True Ample Limited ("brandpay", "we", "our" or "us") provides a software platform that helps our clients who are brands and businesses (our "Businesses" or "Brands") run engaging online marketing campaigns ("Campaigns") that are promoted to consumers, customers, visitors and other users of our website and/or platform ("Consumers") and that allow those Consumers to accumulate points for use in redeeming and/or purchasing a Business’s products and/or services or other goods and/or services..

In the course of conducting our business and/or running any Campaigns on our brandpay platform, we may collect and handle personal information. We are committed to the protection of personal information and so this Privacy Policy governs how we collect, use, maintain and disclose personal information collected from Consumers, Businesses and other visitors, persons or entities that use the https://brandpay.io website or our platform (the "Site") or seek or use our Services (each, a "User", "your" or "you"). This policy applies to the Site and all products or services offered by brandpay (but not any third party) on the Site.

In order to ensure the lawful processing of the personal data of Users, we, in our capacity as a data controller and a processor, conduct our activities in compliance with the requirements set in the Australian Privacy Act 1988 (Cth), including the Australian Privacy Principles, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of this data ("GDPR") and the California Consumer Privacy Act ("CCPA").

This Privacy Policy applies to all Users of our Site and Services we offer on our Site.

We may collect the following types of personal information about Users on our Site:

Users of our Site: We may collect your personal information in a variety of ways, including, but not limited to, when you visit our Site, register on the Site, register a brandpay account on the Site, participate in a Campaign, subscribe to our newsletter, fill out a form, use any of our Services or in connection with other activities, services, features or resources we make available on or with regard to the Site.

Registration and Contact Information: Depending on the Services a User would like to use, that User may be asked to provide us with their name, username, whatsapp or mobile phone number, email address, physical address, emergency contact details, age, date of birth, gender, Instagram handle and/or other related information.

Payment Information: When a User purchases any Services, we will also collect transaction information, which may include their credit card information, bank account information, billing and mailing address and other payment-related information.

Technical, Usage and Location Information: We automatically collect information on how Users interact with the Site and/or Services, such as the IP address from which a User accesses the Site or those Services, date and time, information about their browser, operating system and computer or device, pages viewed and items clicked. We may also collect location information, including location information automatically provided by the computer or device a User is using. We use cookies and similar technologies to collect some of this information and to maintain your login to our Site.

Third Party Platforms: We may collect information when a User interacts with our advertisements and other content on third-party sites or platforms, such as social networking sites. This may include information such as likes, posts, profile information gathered from social networking sites during signup or the fact that a User viewed or interacted with our content and/or Services.

Opinions/Surveys: We may collect information about a User’s interests, opinions about any Business, Service or other businesses or services, or other information relevant to promotions and activities that we or our Businesses run and to your engagement with the Site or Services. We may also conduct research surveys for a Business. Where a Consumer participates in these surveys we may also collect information about their occupation and salary, their opinions about the brands and services of third parties, as well as sensitive information such as their political opinions or health information. We will only collect their personal information as part of a research survey with their prior consent.

Other Information: We may collect other information from you that is not specifically listed here. We may use any such information in accordance with this Privacy Policy or as otherwise permitted by you.

Business and Consumer Information: Businesses that use the Site to run their Campaigns may require Consumers to supply certain information as part of a Campaign. brandpay processes this data in accordance with this Privacy Policy.

We are a consent-based marketing platform, which means that in order for us to process data on behalf of Users, they must provide it via explicit consent first. This might be as simple as filling out a form or something more complex like connecting their social media accounts to their brandpay account.

We do not collect retain or share end user information including IP addresses, unique user identifiers, or personally identifiable information gathered on sites or apps not owned by brandpay, except for the limited purpose of determining conversion rates and detecting fraud, in which case all personally identifiable information remains anonymous until the relevant User explicitly consents by entering a Campaign.

We do not track or provide any personal information of a Consumer to Businesses that run Campaigns other than in accordance with this Privacy Policy and until that Consumer joins brandpay and provides their social handle on a third party platform, eg Instagram. This means that the Consumer does not expose any of its personal information to either us or our Businesses until that Consumer participates in a Campaign (whether the Consumer is still logged into the Site or not).

IP Addresses: IP addresses are collected anonymously (last octet removed) for reporting and usage purposes. When a Consumer consents to a specific Campaign, their IP address is linked to the associated record and allows Campaign owners (i.e., the relevant Business) to filter records that share an IP address. The Consumer's IP address is never shared publicly within the Site and always remains hidden.

Insta Handles, Mobile Numbers & Form Fields: By default, each Campaign may collect basic login information from Consumers that includes their Instagram handle(s) and mobile phone number(s). By entering into a Campaign, a Consumer is accepting that the relevant Business will have access to the information that Consumer provides.

Some Campaigns may also require additional Custom Fields that include Date of Birth (for Age Verification) and other identifiable fields that the Consumer can or may be required to fill out.

Business Social Logins: We also allow Businesses to connect their social media accounts to their brandpay profile. Businesses that have social logins enabled on their brandpay account will be able to see basic information related to connected accounts. This includes but is not limited to social business account names, account usernames and media data and insights connected to public social media content that mentions their business account. We will never use or post to these accounts without the relevant Business’s permission and will always require their interaction or authorisation via the brandpay platform to execute any specific actions. We will only ever use information that a Business has made public or specifically allowed us to access in accordance with this Privacy Policy. We do not know or store any passwords associated with a Business’s social media accounts. If a User wishes to remove the link between the Site, us and any social media network, that User can either remove our permissions inside that specific social media network or unlink it from the Edit tab inside the Campaign and brandpay account settings.

Persistent Logins: The Site is a distributed platform, which means that if a Consumer has previously logged into our platform they will continue to stay logged in via third party Cookies across all other Campaigns by other Businesses on brandpay. This is designed to make it easy for Consumers to enter into more than one Campaign without having to re-enter their details again or select specific Campaigns to participate in directly on brandpay.

Social Media Platforms

For certain social media platform actions, we use the relevant social media platform's API's to receive data. Users who use these actions agree to be bound by the relevant social media platform terms of service. Users who log in via a social media platform grant access to us to access selected data stored in that social media platform. A User may revoke this access at any time via its security settings (for example, under "Your connections to third-party apps & services"). For more information, please review the privacy policy of the relevant social media platform.

Cookies

Our Site uses both first and third party Cookies to enhance User experience. A User's web browser places a cookie on their hard drive for record-keeping purposes and sometimes to track information about them. Users may choose to set their web browser to refuse cookies, or to alert when cookies are being sent. If they do so, please note that some parts of the Site and Campaigns may cease to function.

Campaigns use Cookies to track information about Consumers in order to serve them content. This includes but is not limited to:

• Maintaining Business sessions that are logged into the Site
• Maintaining Consumer sessions that are logged into a Campaign (either on the Site or embedded via iFrames)
• Tracking and awarding credit for referring Users
• Tracking browser behaviours to show Campaigns
• Tracked Users referred by our Referral Program

Device Fingerprinting

Device fingerprinting is a process by which a fingerprint of a device is captured when visiting a website.

We use 3rd party services to gather a number of data points from a User’s computer or other device, such as operating system version, browser version, screen resolution, plug-ins and language. This unique ID is then transmitted when Users consent by providing their details when entering a Campaign.

The information collected via device fingerprinting is used by us to identify patterns of fraudulent behaviour by Users that violate our Terms of Service. This includes trying to cheat by creating multiple accounts, Users referring their own devices or accounts into a Campaign or attempting to redeem a reward that is limited to one per person.

We do not use this information to track or identify Users on sites or apps not owned by us or for any other purpose than to detect fraud and protect the integrity of Campaigns, nor do we use the Site to fingerprint on 3rd party domains.

Why and How We Use Collected Information

How we use the personal information of a User will depend on the nature of our relationship with that User. Generally, we collect a User's personal information in order for us and our Businesses to provide that User with various benefits (including access to the Site and certain campaigns and Services) and to manage our relationship with that User.

Specifically, we may collect and use the personal information of Users for purposes that include the following:

brandpay Site Users

• To administer our Site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
• To write or display content, including case studies or customer testimonials on our Site.
• To improve the Site and/or Services or to ensure that content is presented in the most effective manner for Users and for their devices.
• To allow Users to use the Site or any Services or to participate in interactive features of our Site and/or Services.
• To send periodic emails: We may use the email address to send information and updates to certain Users pertaining to their subscription or other Services. It may also be used to respond to their inquiries, questions and/or other requests or matters.

brandpay Consumers

Using any identifiable data provided by Consumers for any of the following:

• Ensuring that their requests are carried out and assigned to the correct Campaign that they provided consent for or to.
• Identify and detect fraudulent behaviour or Consumers that are violating our Terms of Service.
• Provide support to Businesses regarding specific Consumer queries.
• Identify and inform Consumers about Businesses, products or services that may be of interest to those Consumers.
• Analyze statistics or usage to help improve the Site, any Campaign and/or any Services, including reporting to our Businesses on an aggregated, de-identified basis.

We collect personal information directly from Users when they interact with us, the Site or any of the Services, for example when:

• They participate in any Campaign;
• They use the Site or any Services;
• They submit an entry into a competition or promotion;
• The participate in loyalty programs;
• They subscribe to a database or email newsletter;
• They send us an email, contact us or through any of our websites, or post on any of our websites (including any of our social media pages);
• They participate in a survey;
• They download any of our apps; or
• They call us.

Direct marketing opt out: If a Consumer no longer wishes to receive marketing or other communications from us, that Consumer must contact us on the details below so that we can update their preferences, or else they should follow the instructions in these communications on how to unsubscribe.

Data quality: We take reasonable steps to ensure that the personal information we collect, use and disclose is accurate, complete, relevant and up-to-date. If a User believes that the personal information we hold about it is incorrect or out-of-date, the User needs to contact us on the details below so that we can update our records.

Sharing Information With Third Parties

We do not sell, trade, or rent Users' personal identification information to others.

Once a User provides access to specific data in connection with a Campaign it belongs to the Business running that specific Campaign and only that Business. We urge Users to review the Terms & Conditions and Privacy Policy of the relevant Business that owns the relevant Campaign to understand how they may use your data once it leaves brandpay.

Businesses and Visitors of our Site: We may use third party service providers to help us operate our business (including the Site and any Services) or administer activities on our behalf, such as storing and managing databases, processing credit card, debit card or other payment information, mailouts, debt collection, marketing research and advertising and collecting Site/Campaign analytics, some of whom may be located outside Hong Kong, including in the United States and the United Kingdom. We may share a User's information with these third parties for their relevant purposes.

We engage certain onward subprocessors that may process personal data submitted to our services. These subprocessors are listed below, and may be updated by us from time to time:

• Google Cloud Platform
• Google Analytics

brandpay Campaign Owners: We offer a number of integrations with 3rd party service providers that enable Businesses to send to Consumers data from us for processing:

These providers include:

• Google Cloud Platform Google Analytics
• SendGrid
• Shopify

Others: We may also disclose Users’ personal information to:

• our related bodies corporate;
• third parties to whom Users authorise us to disclose their personal information; and
• our Businesses and Brands where a User has expressly consented (“opted in”) to being contacted by them.

To protect a User's privacy, wherever practical we impose contractual requirements of security and confidentiality on third parties as to how they handle personal information that we disclose to them

Third Party Websites: Users may find advertising or other content on our Site that link to the sites and services of our Businesses and other partners, suppliers, advertisers, sponsors, licensors and other third parties. We do not control the content or links that appear on these sites and are not responsible for the practices employed by websites, apps, social media accounts or other digital platforms linked to or from our Site. In addition, these sites or services, including their content and links, may be constantly changing. These sites and services may have their own privacy policies and customer service policies. Browsing and interaction on any other website, app, social media account or other digital platform, including those that have a link to our Site, is subject to that website's, app's, social media account's/platform's or other digital platform's own terms and policies.

Legal Disclosures: In certain limited circumstances, we may also have to disclose a User's personal information and data to regulators, public authorities and other third parties, if the disclosure is in response to lawful requests, including to conform with national security or law enforcement requirements. a User's personal information may also be disclosed to other third parties when compelled to do so by government authorities or required by law or regulation including, but not limited to, in response to court orders and subpoenas.

We may also share personal data with third parties to prevent, investigate or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our Terms of Service or any other agreement related to the Site or any Services, or as otherwise required by law.

Information Security

We store a User's personal information in a number of secure computer storage facilities and/or paper based files, and/or in other records. We may also engage third party service providers to assist in storing and processing certain types of personal information for us, some of which may be located overseas, including in the United States and the United Kingdom.

We use appropriate technical and organizational security measures to protect any personal information we process about visitors to our Site against unauthorized access, disclosure, alteration, and destruction. However, please note that no Internet transmission can ever be guaranteed 100% secure, and so we encourage each User to take care when disclosing personal information online and to use readily available tools, such as Internet firewalls, secure e-mail and similar technologies to protect themselves online.

brandpay uses PayPal to process credit card payments, and no credit card details are stored on our servers. PayPal has been audited by a PCI-certified auditor and is certified as a PCI DSS Level 1 Service Provider, the highest level of certification for payment security.

In case of an unauthorized security intrusion that materially affects a User or the people on its mailing list, we will notify that User as soon as possible and will within reasonable time report the action we took in response.

Reporting Security Issues: If a User has found a bug and would like report it ethically, please email [email protected] for an invite.

EU and EEA residents: To assist our Businesses and their European Campaign users (data subjects), the legality of our processing services and the international transfers of the personal data, brandpay has undertaken GDPR compliant contractual commitments, binding us, as a data processor, to protect the data privacy and to ensure the most adequate level of data security.

Please note that the country where we operate may have privacy and data protection laws that differ from, and are potentially less protective than, the laws of your country. You agree to this risk when you create an account with Us and click "I accept brandpay's Terms of Service & Privacy Policy" to data transfers, irrespective of which country you live in. If you later wish to withdraw your consent, you can delete your brandpay account as described in the "Your Rights" section.

Business Data Retention Periods: We will not retain data longer than is necessary to fulfil the purposes for which it was collected or as required by applicable laws or regulations. For Campaign data, Businesses have control of the purpose for collecting data, and the duration for which the Personal Data may be kept. When a Customer's account is terminated or expired, all Personal Data collected through the platform will be deleted, as required by applicable law.

If a Business or other User account has been suspended or terminated for any breach or violation of any Terms of Service, we will retain the information necessary to continue to enforce this suspension or termination for up to 10 years.

Privacy Controls, Choices, Access and Correction

brandpay Website Communication: Our Businesses, Customers and other Users have a choice about how we use their personal data to get in touch with them and may choose to opt-out at any time by unsubscribing or changing their account settings.

Consumer User Notifications: We provide an easy mechanism for opt-ing out of any communication from campaigns inside the Post Entry Email. You can simply select the Unsubscribe or "Turn them off" links in the footer.

Social Accounts: We provide a mechanism for every User to remove any linked social accounts from us via the Edit panel inside our campaign platform.

Your Rights: We provide all Users with the opportunity to request access, correction, restriction, deletion, data portability or oppose to any personal information that has previously been provided to us by those Users in connection with the use of our Site or Services, as required by law. A User can send us an email to [email protected]. We may request specific information from that User to confirm its identity. Generally, and subject to applicable laws and legal obligations, we will provide a User with access to its personal information unless where providing access would unreasonably impact on the privacy of others.

We may charge a fee for giving access to personal information which reflects our costs of providing access. If we refuse a User's request for access to, or correction of, that User's personal information, we will provide the User with written notification of our decision and our reasons for reaching that decision. If we refuse the User's request to correct its personal information, that User can request that we associate with that information a statement that the User believes it to be inaccurate, out-of-date, irrelevant or misleading.

brandpay's Data Protection Officer

We have a Data Protection Officer who is responsible for matters relating to privacy and data protection. This Data Protection Officer can be reached at the following address:

brandpay.ioAttn: Data Protection Officer6/F, 44 Wyndham StreetCentral, Hong KongHong Kong SAR, China[email protected]

California Consumer Privacy Act

For our users or customers living or doing business in California, we are subject to the CCPA.

brandpay Does Not Sell Your Personal Information. You can read more about this in our Sharing Information With Third Parties section.

Accuracy and Access To Your Personal Information.

If you believe that Personal Information brandpay holds about you is inaccurate, you may modify or correct your Personal Information the Edit tab for brandpay Consumers, the User Settings tab for brandpay Businesses or by contacting us at: [email protected]. We may request specific information from you to confirm your identity.

Deleting Your Personal Information. You can learn about this in our Privacy Controls, Choices, Access and Correction section.

Compliance With Children's Online Privacy Protection Act

Because the nature of our Site and Services does not appeal to children under the age of 13, we do not knowingly acquire or receive personal data from children under 13. We do not intentionally process any information, including personal data, from children or other individuals who are not legally able to use our Site and/or Services. If we later learn that any user of our Site or any Service is under the age of 13 and that we have obtained his/her/their personal data, we will promptly delete it from our database and will take further steps to restrict that individual from future access to our Site or Services, unless we are legally obligated to retain such data.

If you are a parent or legal guardian of a child under 13 and believe that we might have any information from or about such child, please contact us at the email or mailing address provided above.

Business Transfers

In some cases, we may choose to buy or sell assets. In these types of transactions, customer information is typically one of the business assets that are transferred. Moreover, if brandpay, or substantially all of its assets were to be acquired, or in the unlikely event that brandpay goes out of business or enters bankruptcy, customer information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquire of brandpay or its assets may continue to use your Personal Information as set forth in this policy.

Complaints and More Information

For more information on how we handle your personal information, or if you are concerned that we may have breached your privacy and wish to make a complaint, please contact us on the details above. We will take any privacy complaint seriously, and we aim to resolve all complaints in a timely and efficient manner. We request that you cooperate with us during this process and provide us with relevant information we may require. We expect our procedures will deal fairly and promptly with your complaint. However, if you are unsatisfied with our response, you can make a complaint to the relevant privacy or other relevant regulatory authority in your country.

Changes To This Privacy Policy

We have the discretion to update this Privacy Policy at any time. When we do, we will revise the updated date at the bottom of this page. We encourage Users to frequently check this page for any changes to stay informed about how we are helping to protect the personal information we collect. You acknowledge and agree that it is your responsibility to review this privacy policy periodically and become aware of modifications. We will notify you of any changes to this Privacy Policy solely by posting an amended version on our website (https://brandpay.io/privacy-policy), and changes will take effect from the date of posting.

Your Acceptance Of These Terms

By accessing or using the Site, contacting us by email, telephone or any other means, or using applications or websites owned or controlled by us, all products, software, data feeds, plugins, mobile applications and other applications and services provided from time to time on, from or through the Site (together, the "Services"), or engaging with us in any other way, agree to the terms and conditions set out in this Privacy Policy and terms of service and consent to the processing of your information in accordance with this Privacy Policy and any other arrangements that apply between us. If you do not agree to this Privacy Policy, you may not use our Site or Services. Your continued use of the Site or Services, including following the posting of any changes to this Privacy Policy, will be deemed your acceptance of this Privacy Policy and any subsequent changes.

Contacting Us

If you have any questions about this Privacy Policy, the Site, our Services or your dealings with the Site in connection with the matters set out in this Privacy Policy, please contact us at [email protected]

This document was last updated on 27 February 2025