Privacy Policy

Wonder’s Privacy Policy describes how we collect, use, and disclose your personal information. It also explains your rights and choices in relation to your personal data, including how you can access, update, or object to certain uses of your information.
This Privacy Policy applies to any user of our Services and any visitor to our website, mobile application, or other channels (collectively, the “Sites”). This Policy does not apply to third-party websites, products, or services, even if they are linked to or provided in connection with our Services.
Here are some important definitions to help you understand our terms and this Privacy Policy:
  • “Wonder”, “we”, “us”, or “our” refers to Bindo Labs Limited (hereafter called “Bindo”, “the Company”) Bindo is the underlying legal entity, and ‘Wonder’ is the operating name used for Hong Kong operations.
  • “Services” means the Wonder platform and all related products and services provided by Wonder, including but not limited to the Wonder App, Wonder Dashboard, Wonder Terminal, Wonder Website, and any associated technologies, APIs, or functionalities.
  • “Sites” means our website, mobile application, and any other digital platforms through which we provide our Services.
  • “Personal Information” means any information that identifies or relates to an individual.
Your personal information is stored and maintained by Bindo Labs Limited at:
Suite 05-181, 5/F, The Quayside77
Hoi Bun Road, Kwun Tong
Kowloon, Hong Kong.
1. Legal Basis to Collect and Process Personal Data
We must have a legal basis (a valid legal reason) for collecting and processing your personal data. Our legal basis for processing personal data includes:

(a) the performance of a contract with you;
(b) compliance with legal and regulatory obligations;
(c) your consent, where required; and
(d) our legitimate interests in operating and improving our Services, provided such interests do not override your rights.
The key principles of privacy and personal data protection in Hong Kong are set out in the Personal Data (Privacy) Ordinance (PDPO) (Cap. 486). The PDPO establishes six Data Protection Principles (DPPs), which form the foundation of personal data compliance in Hong Kong. Below is a summary of each of the six Data Protection Principles under the PDPO:
DPP1 – Purpose and Collection of Personal Data
Personal data must be collected for a lawful purpose directly related to the data user’s functions or activities, and the collection must be necessary and not excessive. The data must be obtained by lawful and fair means, and individuals must be informed of the purpose of collection, how the data will be used, whether provision is mandatory or voluntary, and their rights to access and correct the data.
DPP2 – Accuracy and Retention
Personal data must be accurate, up-to-date, and not misleading, with reasonable steps taken to ensure its correctness. Data should not be retained longer than necessary for the purpose for which it was collected and must be securely deleted once it is no longer required.
DPP3 – Use of Personal Data
Personal data may only be used for the purpose for which it was originally collected or a directly related purpose. If the data is to be used for a new purpose, the data user must obtain the prescribed (express and voluntary) consent of the individual concerned.
DPP4 – Security of Personal Data
Data users must take all practicable steps to protect personal data against unauthorized or accidental access, processing, erasure, loss, or use. Appropriate security safeguards: physical, technical, and organizational must be implemented based on the sensitivity of the data and the potential harm that could result from a breach.
DPP5 – Openness and Transparency
Organizations must be transparent about their personal data practices by maintaining a clear and accessible privacy policy. This policy should describe the types of personal data held, the main purposes for which it is used, and how individuals can request access to or correction of their data.
DPP6 – Access and Correction
Individuals have the right to request access to their personal data and to request corrections if the data is inaccurate. Data users are required to respond to such requests within the statutory timeframe and must provide the requested data unless a lawful exemption applies.
2. Who This Policy Applies To
We will collect personal data from our customers and other individuals in connection with the purposes set out in this Privacy Policy. These customers and other individuals may include the following, and we refer to them collectively as “you/your” in this Privacy Policy:
  • applicants or account-holders of Wonder products or Services;
  • customers; and
  • any third party transacting with or through us.
3. What Personal Data We Collect
  • When registering or creating an account with Wonder, we will collect information such as your name, phone number, physical address, email address and other information reasonably required to verify your identity, maintain account security, and verify and control access to your account.
  • For complete access to Wonder’s services, we may collect additional information about you and the business parties you have affiliations with including but not limited to:
    (i) Name, address, phone number, email address, date of birth, your photos, nationality, information for the verification of identity – including identification document type and identification number – and additional information that may be required for identity/account authentication
    (ii) Tax ID number
    (iii) Details of your company’s bank account including account number, sort code and IBAN
  • Wonder will also collect information about you from publicly available sources such as official registers and databases as well selected social media websites or apps to carry out our due diligence checks. In addition, we collect information from media stories and websites to ensure your business is legitimate and to verify screening results.
  • We may also collect information about you from affiliates (by “affiliates” we mean other companies that Wonder has a contractual relationship with) who provide us with services such as “name screening” and biometric data capturing in order to help verify your identity which, in turn, allows us to improve the safety of our services. This includes being able to detect and respond quickly to any fraud or security risks.
  • You acknowledge and agree that, where information relating to other parties is disclosed to Wonder by you, you have provided a copy of this Privacy Policy to such parties prior to your disclosure of their information to Wonder, and you have obtained all relevant consents from such parties for the use of their information in the manner as described in this Privacy Policy. You further represent and warrant that you have complied with the requirements of all Applicable Laws with respect to such information and its use by us for the purposes set out herein.
  • We may also collect information directly or indirectly from your transactions with or through Wonder in the ordinary course of our business. This may include transaction data, information relating to deposits made or transactions executed through your Wonder App Card or other Wonder products and services, and information about your spending and saving behaviour.
  • We may also collect payment-related information if you make purchases or payments through our Services, including billing details and payment instrument information. Where payment card information is collected, it is used only as necessary to process and authorise transactions and is handled in accordance with applicable security standards.
  • We may also collect information through your use of our Services (our application, dashboard, terminal, website, or other platforms), including usage data, cookies, and data obtained through behavioural or location tracking technologies.
  • We may also store and use communications you send to us, including feedback, complaints, questions, or support requests, in order to respond to you, investigate issues, and improve our Services.
  • We may also collect and process biometric data, including facial images or facial recognition data, for the purpose of identity verification, fraud prevention, and security. Face data is collected solely to verify your identity and protect your account from unauthorised access. This data is not used for profiling, marketing, or any unrelated purposes. Face data is retained only for as long as necessary to fulfil these purposes and to comply with applicable legal and regulatory obligations. This means face data will be retained for the duration of your relationship with Wonder and for up to seven years thereafter, in line with anti-money laundering and regulatory record-keeping requirements. Face data is not stored indefinitely and will be securely deleted once it is no longer required. a globally recognized leader in AI-powered identity verification and fraud prevention. Jumio is trusted by major financial institutions and technology companies worldwide, and holds key security certifications including ISO 27001, SOC 2 Type 2, and PCI DSS. Jumio processes and stores face data on our behalf in accordance with its own privacy and data retention policies and applicable data protection laws. Jumio may retain face data for as long as necessary to provide identity verification services to Wonder and to comply with its legal and regulatory obligations, after which such data is securely deleted or anonymised in accordance with its retention policies. Jumio is contractually required to implement appropriate technical and organisational measures to protect face data and may only use such data for identity verification, fraud prevention, and compliance purposes.
  • We may also store, display, and use any reviews, feedback, comments, or other content that you submit through our Services which is intended to be visible to others, in connection with operating and promoting our Services. You should avoid including unnecessary personal information in such content, as it may be visible to other users.
  • We may also receive information about you from third-party services if you choose to link your Wonder account with such services or import contacts from another platform, in accordance with your settings and the permissions you grant. We may use this information to help you connect with others, personalise your experience, and provide relevant features within our Services.
4. How We Use Your Personal Data
Wonder collects and uses your personal data for purposes connected with providing, operating, and improving our Services.

This includes processing and assessing your application for Wonder products and services, conducting Know Your Customer (KYC) and customer due diligence procedures, setting up and administering your account, facilitating transactions, and communicating with you in relation to your account and our Services.

We may use your personal data for internal operational purposes, including credit risk assessment, fraud prevention and detection, investigation of complaints, suspicious activities or failed transactions, audit, insurance, testing, analysis, system development, and service improvement. This also includes designing new products or enhancing existing services.

Your personal data may also be used to manage and enforce our rights and your rights under the Customer Agreement, collect monies owed, and support the ongoing management, operation, and maintenance of our Services.

We may also use your personal data to meet our legal, regulatory, and compliance obligations. This includes complying with applicable laws, regulations, guidelines, and requirements imposed by legal, regulatory, governmental, tax, law enforcement, or industry authorities, whether in Hong Kong or elsewhere. It also includes responding to investigations, requests, or demands from such authorities, as well as complying with contractual obligations with partner banks, financial institutions, marketplaces, and service providers.

In addition, your personal data may be used in connection with legal or regulatory proceedings, obtaining professional advice, establishing, exercising, or defending legal rights, investigating insurance-related matters, and evaluating any actual or proposed transfer of our business or assets.

We may also use your personal data to organise and deliver seminars, events, or communications, and to monitor and assess the performance of our service providers, agents, and contractors.

Where permitted by applicable law, we may use your personal data to send you information about relevant products, services, events, or other subjects.

You may opt out of receiving such communications at any time.We may also use information provided by you to compile aggregated or anonymised statistics and insights to help us better understand our customers and improve our Services.

If we intend to use your personal data for any purpose not described in this Privacy Policy, we will notify you and obtain your consent where required by applicable law.
5. Cookies, Tracking and Advertising
Wonder may, at its discretion, partner with third parties to either display advertising in our Services, including our application and website, or to manage Wonder’s advertising on other sites. Our third-party partners may use technologies such as cookies to gather information about your activities while using the application or website and other sites in order to provide you advertising based on your browsing activities and interests.

We may also use analytics and advertising tools provided by third parties, including tools that help us measure visits, conversions, and user interactions with our Services. This may include the use of third-party services such as Google Ads conversion tracking to help us understand website traffic, measure the effectiveness of our campaigns, and improve our Services.

In addition, Wonder automatically gathers and stores in log files certain information, such as Internet Protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and/or clickstream data. Wonder does not link this automatically-collected data to other information we collect about you. Wonder, as well as our third-party partners, may use local storage to store content information and preferences.
6. Disclosure of Information
We will safeguard the information collected from you in accordance with the laws and regulations applicable in the Hong Kong Special Administrative Region. Subject to our obligations under applicable law, and for the purposes set out in this Privacy Policy, we may transfer or disclose your Personal Information to the following parties:
  • our partner banks, merchant acquiring companies, financial institutions, insurers, credit card companies, securities and investment service providers, and other financial services companies;
  • marketplaces, e-commerce platforms, and other counterparties with whom you conduct business, in order to facilitate your transactions and the disbursement of proceeds;
  • our agents, contractors, service providers, and professional advisers under a duty of confidentiality to us who provide administrative, telecommunications, identity verification / know-your-customer, computer, payment, transaction processing, cloud storage, data processing, data analytics, cybersecurity, securities clearing, marketing, audit, professional advisory, or other services to us in connection with the operation of our business or the provision of our Services;
  • our affiliates and any person who owes a duty of confidentiality to us;
  • our employees and any person who works for us or provides services to us;
  • auditors, internal risk teams, and other persons supporting our audit, compliance, corporate governance, fraud prevention, risk management, or suspicious activity monitoring functions;
  • any interface, including an application programming interface, that links to, or otherwise makes available, information about our products or services;
  • reward, loyalty, co-branding, and privileges programme providers, and our co-branding partners;
  • charitable or non-profit making organisations, where relevant;
  • any actual or proposed assignee, transferee, participant, sub-participant, or purchaser of all or any part of our business, assets, or rights;
  • any law enforcement agencies, judicial authorities, regulatory bodies, governmental authorities, tax authorities, self-regulatory bodies, industry associations, or any person or entity to whom we have an obligation under Applicable Laws, regulations, guidelines, investigations, demands, or requests to disclose information, provided that such disclosure is made under proper authority;
  • any shareholder of Wonder and their affiliates, and any person who works for or provides services to them, where permitted by law;
  • other Wonder customers where disclosure is necessary in connection with your use of Wonder products or services; and
  • any other person where the public interest requires such disclosure or where you have given your express or implied consent.
Your Personal Information may be transferred to, stored in, or processed in jurisdictions outside Hong Kong, including jurisdictions that may have different data protection laws from those in your home country. Personal Information may also be processed by persons operating outside Hong Kong on behalf of Wonder, our affiliates, or our service providers for transaction processing, payment detail verification, storage, and other Services-related support.

Wonder will take commercially reasonable steps to ensure that any Personal Information disclosed is treated securely and in accordance with this Privacy Policy, whether within or outside Hong Kong.

By using our Services or submitting your Personal Information to us, you consent to such transfer, storage, and processing in accordance with this Privacy Policy and applicable law.
7. Direct Marketing
We would like to use your data in direct marketing and we require your consent (which includes an indication of no objection) for that purpose. The data that we may use in direct marketing includes:
  • your name and contact details;
  • your demographic data;
  • the products and services provided to you by Wonder App, or any Shareholder;
  • your saving and spending patterns and behaviour; and
  • your financial background.

We may directly market the following classes of services, products, and subjects:
  • financial, fiduciary, banking and related services and products;
  • reward, loyalty or privileges programs and related services and products;
  • services and products offered by any Shareholder;
  • services and products offered by our co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
  • donations and contributions for charitable and/or non-profit making purposes.

Along with us, the following persons may provide or solicit (in the case of donations and contributions) the above services, products and subjects:
  • third party financial institutions;
  • third party reward, loyalty, co-branding or privileges program providers;
  • our co-branding partners; and
  • charitable or non-profit making organisations.
We may also provide your data to any of these people for them to use in directly marketing the same services, products and subjects to you. Wonder App will always first obtain your consent (which includes an indication of no objection) for that purpose. We may receive money or other property in return for providing your data to these other persons, but we’ll tell you if this is the case when obtaining your consent.

You can change your mind about giving consent for us to use or provide to other persons your data for use in direct marketing, as set out above. Just let us know at any time.
8. Accuracy of Information
Wonder will make reasonable efforts to ensure that your personal data is sufficiently accurate, complete, and up to date to minimise the possibility that inappropriate information may be used to make a decision about you. Wonder will not routinely update your personal data unless such updating is necessary to fulfil the purposes for which the information was collected. You are responsible for notifying us as soon as possible if any of the information you have provided to us changes.
9. Access, Correction and Your Rights
Subject to applicable law, you have the right to request access to the personal data we hold about you, request correction of inaccurate personal data, withdraw any consent previously given in relation to the use of your personal data, understand our policies and practices relating to personal data, and be informed of the types of personal data we hold.

If you wish to exercise any of these rights, please contact us via the Wonder App, by email at support@wonder.app, or by post to:

Data Protection Officer
Suite 05-181, 5/F, The Quayside
77 Hoi Bun Road, Kwun Tong
Hong Kong

We may charge a reasonable fee for processing a data access request where permitted by law. We will not charge a fee unless you request that a paper copy be sent to you.
10. Security and Retention
We take the security of your personal data seriously and use technical and organisational measures to safeguard it, including personal data in transit and in storage. These measures are designed to protect the confidentiality and integrity of your personal data and to prevent unauthorised access, use, loss, disclosure, or leakage. Personal data may be encrypted using strong encryption standards and protected through appropriate key management practices. Where we engage external service providers, we require them to follow security standards mandated by us where applicable.

Please note that the Internet, including applications that use the Internet for data transfer, may not always be a secure means of communication. Sending personal data over the Internet may involve risks, including access or interference by unauthorised third parties, and information transmitted over the Internet may pass through jurisdictions with different data protection laws.

Wonder retains personal data in accordance with applicable legal and regulatory requirements and for business and operational purposes. In most cases, we retain personal data for up to seven years after the end of your relationship with us. You may request deletion of some or all of your personal data earlier, but we may only comply where we have no legal or regulatory obligation to retain the data and where the data is no longer required for the provision of any service you continue to use. If we cannot delete your personal data promptly after your request, we will inform you accordingly.

We may also record and monitor electronic communications with you to ensure compliance with legal and regulatory obligations and internal policies.
11. Contact
If you have any questions about this Privacy Policy, our privacy practices, or your personal data, or if you wish to make a complaint or exercise your rights, please contact us at:

Email: compliance@wonder.app or support@wonder.app

By post:
Data Protection Officer
Suite 05-181, 5/F, The Quayside
77 Hoi Bun Road, Kwun Tong
Hong Kong
12. General
This Privacy Policy is provided in accordance with Hong Kong’s Personal Data (Privacy) Ordinance and, where applicable, the Code of Practice on Consumer Credit Data.

Wonder Singapore
Data Privacy Notice

Effective Date: 17 March 2026

Who We Are

This Privacy Notice applies to the following Singapore-incorporated entities operating under the Wonder brand:

Entity

UEN / Registration

Wonder Tech Singapore Pte. Ltd.

202515097W

Wonder Tech Capital Pte. Ltd.

202548289Z

Bindo Pte. Ltd.

202217737E

References to “Wonder SG”, “we”, “us” or “our” in this Notice refer to the specific entity responsible for collecting and handling your personal data in connection with the services you use.
Wonder Tech Singapore Pte. Ltd. and Wonder Tech Capital Pte. Ltd. are wholly-owned subsidiaries of Wonder Group Holdings Limited (BVI), which is in turn majority-owned by Universal Intelligence Holdings Limited (BVI). Bindo Pte. Ltd. is a wholly-owned subsidiary of Bindo Labs Group Limited (Cayman Islands). All three entities operate under the Wonder brand in Singapore.

1.  About This Notice

This Data Privacy Notice ("Notice") explains how Wonder SG collects, uses, discloses, and protects personal data relating to our merchants, customers, cardholders, website visitors, job applicants, and other individuals who interact with us (collectively "you" or "individuals").
This Notice applies to personal data collected through:
(a) our websites, including wonder.app/en-sg and related sub-domains;
(b) our mobile applications;
(c) our payment processing and financial technology platforms;
(d) our customer service channels; and
(e) any other interaction between you and Wonder SG.
By accessing our website, submitting your personal data, or using our products and services, you acknowledge that you have read this Notice and understood how we handle your personal data as described in this Notice.
This Notice should be read together with any product-specific notices or terms and conditions that may be provided to you at the point of collection of your personal data. In the event of any conflict, the more specific notice shall prevail.

2.  Definitions

In this Notice, unless the context otherwise requires:
  • "Personal Data" has the meaning given to it under the Personal Data Protection Act 2012 ("PDPA"), and refers to data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.
  • "PDPA" means the Personal Data Protection Act 2012 of Singapore (No. 26 of 2012), as amended or re-enacted from time to time, including all subsidiary legislation made thereunder.
  • "PDPC" means the Personal Data Protection Commission of Singapore, the regulatory authority responsible for administering and enforcing the PDPA.
  • "DPO" means Data Protection Officer, the designated individual responsible for overseeing data protection compliance within Wonder SG.
  • "Platform" means Wonder SG's payment processing, e-wallet, financial technology services, merchant dashboard, and all related services."Services" means all products and services provided by Wonder SG, including but not limited to the Wonder App, Wonder Terminal, Wonder Card, Wonder Dashboard, Wonder SoftPOS, and Wonder Transit X.
  • "Services" means all products and services provided by Wonder SG, including but not limited to the Wonder App, Wonder Terminal, Wonder Card, Wonder Dashboard, Wonder SoftPOS, and Wonder Transit X.
3.  Personal Data We Collect
The categories of personal data we collect will depend on your relationship with us and the services you use. We collect only the minimum personal data necessary for the relevant purpose.

Category of Personal Data

Examples

Identity Information

Full name, aliases, NRIC/FIN/Passport number, date of birth, nationality, gender, photographs.

Contact Information

Residential or business address, email address, telephone number(s), preferred communication method.

Financial Information

Bank account details, credit/debit card information, billing address, transaction history, account balances.

Payment & Transaction Data

Transaction amounts, dates and times, merchant names and identifiers, payment references, payment method details.

eKYC & Verification Data

Identity document scans, selfie/liveness check images, proof of address, business registration documents, beneficial ownership information.

Account & Login Information

Username, encrypted password, account preferences, login timestamps, device identifiers.

Usage & Technical Information

IP address, browser type and version, operating system, device identifiers, geolocation data, pages accessed, referring URLs, session duration.

Communications Data

Enquiries, complaints, feedback, live chat logs, call recordings (where applicable), emails, and other correspondence with us.

Marketing Preferences

Subscription status, communication preferences, survey responses, promotional campaign interactions.

Employment Information

CV/resume, employment history, qualifications, references (for job applicants only).

Special Categories of Personal Data
We do not intentionally collect special categories of personal data (such as race, religion, health, sexual orientation, or biometric data) unless strictly required by applicable law or regulation (e.g., mandatory anti-money laundering checks). Where required, we will seek your explicit consent and process such data in accordance with the PDPA.
4.  How We Collect Personal Data
4.1  Directly from You
We collect personal data directly from you when you:
  • Create an account or register for our Services;
  • Complete eKYC (Know Your Customer) or onboarding processes;
  • Make or receive a payment through our Platform;
  • Scan a QR code or use any Wonder payment product;
  • Contact us via email, telephone, live chat, or in person;
  • Submit a form, survey, or application on our website or app;
  • Subscribe to our marketing communications or promotional campaigns;
  • Apply for a position at Wonder SG;
  • Provide feedback or file a complaint.
4.2  Automatically
We collect certain technical and usage data automatically when you interact with our website or Platform, including through cookies, web beacons, and similar tracking technologies (see Section 9 on Cookies).
4.3  From Third Parties
We may also receive personal data from third parties, including:
  • Merchants and business partners who refer you to our Services;
  • Financial institutions, payment networks (e.g., Visa, Mastercard), and acquiring banks involved in processing your transactions;
  • Credit bureaus and identity verification service providers (for eKYC and fraud prevention purposes);
  • Government databases and publicly available sources, to the extent permitted by law;
  • Other entities within the Wonder and Bindo corporate group, where data sharing is necessary to provide you with integrated services.
5.  Purposes for Collection, Use & Disclosure
We collect, use, and disclose your personal data only for purposes that are made known to you at the time of collection or that are reasonably expected given the nature of our services. The purposes for which we process your personal data include:
5.1  Account Management & Service Delivery
  • Creating and managing your Wonder account;
  • Providing and maintaining our payment processing services Verifying your identity and processing eKYC checks;
  • Processing payments, transfers, refunds and chargebacks;
  • Issuing Wonder Cards to eligible users;
  • Maintaining and updating our records.
5.2  Regulatory Compliance & Legal Obligations
  • Complying with the PDPA and other applicable Singapore laws;
  • Meeting requirements under the Payment Services Act 2019 ("PSA");
  • Complying with anti-money laundering ("AML"), counter-financing of terrorism ("CFT")g;
  • Responding to requests from MAS, PDPC, law enforcement or other regulatory authorities;
  • Maintaining records and audit trails as required by law.
5.3  Risk Management, Fraud Prevention & Security
  • Detecting, investigating, and preventing fraud, and other illicit activities;
  • Conducting transaction monitoring and  sanctions screening;
  • Protecting the security and integrity of our systems;
  • Enforcing our Terms and Conditions.
  • Maintaining records and audit trails as required by law.
5.4  Customer Support & Relationship Management
  • Responding to your enquiries,and complaints;
  • Notifying you of changes to our services, terms, or policies;
  • Providing technical support.
5.5  Marketing & Communications
  • Sending you information about our products, services and  promotions (only where we have obtained your consent);
  • Personalising content and communications based on your preferences;
  • Conducting market research and satisfaction surveys.
You may withdraw consent for marketing communications at any time by clicking the unsubscribe link in our emails, or by contacting our DPO at sg_dpo@bindo.com.
5.6  Analytics & Service Improvement
  • Analysing usage trends to improve our website and services;
  • Developing new features and enhancing the user experience;
  • Conducting internal research and business planning.
5.7  Corporate Transactions
  • In connection with a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the relevant counterparty, subject to equivalent data protection obligations.
6.  Disclosure of Personal Data
We do not sell or rent your personal data to third parties. We may disclose your personal data to the following categories of recipients, only to the extent necessary for the purposes described in Section 5:
6.1  Within the Wonder / Bindo Group
We may share your personal data with related corporations and affiliates within the Wonder and Bindo corporate group for the purposes of group-level reporting, audit, IT infrastructure, and providing integrated services, subject to equivalent data protection standards.
6.2  Payment Network Partners
We share relevant personal data with payment networks (e.g., Visa, Mastercard), acquiring banks, issuing banks, and other financial intermediaries as necessary to process payment transactions.
6.3  Service Providers & Vendors
We engage third-party service providers who process personal data on our behalf, including technology providers, cloud hosting services, eKYC/AML verification platforms, analytics providers, and customer support systems. We require all such providers to implement appropriate contractual and technical safeguards.
6.4  Regulatory & Law Enforcement Authorities
We may disclose personal data to MAS, PDPC, Singapore Police Force, IRAS or other government or regulatory bodies where required or permitted by law.
6.5  Professional Advisers
We may share personal data with our lawyers, auditors, and other professional advisers, subject to obligations of confidentiality.
6.6  Business Transfers
In connection with a merger, acquisition, restructuring, or transfer of all or part of our business or assets, personal data may be disclosed to prospective buyers or transferees.
7.  Cross-Border Transfers of Personal Data
In providing our services, we may transfer your personal data to countries outside Singapore. Where we do so, we comply with the requirements of the PDPA in relation to cross-border data transfers.
Countries to which we may transfer personal data include, without limitation: Hong Kong Transfers to these jurisdictions are conducted in accordance with the PDPA's and are subject to appropriate contractual safeguards
8.  Retention of Personal Data
We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. In determining the appropriate retention period, we consider:
  • Legal and regulatory obligations (e.g., AML/CFT records will  be retained for at least seven  years);
  • Contractual obligations and applicable limitation periods for legal claims;
  • Audit, accounting, and tax requirements;
  • The nature of the data and any risk associated with unauthorised use or disclosure.
When personal data is no longer required, we will take reasonable steps to destroy or anonymise it in a secure manner.
9.  Cookies & Similar Technologies
Our website and Platform use cookies and similar tracking technologies to provide a better user experience, for analytics, and for security purposes.

Category of Cookies

Purpose

Strictly necessary cookies

Essential for the website and platform to function correctly. These cannot be disabled.

Performance & analytics cookies

Help us understand how visitors use our website so we can improve functionality and content.

Functional cookies

Enable personalisation of your experience, such as remembering your language preference or log-in status.

Targeting/Marketing cookies

Used to deliver advertisements relevant to your interest. You may disable these cookies through your browser settings without affecting your use of core services.

You can manage your cookie preferences through your browser settings. For more information on how to disable or delete cookies, please refer to your browser's help documentation. Disabling certain cookies may affect the functionality of some features of our website or Platform.
10.  Security of Personal Data
We take the security of your personal data seriously. We have implemented appropriate administrative, physical, and technical measures to protect your personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks.
These measures include, but are not limited to: encryption of data in transit and at rest (including SSL/TLS protocols), access controls and role-based permissions, regular security assessments and adherence to Payment Card Industry Data Security Standard (PCI DSS) requirements where applicable.
We have also established procedures to manage personal data breaches. In the event of a notifiable data breach under the PDPA, we will notify the PDPC within three (3) calendar days of becoming aware of the breach, and affected individuals will be informed in accordance with the PDPA's breach notification obligations.
Notwithstanding the above, no security system is completely impenetrable. We cannot guarantee the absolute security of personal data transmitted to us over the internet or stored in our systems. You are encouraged to use strong, unique passwords and to exercise care when accessing our Services on public or shared networks.
11.  Your Rights Under the PDPA
Subject to the exceptions and qualifications set out in the PDPA, you have the following rights with respect to your personal data held by Wonder SG:
11.1  Right of Access
You have the right to request access to the personal data we hold about you, and to information about how such personal data has been or may have been used or disclosed by us in the year preceding your request.
11.2  Right of Correction
You have the right to request that we correct any errors or omissions in the personal data we hold about you. We will correct the data as soon as reasonably practicable, unless there are legitimate grounds under the PDPA for not doing so.
11.3  Right of Withdrawal of Consent
Where we process your personal data on the basis of consent, you may withdraw that consent at any time by written notice to our DPO. Please note that withdrawal of consent may affect our ability to continue providing certain services to you
11.4  Right to Lodge a Complaint
If you are dissatisfied with how we handle your personal data or your access/correction request, you have the right to lodge a complaint with the PDPC at www.pdpc.gov.sg.
To exercise any of the above rights, please submit a written request to our Data Protection Officer at sg_dpo@bindo.com. We will respond to your request within thirty (30) calendar days from receipt, or notify you if additional time is required. We may charge a reasonable administrative fee for access requests in accordance with the PDPA.
Please note that we may not be required to comply with access or correction requests in certain circumstances as specified in the PDPA (e.g., where complying would be contrary to national interest, threaten the safety of another individual, or relate to evaluative purposes).
12.  Minors
Our Services are not intended for persons under the age of 18 years. We do not knowingly collect personal data from minors without verified parental or guardian consent. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take prompt steps to delete such information.
If you believe that we may have collected personal data from a minor, please contact our DPO immediately at sg_dpo@bindo.com.
13.  Links to Third-Party Websites
Our website and Platform may contain links to third-party websites and services. This Notice does not apply to such third-party websites, and we are not responsible for their data protection practices. We encourage you to review the privacy notices of any third-party sites you visit.
14.  Changes to This Notice
We may update this Notice from time to time to reflect changes in our business practices, the services we provide, or applicable laws and regulations. We will publish the updated Notice on our website at wonder.app/en-sg/privacy-policy and update the effective date accordingly.
For material changes that may significantly affect your rights or the way we process your personal data, we will endeavour to provide you with prior notice through our usual communication channels (e.g., email or in-app notification).
Your continued use of our Services following any changes to this Notice will constitute your acknowledgement of, and where applicable, consent to, such changes.
15.  How to Contact Us
If you have any questions, concerns, or requests relating to this Notice or the processing of your personal data, you may contact us at sg_dpo@bindo.com.