1.IN A NUTSHELL
This privacy notice (the “Privacy Notice” or “Notice”) explains why and how UnionPay International Co. Ltd (“UPI” or “we”) may process your personal data.
To use UnionPay service, you need to consent to the privacy notice.
•What does “personal data” mean?
Personal data means any information that can be linked directly or indirectly to identified or identifiable individuals.
•Who is UPI?
UPI is a company incorporated under the laws of the People’s Republic of China (“PRC”) with its registered office at Floor 2-7, No.6 Dongfang Road, Pudong New District, Shanghai, PRC.
UPI is an international company established in numerous countries/regions across the world.
If you have any questions in relation to data protection matters, you can write to us at the abovementioned address or call the UnionPay official hotline at 95516 (Chinese Mainland)
or http://www.unionpayintl.com/en/serviceCenter/hotline/ (outside Chinese Mainland).
•What is the key information contained in this Privacy Notice?
You will find relevant information on the personal data we process about you, the purposes for the processing of personal data and your rights.
2.THE CATEGORIES OF DATA SUBJECTS AND OF PERSONAL DATA WE PROCESS ABOUT YOU
The types of personal data we process are the following:
• Registration information: when you register for the account provided by UPI and bind your UnionPay card, you may need to provide your name, mobile phone number, email address,
and your bank card number, expiration date and security code (for example, CVV2 of your bank card). When using related services, you need to provide your mobile phone number or
email address as your login account, and your password to complete the login. If you refuse to provide the aforementioned personal data, you may not be able to successfully register
for the account provided by UPI or use the service of the UnionPay card.
• Transaction information: UPI members and cooperative partners may provide UPI with the transaction information, including merchant information, your UnionPay card number, expiration
date and security code (for example, the CVV2 of your UnionPay card), transaction time and date, and the transaction amount. We process the transaction data of UnionPay cards under
the instruction of UPI members and cooperative partners to achieve the purpose of transaction.
• Information about your usage of UPI’s service, including hardware device model, screen width and height, software version information, your IP address, your location, mobile network
information, and your device ID , device manufacturer, device model, operator, IMEI/android ID/IDFA/OPENUDID/GUID, SIM card IMSI information, standard web log data, and other
information collected through automated means (such as cookies, scripts and similar technologies).
• Information you may provide in marketing programs, including mobile phone number, email address, card number, airline member name, membership number.
• Information of personal data relating to individual representing or working for UPI members and cooperative partners: managing and maintaining the relationship with UPI members
and cooperative partners, including individual’s name, date of birth, nationality, email address, mailing address, phone number, job title, etc.
• Publicly available information, such as your interaction with UPI on social media page, and use the information as described in this Privacy Notice.
• Information about UPI’s employees or job applicants, including name, email address, home address, contact information, education background.
3.THE PURPOSES OF THE PROCESSING OF YOUR PERSONAL DATA
You will find below the purposes for which UPI processes personal data:
• Creating and managing your UnionPay account;
• Verifying your identity when you bind your UnionPay card to service provided by UPI or electronic wallet;
• Processing your payment transactions;
• Preventing anti-money laundering and fraud risks;
• Providing you with personalized services and recommendations;
• Contacting you about marketing activities, if you have given your consent or as otherwise permitted by applicable law;
• Doing internal research, reporting and analysis;
• Processing your job applicants;
• Managing relationship with UPI members and cooperative partners;
• Compliance with applicable laws, regulations and law enforcement requests.
4.YOUR RIGHTS
Depending on where you are located, you may have the right to:
Accessing your personal dat
We understand that you may like to know what personal data we retain about you. We are happy to assist you with your request as soon as we can. To protect your personal
data, however, we will probably require that you prove your identity to us at the time your request is made.
UPI reserves the right to decline access to your personal data under certain circumstances as permitted by law. If your personal data is not disclosed to you, you will be provided
with the reasons for this non-disclosure.
Other rights
You may also be entitled to:
• object to the processing of your personal data;
• opt out from processing of your personal data for direct marketing purposes;
• request the restriction of the processing of your personal data;
• request the correction and/or deletion of your personal data;
• withdraw your consent to the processing of your personal data (where UPI is processing your personal information based on your consent);
• request the receipt or transmission to another organisation, in machine-readable form, of the personal data you may have provided to UPI;
• object to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.
• request user account cancellation; after you cancel your account, UPI would stop providing services to you, and delete your personal information or anonymize it as required
by applicable laws.
• odge a complaint with a supervisory authority; and
Where you are given the option to share personal data with UPI, you can always choose not to do so.
If you do not wish to receive marketing information from UPI, you may call the UnionPay official hotline at 95516 (Chinese Mainland)
or http://www.unionpayintl.com/en/serviceCenter/hotline/(outside Chinese Mainland). You will always have the ability to accept or decline any form of communication from UPI.
You may unsubscribe from electronic marketing communications at any time by selecting the “unsubscribe” link included in such communications.
If you object to the processing of your personal data, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice.
This could mean that we will be unable to perform the actions necessary to achieve the purposes of processing data for you as described above (see article 3) and that you may
be unable to use our services.
After you have chosen to withdraw your consent, UPI may be able to continue to process your personal data to the extent required or otherwise permitted by law.
Those rights may be limited in some circumstances by local law requirements. If at any time you wish to exercise any of these rights, you can do so by calling the UnionPay official
hotline at 95516 (Chinese Mainland) or http://www.unionpayintl.com/en/serviceCenter/hotline/(outside Chinese Mainland).
5.THE RECIPIENTS OF YOUR PERSONAL DATA AND CROSS-BORDER-TRANSFERS
The recipients of your personal data are:
• UPI’s staff, establishments and affiliates; “affiliates” means any corporation, company or other entity that directly or indirectly controls, is controlled by, or is under common control
with UPI.
• UPI’s processors and other contractors, suppliers and service providers;
• Other participants in the payment ecosystem, including financial institutions, and merchants to perform and/or facilitate payment card transactions, to ensure the safety and security
of those transactions, to authenticate your identity, to tokenize your payment credentials, to resolve disputes, provide customer service, to provide analysis and other services that you
request.
• Third parties whose feature you use in connection with our products and services or with your consent.
Such recipients shall undertake all necessary measures to keep your personal data confidential.
Additional requirements apply when your personal data is transferred to (or accessed from) another country/region. UPI only transfers personal data to another country/region where
that transfer complies with data protection law.
UPI is based in the People’s Republic of China and operates a global payment network with affiliates and service providers located outside of your country/territory of residence. As a
result, UPI may instruct affiliates and/or service providers located worldwide to process any personal data collected by UPI at any time after it is collected. Such cross-border transfer is
necessary for UnionPay services. Regardless of where your personal data is transferred, we will protect it in accordance with this Privacy Notice and applicable law.
6.DIRECT MARKETING
UPI may use your personal data (including your contact numbers) for direct marketing to you. This includes sending you marketing communications about updates, latest offers and
promotions in relation to the goods, services or activities of UPI (or by an agent on behalf of UPI) or, as appropriate, its affiliates and those other companies with whom UPI has
joint-marketing arrangements, whether they are available through it or otherwise. UnionPay may not so use or provide your personal data except permitted by applicable law or it has
received your consent.
These communications may be sent by mail, SMS and email, in accordance with applicable laws. You may opt-out of receiving marketing communications from UPI at any time by:
• calling the UnionPay official hotline at 95516 (Chinese Mainland) or http://www.unionpayintl.com/en/serviceCenter/hotline/(outside Chinese Mainland), or
• using opt-out facilities provided in marketing communications.
UPI will then take all reasonable steps to remove your name from the mailing list.
7.SECURITY
Appropriate technical and organisational measures have been implemented to prevent from unauthorised or unlawful processing of your personal data and against accidental or
unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed, including but not limited to:
• In terms of internal policy, we have adopted a data classification and grading system, based on which we have imposed limitations on user permissions, usage scenario permissions
and approval mechanisms.
• In terms of techniques, we adopted irreversible encrypted storage and isolated storage, adopted de-identification technique during information display, and dedicated line
transmission, encrypted transmission, isolated transmission as well as other techniques to ensure the security of your personal data.
• If a data breach occurs, we may communicate the data breach to you and notify it to the supervisory authorities in accordance with the requirements of applicable laws.
8.COOKIES
In order to ensure that you have a smoother and more relaxed experience, when you use the service provided by UPI, we may identify you through a small data file "Cookie" to
help you reduce the number and frequency of information entry, or assist determining the security status of your account. Cookies usually contain identifiers, site names, and some
numbers and characters. With the help of cookies, websites can store data such as your preferences.
We will not use cookies for any purpose other than the purposes described in this policy. Most web browsers have the function of blocking cookies. You can manage or delete cookies
according to your preferences, and you can clear all cookies saved on your device at any time. If you choose to clear it, you need to reset the user settings every time you use your
device to visit related websites and browse products.
In addition to cookies, we may use Web Beacon to collect statistics about anonymous visits to calculate the number of user visits, stay time, page addresses visited, display settings,
etc., so that you can enjoy more personalized services, and these statistics do not include your personal data.
9.DATA RETENTION
Your personal data will be stored for the period of time required by applicable law. We will only retain your personal information for the period required to achieve the purpose stated
in the policy and the period required by applicable laws and regulations. For example, UPI will, in accordance with the requirements of the Anti-Money Laundering Law of the People's
Republic of China, require customer transaction information to be kept for at least five years after the transaction ends. UPI will keep relevant web logs for your use of the service for
no less than six months in accordance with the requirements of the Cybersecurity Law of the People's Republic of China. Our criteria for determining the aforementioned retention
period include:
• Completing the service purpose related to you, maintaining the corresponding service and business records, and responding to your possible inquiries or complaints;
• Guaranteeing the safety and quality of the services we provide to you;
• Whether there are other agreements for retention periods.
After your personal information exceeds the retention period, we will delete your personal information or make it anonymized in accordance with the requirements of applicable laws.
10.CHILDREN'S DATA
The UPI service is not directed to individuals under the legal age of majority in their respective countries/territories. If you are children, the consent of the holders of parental responsibility
over children is to be obtained.
11.LINKS TO OTHER WEBSITES
You may find links to access the websites of other companies on UPI website. We recommend that you read the privacy policies of these other websites, as this Privacy Notice does
not apply to their processing of your personal data and UPI is not responsible for the processing of your personal data on external websites.
12.CHANGES IN PRIVACY NOTICE
We may update this Privacy Notice from time to time – in particular in case of change of law, of guidance from competent authorities or of UPI’s internal policies. If we change or
expand the purpose of processing personal data, we will provide you with an updated Privacy Policy promptly. In that case, we will share with you the updated Privacy Notice through
our website or other channels, and, in certain circumstances, we may seek your consent.
13.CONTACT UPI
If you have any questions about data protection, this Privacy Notice or your right, you can call UPI's official hotline 95516 (Chinese Mainland) or overseas service
hotline (http://www.unionpayintl.com/cn/serviceCenter/hotline/ ).