Alipay, China's leading third-party online payment solutionAlipay, China's leading third-party online payment solution

Alipay Privacy Policy for Merchant Services

Last updated: 2022-11-2

This “Privacy Notice” applies to visitors to the Alipay website available at (https://intl.alipay.com/open and https://global.alipay.com) and individuals  who are users of Alipay or have their personal information provided to us in the course of using our services (each of them is a "User" and each of the services is an “Alipay Service”), provided outside of the People’s Republic of China.

This Privacy Notice contains the information common to all Alipay Services. Depending on the actual Alipay Services used, each User may enter into one or more agreements (collectively, the “Agreements”) with various companies in the Alipay Group that will provide those Alipay Services. Those Agreements may contain additional terms regarding privacy and our use of information about you.

Unless otherwise indicated or the context requires otherwise, reference to “you” or “your” are intended to refer to a User, and reference to “Alipay”, “we”, “us” or “our” in this Privacy Notice and the Agreements are intended to refer to the relevant compan(y)(ies) in the Alipay Group that are involved in providing the Alipay Services to you. Depending on your location and selected Alipay Services, this may include Alipay US, Inc., Alipay (UK) Limited, Alipay (Europe) Limited S.A., Alipay Singapore E-Commerce Private Limited and/or Alipay Merchant Services Pte. Ltd. (each an “Affiliate” or member of the “Alipay Group”).

The legal entity of the Alipay Group deciding why and how information about you is collected and processed to provide the Alipay Services is the Alipay Group entity which has entered into the Agreement to provide the Alipay Services you use. You can find their name set out in that Agreement. This entity is responsible for ensuring compliance with the applicable data protection and privacy laws or regulations, including the European Union’s General Data Protection Regulation 2016/679 (“GDPR”), under which it acts as the so-called “controller”of your personal information.

We want you to understand:

1 WHAT PERSONAL INFORMATION DO WE COLLECT ABOUT YOU?

We collect and use personal information about you, including when you interact with us, register for an Alipay account, use the Alipay Services to make purchases or otherwise conduct financial transactions, or otherwise visit or use our Alipay Services.

We may collect the following personal information about you:

  • your basic personal details, including first and last name, date of birth, social security number and copies of your personal ID documents (e.g., passport);
  • contact information, including your address, phone number, email, or other information that permits us to contact you;
  • account information, such as details of the payment card used to complete a transaction with a merchant;
  • company registration details, such as the basic personal details of the ultimate beneficiar(y)(ies) and account authentication details to complete “know your business” or “know your client” checks as required by local law;
  • financial information and tax identification information;
  • transaction details, such as the merchants you deal with, the amounts paid and the details of the products and/or services purchased;
  • details of any marketing preferences you have given us (such as requests to receive or not receive certain types of marketing communication);
  • copies of communications with or about you; and
  • the following usage, device, and technical information:
    • information about the device you use to interact with us, and
    • information from your visits to our websites or mobile applications, collected automatically through tracking tools described in section 2 below. This information includes browser history, product engagement, length of visit/usage, page views, IP address or other unique identifiers, browser/platform type and version, internet service provider, operating system, referral source/exit pages, device operations, and other information regarding your interaction with our websites and our advertisements) session information, device ID, user agent, and IP address. We also embed tracking tools within the emails and other communications we send to you to help us understand how you interact with those messages, such as whether and when you opened a message or clicked on content within the message.

As noted above, we collect personal information which may be considered sensitive in certain jurisdictions. Specifically, if we collect your passport, your payment card information, or your financial information and tax identification information, you may have additional rights and protections with regard to such sensitive personal information under certain data protection laws.

Whenever personal information is collected (e.g. upon registration), we will indicate whether the provision of such information is mandatory (e.g. with an asterisk). If you do not provide such mandatory personal information to us, you may not be able to register for Alipay Services or, at least, you may not be able to participate in certain elements of the Alipay Services.

2 HOW WE OBTAIN YOUR PERSONAL INFORMATION

We collect the above personal information (including potentially sensitive personal information) in connection with Alipay Services from various sources, either directly from you or indirectly, as set out below. 

We collect personal information directly from you when you provide it to us in connection with the Alipay Services. For example, we collect your personal information when you enquire about or register to use any of the Alipay Services, sign an Agreement with us, provide your personal information during the merchant on-boarding process, log into your Alipay account to use the Alipay Services on our site, or when you communicate with us via e-mail, phone, SMS, or any other electronic means.  

We also collect personal information automatically from your devices.  We use cookies and other tracking tools and technologies that automatically collect information like browser, usage, and device information any time you visit or interact with our websites, mobile apps, emails, and online content or ads on other websites and platforms. We may provide further information, depending on your location, via a cookie policy; please check the Alipay Services website or app you are using for more details.

We also receive personal information about you from the following sources:

  • merchants and other third parties who support the ability to make payments and conduct transactions through Alipay Services or otherwise;
  • Alipay Affiliates;
  • suppliers providing services on our behalf (such as vendors that provide hosting services, assist in sending emails, provide technical assistance and security, perform research and analysis for us, or provide marketing and advertising services);
  • banks and other payment institutions that we cooperate with to provide you with the Alipay Services; and
  • publicly available sources, such as public registers and social media.

We combine personal information that we obtain from you with additional data we collect about you from the above sources.

Please refer to the section How we use your personal information below for more details.

3 HOW WE USE YOUR PERSONAL INFORMATION

We use your personal information (including your sensitive personal information, if any) to provide you with Alipay Services. More specifically, we may use your personal information for the following purposes:

  • verifying your identity, including during account creation and payment password reset processes;
  • verifying your eligibility as a User of Alipay Services;
  • processing, maintaining and managing your registration as a User;
  • providing you with Alipay Services and related User services, including enabling and conducting transactions, customizing your user experience, enabling the receipt of balance top-ups, financing proceeds and third-party payments, facilitating the settlement of payment for goods and services and providing other fund settlement services, handling foreign exchange conversions, charge-backs, sending notices about transactions, and responding to your queries, feedback, claims or disputes;
  • contacting you in relation to our provision of Alipay Services, contacting you in connection with any communication preferences or requests you have expressed, asking you for feedback about Alipay Services or other related products and services, collecting feedback from you and your staff about our products and services and using such feedback to improve our business and/or customize products and services;
  • serving you advertising and sending you information about products and services, including for promotional and marketing purposes;
  • assessing, detecting, investigating, preventing or remediating fraud, data breaches or other potentially prohibited or illegal activities and otherwise protecting the integrity of our platform and safety and security of our staff and that of our suppliers and counterparties;
  • managing our risk, performing creditworthiness and solvency checks on Users, or detecting, investigating, preventing or remediating violations of your agreements with us or any of our applicable policies, industry standards, guidelines, laws and regulations;
  • making disclosures as may be required by any rules, law or regulation, regulatory authorities, government officials, card association or other payment network. Such disclosures may also be made pursuant to any subpoena, court order or other legal process or requirement applicable to us or any Affiliates (including “know your customer”, anti-money laundering, counter-terrorist financing reporting, tax requirements or other commercial disputes);
  • making disclosures to competent regulators to prevent any harm or financial loss, to report suspected illegal activity or to establish, exercise, or defend claims or potential claims on behalf of ourselves or our Affiliates;
  • improving and optimizing the Alipay Services;
  • managing our business including to protect Users, prevent harm, fraud or theft to ourselves or others, maintain the security of our products, and protect our rights or property and those of others;
  • to comply with law, regulation, codes of conduct and other good practice and conduct requirements; and
  • in any other ways for which we provide notice at the time of collection.

4 WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We share your personal information (including your sensitive personal information, if any) for the purposes indicated under the section How we use your personal information above, with the following categories of recipients:

  • our Affiliates;
  • merchants that provide you with products, services and other offerings on or through Alipay Services;
  • any agent, contractor, vendor, or service provider acting as subcontractor on behalf and upon our instruction to help us in providing Alipay Services. We set out a list of such agents, contractors, vendors, and service providers here. We engage the foregoing to help us with fraud prevention, anti-money laundering checks, credit checking, bill collection, data entry, database management, promotions, marketing, customer service, technology services, products and services alerts and payment extension services or to provide trade financing services;
  • banks, card associations, payment networks or acquiring institutions;
  • organisations involved in processing of payments and conducting transactions through Alipay Services;
  • law enforcement agencies, insurers, government and regulatory authorities or any other organizations to which we, or any of our Affiliates or service providers, is under an obligation to make disclosure under the requirements of any applicable law, regulation, code of conduct or good practice or conduct requirement or commercial arrangement;
  • individuals and entities involved in any merger, acquisition, corporate reorganization, financing, or similar transaction with us, including in the event of the sale of all or part of our assets; and
  • our own and others’ professional advisors (e.g., lawyers, accountants, auditors, and trustees).

See the section How do we store and protect your personal information? Below for information on how long we retain your personal information and how we try to keep your personal information secure when storing it or sharing it with others.

5 HOW DO WE STORE AND PROTECT YOUR PERSONAL INFORMATION?

We will keep your personal information (including your sensitive personal information, if any) in accordance with our policies and for as long as it is necessary to provide you with the Alipay Services or other purposes as set out in this Privacy Notice.  In addition, we may retain your personal information (or sensitive personal information, if any) for a longer period (including after you are no longer a User) if it is necessary to comply with laws and regulations applicable to us. The criteria we use to determine the appropriate retention periods are:

  • the various regulatory requirements that we are subject to;
  • whether a legal claim could be brought against us for which your personal information may be relevant;
  • the necessity of your personal information to provide the Alipay Services,
  • the type, nature, and sensitivity of your personal information being processed; and
  • the legal basis for processing your personal information – e.g., consent or legitimate interests or otherwise.

We use a variety of security measures and technologies designed to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction, consistent with applicable data protection and privacy laws and regulations. However, transmission of your personal information on the internet can never be completely secure due to a variety of factors that cannot always be prevented or controlled. Despite our reasonable efforts, we do not and cannot guarantee the security of any of your personal information collected, stored, or transmitted. You are responsible for maintaining the security of your account information (username, password, etc.) for Alipay Services in your possession or control.

6 WHAT IS OUR LEGAL BASIS FOR COLLECTING AND USING YOUR PERSONAL INFORMATION?

We collect and use your personal information on one or more legal bases set out below (and where applicable, under any other legal bases permitted under the relevant data protection legislation).

  • when the processing is necessary for the performance of the Agreement(s) or other contracts to which you are a party or to take pre-contractual steps at your request to receive the Alipay Services.
  • when the processing is necessary to comply with our obligations under law and regulation.
  • when the processing is necessary for the following legitimate interests:
    • to operate, market and improve our business and minimise any disruption to the Alipay Services that we may offer to you;
    • to ensure the security of the Alipay Services and to protect us, our staff and other Users from fraud or other criminal or similar conduct;
    • to comply with codes of conduct, codes of practice and similar good conduct principles which do not have the force of law in the countries in which we operate, but are prudent for Alipay Group to apply;
    • to make our communications with you more relevant and personalised to you, and to make your experience of our products and services efficient and effective;
    • as the Alipay Group has infrastructures outside of the European Economic Area (including (in China, Singapore and the United States), and the Alipay Services potentially involve Alipay providing services in any jurisdiction where you make purchases, to comply with our obligations under the laws and regulations from countries outside the European Union or to reply to any official request from public or judicial authorities in such countries, at all times in compliance with both the laws and regulations of the European Union or the European Union Member States (as applicable) and the legal requirements under local law.
      However, in cases in which we wish to use your personal information for our legitimate interests, we carefully consider the position and do not proceed if we think your interests or fundamental rights and freedoms relating to your personal information would be prejudiced. Examples of matters we consider include how we use your personal information responsibly (for instance, security measures we put in place to protect it, such as access controls).
  • Because you have given your consent. At times we may ask for your consent to allow us to use your personal information for one or more purposes. See the section Your rights with respect to your personal information for information about the rights that you have if we process your information on the basis of your consent.

7 INTERNATIONAL TRANSFERS OF YOUR PERSONAL INFORMATION

Your personal information will be processed by us, our Affiliates and our trusted third party suppliers and they may be outside the jurisdiction you live in.  So for example, if you live in the European Economic Area, we send personal information outside that area. We send your personal information to locations in the EEA, the US, Singapore and China, and those jurisdictions may not have the same protections of personal information as the places where you live or work.  

Whenever we send information abroad in this way, in accordance with applicable data protection and privacy laws and regulations, we will implement appropriate measures to ensure a comparable standard of protection of your personal information as under applicable law in your jurisdiction. These measures include transferring personal information pursuant to standard contractual clauses approved by the relevant authorities (such as the European Commission where personal information is transferred from the EEA (often called “SCCs”).  You can find information about the SCCs here.  

If you would like further information or would like to obtain a copy of these measures, you can contact us as set out in the Contact Us section below. 

We may also transfer your personal information outside of the EEA, UK or Singapore as permitted by applicable data protection and privacy laws and regulations.  Examples include (where applicable) when we need to transfer your personal information: (a) to perform a contract with you (or to take steps before the contract at your request); (b) perform a contract with which we concluded with another in your interests; or (c) in relation to legal claims.

Notwithstanding the foregoing, where expressly required by applicable law or regulatory order, we will not transfer personal information outside the country from which it was collected.

8 YOUR CHOICES AND PRIVACY RIGHTS WITH RESPECT TO YOUR PERSONAL INFORMATION

You have certain choices about how we use your personal information, as described here:

  • You can control cookies and tracking tools. You can disable or block non-essential cookies on your computer or mobile device. In some jurisdictions, we also provide specific tools on our websites and apps to help do that.  Where that is not the case, please consult your browser’s documentation instructions for information on how to do this and how to delete persistent cookies. However, if you decide not to accept cookies from us, certain aspects of our websites and the Alipay Services may not function properly or as intended. Since these selections are specific to the browser and device you are using, please note that you will need to make these selections for each device and each browser you use to access our website and the Alipay Services.
  • You can opt-out of email marketing and certain other communications. You may manage your receipt of marketing communications by clicking on the "Unsubscribe" link located on the bottom of any Alipay marketing email and/or following the instructions found on any page to which the link may take you.  Please note that you cannot opt out of receiving administrative, support, or transactional emails.

In addition to the above choices, if you are a User in the UK, EEA or Switzerland, in accordance with applicable data protection and privacy laws and regulations, you are entitled to exercise the following rights:

  • ask us about the processing of your personal information and access it, including by asking us to provide you with a copy of your personal information.
  • request the correction and/or updating of your personal information;
  • request the deletion of your personal information;
  • request the restriction of the processing of your personal information, or object to that processing;
  • withdraw your consent to the processing of your personal information (where we process your personal information based on your consent);
  • request receipt or transmission to another organisation, in a machine-readable form, of the personal information that you have provided to us where we are using your personal information based on consent or performance of a contract; and
  • complain to the relevant supervisory authority.

Please note that these rights are not absolute and are subject to a number of exceptions and qualifications that mean they may not always apply.

Privacy Rights for Users located in the United States:

  • Access/Right to Know: You may ask for: (i) a portable copy of the specific pieces of your personal information that we have collected; (ii) a list of categories of personal information (and sensitive personal information) we have collected about you; (iii) a list of categories of sources from which such information was collected; (iv) a list of categories of information that we sold or disclosed for a business purpose about you; (v) a list of categories of third parties to whom the information was sold or disclosed for a business purpose; and/or (vi) the business or commercial purpose for collecting and selling your information.
  • Deletion: You may request that we delete the personal information we have collected about you, subject to certain exceptions. 
  • Do not Sell or Share my Personal Information for Behavioral Advertising: We do not “sell” or “share” your personal information as defined under applicable law.
  • Correct or Update Your Personal Information: You have the right to request that we correct, update, or modify the personal information we maintain about you.
  • Limit the Use and Sharing of Your Sensitive Personal Information: In relation to any sensitive personal information identified in section 1 above, you can request that we limit our use and sharing of such information to those uses which are necessary to perform the Alipay Services or as otherwise allowed by relevant data protection laws.

If you are a User located outside the EEA, UK, Switzerland or the U.S., depending on the data protection and privacy laws and regulations applicable in your jurisdiction, you may be entitled to exercise some or all of the above rights (subject to certain exceptions and limitations under such laws and regulations).

Submitting Privacy Rights Requests: If you would like to exercise your privacy rights, contact us using the details set out in the Contact Us section below.

Where you are given the option to share your personal information with us, you can always choose not to do so.  If we have requested your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations.

However, choosing not to share your personal information with us or withdrawing your consent to our use of it could mean that we are unable to perform the actions necessary to achieve the purposes of processing described (see section How we use your personal information) or that you are unable to make use of the services and products offered by us.  After you have chosen to withdraw your consent, we may be able to continue to process your personal information to the extent required or otherwise permitted by applicable data protection and privacy laws or regulations.

Non-Discrimination: If you exercise any of the above privacy rights, we will continue to treat you fairly and without discrimination.  If you exercise your rights under this Privacy Notice, you will not be denied or charged different prices or rates for the Alipay Services, or provided a different level or quality of goods or services than others.

Verification of your identity: Depending on the nature of your request, we will ask you for identifying information and attempt to match it to information that we maintain about you in order to verify your identity. Not all of the above request types will be subject to verification. If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to your request.  We will notify you to explain the basis of the denial. 

Authorized agents:You may designate an agent to submit requests on your behalf.  When submitting a request through the methods described above, the agent must identify itself as your authorized agent. Depending on the type of request being submitted, we may request additional verification to confirm you have authorized the agent to act on your behalf.

Do Not Track: Some browsers have a “do not track” feature that lets you tell websites that you do not want to have your online activities tracked.  At this time, our websites do not respond to browsers’ do not track signals.

9 ADDITIONAL CALIFORNIA PRIVACY DISCLOSURES

For purposes of the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), please also note the following specific information about how we collect, use, and share California residents’ personal information:

  • Depending on our interactions with you, we may collect, use, and disclose for our business and commercial purposes the following categories of personal information set forth in the CCPA and CPRA: identifiers; payment and customer records information; commercial information; internet or other electronic network activity information; and sensitive personal information.  See section 1 above for more details.
  • We collect and use the above categories of personal information for the business and commercial purposes described in section 3 of this Privacy Notice.
  • We collect these categories of personal information from the sources described in section 2 of this Privacy Notice.
  • We may disclose each of these categories of personal information to the categories of third parties as described in section 4 of this Privacy Notice.
  • We do not “sell” or “share” your personal information.

10 HOW DO WE PROCESS PERSONAL INFORMATION ABOUT CHILDREN?

The Alipay Services and our website are not directed towards children under 18 years old, nor does Alipay knowingly collect information from children under 18. If you are under 18, please do not visit our websites, use the Alipay Services or submit any personal information to us.

If you, acting as a guardian of a child, have relevant questions in respect of a child’s personal information, please contact us using the details set out in the section Contact Us section below.

11 THIRD PARTY SERVICES AND SITES

The Alipay Services and our website may provide links to other websites and services (including other online merchant sites) for your convenience and information. These services and websites may operate independently from us. Linked services and websites may have their own privacy notices or policies, which we strongly suggest you review if you visit any linked websites. To the extent any linked websites you visit are not owned or controlled by us, we are not responsible for these websites’ or services’ content, any use of these services or websites by you, or the privacy practices of these services or websites.

12 CHANGES TO THIS PRIVACY NOTICE

We may change, amend or revise this Privacy Notice from time to time. We will notify you of any substantive or material change in this Privacy Notice through a combination of updating this web page, sending push notifications, e-mails or letters, by phone or by publishing announcements on our website (https://intl.alipay.com/open and https://global.alipay.com).

You can review this Privacy Notice any time at the home page of our website (https://intl.alipay.com/open and https://global.alipay.com).

Once posted on our website, the new Privacy Notice will become immediately effective unless stated otherwise.

13 CONTACT US

If you have questions or requests about the privacy of your personal information, please contact us by email via Privacy-OpenPlatform@alipay.com or at the following business address if you are a User in:

  • the European Economic Area or Switzerland: Alipay (Europe) Limited S.A., Privacy Office, 11-13, 9, rue du Laboratoire, L-1911 Luxembourg; or
  • the United States: Alipay US, Inc., Privacy Office, 525 Almanor Avenue, Suite 100, Sunnyvale, CA 94085.
  • any other part of the world: Alipay Singapore E-Commerce Private Limited, Privacy Office, 51 Bras Basah Road, #04-08 Lazada One, Singapore 189554.