Privacy Policy

1. Who We Are

HONGKONG ADSPOWER INFORMATION TECHNOLOGY LIMITED (Company Registration No. 2993553) (“Cardfornia”, “we”, “us”, “our”), a company incorporated in Hong Kong with registered address at Room 704, 7/F, Tower A, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui East, Kowloon, Hong Kong, is responsible for the personal data described in this Privacy Policy.

This Policy explains how we handle personal data when you access our website, dashboard, APIs, cards and related services (collectively, the “Services”).

Data Protection Officer. We have appointed a Data Protection Officer to oversee our compliance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”). You may contact them at dpo@cardfornia.com or by post at the address above, marked for the attention of the Data Protection Officer.

2. Scope and Our Role

Our Services are provided to business customers, including start-up teams. Personal data reaches us in the ways below, and our role differs in each case.

Where you are a business customer (“Client”). We act as controller of the personal data of your directors, beneficial owners, administrators and authorised contacts. We decide how that data is used, principally to verify your business, meet our legal and partner compliance obligations, and provide the Services to you.

Where you represent a start-up team. A start-up team that has not yet completed company registration may use the Services through one individual representative. If you are that representative, you are the Client until the team’s legal entity completes business verification. We act as controller of your personal data, including the identity data used for your KYC verification, and we process it as described in this Policy for a Client.

Where you are a cardholder. Your employer or the entity that nominated you (the “Client”) provides your data to us so that a card can be issued to you.

• For identity verification, sanctions screening, fraud prevention, transaction monitoring and regulatory reporting, we act as controller. These are obligations imposed on us and on our partners, and we cannot carry them out on the Client’s instructions alone.
• For managing your card, applying spend controls and reporting your transactions to the Client, we act as processor on the Client’s instructions.

If you are a cardholder and want to know why you were given a card, what your spending is used for internally, or how long your employer keeps its own records, those questions are for the Client, not for us.

Cards and funds. Cards are provided by licensed white-label card providers (“Partners”) and issued by licensed issuing institutions. Before a card is created, we tell the Client which Partner provides it. Card funds are held by the Partner in the Client’s dedicated sub-account. Partners and issuing institutions handle personal data for their own regulatory purposes and act as controllers in their own right. Their handling of your data is governed by their own privacy notices.

Self-custodied wallet. The Services include an embedded self-custodied wallet that uses technology from a third-party wallet provider. The wallet’s login and recovery data are held by that provider, not by us. We never collect, hold or have access to your private keys or recovery phrase. The wallet provider handles your data under its own privacy notice, in addition to this Policy.

3. Personal Data We Collect

3.1 Data you or the Client provide

• Identity data: name, date of birth, nationality, government-issued identification, photograph, and liveness or selfie verification images.
• Contact data: email address, telephone number, postal address.
• Business data: company name and registration details, constitutional documents, ownership and control structure, beneficial ownership information, role and authority within the Client.
• Financial and compliance data: source of funds, source of wealth, expected transaction volumes.
• Wallet data: the public address of your embedded wallet, the external wallet addresses you use to fund it, wallet balances, and on-chain transactions to and from your wallet. On-chain data is public on the blockchain. We do not collect private keys or recovery phrases.
• Support data: correspondence, dispute documentation, and records of communications with us.

3.2 Data collected automatically

• Usage data: IP address, browser type and version, device identifiers, operating system, pages visited, dates and times of access, and diagnostic data.
• Transaction data: card authorisations, settlements, declines, refunds, chargebacks, merchant names and categories, transaction amounts, currencies and locations.
• Security data: login records, authentication events, API access logs.

3.3 Data from third parties

• Identity verification providers, who confirm identity against government records and publicly available information.
• Sanctions, PEP and adverse media screening providers.
• Blockchain analytics providers, used by us or our Partners, who screen wallet addresses and transaction flows associated with funding.
• Our wallet technology provider, which confirms the wallet address and the authentication events linked to your account.
• Partners and issuing institutions, who provide transaction, settlement, dispute and compliance information.
• Public registries and corporate databases.

4. How We Use Personal Data, and Our Legal Bases

Where the EU or UK GDPR applies to our processing, the legal bases are as set out below. Under the PDPO, we collect personal data for purposes directly related to our functions and activities, and we use it for those purposes, for directly related purposes, with your consent, or where an exemption under the PDPO applies, including compliance with legal requirements.

Service communications. We send communications about your account, security, service changes and transactions. These are necessary to provide the Services and you cannot opt out of them while you use the Services.

Marketing. You can opt out at any time by using the unsubscribe link or by contacting us at marketing@cardfornia.com. Opting out of marketing does not stop service communications.

Automated processing. We and our Partners use automated systems to screen funding, monitor transactions and detect fraud. These systems may automatically decline a transaction, block a card or flag an account for review. Decisions that produce significant effects, such as declining onboarding or suspending an account, are reviewed by a person before they become final. If you believe an automated decision has affected you unfairly, contact us at support@cardfornia.com.

5. Who We Share Personal Data With

• Partners and issuing institutions, to issue cards, process transactions, hold and settle card funds, and meet their own regulatory obligations.
• Our wallet technology provider, to create and operate your embedded wallet, including login and recovery. The provider holds the wallet’s login and recovery data.
• Card networks (Visa, Mastercard), processors and acquirers, to authorise, clear, settle and dispute transactions.
• Compliance service providers, including identity verification, sanctions screening and blockchain analytics providers.
• Technology service providers, including cloud hosting, communications and customer support tools, under contracts that limit their use of the data to providing services to us.
• The Client, where you are a cardholder — including your card details, spending, merchants and transaction history.
• Professional advisers, including auditors, lawyers and accountants, where necessary.
• Regulators, law enforcement and other authorities, where required by law, court order or a valid request. In some cases we are legally prohibited from telling you that we have made a disclosure.
• Acquirers of our business, in a merger, acquisition, restructuring or insolvency. We will give notice before your data becomes subject to a different privacy policy, where lawful.

6. International Transfers

Cardfornia is based in Hong Kong. Our Partners, issuing institutions, card networks and service providers are located in a number of jurisdictions, and personal data will be transferred outside Hong Kong and outside your own country.

Where we transfer personal data internationally, we take steps to ensure it receives a standard of protection comparable to that required under the PDPO, and where the EU or UK GDPR applies, we rely on an appropriate transfer mechanism such as Standard Contractual Clauses or a finding of adequacy.

You may request information about the safeguards applied to a specific transfer by contacting our Data Protection Officer.

7. How Long We Keep Personal Data

Where a legal claim, investigation or regulatory request is pending, we retain the relevant data until it is resolved.

Retention periods that arise from our Partners’ or issuing institutions’ own obligations are set by those institutions and may differ.

8. Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the data, including access controls, encryption of data in transit and at rest, logging and monitoring, staff access on a need-to-know basis, and vendor security assessments.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also have a role: keep credentials confidential, do not share card details, safeguard your wallet login and recovery method (we cannot recover a lost wallet for you, because we never hold your private keys), and notify us immediately at support@cardfornia.com if you become aware of unauthorised access.

9. Your Rights

Depending on the law that applies to you, you may have the right to:

• Access the personal data we hold about you and receive information about how it is processed;
• Correct data that is inaccurate or incomplete;
• Erase data in certain circumstances;
• Restrict or object to processing in certain circumstances, including objecting to processing based on legitimate interests;
• Withdraw consent where processing is based on consent;
• Receive a copy of data you provided to us in a structured, machine-readable format, and have it transmitted to another controller where technically feasible;
• Complain to a supervisory authority.

Please note that we will often be unable to erase or stop processing data that we are legally required to retain, particularly KYC and transaction records held under anti-money laundering law. On-chain transactions are recorded permanently on public blockchains; neither we nor anyone else can change or erase them. Where we cannot meet a request in full, we will tell you why.

How to exercise your rights. Contact our Data Protection Officer at dpo@cardfornia.com. We will respond within 30 days, or tell you if we need longer. We may need to verify your identity first.

If you are a cardholder, requests relating to data we process on your employer’s instructions should be directed to your employer in the first instance. We will forward such requests to the Client and assist them in responding.

Complaints. In Hong Kong, you may complain to the Office of the Privacy Commissioner for Personal Data (www.pcpd.org.hk). If you are in the EEA or UK, you may complain to your local supervisory authority.

10. Cookies and Tracking

We use cookies and similar technologies, including web beacons and pixels, to operate the Services, remember your preferences, maintain security and analyse usage.

Strictly necessary cookies are required for the Services to function and cannot be disabled. Analytics and preference cookies are used only where you have consented, where consent is required in your jurisdiction.

You can manage cookies through your browser settings and, where offered, through our cookie banner. Blocking cookies may prevent parts of the Services from working.

11. Children

The Services are provided to businesses and are not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we hold such data, we will delete it and close any associated account. If you believe a person under 18 is using the Services, contact our Data Protection Officer at dpo@cardfornia.com.

12. Links to Other Sites

The Services may contain links to sites we do not operate, including merchant and Partner sites. We are not responsible for their content or privacy practices, and we recommend reviewing their policies.

13. Changes to This Policy

We may update this Policy. We will post the updated version on this page and update the “Last updated” date.

Where changes are material, we will give notice by email or by prominent notice on the Services at least 30 days before they take effect, unless a shorter period is required by law.

14. Contact

• Data Protection Officer: dpo@cardfornia.com
• General enquiries: support@cardfornia.com
• Marketing Team: marketing@cardfornia.com
• Post: HONGKONG ADSPOWER INFORMATION TECHNOLOGY LIMITED, Room 704, 7/F, Tower A, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui East, Kowloon, Hong Kong