Privacy Policy and E-sign Consent

This Privacy Policy describes how iPay (Pvt) Ltd ("iPay") collects, uses, stores, shares and protects your information whenever you use iPay payment platform through our website (www.iPay.lk) or iPay mobile or web applications.

We may change this Privacy Policy from time to time without prior notice.

1. Information We Collect

When you create an iPay account, we'll collect certain details about you and sometimes we need to request more information to verify your identity or to meet legal and regulatory obligations. When that is necessary, you will be prompted to provide such information.

There is some information that is automatically collected as you use iPay. This information includes but not limited to:

• Device Information. We collect information about your device, including the type of device (Computer vs. iPhone vs. Android), operating system, mobile phone number, browser type and language, and device identifiers (such as IMEI and MAC address).
• Location Information. We collect your device location so that we can offer you location-based features such as the ability to send funds to nearby iPay users.
• Contacts. To make it easier to send money to your contacts, we will - with your permission - collect information from your phone's address book. By granting permission, you confirm you are authorized to provide us such phone numbers (both iPay users and non-users) in order for us to identify iPay users. Similarly, we may receive your information from other iPay users (in the same manner that you may share theirs). iPay only uses contact information to identify iPay users and does not store any contact information.
• Transactions. We collect information about your payment activity such as the amount, date, time, recipient for each transaction.
• Cookies. Like most mobile apps and websites, we use cookies. Cookies are small data files that we place on your device that allow us to identify you as an iPay user and provide a customized iPay experience. We use both session and persistent cookies when you access our website or content. Session cookies expire and no longer have any effect when you log out of your account or close your browser. Longer lasting cookies, known as persistent cookies, remain on your browser until you erase them or they expire. You are free to decline our cookies if your browser or browser add-on permits, but doing so may interfere with your use of iPay. The help section of most browsers or browser add-ons provides instructions on blocking, deleting or disabling cookies.

2. Protecting Your Information

Throughout this policy, we use the term "personal information" to describe information that is associated with you or can be used to identify you. We do not consider personal information to include information that has been anonymized.

We protect your information using reasonable physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorized access, disclosure and alteration.  All of our physical, electronic and procedural safeguards are designed to comply with applicable laws and regulations.

3. How We Use Your Information

We collect all of this information so that we can provide you with a safe and seamless way to make and receive payments. The information we collect allows us to:

• Deliver the full range of payments and functionality of the iPay product;
• Keep in touch with you - whether it be for providing customer service, notifying you of new features that have been added to the mobile apps, or providing security notices or information;
• Verify your identity so that we can minimize fraud or unauthorized activity;
• Improve iPay or add new product features by analyzing usage trends;
• Personalize the iPay experience by matching product features to things that we think you specifically might be interested in;
• Identify iPay users via their telephone numbers stored in your mobile address book; and
• Fulfill any other purpose for which the information was collected.

 We may combine your information with information we collect from other sources and use it to improve and personalize the Services, as well as our platform.

4. How We Share Your Information

In order to provide you with the iPay product and meet our legal and regulatory obligations, we may share the information we collect as detailed below:

• When you link your bank account, we will share your account information with other banking partners or Finance Companies so that we can process payments. We also may need to share your information with your own Bank or the Finance Institution in order to verify and complete payment transactions.
• In order to prevent fraud, we will sometimes need to share your information with third party identity verification services. This lets us make sure you are who you say you are, by comparing the information you provide us to public records and other third party databases.
• In order to improve iPay's functionality, we may sometimes share information with service providers that help us analyse how people are using the app. This allows us to refine popular features and improve or eliminate features people don't use.
• As a regulated financial institution, we may need to share your information with law enforcement or government officials. We will only do this when we are compelled to do so by a specific regulation, subpoena, court order or formal request, or we otherwise believe in good faith that we need to share such information to prevent physical harm, financial loss, or are obligated to report illegal activity.
• In order to complete third party financial, technical and legal audits of iPay's operations, we may need to share information about your account as part of such review.
• We will share your information with other third parties if you specifically authorize us to do so.

In order to make iPay payments about more than just sending money, we may share additional information with other iPay users. This information includes:

• Transaction Details. At the risk of stating the obvious, when you send someone a payment or payment request, they will be provided with the details of that transaction, including the payment amount, currency, date, time and a unique transaction ID number.

• Your Identity & Photo. When another iPay user receives a payment or payment request from you, they will receive some information about your identity. Exactly what "persona" we provide to others is up to you. This can be your email address or simply your first name and last initial and can be customized in your account settings. If you add a photo or avatar to your iPay account, they'll see that too.

• Location. If you have your location enabled in your settings, the location from which a payment was initiated may be visible to the recipient. This also lets other users take advantage of the "nearby users" function, which makes it easier for them to send you a payment if you're nearby and not otherwise in their contacts.

• Status as an iPay User. Other iPay users may be able to see that you have an iPay account. This lets them know they can send you a payment and you will receive it instantly without having to first set up a iPay account.

5. How To Change or Delete Your Information

If you need to add or change any information, you can just log in to your iPay account and make the change in your settings. If it doesn't look like you can make the change on your own, just reach out to Support and we'll take care of it.

If you want to close your iPay account, know that as a regulatory requirement we are required to retain certain information you have provided for a number of years.

6. E-Sign Consent

Please be aware that your consent to the electronic delivery of disclosures is required to open an account or use any of the Services (as defined in the User Agreement). If you are unable or unwilling to provide such consent, you will not be able to open an account. Once you have opened an account you can rescind your consent to electronic delivery of disclosures at any time and receive paper communications as set forth below.

This E-Sign Consent applies to any and all communications and/or disclosures that iPay is legally required to provide to you in writing in connection with your account and any related products and services ("Communications"). This E-Sign Consent supplements and is to be construed in accordance with the terms and conditions contained in the User Agreement ("User Agreement").

Scope. When you use the Services, you agree that we may provide you with any Communications in electronic format, and that we may discontinue sending paper Communications to you, unless and until you withdraw your consent as described below. Your consent to receive electronic communications and transactions includes, but is not limited to:

• Legal and regulatory disclosures and communications associated with your account or the Services;
• Notices or amendments relating to the User Agreement and this Privacy Policy & E-Sign Consent;
• Communications regarding any deposits, withdrawals or transactions; and
• Responses to claims filed in connection with your account.

Methods of Communication. All Communications that we provide to you in electronic form will be provided by e-mail, by posting to the iPay website (https://iPay.lk), or through other electronic communication such as mobile push notification or text message.

Updating your Information. It is your responsibility to provide us with a true, accurate and complete e-mail address, your contact information, and other information related to this E-Sign Consent and your account, keep such information up to date. You may update your information by logging into your account.

Communications in Writing. All electronic Communications from us to you will be considered "in writing" and shall have the same meaning and effect as a paper Communication.

General. iPay reserves the right, in our sole discretion, to cancel this electronic Communication service, or to terminate or change the terms and conditions on which iPay provides electronic Communications. iPay will provide you with notice of any such termination or change as required by law.