Privacy Policy

1 Who We Are and Scope

This Privacy Policy is issued by JILLION GROUP INTERNATIONAL TRADING LIMITED, trading as Jillionpay ("Jillionpay", "we", "us", "our"), in respect of personal data processed through www.jillionpay.com and our services.

This Policy applies to individuals who are our customers, and to individuals connected with our business customers, including directors, authorised signatories, employees, and ultimate beneficial owners, whose personal data we collect in order to open and administer an account for that business.

We are the data user, as defined under the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"), in respect of the personal data described in this Policy.

2 Personal Data We Collect

Depending on your relationship with us, we may collect:

• Identity data: name, date of birth, nationality, government-issued identification, photograph, and signature;
• Contact data: address, email address, and telephone number;
• Financial data: bank account details, transaction history, source of funds, and source of wealth information;
• Business data (for individuals connected with a business customer): role, shareholding or control percentage, and relationship to the business;
• Verification data: sanctions and politically exposed person screening results, and adverse media search results;
• Technical data: IP address, device identifiers, browser type, and log data collected when you use our website or platform; and
• Communications data: records of correspondence, complaints, and call recordings, where you are informed a call is being recorded.

3 How We Collect Personal Data

We collect personal data directly from you when you apply for an account, use our services, or contact us; from your employer or the business customer you are connected with; from identity verification and screening service providers; and automatically through cookies and similar technologies when you use our website (see our Cookie Policy).

4 Purposes and Legal Bases for Processing

We process personal data for the following purposes:

• to open, administer, and provide our services in connection with your account, which is necessary to perform our contract with you;
• to verify your identity, screen for sanctions and financial crime risk, and meet our ongoing monitoring obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and our Money Service Operator licence, which we carry out to comply with our legal obligations, regardless of any separate consent choice you make;
• to detect, investigate, and prevent fraud and other financial crime, which is necessary for our legitimate interests and those of the wider financial system;
• to respond to your enquiries and complaints;
• to improve our website and services; and
• to send you service updates and, where you have not opted out, marketing communications.

Where our processing relies on a legal obligation, such as anti-money laundering screening and reporting, we will carry out that processing even if you withdraw consent given for other purposes, because we cannot lawfully waive a statutory obligation by agreement with you.

5 Who We Share Personal Data With

We may disclose personal data to:

• banking and payment partners necessary to execute your transactions;
• identity verification, sanctions screening, and transaction monitoring service providers engaged to help us meet our regulatory obligations;
• the Hong Kong Customs and Excise Department, the Joint Financial Intelligence Unit, courts, and other regulators or law enforcement authorities, where required or permitted by law, including suspicious transaction reporting under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance;
• professional advisers, auditors, and insurers, where necessary for their engagement; and
• a successor entity in the event of a merger, reorganisation, or transfer of business, subject to equivalent protections being maintained.

We do not sell personal data. Where we disclose personal data to a service provider, we require them by contract to protect it and to use it only for the purposes we specify.

6 Cross-Border Transfer of Personal Data

Some of our service providers and banking partners are located outside Hong Kong. Where we transfer personal data outside Hong Kong, we take reasonable steps to ensure it receives a standard of protection comparable to that under the PDPO, including through contractual safeguards with the recipient.

7 Data Retention

We retain personal data for as long as your account is active, and for a period afterwards as required by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and our licence conditions, which generally require record-keeping for at least 5 years following the end of the business relationship or the date of a transaction, whichever is later. We may retain data for longer where necessary to comply with a legal hold, resolve a dispute, or enforce our agreements.

8 How We Protect Personal Data

We use administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encryption of data in transit, and staff training. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

9 Your Rights

Under the PDPO, you have the right to:

• request access to the personal data we hold about you;
• request correction of personal data that is inaccurate;
• request that we cease using your personal data for direct marketing purposes; and
• be informed, on request, of our policies and practices in relation to personal data and the kind of personal data we hold.

These rights are subject to exceptions permitted under the PDPO, for example, where disclosure would be likely to prejudice the prevention or detection of crime. We may decline or limit a request where an exception applies, and will explain our reasons if we do so.

Where you make a data access or data correction request, we are required by sections 19 and 25(1) of the PDPO to comply, or to give you written notice of our refusal and the reasons for it, within 40 calendar days of receiving your request. If we are unable to comply in full within that period, we will comply with what we are able to within 40 days and complete the remainder as soon as reasonably practicable afterwards. We may charge a fee for complying with a data access request, limited to our direct and necessary costs, which we will notify to you before completing the request. To exercise these rights, contact us using the details in Section 12.

10 Cookies

We use cookies and similar technologies to operate our website, remember your preferences, and understand how our website is used. You can manage cookie preferences through your browser settings; details are set out in our Cookie Policy.

11 Children

Our services are not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete it.

12 Contact Us

If you have questions about this Policy, or wish to exercise your rights, contact us at:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong.

13 Changes to This Policy

We may update this Policy from time to time to reflect changes in law or our practices. We will post the updated Policy on this page and update the effective date above. Material changes will be notified to active customers through our usual communication channels.