to your device settings to restrict the collection of certain information.
8.2 Notifications: We may occasionally send you notifications that we deem necessary, such as notifications for temporary service suspensions due to maintenance or security, privacy, or administrative-related communications. You cannot opt out of these service-related notifications as they are not promotional in nature.
8.3 Marketing Opt-Out: We only send promotional communications with your consent. If you wish to opt out of receiving such promotional communications from us, you can contact our customer service to modify your preferences. We will action an opt-out request within a reasonable period and without charge. Please note that if you choose to opt out of marketing-related emails, you will still receive non-promotional messages that are necessary for providing our Services, such as transactional receipts and messages related to your account or our relationship with you.
9.1 We may collaborate with third-party partners to present advertisements to you on websites you visit. These partners utilise cookies and other technologies to collect information about your activities on our websites, as well as other websites you visit. This information is used to deliver targeted advertising based on your browsing history and interests.
10.1 We take reasonable technical, organisational and physical measures to protect Personal Information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. Safeguards used to protect your information include firewalls, data encryption, and access controls. Please keep in mind that the transmission of information over the Internet is never 100% secure and no data storage system can be guaranteed safe. We encourage you to understand the integral role you play in keeping your own Information secure and confidential. Please select passwords that are sufficiently complex and always keep your log-in details secure. If you suspect any unauthorized use or access to your account or information, please contact us immediately.
11.1 Our Services and Channels are not intended for or directed towards children.
11.2 We do not knowingly collect any information from children. If we become aware that we have unintentionally collected Personal Information from a child, we will promptly delete it, unless we are legally required to retain such information. If you believe that we have inadvertently collected information from a child, please contact us immediately.
12.1 Our websites may contain links to third-party websites or services, including third-party integrations, co-branded services, or services branded by third parties (“Third-Party Channels”). Clicking on these links or enabling such connections may allow third parties to collect or share information about you. We do not own or control these third-party websites. When you interact with these Third-Party Channels, you may be providing information directly to the Third-Party Channel, KPay, or both. Each Third-Party Channel will have its own policies regarding the collection, use, and disclosure of your information. You should review the policies of these Third-Party Channels for more information.
13.1 We reserve the right to make changes to this Policy at any time by posting a revised version on our website and updating the “Last Updated” date at the end of the Policy. If you do not agree with any of the changes made, you may deactivate your account with us at any time.
14.1 If you have questions or concerns about this Policy or a specific request related to your Personal Information, please contact us at cs@kpay-group.com and we will endeavour to deal with your request as soon as possible.
14.2 You can also send physical mail to:
KPay Merchant Service (Australia) Pty Ltd
Suite 19.01, Level 19, 2 Market Street, Sydney NSW 2000
Attention: Customer Service
15.1 Except as otherwise set out by law, in case of any inconsistency between the English version and translated version of this Policy, the English version shall prevail.
Last updated: 15 September 2026