PRIVACY POLICY

SunLoan Lending Investors Corporation (“SunLoan”), a lending corporation organized and existing in the Philippines, operating the online lending platform of “Cashola” (“Cashola”) (with SunLoan and Cashola, collectively referred to as the “Company”, “we”, “us” or “our”) takes your privacy very seriously.

Before availing our services, we recommend that you read the specific content of this Privacy Policy carefully to help you understand what information we will collect and how the information will be used. The Company will collect, store, share, use, process, and protect your Personal Information in accordance with this Privacy Policy and existing laws, rules, and regulations of the Republic of the Philippines such as the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations (“IRR”) and various issuances of the National Privacy Commission (“NPC”). The Company values your data privacy rights, and makes sure that all Personal Information collected are processed in adherence to the general principles of transparency, legitimate purpose, and proportionality.

We may amend and update this Privacy Policy from time to time, with prior written notice to you, and that if material changes are required, any material revisions to this Privacy Policy shall likewise be published on Cashola.

By accessing or availing of our products/services, it means that you have read, understood, and accepted what is described in this Privacy Policy and agreed to abide by this Privacy Policy.

SCOPE

“Personal Information” in this Privacy Policy refers to any information obtained by the Company whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual, including, but not limited to, the user’s first and last name, gender, date of birth, email address, complete address, educational attainment, marital status, profession, monthly income, payroll period, payroll date, bank account or electronic wallet information, and other information required to be provided in order for the Company to provide its services.

INFORMATION COLLECTION AND GENERAL GUIDELINES

When you visit our platform and avail of our services, in order to improve the quality of our services, we will collect your Personal Information in the following scope. We take the privacy of our users very seriously, and we can only collect your Personal Information only with your explicit consent. If you are unwilling to submit your Personal Information to us, we cannot provide our services to you. To further protect your Personal Information, a Data Privacy Officer shall be in place at all times in order to ensure that the collection of Personal Information will be in compliance with the DPA, its IRR, and the various issuances of the NPC.

Further, you shall be provided the following details in accordance with the DPA, its IRR, and various issuances of the NPC:

1. Information concerning all phases of any processing activity, which, in relation to our services, include loan solicitation, loan origination, repayment, debt collection, and remedial measures;

2. If the services entail the use of profiling, automated processing, automated decision-making, or credit rating or scoring, you shall be informed of the same before the entry of your Personal Information into the data processing system or at the next practical opportunity;

3. Pursuant to your right to information and access, the Company shall disclose the categories of data considered in deciding whether to approve or disapprove your application. Recognizing, however, that the integrity of the evaluation process and methods used must be maintained to avoid possible manipulation or exploitation of the same, the Company may implement reasonable policies determining the minimum information and manner of disclosure to you.

RIGHTS UNDER THE DPA, IRR, AND OTHER RELATED ISSUANCES

The DPA, its IRR, and other related issuances of the NPC establishe that you have the following rights as a data subject:

1. Be informed of whether your Personal Information is being or have been processed;
2. Be furnished with the following information before the entry of your Personal Information into the processing system of the Company, or at the next practical opportunity:
   1. Description of the Personal Information to be entered into the system;
   2. Purposes for which they are being or are to be processed;
   3. Scope and method of the Personal Information processing;
   4. Recipients or classes of recipients to whom the Personal Information are or may be disclosed;
   5. Methods utilized for automated access and the extent to which such access is authorized;
   6. The identity and contact details of the personal information controller (“PIC”) and our representative;
   7. The period for which the Personal Information will be stored;
   8. The existence of your rights, including the right to access, correction, and lodging of complaints before the NPC;
3. Reasonable access to, upon demand, the following:
   1. Contents of your Personal Information that were processed;
   2. Sources from which Personal Information were obtained;
   3. Names and addresses of recipients of the Personal Information;
   4. Manner by which Personal Information were processed;
   5. Reasons for the disclosure of the Personal Information to recipients;
   6. Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;
   7. Date when the Personal Information were last accessed and modified; and
   8. The designation, or name or identity and address of the PIC;
4. Dispute the inaccuracy or error in the Personal Information and have the PIC correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable. If the Personal Information have been corrected, the PIC shall ensure the accessibility of both the new and the retracted information and the simultaneous receipt of the new and the retracted information by recipients thereof: Provided, That the third parties who have previously received such processed Personal Information shall he informed of its inaccuracy and its rectification upon reasonable request of the data subject;
5. Suspend, withdraw or order the blocking, removal or destruction of the Personal Information from the PIC’s filing system upon discovery and substantial proof that the Personal Information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. In this case, the PIC may notify third parties who have previously received such processed Personal Information; and
6. Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of Personal Information.
7. Right to Data Portability

1. Personal Information provided by users while users are registering an account

We are committed to encrypting and ensuring the security of the Personal Information collected during the registration of account. Collection and processing of your Personal Information by the Company is necessary for the provision of Company’s products and services and to comply with applicable legal and regulatory requirements to which you and the Company is subject. Apart from such cases, we do not collect Personal Information without your specific and explicit prior consent.

We will store all your information in the Philippines.

1. Information Collected by us while users are using the app

1. Image Information

We will collect photos taken by users during the loan application process and photos actively selected and uploaded by customers for KYC verification and anti-fraud inspection purposes only. We will not access, retrieve and collect any other photos from your device's gallery.

We are committed to encrypting the information and ensuring the security of the information.  This information will be encrypted.

2. Camera Information

We need permission from the camera information to take documents and pictures for loan applications needed and perform face recognition to authenticate your identity and ensure that your account is operated by yourself.

We are committed to encrypting the information and ensuring the security of the information.  This information will be encrypted.

3. APPUse Information

We need permission from APPuse information to prevent fraud.

We are committed to encrypting the information and ensuring the security of the information. This information will be encrypted.

4. Approximate Location Information

We collect approximate location information of your device to provide service ability of your loan application.

We are committed to encrypting the information and ensuring the security of the information.  This information will be encrypted.

5. Collection of Device Information

We collect device information in the background to help us determine whether your usage environment is your own device and prevent fraudsters from stealing your account and login unreliable devices, including your telco usage score generated by our third-party service providers engaged in data analytics and credit scoring from your telecommunications data through your telecommunications service provider (e.g. Globe Telecom Inc., PLDT, Smart Communications, and Sun Cellular), in the possession of mobile network operators, utilities companies (e.g. the MVP Group, including but not limited to Kayana Solutions Inc., PLDT Inc., Smart Communications, Inc. and its affiliates).

We are committed to encrypting the information and ensuring the security of the information.  This information will be encrypted.

6. SMS Information

We use SMS to auto-fill the verification code during the process of verifying the validation of your financial account when you add your beneficiary's bank account. We will send you notifications and messages through SMS. We may collection information from your SMS contents relevant to your financial circumstances for the purposes of risk analysis.

We are committed to encrypting the information and ensuring the security of the information. This information will be encrypted.

PURPOSE OF COLLECTING INFORMATION

1. To verify your identity;

2. To contact the user;

3. To assess your eligibility to use our products and services, and assess your credit worthiness as a borrower;

4. To detect and prevent fraud, money laundering or other financial crimes, and/or other illegal uses of our services;

5. For data and risk analysis, identifying usage trends, and evaluating and improving our services, products and your experience, including conducting studies, research, statistical, automatic, and manual profile analysis, behavior modelling (including without limitation, training and back-testing machine learning algorithms of our third-party service provider’s software) to improve efficiency and reliability of their credit scoring capabilities;

To comply with relevant laws, rules and regulations.

USE OF INFORMATION

1. To provide and maintain our services, including establishing your true identity, and monitoring the use of our services;

2. To monitor, detect, analyze and prevent actual or suspected crimes, fraud, and business and credit risks;

3. To develop, enhance and maintain risk control assessment processes and models;

 To measure consumer interest and satisfaction with our products and services

4. Disclose your data in order to meet legal and regulatory requirements

DISCLOSURE AND SHARING OF PERSONAL INFORMATION

When you use our services, it shall be deemed as your consent to the Company regarding the collection, storage, sharing, use, processing, and protection of your Personal Information by the Company.

The Company will not disclose or shareyour Personal Information and/or all other information described in this Privacy Policy that we collected , except for the following circumstances:

1. When your desired products and services can only be provided if your Personal Information is disclosed;

2. When we are required or it is necessary to disclose or share the aforesaid information to third parties that provide products or services on our behalf such as service providers, and data science and credit scoring service providers or those that enable us to deliver the product or service you availed or will avail, as well as for initiatives related to or connected with customer due diligence; account management; collections; marketing; data analytics and risk modeling; credit investigation, verification, and assessment; and contacting or communicating with you,;

3. When it is necessary for dispute resolution, arbitration, or litigation.

4. Disclosure to our prospective investors.

5. When we are required to comply with a court summons, court order or to comply with a legal process.

By using or availing, or attempting to use or avail, our Services, you consent to the disclosure or sharing of your Personal and other information to third parties under the circumstances described above.

The Company is not responsible for any collection, disclosure and/or use of your Personal Information provided by you to any third party's website.

SECURITY OF PERSONAL INFORMATION

We value Personal Information collected, used, retained and stored through the Platform.

To protect Personal Information from unauthorized access, use or disclosure, we use encryption methods when storing the same.

In order to ensure the security of information and protect it from any form of fraud, we strive to maintain and restrict access to Personal Information through the latest technological means, physical forms and other measures, so that your Personal Information will not be damaged or lost.

RETENTION OF PERSONAL INFORMATION

Collected personal information is retained for the period necessary to carry out the purposes and pursuant to the provisions of pertinent laws, rules and regulations. We retain Personal Information including Basic Information, APPUse Information, Camera Information, Image Information, Approximate Location Information, , and Device Information, as well as transaction records.

We retain the user’s Personal Information for the following purposes:

1. Information is still necessary for our services and for a reasonable time after completion of services.

2. Information is required in order to comply with any legal and regulatory obligations.

3. Disposal of Personal Information that is no longer necessary for our services will be performed securely and in accordance with all applicable laws and regulations.

All records of transactions, especially customer identification records, shall be retained for at least five (5) years from date of transactions. With respect to closed accounts, the records on customer identification, accounts files, and business correspondence shall be retained for at least (5) years from the date when they were closed.

DELETION OF PERSONAL INFORMATION

If you want to stop using our service  and delete your Personal Information, you may send an email to cs@casholapp.com.  Your Personal Information will be deleted from the Company’s system after the lapse of retention period described above.

MINORS

Minors shall not use our products/service for any purpose. The Company does not knowingly collect Personal Information from Minors for any purpose. If you believe that the Company has Personal Information of a Minor without parental/guardian consent, please contact us and we will delete such information.

CONTACT US

For any questions, requests, or complaints concerning this Privacy Policy, you may contact  the Company’s Data Protection Officer through dataprotection@sunloanlending.com.