1. Controller and Scope
GooseCard is a service provided by GOOSEPAY SDN. BHD. ("GooseCard", "we", "us", or "our"). GOOSEPAY SDN. BHD. is the data controller responsible for the personal data covered by this Policy.
Registered address: S-07-03, Setia Triangle, Persiaran Kelicap, 11900 Bayan Lepas, Pulau Pinang, Malaysia
This Policy applies to the GooseCard mobile application, our websites, account and customer-support channels, gift-card transactions, wallet and payout functions, and related services (collectively, the "Services"). It applies to information collected directly from you, automatically from your device, and from authorised service providers and business partners.
2. Personal Data We Collect
- Account and profile data: name, phone number, email address, date of birth, country, username, account ID, profile information, language, preferences, and protected password credentials.
- Identity and compliance data: government-issued identity documents, document numbers and images, selfie or liveness-verification results, nationality, date of birth, verification status, sanctions or watch-list match results, and other information needed for KYC, AML/CFT, fraud prevention, or legal compliance.
- Gift-card and transaction data: gift-card brand, country, currency, denomination, card type, card images, codes or PINs submitted for verification, quotations, orders, wallet entries, transaction status, transaction history, fraud indicators, and dispute records.
- Financial and payout data: bank or payout account details, beneficiary name, payment references, payout amount, currency, status, refund information, and related verification data. We do not intentionally store complete payment-card details unless specifically disclosed and required.
- Device, usage, and security data: IP address, device model, operating system, app version, language, device or app identifiers, push-notification token, login and authentication events, pages or features used, timestamps, crash logs, diagnostics, and security or fraud signals.
- Communications and user content: customer-support requests, chat or email content, feedback, complaints, survey responses, uploaded files, and other information you choose to provide.
We do not intentionally collect contacts, precise location, microphone recordings, health data, or unrelated files unless a feature clearly requests them and you give the required permission. If a new feature collects an additional category of data, we will update this Policy and any required in-app disclosure before collection.
3. How We Collect Data and Your Choices
- Information you provide: when you register, complete verification, submit a gift card, add payout details, contact support, respond to a survey, or otherwise use the Services.
- Information collected automatically: through our app, websites, servers, security tools, logs, and approved analytics or crash-reporting technologies.
- Information from third parties: identity-verification providers, banks and payout providers, gift-card verification partners, fraud-prevention services, and other providers acting for us or supporting a transaction you requested.
- Device permissions: camera or photo access may be requested to capture or upload identity documents and gift-card images; notifications may be requested for account, transaction, support, security, and optional marketing updates. You can manage permissions in your device settings.
Account identifiers, transaction details, relevant gift-card information, and required KYC or payout data are mandatory when needed to provide a requested feature or meet legal obligations. If you do not provide them, we may be unable to create an account, verify you, process a trade, or complete a payout. Marketing choices and non-essential notifications are optional and can be withdrawn without losing core account functions.
4. Purposes and Legal Bases
- Contract and requested steps: create and maintain accounts; authenticate users; quote, verify, and process gift-card transactions; operate wallets; complete payouts, refunds, and support requests.
- Legal obligations: conduct KYC, AML/CFT, sanctions, tax, accounting, audit, regulatory reporting, record-keeping, and lawful authority checks.
- Legitimate interests: secure the Services, detect fraud and abuse, prevent duplicate accounts, investigate disputes, improve reliability and user experience, maintain business records, and protect users, our company, and partners, where those interests are not overridden by your rights.
- Consent: send optional marketing, use optional device permissions, or carry out processing that applicable law requires us to base on consent. You may withdraw consent at any time, without affecting processing already carried out lawfully.
- Vital interests and legal claims: protect life or safety, respond to emergencies, and establish, exercise, or defend legal claims where permitted.
5. Third-Party Services and SDKs
We use carefully selected providers only where needed to operate and protect the Services. The providers enabled in a particular app version may change. Before using a provider, we require appropriate confidentiality, security, data-processing, retention, deletion, and cross-border safeguards. Provider categories may include:
- Identity verification, KYC, AML/CFT, sanctions, and fraud-prevention providers: receive identity details, document images, selfies or liveness results, account identifiers, transaction signals, and verification outcomes to verify identity and manage compliance risk.
- Banks, payment, wallet, and payout providers: receive identity, beneficiary, bank or payout details, amounts, references, and status information to process or reconcile payments, withdrawals, refunds, and related checks.
- Gift-card verification and transaction partners: receive relevant card brand, denomination, country, images or codes, order identifiers, and fraud signals to validate cards and complete transactions.
- Cloud hosting, storage, content delivery, database, backup, and cybersecurity providers: process account, transaction, uploaded-content, technical, and log data to host, deliver, back up, monitor, and secure the Services.
- Analytics and crash-reporting providers: process app version, device and app identifiers, usage events, diagnostics, and crash data to measure performance and fix errors. We do not permit these providers to use GooseCard data for their own targeted advertising unless separately disclosed and consented to.
- Customer-support, email, SMS, and push-notification providers: process contact details, notification tokens, message content, and service events to deliver communications and support.
Our app-store Data Safety and App Privacy disclosures must reflect the providers and SDKs actually included in the released application. You may request information about currently active provider categories by contacting us.
6. Other Disclosures and No Sale of Data
We may also disclose personal data to professional advisers, auditors, insurers, affiliates, and competent public authorities where necessary to comply with law, investigate misconduct, resolve disputes, or protect rights, safety, or property. Data may be disclosed in connection with a merger, financing, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality and continuity protections.
We do not sell personal data. We do not share personal data with third parties for their own cross-context behavioural advertising without a separate, clear disclosure and any consent required by law or platform policy.
7. International Data Transfers
We are established in Malaysia and provide services involving users and providers in Nigeria and potentially other countries. Personal data may therefore be processed outside the country where you live. Before a cross-border transfer, we identify the recipient, data categories, purpose, destination, and applicable transfer condition.
Depending on applicable law, safeguards may include an adequacy or comparable-law assessment, a transfer impact assessment, contractual data-protection clauses, binding provider obligations, recognised certification, necessity to perform a contract or comply with law, or your informed consent. We require recipients and processors to protect personal data to a standard consistent with this Policy and applicable law.
8. Retention
We retain data only for as long as reasonably necessary for the stated purpose, then delete, anonymise, or securely isolate it. Our general retention targets are:
- Account and profile records: while the account is active and generally up to 5 years after closure where needed for legal, fraud, dispute, or audit purposes.
- KYC, AML/CFT, transaction, payout, tax, and accounting records: generally 5 years after the relevant transaction or end of the business relationship, or longer if applicable law, a regulator, or a legal hold requires it.
- Gift-card images and codes: only for verification, settlement, fraud, and dispute purposes; normally deleted or access-restricted within 180 days after completion, unless a dispute, investigation, or legal requirement requires longer retention. Transaction metadata may be retained for the longer period above.
- Security, device, diagnostic, and server logs: generally up to 12 months, unless needed to investigate fraud, abuse, or a security incident.
- Support and complaint records: generally up to 3 years after the matter is closed.
- Marketing data: until you opt out or the information becomes unnecessary; we may retain a minimal suppression record to honour your opt-out.
Backups may retain data for a limited rolling period before secure overwriting. Where deletion is not immediately possible, we restrict further use until deletion occurs.
9. Your Rights and Controls
Subject to applicable law, you may:
- be informed about processing and request access to your personal data;
- request correction of inaccurate, incomplete, outdated, or misleading data;
- request deletion or restriction of processing;
- object to processing based on legitimate interests or for direct marketing;
- withdraw consent as easily as it was given;
- request a portable copy of eligible data in a commonly used electronic format;
- request human review of certain automated decisions and provide additional information; and
- lodge a complaint with us or a competent supervisory authority.
To exercise a right, email support@goosecard.cn. We may verify your identity, clarify the request, and retain a record of our response. Rights may be limited where retention or processing is required by law, necessary to protect another person's rights, or subject to another lawful exception.
10. Account and Data Deletion
You may request deletion through the in-app account-deletion option, our Account Deletion page, or by emailing us. Deletion permanently removes access to the account and deletes or anonymises eligible personal data. It is not the same as temporary suspension or deactivation.
Before deletion, we may ask you to verify account ownership, complete or cancel pending transactions, and withdraw remaining funds. We may retain limited KYC, AML/CFT, transaction, fraud, tax, dispute, or legal records for the periods explained above. Retained records are access-restricted and are not used for unrelated purposes.
11. Automated Checks and Profiling
We and our authorised providers may use automated tools to verify identity or documents, detect duplicate accounts, assess transaction and gift-card risk, identify fraud or sanctions concerns, and prioritise manual review. These tools may produce a verification result, risk flag, delay, request for more information, or temporary restriction.
Where a decision produces a legal or similarly significant effect and applicable law gives you the right, you may request human review, express your view, and challenge the result by contacting support.
12. Security and Data Breaches
We use technical and organisational safeguards appropriate to the sensitivity and risk of the data. These include HTTPS/TLS for data in transit, encryption or tokenisation where appropriate, protected password credentials, role-based access, least-privilege controls, logging and monitoring, backups, vendor due diligence, staff confidentiality obligations, and incident-response procedures.
No system is completely secure. If a personal-data breach creates a risk requiring notification, we will notify the relevant regulator and affected individuals within the period required by applicable law and provide information about the incident and protective steps.
13. Children
The Services are intended only for persons aged 18 or older. We do not knowingly create accounts for or collect personal data from children. If you believe a child has provided data to us, contact us so we can investigate and delete it where appropriate.
14. Website Technologies and Third-Party Links
Our websites may use essential local storage, cookies, or similar technologies for language preferences, security, sessions, and functionality. If non-essential analytics or advertising technologies are introduced, we will provide any notice and consent controls required by law. The Services may link to third-party sites or apps; their independent privacy practices are governed by their own policies.
15. Updates, Contact, and Complaints
We may update this Policy to reflect changes in our Services, providers, laws, or data practices. We will post the revised version at this URL, update the effective date, and provide additional notice in the app or by another appropriate channel for material changes.
S-07-03, Setia Triangle, Persiaran Kelicap, 11900 Bayan Lepas, Pulau Pinang, Malaysia
If we do not resolve your concern, you may complain to the Personal Data Protection Commissioner of Malaysia, the Nigeria Data Protection Commission, or another competent authority in your jurisdiction.