Overview

This privacy statement explains how and why PayPal collects, stores, uses, and shares personal data when you visit our websites or use our services. Reading it will help you understand:

• The personal data we collect and why we collect that personal data for:
  • Creating an account and using payment services
  • Additional features
• The sources of personal data
• How and why we share personal data
• How we protect your personal data
• Your privacy rights and choices
• Age limit for our services
• How we store and transmit your personal data globally
• How this statement changes over time
• How to contact us

“PayPal” in this statement means PayPal Payments (Beijing) Co., Ltd. (贝宝支付（北京）有限公司) (whose registered address is at Room B-041, No. 1, Shunchang Avenue, Nanfaxin Town, Shunyi District, Beijing, People’s Republic of China) and subsidiaries and affiliates.

This privacy statement only applies to your use of a PayPal China account and associated PayPal services. To learn about our privacy practices for our other products or services, visit the website and review the privacy statement for that product or service.

We recommend you review this statement carefully and make the choices you deem appropriate. Please note that we have marked in bold items that may involve sensitive personal data.

The personal data we collect and why we collect that personal data

A. Creating an account and using payment services

We may collect your personal data when you register for or use our payment services, such as when you create an account, make a payment, make a purchase on a merchant’s website or other maintenance of your account including its closure.

The reasons why we collect your personal data include:

1. Provide payment services, for example to help you send or request money, make purchases, show your account information, verify access to your account, and keep your account and payment information up to date.
2. Protect our business and our customers from risk and fraud, including fraud that involves our business partners, strategic ventures, or other individuals and merchants. It is essential for us to evaluate risk and fraud in order to provide our payment services.
3. Contact you when you need us to, such as answering a question you sent to our customer service team.
4. Comply with laws and enforce our agreements with you and other people who use our services.

Here are the kinds of personal data (including sensitive personal data) that we must collect in order to create an account for you or offer payment services to you. If you do not consent to the collection of these kinds of personal data, you will not be able to open a PayPal China account, and we will not be able to provide PayPal services to you. We will only collect and process sensitive personal data to the extent necessary to create an account and provide our services to you, and we will adopt strict measures to protect all personal data we collect (see the section “How we protect your personal data”).

1. Information that identifies you, for example:

• First and last name
• Address
• Phone number
• Email address
• IP address
• Information collected from cookies or other tracking technologies that are essential for payment services

2. Records and financial information, for example:

• Identity card numbers
• Government-issued identification
• Bank account and routing numbers
• Financial information

3. Personal characteristics, for example:

• Age
• National origin
• Citizenship

4. Commercial information, for example:

• Online shopping cart information
• Purchase history
• Shipping address

5. Internet or network activity, for example:

• Interactions with our services or sites
• Shopping history

6. Geolocation data, for example:

• IP-based geolocation

7. Audio, electronic, visual, or similar information, for example:

• Call recordings when you talk to customer service
• Photo IDs and profile pictures you provide
• The video of the legal representative of user expressing the willingness to register an account with us, so that we could verify the willingness of legal person to register the account is true in accordance with the requirements of relevant laws and regulations

8. Professional or employment information, for example:

• Business information, contact emails and phone numbers
• Tax IDs
• Business license
• Special industry qualification documents

9. Information we infer based on your personal data, for example:

• Fraud and risk assessments

Personal Data about you if you use unbranded Services - Our certain Services are available without being required to log in to or establish an Account. We will collect Personal Data when you are interacting with and making payments to merchants using our card payment services that do not carry the PayPal brand and when you checkout with PayPal without logging into an account. For our unbranded payment services, your interaction is with the merchant, on their platform. If you are an Account holder, or create an Account at a later date, we may collect information about unbranded transactions and associate them with your Account to improve your customer experience as an Account holder and for compliance and analytics purposes. If you are not an Account holder, we will collect and store all information you provide and use such information in accordance with this Privacy Statement.

B. Additional features

If you agree, we may also provide you with additional features and collect your personal data for the following reasons:

1. Help us improve your experience. For example, we do user research to improve our products’ performance and abilities to the extent necessary to continue providing our payment services at a level that meets your expectations. We also monitor and analyze our sites to help ensure they work as expected.
2. Provide you with information about our products and services. We may also send you information and connect you with our partners, such as merchants. We use personal data to better understand and cater to your interests.
3. Personalize your experience when you use our sites and services, as well as other third-party sites and services to make your experience more convenient and suitable for your needs. In this case, we might use tracking technologies like cookies. See below “How we use tracking technologies like cookies” for more details.
4. Send you locally relevant options, but only if you agree to let us track your location. If you do, this can help us enhance the security of our sites and services and customize our services by using the right language and personalizing content such as ads and search results.

The kinds of additional personal data we collect for all of our additional features include:

• Geolocation data, for example, IP-based geolocation and Global Positioning System (GPS) information.
• Personalization preferences.
• Additional information on how you interact with our services or sites, such as information collected from cookies or other tracking technologies that you choose to enable. Examples of these types of cookies include marketing cookies that let us know which PayPal features you like, performance cookies that tell us how you use our sites and services, and functional cookies that help us track your past browsing choices. See below “How we use tracking technologies like cookies” for more details. In addition, we use other analytical tools to collect your information of IP address, click acts and the length of time stayed on our website.
• Device information, such as the type of device, browser and operating system that you use to access the PayPal services, the device’s network connections and other apps downloaded to the device.
• Contacts in your address book.

You may choose at any time whether to provide us with your personal data for these additional features. This will not affect our ability to provide you with our core payment services.

Sources of personal data

For the purposes described in " The personal data we collect and why we collect that personal data” section, we may collect personal data about you from various sources, for example from:

• You
• Merchants
• Members of the PayPal corporate group (e.g. PayPal Pte. Ltd.) from time to time
• Our payment partners, such as card networks and payment processors
• Financial institutions, such as banks
• Service providers, such as companies that help us manage risk and fraud, deliver services to you, and market our services

We do not buy or acquire any personal data from third parties systematically or on an aggregate scale. We may, however, collect your personal data through valid legal channels, such as under contracts, in the course of providing the PayPal China services to you.

We may also collect, use, process and share your personal data if we are required to do so under applicable laws or by governmental or regulatory authorities.

How we use tracking technologies like cookies

We or our authorized service providers may use cookies and similar tracking technologies [which may include scripts, Clickstreams, web beacons and SDKs] to collect personal data whenever you use our services, visit our sites, or visit websites that offer our services. The information collected with these technologies helps us personalize your experience, measure the effect of our ads, prevent fraud and enhance the security of our sites and service.

You can disable or decline some cookies for our sites and services. But, since some parts of our service rely on essential cookies to work, those services could become difficult or impossible to use if you disable of decline the essential cookies. Some web browsers have an optional setting called “Do Not Track” (DNT) that lets you opt-out of being tracked by advertisers and some third parties. Because many of our services won’t function without tracking data, we do not respond to DNT settings once you have accepted the use of cookies.

Please review our Statement on Cookies, Web Beacons, and Similar Technologies to learn more about how we use technologies such as Cookies.

How and why we share personal data

We do not sell your personal data. However, we may share personal data across our services and with other members of the PayPal corporate group. Sometimes we share the personal data we collect with third parties to help us provide services, protect our customers from risk and fraud, market our products, and comply with legal obligations.

You can review the personal data that we may share by reviewing "The personal data we collect" section. Examples of the types of personal data that we may share include:

• Payment information such as a transaction reference number;
• Commercial information such as information about your order and shipping address;
• Your account information and other information that identifies you, such as records and financial information, tags or restrictions imposed on your account; and
• Personal characteristics such as data of birth.

We may share personal data with:

1. Members of the PayPal corporate group from time to time to, among other things, provide the services you have requested or authorized; to manage risk; to help detect and prevent potentially illegal and fraudulent acts and other violations of our policies and agreements; and to help us manage the availability and connectivity of PayPal products, services, and communications.
2. Service providers appointed by us or on behalf of our merchants that help us with processing payments, marketing, research, compliance, audits, corporate governance, communications, customer service, technical and/or design services, shipping, security and/or fraud detection.
3. Your third-party partner if you as a merchant use such a partner to access or integrate PayPal.
4. Institutions and service partners involved in processing and facilitating payments and settlements, such as the Nets Union Clearing Corporation.
5. Card networks, credit card associations and payment processors.
6. Financial institutions, such as banks we partner with to offer joint products.
7. Courts, governments, regulators (including the People’s Bank of China) and law enforcement agencies. Please note that personal data shared with these entities may become public.
8. People involved in a transaction, such as other users or merchants and their service providers.
9. Third parties that you asked us to connect with, such as other financial or social media apps. If you want us to stop sharing information with a third party, disconnect your account from that third party.
10. Other third parties to:
    • Comply with laws (please note that personal data shared with these entities may become public)
    • Investigate or enforce violations of our user agreement (please note that personal data shared with these entities may become public)
    • Facilitate a merger, purchase, or sale of part or all of our business
    • Comply with card association rules
    • Advise us professionally

When sharing personal data with the above-mentioned third parties, we will ensure that appropriate safeguards are in place pursuant to applicable laws. For more information on entities with whom we may share personal data, click here.

How we protect your personal data

Helping to keep your personal data safe against loss, misuse, unauthorized access, disclosure, and alteration is our top priority.

To protect your personal data, we use technical, physical, and administrative security policies and procedures in line with industry best practices, such as ISO 27001 and PCI DSS, to safeguard the confidentiality, privacy, and integrity of your personal data. These policies and standards are reviewed and/or updated on a regular basis. The specific security measures we adopted for protecting your personal data include but are not limited to:

• Firewalls
• Data encryption
• Physical access controls at our data centers

While we protect our systems and services, you’re responsible for keeping your password(s) and account information private. You are also responsible for making sure your personal data is accurate and up to date.

Your privacy rights and choices

You have rights and choices about how your personal data is collected, stored, used, and shared.

Understanding your rights

You have the right to request a copy of the personal data we’ve collected and held about you, to request that we correct or update our records, or to request that we transfer that data to another provider, or to ask us to explain our rules of processing your personal data. Please contact us via Customer Service number (+86) 400-820-8811 if you would like to request that we do this.

You also have the right to ask us to delete any personal data we have collected and held about you in the circumstances (i) that is not explained in this Privacy Statement (or breaches the law); (ii) the personal data is no longer required for the specified purpose that it was collected for, (iii) you withdraw your consent to our collection or processing of such personal data when a consent is required by law (such as to send you updated information about our services from time to time); but note that most of the circumstances in which we process your personal data are necessary to reach and perform contracts with you and, as such, do not require your consent under law, or (iv) we cease the provision of the service involved or the applicable data retention period has otherwise expired. We may not respond to your request of deleting personal data if the retention of data has not expired, or it is technically difficult to delete the personal data. In the latter scenario, we will cease the processing activities of your personal data, except for the storage or for necessary security measures. We will consider the requirements of laws and regulations and the time needed to achieve the purposes described in this statement to determine the retention period of personal data.

If you want to see, transfer or delete your personal data or close your account altogether, contact us via Customer Service number (+86) 400-820-8811 or manage this through your account.

If you want to delete your personal data, you have choices:

• Log in to your account and delete information you previously added. For example, you can delete your profile picture and non-primary addresses in your settings
• Call us and request that we delete specific information
• Close your account

If you request to see or delete your personal data, we’ll first need to verify who you are before we can respond to your request. If we can’t verify your identity, we will not be able to fulfill your request.

If you request to close your account, we still need to keep some personal data so we can:

• Complete a pending transaction, provide goods or services you requested, or comply with our promises to you in the User Agreement or other contract you have with us
• Detect and prevent malicious, fraudulent, or illegal activity
• Protect your (or another person’s) legal rights
• Manage our internal business processes that are reasonably related to your expectations when using our services
• Comply with laws

Once your account is closed, we will stop collecting or using your personal data unless otherwise required under applicable law and regulations or by regulatory authorities.

Some aspects of our services, such as account log in, authentication and fraud prevention, may rely on an automatic decision-making mechanism such as an algorithmic process. If these decisions have a significant impact on your rights and interests, you have the right to request an explanation of the automatic decision-making mechanism and a manual review of the decision. If you want to do this, contact us via Customer Service number (+86) 400-820-8811.

We will not deny you services, charge you different prices, or provide you with a different level of service solely for exercising your privacy rights.

We will respond to a request to close your account within 15 working days (or you can close it immediately online). For other requests to exercise the privacy rights, we will respond to your requests within the period required by law. In each case, we will explain if we are unable to fulfil your request. If you are not satisfied with our response, you may contact the relevant consumer protection authorities.

Understanding your choices

You can control how personal data is collected or shared, as well as how we communicate with you, through the settings in your account. Here are some of the ways you can customize your choices.

Choose how we collect personal data

In the section “The personal data we collect and why we collect that personal data” above, we will tell you what personal data is required to provide a service to you, and what personal data is optional.

Choose how connected accounts collect and use personal data

If you connect your account to a third-party service, you may be able to manage how your personal data is collected, used, and shared by them. Read the third parties’ privacy policies to see the choices they offer you.

You can control which third-party services you connect to your account and what personal data they can collect about you. For example, to manage the permissions, go to the Security settings in your PayPal account.

Choose how we communicate with you

Your choices about how we communicate with you differ depending on the purpose of the message and how it is delivered. Some messages are optional, and some are necessary for you to manage your accounts with us. We use email, text messages, push notifications on your mobile device, and even paper mail depending on the situation and your preferences.

You can click the unsubscribe link in a marketing email, opt out of a text message by replying “STOP”, or turn off notifications on your device. You can also change your account’s notification settings or the notification preferences on your device.

You won’t be able to opt out of messages that are necessary for you to manage your account, such as receipts and emails that alert you to changes in your account’s status that require your attention. But you will be able to decide how we send those messages, such as by email, text message, or a notification on your mobile device.

How we protect personal data of the deceased

If you are a close relative of a deceased user of PayPal, you may exercise the rights under the sections heading with “Understanding your rights”, provided that PayPal is not aware of that the deceased person had made any different arrangement in respect of your access to their account.

When you notify us that you wish to exercise the above right you will need to provide us with valid official government identification documentation and a death certificate for the deceased, together with your own valid official government identification information and notarized documentation evidencing your relationship with the deceased, as well as other documentation which we may request on a case by case basis where needed to protect the personal data rights of the deceased person.

Age limit for our services

To open a PayPal China account and to use the PayPal services, you must be at least 18 years old. If we become aware that a person who is not allowed to use our services has opened a PayPal China account, we have the right to close that account immediately according to our User Agreement. We do not knowingly collect personal data from people who are not allowed to use our sites and services, such as children under the age of 18. Contact us via Customer Service number (+86) 400-820-8811 if you believe that we’ve mistakenly collected personal data from someone not allowed to use our services. We’ll delete it immediately, unless we’re legally required to keep it.

How we store and transmit your personal data globally

In principle, the personal data that we collect in the PRC will be stored within the PRC. We only store your personal data necessary for the purposes stated in this statement.

Because our services involve cross-border transactions, we need to transmit your personal data collected in China to overseas institutions. The cross-border data transfer will be carried out in accordance with Chinese laws, regulations and relevant regulatory rules. For more information on overseas entities to whom we transfer personal data, click here.

How this statement changes over time

We’ll make changes to this privacy statement from time to time. This helps us stay up to date with changes to our business and the most current laws. After a new version is published, we’ll collect, store, use, and protect your personal data as we outline in that revised statement.

If the new version reduces your rights or changes the types of personal data we collect or the reasons for collecting that data, we’ll post it on our website at least 21 days before it becomes effective.

We may notify you about these changes through email or other communications.

How to contact us

If you have questions about this privacy statement or your personal data or the personal data of your deceased close relative, contact us via Customer Service number (+86) 400-820-8811 so we can help.

To talk about your PayPal account visit our Customer Service web portal.