PayMe for Business Personal Information Collection Statement ("PICS")

This PICS and the Notice relating to the Personal Data (Privacy) Ordinance (“Notice”) together set out the purposes for which your Personal Data may be collected, used, processed, disclosed, transferred and retained in connection with PayMe for Business and the Services. We are required by the Ordinance to give you the information set out in this PICS and the Notice before collecting your Personal Data. The terms used in this PICS are defined in Clause 5.

  1. Collection of Personal Data
    1. In order to register for and to use the Services and in order to create your PayMe for Business user profile and PayMe for Business Account, the following Personal Data will be collected by us or our third party service providers:
      1. the Personal Data requested in the PayMe for Business registration journey;
      2. details of your Bank Account, so that you can receive money transferred from the Services and (if allowed by us) pay money to your PayMe for Business Account; and
      3. any other Personal Data that we may request from time to time in order to verify or authenticate your identity and information,

      for purposes detailed in the Notice and for additional purposes set out in this PICS.

    2. If you choose to create your PayMe for Business user profile and to register for the Services by logging in to your existing business internet banking profile with us, then we may access and collect from there your Personal Data and other information such as your user name and email address in order to create your PayMe for Business user profile.
    3. For verification and security purposes, we also collect and store your Mobile Device identification number during the registration process, or when you access the Services from your Mobile Device from time to time. We may also access the location services of your Mobile Device from time to time with your permission if you wish to use certain functions of PayMe for Business. You may refuse to give and you may withdraw permission at any time by turning off location services and continue to use other functions of PayMe for Business.
    4. The items of information in the PayMe for Business registration journey are mandatory. If you do not provide these items of information, or if any information provided is untrue, inaccurate or incomplete, we may not be able to provide you with the Services.
    5. If you provide us with the Personal Data of another individual in connection with PayMe for Business or the Services, you confirm that you have obtained the consent of the relevant individual to provide his/her Personal Data to us, and for the Personal Data to be used, processed, disclosed, transferred and retained by us in accordance with this PICS.
  2. Use of Personal Data
    1. In addition to the purposes set out in the Notice, we may use the Personal Data you provide for the following purposes (or any of them):
      1. to process your request for registration and use of the Services, including creating your PayMe for Business user profile and PayMe for Business Account;
      2. to administer your PayMe for Business user profile and PayMe for Business Account, which include details of the transfers, transactions and dealing conducted by you through the Services;
      3. to verify or authenticate your identity and information for your registration and use of the Services, including conducting matching procedures against databases of known fraudulent transactions (maintained by us or third parties) and where you are registering the PayMe for Business Account on behalf of an entity, sending your information to the business owner of such entity for verification purposes;
      4. to provide, maintain and operate the Services, including processing, executing and effecting instructions, payments and transactions through the Services, and providing technology support or services for or relating to the Services;
      5. to process, handle or communicate with you in respect of any enquiry, complaint or service support request relating to the Services;
      6. to prevent, detect or investigate fraud or other illegal activities; and
      7. subject to your consent, to send you Direct Marketing materials about services, add-ons, enhancements and products relating to PayMe for Business and the Services.
  3. Disclosure and transfer of Personal Data

    Payment senders/recipients and social sharing

    1. Details of payments made by you through the Services (including the amount, your message and your user name) will be shared with your payment sender/recipient.
    2. The merchant name, merchant logo and any information you post or share in PayMe for Business, may be viewed by other users of PayMe. You should seek prior consent from a person before you post or share anything in PayMe for Business involving such person, including the payment sender/recipient.
    3. Details of transactions or other activities in PayMe for Business (for example, participation in any PayMe for Business promotional activities) involving you may be shared and/or viewed by other PayMe users. For example, a sender of payment may share or post information of a payment made to you in PayMe in which you may be mentioned. You may also be mentioned by another PayMe user in any transaction not relating to you. If you become aware of any social abuse, you may report such abuse to us by sending us an enquiry via our public website.

      4. Third party service providers and HSBC Group

    4. We may transfer your Personal Data to the following parties (or any of them), whether in or outside of Hong Kong:
      1. any third party service provider, contractor or sub-contractor that operates or maintains PayMe for Business on behalf of HSBC or the HSBC Group, or carries out back-end services, administrative services, verification services or information technology services on behalf of HSBC or the HSBC Group, or provides necessary support or services to HSBC or the HSBC Group to enable us to provide PayMe for Business and the Services, including any third party payment gateways used by HSBC or the HSBC Group; and
      2. any member of the HSBC Group, for the purposes set out in the Notice or in paragraph 2.1 above.
    5. We and/or our third party service providers may retain your Personal Data in accordance with our record retention policy and schedule using data centre of our third party service providers inside or outside Hong Kong.

      6. Legal or compliance

    6. We may disclose and transfer your Personal Data in accordance with any legal or regulatory requirements or any court order applicable to us or the HSBC Group.
  4. Access to and correction of your Personal Data

    You have the right to access to and correct your Personal Data held by us. The person to whom requests for access to personal data or correction of personal data, or for information regarding policies and practices and kinds of personal data held by us, should be addressed to us as follows:

    The Data Protection Officer

    The Hongkong and Shanghai Banking Corporation Limited

    PO Box 72677

    Kowloon Central Post Office

    Hong Kong.

  5. Definitions and language

    1. Capitalised terms used in this PICS shall have the following meanings:

      "Bank Account" means a Hong Kong dollar business account held with us or any other licensed bank in Hong Kong acceptable to us, designated by you for using the Services.

      "Direct Marketing" means:

      1. sending information or goods, addressed to specific persons by name, by mail, fax, electronic mail or other means of communication; or
      2. making telephone calls to specific persons.

      "Hong Kong" means the Hong Kong Special Administrative Region of the People's Republic of China.

      "HSBC Group" means HSBC Bank plc, its affiliates, subsidiaries, associated entities and any of their branches and offices (together or individually), and member of the HSBC Group has the same meaning.

      "Internet Site" means any internet site established, operated or maintained by us or for us for or in relation to the Services.

      "Mobile Device" means a smartphone or tablet with PayMe for Business installed.

      "Ordinance" means the Personal Data (Privacy) Ordinance, Cap 486 of Laws of Hong Kong.

      "PayMe" means the software platform known as "PayMe from HSBC", which allows individuals to: (a) link a credit card and/or personal bank account; (b) store money on such software platform; and (c) send and receive low-value monetary amounts to and from other individuals.

      "PayMe for Business" means the software platform which allows you to, amongst other features, accept payments from and send refunds to your customers who have PayMe accounts.

      "PayMe for Business Account" means your account in PayMe for Business in which you may store value by keeping funds received from payments through the Services, and from which you may send or transfer money.

      "PayMe for Business App" means the software Mobile Device application which incorporates and utilises PayMe for Business.

      "Personal Data" means any information relating to an individual from which such individual can be identified.

      "Services" means the stored value and payment services and facilities provided through PayMe for Business and the related Internet Site to enable a user to send or receive payments and include all ancillary and related services. For the avoidance of doubt, "Services" include PayMe for Business and the PayMe for Business Account.

      "we", "us", "our" or "HSBC" means The Hongkong and Shanghai Banking Corporation Limited and its successors and assigns.

      "you" or "your" means the person or entity to whom we provide the Services and, where the context permits, includes any individual authorized by you to use PayMe for Business on your behalf and each of your personal representatives and lawful successors.

    2. The English version of this PICS prevails to the extent of any inconsistency between the English and the Chinese versions. Any Chinese version of this PICS is for reference only.

    To find out more information, please visit [Privacy and Security] and [Notice Relating to the Personal Data (Privacy) Ordinance]. To find out more information about what data the PayMe for Business App accesses and uses, please visit [App Privacy Notice].

    SVF License Number: SVFB002