Privacy Policy

1. Who We Are

Tapat (“we,” “us,” “our”) is a remittance service that helps Filipino migrant workers in Hong Kong send money home to the Philippines. We operate through our website at tapat.com.ph, our chatbot on Facebook Messenger (powered by ManyChat), and related applications and services.

Tapat is applying for a Money Service Operator (MSO) license from the Hong Kong Customs and Excise Department under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and what rights you have. It applies to all interactions with Tapat, whether through our website, Facebook Messenger, Facebook Login, or any other channel.

2. Information We Collect

2.1 Personal and Identity Information

When you register with Tapat or use our services, we collect:

• Full name (in English and Filipino/local script)
• Date of birth
• Hong Kong Identity Card (HKID) number
• Philippine passport number
• Phone number (Hong Kong)
• Photo or selfie (for identity verification / KYC)
• Employment details (employer name, employer address, employment contract dates)
• Home address in the Philippines

2.2 Financial and Transaction Information

• Remittance transaction history (amounts, dates, exchange rates, status)
• Recipient details (name, relationship to you, GCash number, Maya number, bank account details, or preferred cash pickup location)
• Payment method details (FPS reference, bank transfer reference numbers)

2.3 Facebook and Messenger Data

When you interact with us through Facebook Messenger or log in with Facebook, we may collect:

• Facebook User ID and profile name
• Profile picture (public)
• Email address associated with your Facebook account (if you grant permission)
• Conversation history with the Tapat chatbot on Messenger
• Message timestamps
• Preferences and selections you express during chat conversations
• Locale and language preferences from your Facebook profile

When you interact with our Messenger chatbot, you are communicating with an automated system. If a human agent joins the conversation, we will let you know. You can block or mute our Messenger bot at any time through the Messenger app.

2.4 Device and Technical Information

• IP address
• Device type and operating system
• Browser type and version
• Pages visited on tapat.com.ph and time spent
• Referring URL

2.5 Cookies and Tracking Technologies

Our website uses:

• Essential cookies for site functionality (session management, security)
• Facebook Pixel (Meta Pixel), which collects data about page views, button clicks, and other events on our website. This data is sent to Meta/Facebook to measure the effectiveness of our advertising, build audiences for ad targeting, and optimize ad delivery. The Pixel may place cookies on your browser.
• Meta Conversions API, which sends event data (such as page views, sign-ups, and transaction completions) from our server to Meta. This data is hashed using SHA-256 before transmission.

You can manage cookies through your browser settings. You can opt out of Facebook ad targeting based on your activity on our website by adjusting your Facebook Ad Preferences. See also Meta’s Cookie Policy and Meta’s Privacy Policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Processing transactions: To send your money to the Philippines through our partner networks (GCash, Maya, banks, cash pickup locations)
• Identity verification and KYC: To verify your identity as required by Hong Kong law (AMLO) and Philippine regulations before you can send money
• Anti-money laundering (AML) compliance: To screen transactions for suspicious activity, comply with sanctions, and file reports as required by the Hong Kong Customs and Excise Department and the Joint Financial Intelligence Unit
• Customer support: To respond to your questions and resolve issues through Messenger or other channels
• Service improvement: To understand how people use Tapat and make it better
• Fraud prevention: To detect and prevent fraudulent transactions and unauthorized use of our service
• Advertising and marketing: To show you relevant ads on Facebook and Instagram, measure ad performance, and send you promotional messages (only with your consent, and you can opt out at any time)
• Legal obligations: To comply with applicable laws, regulations, and lawful government requests

4. How We Share Your Information

We do not sell your personal data. We share it only when necessary for the purposes described in this policy:

4.1 Remittance and Payment Partners

We share recipient details and transaction information with our partners in the Philippines (such as GCash, Maya, banks, and cash pickup networks) so they can complete the delivery of your remittance.

4.2 KYC and Verification Providers

We share identity documents and personal information with third-party identity verification services to confirm your identity as required by law.

4.3 Regulatory and Law Enforcement Authorities

We may disclose personal data to:

• Hong Kong Customs and Excise Department (C&ED), which supervises licensed money service operators
• Joint Financial Intelligence Unit (JFIU) for suspicious transaction reports
• Hong Kong Monetary Authority (HKMA), if required
• Bangko Sentral ng Pilipinas (BSP) and the Anti-Money Laundering Council (AMLC) in the Philippines, as required by Philippine law
• Other government or regulatory bodies when required by law or court order

4.4 Meta / Facebook

When you use our Messenger chatbot, Meta processes certain data as part of the Messenger Platform (see Meta’s Privacy Policy). We also share event data with Meta through the Facebook Pixel and Conversions API to measure advertising effectiveness and optimize ad delivery. This data may be used by Meta for its own purposes as described in Meta’s Privacy Policy. We do not share your financial transaction details, KYC documents, or HKID/passport numbers with Meta.

4.5 Service Providers

We use third-party service providers for cloud hosting, data storage, analytics, and communication tools. These providers process data on our behalf under contractual confidentiality obligations and may not use your data for their own purposes.

4.6 ManyChat

Our Messenger chatbot is built on ManyChat. ManyChat processes message data as a data processor on our behalf. See ManyChat’s Privacy Policy for details on how they handle data.

5. Legal Basis for Processing

We process your personal data on the following grounds:

• Contractual necessity: Processing your remittance transactions and providing the service you requested
• Legal obligation: Complying with the AMLO, PDPO, and other applicable laws that require us to verify your identity, monitor transactions, and retain records
• Consent: Sending you marketing messages, placing non-essential cookies, and collecting certain Facebook profile data. You can withdraw consent at any time (see Section 8)
• Legitimate interest: Fraud prevention, service improvement, and protecting the security of our systems

6. Data Security

We protect your data using:

• Encryption in transit (TLS/HTTPS) and at rest
• Access controls limiting who within Tapat can view sensitive data
• Secure cloud infrastructure with regular security reviews
• SHA-256 hashing of personally identifiable information before transmission to Meta via the Conversions API

No system is 100% secure. We take reasonable and appropriate measures to safeguard your data against unauthorized access, alteration, disclosure, or destruction, but we cannot guarantee absolute security.

7. Data Retention

We keep your data for as long as necessary to fulfill the purposes described in this policy, subject to the following minimum retention periods required by law:

When data is no longer needed, we delete or anonymize it. Some data may be retained in backups for a limited period before being purged.

8. Your Rights

Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO, Cap. 486) and Meta’s Platform Terms, you have the following rights:

8.1 Access Your Data

You can request a copy of the personal data we hold about you. We will respond within 40 days as required by the PDPO. We may charge a reasonable fee to cover the cost of providing this information.

8.2 Correct Your Data

If any personal data we hold about you is inaccurate, you can ask us to correct it.

8.3 Request Deletion of Your Data

You can request that we delete your personal data. We will delete data that is not subject to a legal retention requirement. Please note:

• Transaction records and KYC documents must be retained for 6 years under AMLO, so we cannot delete these until the retention period expires, even if you close your account.
• Data already shared with regulatory authorities or remittance partners cannot be recalled.
• Data processed by Meta is subject to Meta’s own data deletion policies.

To request deletion, email us at privacy@tapat.com.ph or message us on Messenger. We will confirm your request within 30 days and complete deletion of eligible data within 90 days.

8.4 Opt Out of Marketing

You can opt out of marketing messages at any time by:

• Typing “STOP” in our Messenger chat
• Clicking the unsubscribe link in any promotional message
• Emailing privacy@tapat.com.ph

Opting out of marketing will not affect transactional messages (such as transaction confirmations and security alerts).

8.5 Withdraw Consent for Messenger

You can stop interacting with our Messenger chatbot at any time by blocking or muting the Tapat page in Messenger. This will stop all future messages from us through that channel. You can still use other Tapat channels (website, email) to manage your account and transactions.

8.6 Manage Facebook Ad Preferences

You can control how your data is used for ad targeting by visiting your Facebook Ad Preferences. You can also opt out of interest-based advertising through the Digital Advertising Alliance.

9. Facebook Login

If you use Facebook Login to sign in to Tapat, we request access to the following information from your Facebook profile:

• Public profile (name, profile picture): To identify you within Tapat and personalize your experience
• Email address: To contact you about your account and transactions if Messenger is unavailable

We only request permissions that are necessary to provide the service. We do not post to your Facebook timeline, access your friends list, or read your Facebook messages outside of the Tapat Messenger conversation. You can revoke Tapat’s access to your Facebook data at any time through your Facebook App Settings.

10. International Data Transfers

Your data may be transferred to and processed in countries outside Hong Kong, including the Philippines (for remittance delivery and regulatory compliance) and the United States (where Meta and some of our cloud service providers are based). We take steps to ensure that any transfer of personal data complies with applicable data protection laws and that your data receives an adequate level of protection through contractual safeguards.

11. Children’s Privacy

Tapat is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@tapat.com.ph and we will delete it.

12. Third-Party Links and Services

Our website and Messenger chatbot may contain links to third-party websites or services (such as GCash, Maya, or Meta). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing them with your personal data.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Notify you through our Messenger chatbot or website
• Where required by law, obtain your consent before applying changes that affect how we process your existing data

14. Contact Us

If you have questions or concerns about this Privacy Policy, your personal data, or if you want to exercise any of your rights described above:

• Email: privacy@tapat.com.ph
• Facebook Messenger: @TapatPay

If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong at www.pcpd.org.hk.