Privacy Policy

Controller / responsible Onerway entity

For this Singapore version, "Onerway", "we", "our", and "us" means Overcross Pte. Ltd. Where more than one Onerway group company is involved in delivering the Services, the relevant Onerway entity may act as controller, joint controller, processor, or service provider depending on the circumstances and the role it performs.

Regional rights and regulatory note

If you are in Singapore, we handle Personal Data in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA") and related guidance.

We collect, use, and disclose Personal Data with your consent or as otherwise permitted or required by applicable law. Consent may be obtained expressly or deemed to be given where you voluntarily provide Personal Data for a purpose that a reasonable person would consider appropriate in the circumstances.

You may request access to your Personal Data, request correction of your Personal Data, and withdraw your consent at any time. Upon receiving a request to withdraw consent, we will inform you of the likely consequences, including any legal or service limitations, and will cease to collect, use, or disclose your Personal Data unless required or authorised under applicable law.

Withdrawal of consent does not affect processing that was lawful before withdrawal and may affect our ability to continue providing certain Services.

We will notify individuals of the purposes for which their Personal Data will be collected, used, or disclosed at or before the time of collection, unless an exception under applicable law applies.

We make reasonable security arrangements to protect Personal Data in our possession or under our control.

1. Scope of this Privacy Policy

This Privacy Policy explains how Onerway collects, uses, shares, stores, and otherwise processes Personal Data when individuals and businesses interact with our websites, platform, products, and related services. It applies to our business-facing services, end-user services where offered, and our public websites, including where we provide payment acceptance, fund collection, payout, merchant onboarding, risk management, and related support services.

Depending on the context, Onerway may act as an organisation in its own right or process Personal Data on behalf of a Business User as a data intermediary.

2. Key Definitions

"Personal Data" means data, whether true or not, about an individual who can be identified.

"Services" means the products, services, applications, platforms, and websites we provide.

"Business Users" are merchants, platforms, or other business customers using our Services.

"End Customers" are individuals whose Personal Data we process on behalf of Business Users.

"Representatives" are individuals acting on behalf of a Business User.

"Visitors" are individuals interacting with our websites without an account.

3. Personal Data We Collect

We may collect the following categories of Personal Data, depending on your interaction with us:

• identity and contact data (e.g. name, email, phone number, address);
• transaction and payment data (e.g. payment details, transaction history, payout details);
• onboarding and verification data (e.g. identification documents, beneficial ownership, due diligence information);
• device and technical data (e.g. IP address, browser type, cookies, usage data);
• communications data (e.g. support interactions, emails, call recordings where permitted); and
• any other information provided in connection with the Services.

4. How We Collect Personal Data

We collect Personal Data:

• directly from you;
• from Business Users;
• through your use of our Services and websites;
• from service providers acting on our behalf;
• from financial institutions and payment partners; and
• from publicly available or lawfully obtained third-party sources.

5. How We Use Personal Data

We use Personal Data to:

• provide, operate, and improve the Services;
• create accounts and verify identities;
• process payments, refunds, settlements, and payouts;
• conduct transaction monitoring, fraud detection, authentication, and security controls;
• perform anti-money laundering, counter-terrorism financing, sanctions screening, and regulatory reporting obligations;
• comply with legal and regulatory requirements;
• communicate with you regarding Services and updates;
• analyse usage and improve performance;
• send marketing communications where permitted by law; and
• enforce our terms and protect our legal rights.

6. How We Share Personal Data

We may share Personal Data with:

• Onerway group entities and affiliates;
• Business Users and authorised parties;
• banks, payment networks, and financial partners;
• service providers supporting operations (e.g. hosting, analytics, compliance, support);
• professional advisers and auditors;
• regulators, law enforcement, and authorities where required; and
• parties involved in corporate transactions.

We require our service providers to implement appropriate data protection measures and to process Personal Data only in accordance with our instructions and applicable law.

7. Cookies and Similar Technologies

We use cookies and similar technologies to operate our Services, analyse usage, personalise content, and enhance security.

Where required by law, we will obtain your consent before using non-essential cookies.

8. Marketing Communications

Where permitted by law, we may send marketing communications. You may opt out at any time using the unsubscribe link or by contacting us.

We may still send service-related or legally required communications.

9. Security, Accuracy, and Retention

We implement reasonable administrative, technical, and physical safeguards to protect Personal Data.

We take reasonable steps to ensure that Personal Data is accurate, complete, and up to date where it is likely to be used to make decisions affecting individuals or disclosed to other organisations.

We retain Personal Data only as long as necessary to fulfil business or legal purposes. We will cease retention or anonymise data when it is no longer required.

10. International Transfers

Where Personal Data is transferred outside Singapore, we will ensure that the receiving organisation provides a standard of protection comparable to the PDPA.

This may include contractual safeguards, standard contractual clauses, or other recognised legal mechanisms.

11. Requests Through Business Users

Where we process Personal Data on behalf of Business Users, those users are responsible for handling data subject requests.

We may assist or redirect requests where appropriate.

12. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. Where required, we will notify you of material changes.

13. Contact Us / Data Protection Officer

We have appointed a Data Protection Officer responsible for compliance with applicable data protection laws.

For any questions or requests, please contact:

Email: dposg@onerway.com

We may require verification of identity before processing requests.

14. Data Breach Notification

In the event of a data breach that is notifiable under applicable law, we will notify the Personal Data Protection Commission of Singapore and affected individuals in accordance with the PDPA.

We maintain procedures to detect, assess, and respond to data breaches promptly.