Privacy Policy
In short
- PAYSTOA has not launched yet. This website and its demo take no sign-ups, and the demo sends nothing to our servers.
- The only personal data we collect today is what you send us by email. We delete it within one year after we have dealt with it.
- When the app launches it will process the data needed for payments, top-ups and transfers. Section 3 describes this in advance, and we will confirm our service providers and overseas transfers before launch.
- We never store card numbers on PAYSTOA servers.
BUKCS PTE. LTD. (“we”, “us”) operates PAYSTOA for users outside the Republic of Korea. This policy explains how we collect, use, disclose and protect personal data under Singapore’s Personal Data Protection Act 2012 (“PDPA”). If you use PAYSTOA in Korea, the Korean 개인정보 처리방침 of Bukcs.com Co., Ltd. applies instead.
Contents
- Data we collect today
- Automatic data and cookies
- Data the app will process after launch
- Consent and its withdrawal
- Disclosure to third parties
- Transfers outside Singapore
- Retention
- Protection
- Access and correction
- Automated decisions
- Data breaches
- Children
- Data Protection Officer
- Changes
1. Data we collect today
| Purpose | Data |
|---|---|
| Replying to launch, business and partnership enquiries | Email address, name (if you give it), the content of your message |
The app demo on this website runs only in your browser. Nothing you tap or enter is sent to us.
2. Automatic data and cookies
Our hosting provider, Cloudflare, processes your IP address, browser details, the time of your visit and the pages you request as security logs. We do not use them to identify you.
We do not use advertising or analytics cookies. When your browser loads our fonts from Google Fonts, your IP address may be shared with Google.
3. Data the app will process after launch
After launch the app will process the data below. Processing will start only at launch, under the version of this policy in force then and the consent screens in the app.
| Purpose | Data |
|---|---|
| Creating and managing your account | Name, mobile number, email, date of birth, language |
| Identity verification (KYC) and anti-money-laundering checks | Name, nationality, date of birth, ID or passport number and image, selfie for liveness, address where required |
| Device-bound payment approval | Device identifiers and a public key created by your phone’s secure chip. Your biometric data never leaves your phone and we never receive it. |
| Processing and recording payments, top-ups and transfers | Date, amount, merchant, merchant category code, a card reference issued by the payment provider (not the card number), linked account details, recipient’s name, country and account details |
| Fraud prevention | Transaction patterns, access logs, device information |
| Spending insights and benefit suggestions | Category totals calculated from your transactions |
| Customer support | Your messages and contact details |
Card numbers, expiry dates and CVCs are collected and stored by our payment provider, never by PAYSTOA servers.
4. Consent and its withdrawal
We collect, use and disclose personal data with your consent, or where the PDPA otherwise permits, for example to meet legal obligations. You may withdraw consent at any time by emailing our Data Protection Officer. We will tell you what withdrawal means for the service, and we will act on it within a reasonable time. Withdrawal does not affect data we must keep by law.
5. Disclosure to third parties
We disclose personal data only to service providers who act for us, to partners needed to complete a transaction you ask for (for example a transfer partner who pays your recipient), or where the law requires it. We do not sell personal data. Before launch we will list our payment, identity, card issuing, transfer and cloud providers here.
| Provider | Service |
|---|---|
| Cloudflare, Inc. | Website hosting and security |
| Google LLC | Web fonts |
6. Transfers outside Singapore
Our providers may process data outside Singapore, including in the United States and the Republic of Korea, where our product team works. When we transfer personal data overseas, we take steps under the PDPA’s Transfer Limitation Obligation, such as contractual clauses, so that the data is protected to a standard comparable to the PDPA.
7. Retention
We keep personal data only as long as needed for its purpose or as required by law. Email enquiries are deleted within one year after we have dealt with them. After launch, transaction and verification records will be kept for at least five years after the end of our relationship, as required by anti-money-laundering and payment rules.
8. Protection
- Encryption in transit (TLS) and encryption of sensitive data at rest
- Least-privilege access and access logging
- Payment approval signed with keys held in your phone’s secure chip
- Certified cloud data centres
9. Access and correction
You may ask to see the personal data we hold about you and how it has been used or disclosed in the past year, and ask us to correct it. Email our Data Protection Officer. We will respond within 30 days, or tell you within that time when we will respond. We may charge a reasonable fee for access requests and will tell you the amount first.
10. Automated decisions
After launch, we may screen transactions automatically to prevent fraud, for example by holding an unusual payment. You can ask us to explain such a decision and to have a person review it.
11. Data breaches
If a data breach is likely to cause significant harm, or affects 500 or more people, we will notify the Personal Data Protection Commission and, where required, the people affected, within the time limits set by the PDPA.
12. Children
The PAYSTOA app will not be offered to anyone under 18 outside Korea unless local law and our partners allow it.
13. Data Protection Officer
Data Protection Officer, BUKCS PTE. LTD.
Email: [email protected]
If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.
14. Changes
We will post changes on this page and, for material changes, notify you in the app at least 7 days before they take effect.