Privacy Policy

Wonder’s Privacy Policy describes how we collect, use, and disclose your personal information. It also explains your rights and choices in relation to your personal data, including how you can access, update, or object to certain uses of your information.

This Privacy Policy applies to any user of our Services and any visitor to our website, mobile application, or other channels (collectively, the “Sites”). This Policy does not apply to third-party websites, products, or services, even if they are linked to or provided in connection with our Services.

Here are some important definitions to help you understand our terms and this Privacy Policy:

“Wonder”, “we”, “us”, or “our” refers to Bindo Labs Limited (hereafter called “Bindo”, “the Company”) Bindo is the underlying legal entity, and ‘Wonder’ is the operating name used for Hong Kong operations.

“Services” means the Wonder platform and all related products and services provided by Wonder, including but not limited to the Wonder App, Wonder Dashboard, Wonder Terminal, Wonder Website, and any associated technologies, APIs, or functionalities.

“Sites” means our website, mobile application, and any other digital platforms through which we provide our Services.

“Personal Information” means any information that identifies or relates to an individual.

Your personal information is stored and maintained by Bindo Labs Limited at:
Suite 05-181, 5/F, The Quayside77
Hoi Bun Road, Kwun Tong
Kowloon, Hong Kong.

1. Legal Basis to Collect and Process Personal Data

We must have a legal basis (a valid legal reason) for collecting and processing your personal data. Our legal basis for processing personal data includes:

(a) the performance of a contract with you;
(b) compliance with legal and regulatory obligations;
(c) your consent, where required; and
(d) our legitimate interests in operating and improving our Services, provided such interests do not override your rights.

The key principles of privacy and personal data protection in Hong Kong are set out in the Personal Data (Privacy) Ordinance (PDPO) (Cap. 486). The PDPO establishes six Data Protection Principles (DPPs), which form the foundation of personal data compliance in Hong Kong. Below is a summary of each of the six Data Protection Principles under the PDPO:

DPP1 – Purpose and Collection of Personal Data
Personal data must be collected for a lawful purpose directly related to the data user’s functions or activities, and the collection must be necessary and not excessive. The data must be obtained by lawful and fair means, and individuals must be informed of the purpose of collection, how the data will be used, whether provision is mandatory or voluntary, and their rights to access and correct the data.

DPP2 – Accuracy and Retention
Personal data must be accurate, up-to-date, and not misleading, with reasonable steps taken to ensure its correctness. Data should not be retained longer than necessary for the purpose for which it was collected and must be securely deleted once it is no longer required.

DPP3 – Use of Personal Data
Personal data may only be used for the purpose for which it was originally collected or a directly related purpose. If the data is to be used for a new purpose, the data user must obtain the prescribed (express and voluntary) consent of the individual concerned.

DPP4 – Security of Personal Data
Data users must take all practicable steps to protect personal data against unauthorized or accidental access, processing, erasure, loss, or use. Appropriate security safeguards: physical, technical, and organizational must be implemented based on the sensitivity of the data and the potential harm that could result from a breach.

DPP5 – Openness and Transparency
Organizations must be transparent about their personal data practices by maintaining a clear and accessible privacy policy. This policy should describe the types of personal data held, the main purposes for which it is used, and how individuals can request access to or correction of their data.

DPP6 – Access and Correction
Individuals have the right to request access to their personal data and to request corrections if the data is inaccurate. Data users are required to respond to such requests within the statutory timeframe and must provide the requested data unless a lawful exemption applies.

2. Who This Policy Applies To

We will collect personal data from our customers and other individuals in connection with the purposes set out in this Privacy Policy. These customers and other individuals may include the following, and we refer to them collectively as “you/your” in this Privacy Policy:

applicants or account-holders of Wonder products or Services;
customers; and
any third party transacting with or through us.

3. What Personal Data We Collect

When registering or creating an account with Wonder, we will collect information such as your name, phone number, physical address, email address and other information reasonably required to verify your identity, maintain account security, and verify and control access to your account.

For complete access to Wonder’s services, we may collect additional information about you and the business parties you have affiliations with including but not limited to:

(i) Name, address, phone number, email address, date of birth, your photos, nationality, information for the verification of identity – including identification document type and identification number – and additional information that may be required for identity/account authentication
(ii) Tax ID number
(iii) Details of your company’s bank account including account number, sort code and IBAN

Wonder will also collect information about you from publicly available sources such as official registers and databases as well selected social media websites or apps to carry out our due diligence checks. In addition, we collect information from media stories and websites to ensure your business is legitimate and to verify screening results.

We may also collect information about you from affiliates (by “affiliates” we mean other companies that Wonder has a contractual relationship with) who provide us with services such as “name screening” and biometric data capturing in order to help verify your identity which, in turn, allows us to improve the safety of our services. This includes being able to detect and respond quickly to any fraud or security risks.

You acknowledge and agree that, where information relating to other parties is disclosed to Wonder by you, you have provided a copy of this Privacy Policy to such parties prior to your disclosure of their information to Wonder, and you have obtained all relevant consents from such parties for the use of their information in the manner as described in this Privacy Policy. You further represent and warrant that you have complied with the requirements of all Applicable Laws with respect to such information and its use by us for the purposes set out herein.

We may also collect information directly or indirectly from your transactions with or through Wonder in the ordinary course of our business. This may include transaction data, information relating to deposits made or transactions executed through your Wonder App Card or other Wonder products and services, and information about your spending and saving behaviour.

We may also collect payment-related information if you make purchases or payments through our Services, including billing details and payment instrument information. Where payment card information is collected, it is used only as necessary to process and authorise transactions and is handled in accordance with applicable security standards.

We may also collect information through your use of our Services (our application, dashboard, terminal, website, or other platforms), including usage data, cookies, and data obtained through behavioural or location tracking technologies.

We may also store and use communications you send to us, including feedback, complaints, questions, or support requests, in order to respond to you, investigate issues, and improve our Services.

We may also collect and process biometric data, including facial images or facial recognition data, for the purpose of identity verification, fraud prevention, and security. Face data is collected solely to verify your identity and protect your account from unauthorised access. This data is not used for profiling, marketing, or any unrelated purposes. Face data is retained only for as long as necessary to fulfil these purposes and to comply with applicable legal and regulatory obligations. This means face data will be retained for the duration of your relationship with Wonder and for up to seven years thereafter, in line with anti-money laundering and regulatory record-keeping requirements. Face data is not stored indefinitely and will be securely deleted once it is no longer required. a globally recognized leader in AI-powered identity verification and fraud prevention. Jumio is trusted by major financial institutions and technology companies worldwide, and holds key security certifications including ISO 27001, SOC 2 Type 2, and PCI DSS. Jumio processes and stores face data on our behalf in accordance with its own privacy and data retention policies and applicable data protection laws. Jumio may retain face data for as long as necessary to provide identity verification services to Wonder and to comply with its legal and regulatory obligations, after which such data is securely deleted or anonymised in accordance with its retention policies. Jumio is contractually required to implement appropriate technical and organisational measures to protect face data and may only use such data for identity verification, fraud prevention, and compliance purposes.

We may also store, display, and use any reviews, feedback, comments, or other content that you submit through our Services which is intended to be visible to others, in connection with operating and promoting our Services. You should avoid including unnecessary personal information in such content, as it may be visible to other users.

We may also receive information about you from third-party services if you choose to link your Wonder account with such services or import contacts from another platform, in accordance with your settings and the permissions you grant. We may use this information to help you connect with others, personalise your experience, and provide relevant features within our Services.

4. How We Use Your Personal Data

Wonder collects and uses your personal data for purposes connected with providing, operating, and improving our Services.

This includes processing and assessing your application for Wonder products and services, conducting Know Your Customer (KYC) and customer due diligence procedures, setting up and administering your account, facilitating transactions, and communicating with you in relation to your account and our Services.

We may use your personal data for internal operational purposes, including credit risk assessment, fraud prevention and detection, investigation of complaints, suspicious activities or failed transactions, audit, insurance, testing, analysis, system development, and service improvement. This also includes designing new products or enhancing existing services.

Your personal data may also be used to manage and enforce our rights and your rights under the Customer Agreement, collect monies owed, and support the ongoing management, operation, and maintenance of our Services.

We may also use your personal data to meet our legal, regulatory, and compliance obligations. This includes complying with applicable laws, regulations, guidelines, and requirements imposed by legal, regulatory, governmental, tax, law enforcement, or industry authorities, whether in Hong Kong or elsewhere. It also includes responding to investigations, requests, or demands from such authorities, as well as complying with contractual obligations with partner banks, financial institutions, marketplaces, and service providers.

In addition, your personal data may be used in connection with legal or regulatory proceedings, obtaining professional advice, establishing, exercising, or defending legal rights, investigating insurance-related matters, and evaluating any actual or proposed transfer of our business or assets.

We may also use your personal data to organise and deliver seminars, events, or communications, and to monitor and assess the performance of our service providers, agents, and contractors.

Where permitted by applicable law, we may use your personal data to send you information about relevant products, services, events, or other subjects.

You may opt out of receiving such communications at any time.We may also use information provided by you to compile aggregated or anonymised statistics and insights to help us better understand our customers and improve our Services.

If we intend to use your personal data for any purpose not described in this Privacy Policy, we will notify you and obtain your consent where required by applicable law.

5. Cookies, Tracking and Advertising

Wonder may, at its discretion, partner with third parties to either display advertising in our Services, including our application and website, or to manage Wonder’s advertising on other sites. Our third-party partners may use technologies such as cookies to gather information about your activities while using the application or website and other sites in order to provide you advertising based on your browsing activities and interests.

We may also use analytics and advertising tools provided by third parties, including tools that help us measure visits, conversions, and user interactions with our Services. This may include the use of third-party services such as Google Ads conversion tracking to help us understand website traffic, measure the effectiveness of our campaigns, and improve our Services.

In addition, Wonder automatically gathers and stores in log files certain information, such as Internet Protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and/or clickstream data. Wonder does not link this automatically-collected data to other information we collect about you. Wonder, as well as our third-party partners, may use local storage to store content information and preferences.

6. Disclosure of Information

We will safeguard the information collected from you in accordance with the laws and regulations applicable in the Hong Kong Special Administrative Region. Subject to our obligations under applicable law, and for the purposes set out in this Privacy Policy, we may transfer or disclose your Personal Information to the following parties:

our partner banks, merchant acquiring companies, financial institutions, insurers, credit card companies, securities and investment service providers, and other financial services companies;
marketplaces, e-commerce platforms, and other counterparties with whom you conduct business, in order to facilitate your transactions and the disbursement of proceeds;
our agents, contractors, service providers, and professional advisers under a duty of confidentiality to us who provide administrative, telecommunications, identity verification / know-your-customer, computer, payment, transaction processing, cloud storage, data processing, data analytics, cybersecurity, securities clearing, marketing, audit, professional advisory, or other services to us in connection with the operation of our business or the provision of our Services;
our affiliates and any person who owes a duty of confidentiality to us;
our employees and any person who works for us or provides services to us;
auditors, internal risk teams, and other persons supporting our audit, compliance, corporate governance, fraud prevention, risk management, or suspicious activity monitoring functions;
any interface, including an application programming interface, that links to, or otherwise makes available, information about our products or services;
reward, loyalty, co-branding, and privileges programme providers, and our co-branding partners;
charitable or non-profit making organisations, where relevant;
any actual or proposed assignee, transferee, participant, sub-participant, or purchaser of all or any part of our business, assets, or rights;
any law enforcement agencies, judicial authorities, regulatory bodies, governmental authorities, tax authorities, self-regulatory bodies, industry associations, or any person or entity to whom we have an obligation under Applicable Laws, regulations, guidelines, investigations, demands, or requests to disclose information, provided that such disclosure is made under proper authority;
any shareholder of Wonder and their affiliates, and any person who works for or provides services to them, where permitted by law;
other Wonder customers where disclosure is necessary in connection with your use of Wonder products or services; and
any other person where the public interest requires such disclosure or where you have given your express or implied consent.

Your Personal Information may be transferred to, stored in, or processed in jurisdictions outside Hong Kong, including jurisdictions that may have different data protection laws from those in your home country. Personal Information may also be processed by persons operating outside Hong Kong on behalf of Wonder, our affiliates, or our service providers for transaction processing, payment detail verification, storage, and other Services-related support.

Wonder will take commercially reasonable steps to ensure that any Personal Information disclosed is treated securely and in accordance with this Privacy Policy, whether within or outside Hong Kong.

By using our Services or submitting your Personal Information to us, you consent to such transfer, storage, and processing in accordance with this Privacy Policy and applicable law.

7. Direct Marketing

We would like to use your data in direct marketing and we require your consent (which includes an indication of no objection) for that purpose. The data that we may use in direct marketing includes:

your name and contact details;
your demographic data;
the products and services provided to you by Wonder App, or any Shareholder;
your saving and spending patterns and behaviour; and
your financial background.

We may directly market the following classes of services, products, and subjects:

financial, fiduciary, banking and related services and products;
reward, loyalty or privileges programs and related services and products;
services and products offered by any Shareholder;
services and products offered by our co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
donations and contributions for charitable and/or non-profit making purposes.

Along with us, the following persons may provide or solicit (in the case of donations and contributions) the above services, products and subjects:

third party financial institutions;
third party reward, loyalty, co-branding or privileges program providers;
our co-branding partners; and
charitable or non-profit making organisations.

We may also provide your data to any of these people for them to use in directly marketing the same services, products and subjects to you. Wonder App will always first obtain your consent (which includes an indication of no objection) for that purpose. We may receive money or other property in return for providing your data to these other persons, but we’ll tell you if this is the case when obtaining your consent.

You can change your mind about giving consent for us to use or provide to other persons your data for use in direct marketing, as set out above. Just let us know at any time.

8. Accuracy of Information

Wonder will make reasonable efforts to ensure that your personal data is sufficiently accurate, complete, and up to date to minimise the possibility that inappropriate information may be used to make a decision about you. Wonder will not routinely update your personal data unless such updating is necessary to fulfil the purposes for which the information was collected. You are responsible for notifying us as soon as possible if any of the information you have provided to us changes.

9. Access, Correction and Your Rights

Subject to applicable law, you have the right to request access to the personal data we hold about you, request correction of inaccurate personal data, withdraw any consent previously given in relation to the use of your personal data, understand our policies and practices relating to personal data, and be informed of the types of personal data we hold.

If you wish to exercise any of these rights, please contact us via the Wonder App, by email at support@wonder.app, or by post to:

Data Protection Officer
Suite 05-181, 5/F, The Quayside
77 Hoi Bun Road, Kwun Tong
Hong Kong

We may charge a reasonable fee for processing a data access request where permitted by law. We will not charge a fee unless you request that a paper copy be sent to you.

10. Security and Retention

We take the security of your personal data seriously and use technical and organisational measures to safeguard it, including personal data in transit and in storage. These measures are designed to protect the confidentiality and integrity of your personal data and to prevent unauthorised access, use, loss, disclosure, or leakage. Personal data may be encrypted using strong encryption standards and protected through appropriate key management practices. Where we engage external service providers, we require them to follow security standards mandated by us where applicable.

Please note that the Internet, including applications that use the Internet for data transfer, may not always be a secure means of communication. Sending personal data over the Internet may involve risks, including access or interference by unauthorised third parties, and information transmitted over the Internet may pass through jurisdictions with different data protection laws.

Wonder retains personal data in accordance with applicable legal and regulatory requirements and for business and operational purposes. In most cases, we retain personal data for up to seven years after the end of your relationship with us. You may request deletion of some or all of your personal data earlier, but we may only comply where we have no legal or regulatory obligation to retain the data and where the data is no longer required for the provision of any service you continue to use. If we cannot delete your personal data promptly after your request, we will inform you accordingly.

We may also record and monitor electronic communications with you to ensure compliance with legal and regulatory obligations and internal policies.

11. Contact

If you have any questions about this Privacy Policy, our privacy practices, or your personal data, or if you wish to make a complaint or exercise your rights, please contact us at:

Email: compliance@wonder.app or support@wonder.app
By post:
Data Protection Officer
Suite 05-181, 5/F, The Quayside
77 Hoi Bun Road, Kwun Tong
Hong Kong

12. General

This Privacy Policy is provided in accordance with Hong Kong’s Personal Data (Privacy) Ordinance and, where applicable, the Code of Practice on Consumer Credit Data.