Alipay Singapore E-Commerce Private Limited

Privacy Notice

Effective Date: Dec 2022

This Privacy Notice to Users of Alipay Services (as defined below) applies to our users of our Alipay Services (Users) and other relevant individuals worldwide, including:

1) each individual who is a registered member of a merchant site, and who makes an online purchase or sale from the merchant site using Alipay Services; and

2) each merchant being a sole trader or an entity who buys or sells products or services on a merchant site using Alipay Services and provides personal data (generally, information that identifies an individual whether directly or indirectly) to Alipay in the process thereof.

The term “merchant site” means any web-based marketplace platform to which our website is linked (each a merchant site), including:

1. Platform Site: www.aliexpress.com and/or the related mobile application (the "AliExpress Site")

2. Platform Site: http://wholesale.alibaba.com and/or the related mobile application (the “Alibaba.com Wholesale Site”)

3. Platform Site: www.tmall.hk and/or the related mobile application (the "Tmall Global Site")

4. Platform Site: https://intl.aliyun.com and/or the related mobile application (the "Alibaba Cloud Site")

5. Platform Site: distributor.taobao.global and/or the related mobile application (the “Taobao Drop Shipping Site”)

6. Platform Site: https://www.tmall.com and/or the related mobile application (the “Tmall Site”)

7. Platform Site: https://www.alibaba.com (the "Alibaba.com Site")

8. Platform Site: https://world.taobao.com/ and/or the related mobile application (the “Taobao Site”)

9. Platform Site: https://www.taobao.com/markets/gmall/ and/or the related mobile application (the "Taobao Global Site")

10. Platform Site: www.allylikes.com and/or the related mobile application (the “Allylikes Site”)

11. Platform Site: https://qian.cainiao.com/ and/or the related mobile application (the “Cainiao Site”)

12. Platform Site: www.trusple.com and/or the related mobile applicable (the "Trusple Site")

13. Platform Site: www.aliexpress.ru and/or the related mobile application (the "AliExpress RU Site")

14. Platform Site: https://g.cainiao.com and/or the related mobile application (the “Caiyuan Site”)

15. Platform Site: https://miravia.es and/or the related mobile application (the “Miravia Site”)

Alipay Services are services provided by Alipay Singapore E-Commerce Private Limited and our affiliates (collectively, referred to as the Alipay Group) to facilitate payments in connection with certain online transactions on these merchant sites and are only available to registered members of the merchant sites. Unless otherwise indicated or the context requires otherwise, reference to “you” or “your” are intended to refer to a User, and reference to “Alipay”, “we”, “us” or “our” in this Notice and the Agreements include relevant companies in the Alipay Group that are involved in providing the Alipay Services (each an “Affiliate” or member of the “Alipay Group”).

Please read this Privacy Notice before using Alipay Services or submitting personal data to us. By accessing and using the Alipay Services, you agree and consent to the collection, use and disclosure of your personal data as outlined in this Privacy Notice. If you do not consent to the processing of your personal data as described in this Privacy Policy, please do not access and use merchant sites and Alipay Services.

Please see here our terms and conditions for the Alipay Services, which may contain additional terms regarding privacy and our use of information about you.

We want you to understand:

1. What personal information do we collect about you?

We collect and use personal information about you, including when you interact with us, register for an Alipay account, use the Alipay Services to make purchases or otherwise conduct financial transactions, or otherwise visit or use our Alipay Services. The personal information that we collect includes (but is not limited to):

1) your basic personal details, including first and last name, and copies of your personal identity documents;

2) contact information including your address, phone number, email, or other information that permits us to contact you;

3) account information, such as details of the payment card used to complete a transaction with a merchant;

4) registration details;

5) financial information and tax identification information;

6) transaction details, including recipient name, delivery address and recipient phone number; and

7) details of any marketing preferences you have given us (such as requests to receive or not receive certain types of marketing communication);

8) copies of communications with or about you; and

9) the following usage, device, and technical information: i）information about the device you use to interact with us, and ii) information from your visits to our websites or mobile applications, collected automatically through tracking tools. This information includes browser history, product engagement, length of visit/usage, page views, IP address or other unique identifiers, browser/platform type and version, internet service provider, operating system, referral source/exit pages, device operations, and other information regarding your interaction with our websites and our advertisements) session information, device ID, user agent, and IP address. We also embed tracking tools within the emails and other communications we send to you to help us understand how you interact with those messages, such as whether and when you opened a message or clicked on content within the message.

As noted above, we collect personal information which may be considered sensitive in certain jurisdictions. Specifically, if we collect your passport, your payment card information, or your financial information and tax identification information, you may have additional rights and protections with regard to such sensitive personal information under certain data protection laws.

Whenever personal information is collected (e.g. upon registration), we will indicate whether the provision of such information is mandatory (e.g. with an asterisk). If you do not provide such mandatory personal information to us, you may not be able to register for Alipay Services or, at least, you may not be able to participate in certain elements of the Alipay Services.

2. How we obtain your personal information

We collect personal information about you in connection with the Alipay Services. For example, we collect your personal information when you browse our websites, register as a User of Alipay Services, or log into your Alipay account to use our Alipay Services on a merchant site; or when you sell or provide products or services on one of the merchant sites using Alipay Services or when you communicate with us via e-mail, phone, SMS, or any other electronic means.

We also collect personal information automatically from your devices. We use cookies and other tracking tools and technologies that automatically collect information like browser, usage, and device information any time you visit or interact with our websites, mobile apps, emails, and online content or ads on other websites and platforms. We may provide further information, depending on your location, via a cookie policy.

We also receive personal information about you from following sources, including:

1) merchants, merchant sites and other third parties who support the ability to make payments and conduct transactions through Alipay Services or otherwise;

2) our Affiliates

3) suppliers providing services on our behalf (such as vendors that provide hosting services, assist in sending emails, provide technical assistance and security, perform research and analysis for us, or provide marketing and advertising services);

4）banks and other payment institutions that we cooperate with to provide you with the Alipay Services; and

5）publicly available sources, such as public registers and social media.

We combine information that we have about you from various sources including the information you have provided to us.

Please refer to HOW WE USE YOUR PERSONAL INFORMATION for more details.

3. How we use your personal information

We use your personal information (including your sensitive personal information, if any) to provide you with Alipay Services. More specifically, we may use your personal information for the following purposes:

1） verifying your identity, including during account creation and payment password reset processes;

2）verifying your eligibility as a User of Alipay Services (including “know your customer”, anti-money laundering and counter-terrorist financing verification);

3）conducting due diligence checks, anti-money laundering checks, fraud monitoring, financial compliance and other activities in order to comply with the regulations that may be issued by the Monetary Authority of Singapore from time to time;

4）processing, maintaining and managing your registration as a User;

5）providing you with Alipay Services and related User services, including operating the Alipay Services and enabling transactions, customizing your user experience, facilitating the settlement of purchase price for goods and services, shipping and related services for purchases, charge-backs, sending notices about transactions, and responding to your queries, feedback, claims or disputes;

6）contacting you in relation to our provision of Alipay Services, contacting you in connection with any communication preferences or requests you have expressed, asking you for feedback about Alipay Services or other related products and services;

7）collecting feedback from you and your staff about our products and services and using such feedback to improve our business and/or customize products and services for you;

8) serving you advertising and sending you information about products and services, including for promotional and marketing purposes;

9) assessing, detecting, investigating, preventing or remediating fraud, data breaches or other potentially prohibited or illegal activities and otherwise protecting the integrity of our platform and safety and security of our staff and that of our suppliers and counterparties

10) managing our risk, performing creditworthiness and solvency checks, or detecting, investigating, preventing or remediating violations of your agreements with us or any of our applicable policies, industry standards, guidelines, laws and regulations;

11) managing our everyday business needs, such as internal recordkeeping, reporting and other account management, client reporting, business continuity and disaster recovery, regulatory reporting and legal compliance;

12) making disclosures as may be required by any law or regulation, government official or other third party, including any card association or other payment network. Such disclosures may also be made pursuant to any subpoena, court order or other legal process or requirement applicable to us or any Alipay Group company (including “know your customer”, anti-money laundering and counter-terrorist financing reporting requirements or other commercial disputes);

13) making disclosures to competent regulators to prevent any harm or financial loss, to report suspected illegal activity or to establish, exercise, or defend claims or potential claims on behalf of ourselves or our Affiliates;

14) improving and optimizing the Alipay Services, conducting trend analysis or using data analytics to obtain information and insights on transaction and usage patterns;

15) managing our business including to protect Users, prevent harm, fraud or theft to ourselves and others, maintain the security of our products, and protect our rights or property and those of others;

16) complying with all applicable laws, regulations, rules, directives, orders, instructions, guidance and requests from any local or foreign authorities, including regulatory, governmental, tax and law enforcement authorities or any other authorities; and

17) for other purposes for which we provide specific notice at the time of collection.

4. With whom Do we share your personal information?

We share your personal information to operate and manage our business, including for the purposes indicated under How We Use Your Personal Information. For example, we may share your information with:

1) our affiliates in the Alipay Group providing services on our behalf or to which we provide services. For example, we may share your personal information with Alipay.com Co., Ltd ("Alipay.com") to obtain risk information and analysis relating to any activities you may have with Alipay.com, for purposes of risk controls and fraud detection and prevention purposes;

2) merchants and merchant sites that provide you with products, services and other offerings on or through Alipay Services;

3) any agent, contractor, vendor, or service provider acting as subcontractor on behalf and upon our instruction to help us in providing Alipay Services. We set out a list of such agents, contractors, vendors, and service providers in the Sharing with our service providers section below. We engage the foregoing to help us with fraud prevention, anti-money laundering checks, credit checking, bill collection, data entry, database management, promotions, marketing, customer service, technology services, products and services alerts and payment extension services or to provide trade financing services;

4) entities with whom Alipay maintain commercial arrangements, including merchant sites, online merchant platforms, and companies in the Alibaba Group;

5) banks, card associations, payment networks or acquiring institutions, and other organizations, including those involved in processing of payments and conducting of transactions through Alipay Services; and

6) law enforcement agencies, insurers, government and regulatory authorities or any other organizations to which Alipay, or any Alipay Group company or third-party service provider is under an obligation to make disclosure under the requirements of any applicable law, regulation or commercial arrangement;

7) individuals and entities involved in any merger, acquisition, corporate reorganization or financing, or similar transaction with us, including in the event of the sale of all or part of our assets; and

8) our own and others’ professional advisors (e.g., lawyers, accountants, auditors and trustees).

When sharing your personal information, we shall endeavour to comply with the Singapore Personal Data Protection Act 2012 and other applicable data protection and privacy laws.

See How do we store and protect your personal information for information on how we keep your personal information secure when sharing it with others.

5. How do we store and protect your personal information?

We will keep your personal information in accordance with our policies and for as long as it is necessary to provide you with the Alipay Services or other purposes as set out in this notice. In addition, we may retain your personal information for a longer period (including after you are no longer a User), if it is necessary to comply with laws and regulations applicable to us, including the Singapore Personal Data Protection Act 2012.

The criteria we use to determine the appropriate retention periods are:

1) the various regulatory requirements that we are subject to;

2) whether a legal claim could be brought against us for which your personal information may be relevant;

3) the necessity of your personal information to provide the Alipay Services,

4) the type, nature, and sensitivity of your personal information being processed; and

5) the legal basis for processing your personal information – e.g., consent or legitimate interests or otherwise.

We use a variety of security measures and technologies designed to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable data protection and privacy laws and regulations. However, transmission of your personal information on the internet can never be completely secure due to a variety of factors that cannot always be prevented or controlled. Despite our reasonable efforts, we do not and cannot guarantee the security of any of your personal information collected, stored, or transmitted. You are responsible for maintaining the security of your account information (username, password, etc.) for Alipay Services in your possession or control.

6. How do we process personal information about children?

Our service is not directed towards children under 13 years old nor does Alipay knowingly collect information from children under 13. If you are under 13, please do not use Alipay Services or submit any personal information to us.

If you are above 13 but below 16 years old, and where we have asked for your consent for collecting your information in order to provide services to you, you must ask your parents or guardian to read this Notice, and use our services or provide us with your information with prior express consent from your parents or guardian. If your guardian disagrees to your use of our services or provision of information to us in accordance with this Notice, please cease immediately the use of our services and notify us promptly so that we can take appropriate actions.

If you, acting as a guardian of a child, have relevant questions in respect of a child’s personal information, please contact us using the details set out in the Contact us section below.

7. Third party services and sites

The Alipay Services and our website may provide links to other websites and services (including other online merchant sites) for your convenience and information. These services and websites may operate independently from us. Linked services and websites may have their own privacy notices or policies, which we strongly suggest you review if you visit any linked websites. To the extent any linked websites you visit are not owned or controlled by us, we are not responsible for these websites’ or services content, any use of these services or websites by you, or the privacy practices of these services or websites.

8. Changes to this Notice

We may change, amend or revise this Notice from time to time. We will notify you of any substantive or material change in this Notice by updating this web page, sending push notifications, e-mails or letters, by phone.

9. Contact us

If you have questions or requests about the privacy issues relating to the processing of your personal information, you can contact us by email at privacy@alipay.com or at our business address: Privacy Matters, 51 Bras Basah Road, #04-08 Lazada One, Singapore 189554. Please provide us with your email address and the merchant site your query is related to. As required under applicable law, please note that we may take steps to ask you to provide further information to verify your identity before granting you access to information or acting on your request to exercise your rights.

Appendix 1 Provisions specific to EU users

If you are an individual in the European Union (EU) whose personal data we process in relation to either our offer of goods or services to you or our monitoring of your behaviour in the EU (EU Users, the following additional provisions may also apply to you.

1. Who is your data controller and EU representative?

The data controller of your personal information is Alipay Singapore E-Commerce Private Limited (any references to Alipay, we, our or us in this Notice as applied to you are intended to refer to this entity). Our representative in the EU is Alipay (Europe) Limited, 9, rue du Laboratoire, L-1911 Luxembourg.

2. What is our legal basis for using your personal information?

We use your personal information on bases set out below.

1) For the performance of Alipay Services Agreement or other contracts to which you are a party.

2) To comply with legal and regulatory obligations.

3) For legitimate business purposes.

i） Using your personal information helps us to operate and improve our business and minimise any disruption to the services that we may offer to you for. It also allows us to make our communications with you more relevant and personalised to you, and to make your experience of our products and services efficient and effective.

ii) As we are based in Singapore and have infrastructure in the US, we need to transfer your personal information internationally as part of our business structure, including as a result of laws and regulations applicable to us and other Alipay Group companies and legal claims or proceedings that involve us or other Alipay Group companies.

iii）However, in cases in which we wish to use your data for our legitimate business purposes, we carefully consider the position and do not go ahead if we think your interests or fundamental rights and freedoms relating to your personal information would be prejudiced. Examples of matters we consider include how we use your data responsibly (for instance security measures we put in place to protect it, such as access controls).

4）Because you have given your consent. At times we may ask for your consent or the consent of the holder of parental responsibility over you (in case you are below the age of 16 years, please see How do we process personal information about children ) to allow us to use your personal information for one or more purposes. See Your rights with respect to your personal information for information about the rights that you have if we process your information on the basis of your consent.

3. Transfers of your personal information outside of the EEA

Your personal information may be processed by us, companies in the Alipay Group and our trusted third party suppliers outside of the European Economic Area (EEA), including in countries where data protection and privacy laws or regulations may not be equivalent to, or as protective as, the data protection and privacy laws and regulations in the EEA.

These countries include, among others:

1) China;

2) Singapore; and

3) the United States.

In accordance with applicable data protection and privacy laws and regulations, we will implement appropriate measures to ensure that your personal information remains protected and secure when it is transferred outside of the EEA to a jurisdiction other than one that is recognised by the European Commission has having an adequate level of protection of personal data. These measures include transferring personal information pursuant to standard contractual clauses approved by the relevant authorities (such as the European Commission where personal information is transferred from the EEA (often called “SCCs”). You can find information about the SCCs here. If you would like further information, you can contact us at the details set out in the Contact us section below.

We may also transfer your personal information outside of the EEA as permitted by applicable data protection and privacy laws and regulations. Examples include where we need to transfer your personal information: (a) to perform a contract with you (or to take steps before the contract at your request); (b) perform a contract in your interests; or (c) in relation to legal claims.

4. Your rights with respect to your personal information

In accordance with applicable data protection and privacy laws and regulations, you may be entitled to:

1) ask us about the processing of your personal information, including to be provided with a copy of your personal information;

2) request the correction and/or (in some cases) deletion of your personal information;

3) in some cases, request the restriction of the processing of your personal information, or object to that processing;

4) withdraw your consent to the processing of your personal information (where Alipay is processing your personal information based on your consent);

5) request receipt or transmission to another organisation, in a machine-readable form, of the personal information that you have provided to Alipay where we are using your personal information based on consent or performance of a contract; and

6) complain to the relevant supervisory authority if your privacy rights are violated, or if you have suffered as a result of unlawful processing of your personal information.

Where you are given the option to share your personal information with us, you can always choose not to do so. If we have requested your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations.

However, choosing not to share your personal information with us or withdrawing your consent to our use of it could mean that we are unable to perform the actions necessary to achieve the purposes of processing described (see How we use your personal information) or that you are unable to make use of the services and products offered by us. After you have chosen to withdraw your consent, Alipay may be able to continue to process your personal information to the extent required or otherwise permitted by applicable data protection and privacy laws or regulations. If you would like to exercise your rights, contact us using the details set out in the Contact us section above.

Appendix 2 Provisions specific to California Residents

If you are an individual residing in the State of California, the United States of America who is a registered member of a merchant site and who makes online purchases or sales from the merchant site using Alipay Services, the following additional provisions may also apply to you:

Your rights with respect to your personal information

In accordance with applicable data protection and privacy laws and regulations, you may be entitled to:

1) Access/Right to Know: You may ask for: (i) a portable copy of the specific pieces of your personal information that we have collected; (ii) a list of categories of personal information (and sensitive personal information) we have collected about you; (iii) a list of categories of sources from which such information was collected; (iv) a list of categories of information that we sold or disclosed for a business purpose about you; (v) a list of categories of third parties to whom the information was sold or disclosed for a business purpose; and/or (vi) the business or commercial purpose for collecting and selling your information.

2) Deletion: You may request that we delete the personal information we have collected about you, subject to certain exceptions.

3) Do not Sell or Share my Personal Information for Behavioral Advertising: We do not “sell” or “share” your personal information as defined under applicable law.

4) Correct or Update Your Personal Information: You have the right to request that we correct, update, or modify the personal information we maintain about you.

5) Limit the Use and Sharing of Your Sensitive Personal Information: we only use and share such information for the reasonable and proportionate purposes specified under applicable privacy laws (such as protecting against illegal or fraudulent activity and conducting KYC/AML checks).

For purposes of the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), please also note the following specific information about how we collect, use, and share California residents’ personal information:

1) Depending on our interactions with you, we may collect, use, and disclose for our business and commercial purposes the following categories of personal information set forth in the CCPA and CPRA: identifiers; payment and customer records information; commercial information; internet or other electronic network activity information; and sensitive personal information. See What Personal Information Do We Collect About You for more details.

2) We collect and use the above categories of personal information for the business and commercial purposes described in How We Use Your Personal Information.

3) We collect these categories of personal information from the sources described in How We Obtain Your Personal Information.

4) We may disclose each of these categories of personal information to the categories of third parties as described in With Whom Do We Share Your Personal Information.

Appendix 3 Provisions specific to Singapore Residents

If you are an individual residing in Singapore who is a registered member of a merchant site and who makes online purchases or sales from the merchant site using Alipay Services, the following additional provisions may also apply to you:

1. Your rights with respect to your personal information

In accordance with applicable data protection and privacy laws and regulations, you may be entitled to withdraw consent, request access to, and correct personal data that we hold about you in accordance with Singapore Personal Data Protection Act 2012 and other applicable laws.

If you would like to exercise your rights, contact us using the details set out in the Contact us section above.

2. Transfers of personal information outside Singapore

We transfer the personal data we collect about you to entities within the Alipay Group. Some of them may be located in countries other than the country in which the data were originally collected. We shall endeavour to ensure that those countries provide a standard of protection comparable to that under the Singapore Personal Data Protection Act 2012. In accordance with applicable data protection and privacy laws and regulations, we will implement appropriate measures to ensure that your personal information remains protected and secure when it is transferred outside of Singapore.

Sharing with our service providers

Like most businesses, we work with other companies outside of the Alipay Group who help us to provide and improve the Alipay Service.

We call these companies our “service providers”.

The table below explains the types of service providers we use.

Type of service provider and the services they provide

Our banking and financial services partners and payments networks, including Visa and MasterCard involved in processing of payments and conducting transactions through Alipay Services

Data back-up and hosting services providers for the storage of your personal information

IT system providers who provide technical solutions and security programs

Customer services providers who provide us with customer services for you, so that we can keep a record of any questions or other messages our customer services team receives from our users, and manage those interactions appropriately

Screening providers who assist us with sanction screening, fraud and AML prevention, detection and mitigation

Communications partners such as the postal service, couriers, SMS, message, voice call and email service providers

Analytics providers and survey agencies who help improve the Alipay Services

Security monitoring providers who verify accounts, investigate suspicious activity or possible violations of terms or policies

Professional advisors who provide legal and consultancy services to us such as advising on disputes, investigations or intellectual property infringements

Business analytics providers who carry out product and service research, testing of Alipay Services and features, developing and testing products and services, troubleshooting technical issues, testing technological updates, conduct and support research into new products and services

Business analytics who providers generate insights about Users and usage across the Alipay Services (at an aggregate level)

Content Safety API providers who provide safety API products and services and related technical support to help us maintain the safety and integrity of the Alipay Services by detecting and helping us to prioritise harmful material for our reviewers to assess

Translation service providers who help us communicate with you

Accountancy service providers who prepare or help prepare statutory financial statements and prepare and file tax returns

Auditors who audit the statutory financial statements (SFS)