With your consent, we may automatically collect certain data from your device to enhance security, assess risks, and improve our services. This information may include:

• Camera Access
• SMS Details
• Phone Number (for verification purposes)
• Network Data
• Device Information (such as device model, system type, and software version)
• App Usage Details

This data is collected strictly for risk assessment purposes and will not be used for any other purpose without your explicit consent.

For borrowers with designated co-makers, we may also collect personal data from the co-maker to assess their creditworthiness and verify their identity. This may include their name, contact details, employment information, and relationship with the borrower.

With your consent, we may collect certain app-related permissions and data, including but not limited to camera access, SMS, phone number, network data, device information, and app usage details. This information will be used strictly for risk assessment purposes to enhance our services, improve security, and ensure compliance with applicable regulations. We are committed to safeguarding your data and will not use this information for any other purpose without your explicit consent.

During the loan service period, we will collect personal information from borrowers and co-maker to comply with Know Your Customer (KYC) requirements. This may include, but is not limited to, name, phone number, live photos, identification details, employment information, income, and contact details. This information is gathered to verify identities, assess creditworthiness, and ensure compliance with applicable laws and regulations. We are committed to handling this data securely and using it solely for these intended purposes.

TrustDecision SDK: For business security and risk control, we use the TrustDecision SDK. The SDK needs to obtain the information of your devices, such as IDFA, AndroidID, OAID, GAID, MAC address, Wireless IP address, WIFI list, wireless router identification (BSSID, SSID), device type, device model, system type, login IP address, running process, network type, device software version, sensor information (light sensor, gravity sensor, magnetic field sensor, acceleration sensor, gyroscope sensor) and other related device information, for fraud risk identification.

2.Purpose of Collecting Personal Data

Your Personal Data shall be used for registration, loan approval, risk management, fraud prevention, collection, marketing, and other similar purposes as provided under Article 2 (“Purposes”) of this Privacy Notice which will aid us in providing you with better services. To illustrate, your IP address, device information, and SMS metadata may be used for anti-fraud purposes; your mobile number may be used for registration, loan approval, fraud prevent, collection and marketing; your biometric information may be used for risk management and fraud prevention.

We shall occasionally request for additional Personal Data after the creation of your account. Your submission of any information to us, our authorized agents or the Platforms expressly contains your warranty that such information is accurate, up to date, and not misleading.

If you sign up for KidlatPeso using your social media account, link your KidlatPeso account to any of your social media accounts, or use other certain available KidlatPeso social media features, we may access information about you under your social media provider in accordance with the provider’s policies. However, we undertake to manage and use the information we accessed from your social media account only for the purposes stated in and in accordance with the Data Privacy Act of 2012, other National Privacy Commission Circulars and/or Regulations, and this Privacy Notice.

3.Usage of Personal Data

During the course of your availment of our service, we may, through manual or automated means, use, process and/or disclose your Personal Data to WeFund’s affiliates, subsidiaries and third-party partners for any of the following purposes (“Permitted Processing”):-

1. to authenticate your identity;
2. to assess and process your applications for our products and/or services;
3. to communicate with you including but not limited to sending you updates and reminders, responding to your inquiries and/or complaints and resolving disputes;
4. to manage and maintain your accounts/facilities with us;
5. to conduct credit checks and scoring to assess or verify your credit/financial worthiness and to assist other financial institutions to conduct credit checks;
6. to evaluate your financial needs;
7. to make and facilitate credit decisions based on your eligibility for our products and services;
8. to utilize the same for strategic alliances, cross-selling, marketing, and promotions;
9. to maintain your credit history for present and future references;
10. to detect and investigate crime, fraud or illegal activities, and to utilize and disclose the same for investigation, prevention, prosecution and compliance with sanctions, including, know-your-customer (KYC) and regular politically-exposed-persons (PEP) screening purposes and in compliance to the Anti-Money Laundering and Terrorist Prevention Acts of the Republic of the Philippines;
11. to respond to the requirements of a civil or criminal legal process and/or for regulatory compliance purpose and/or as required by law or regulation;
12. to collect any debt due or owing and to enforce your obligations to us;
13. to utilize and disclose the same for market research and statistical analysis and surveys with the aim of improving our products and services and product development;
14. to provide you with the information on our and third-party products and services which may be of interest to you;
15. to verify the accuracy of records maintained by us and/or for us by third parties;
16. to utilize the same for research, design and improvement of our products and services, operational and business processes;
17. to support our business, financial and risk monitoring, planning and decision making;
18. to handle complaints and queries;
19. to utilize and disclose the same for audit, compliance and risk management;
20. to transfer or assign our rights and duties under any governing terms and conditions between us and yourself;
21. to utilize the same for our outsourcing of business and internal operations;
22. to utilize and disclose the same for security reasons;
23. to transfer your Personal Data to foreign jurisdictions for the purpose of processing and storage and to enable any cross-border transactions, for the performance of a contract, for the purposes of legal proceedings, upon written request from a foreign regulatory or government authority or body, to protect your vital interest or where it is in the public interest to do so;
24. to disburse payments and collect repayment;
25. to analyze voiceprint biometric data for the purpose of identity verification;
26. to conduct data analytics and data profiling; and/or
27. to process your Personal Data for any other purposes that is required or permitted by the Data Privacy Act of 2012, its Implementing Rules and Regulations, and any other lawful regulation, order and/or guidelines.

We also use cookies for a number of purposes, including but not limited to, storing your preference for certain types of information or products, for further analysis to provide products and services to you, to improve our products and/or to personalize our services to you. You may adjust the settings on your browser and/or mobile device so that you will be notified when you receive cookie or other similar tracking tools. Please refer to your browser documentation to check if the tracking tools have been enabled on your computer and/or mobile device or to disable cookies.

4.Disclosure of Personal Data

Your Personal Data held by us shall be kept confidential at all times. However, in order to provide you with effective and continuous products and services subject to any laws, regulations and guidelines and for the Permitted Purpose, you explicitly consent to us providing, disclosing, or otherwise processing your Personal Data, in connection with our products and services, to the following parties, in and/or outside the Philippines:

1. WeFund agents, holding companies, subsidiaries, affiliates and associates;
2. professional advisers, contractors, service providers, debt collection agencies and our other agents with whom we have contractual agreements for some of our functions and services;
3. national and local credit bureau, credit reporting agencies, credit reference agencies, rating agencies (such as Credit Information Corporation), insurers and/or insurance brokers;
4. financial service providers in relation to the products and services that you have with us;
5. any actual or potential participants or assignee or transferee of our rights and/or obligations under any transaction between us and you;
6. any co-maker or security provider for the products and/or services granted by us to you;
7. any authorities or regulators, including foreign regulators for the performance of their functions, or any party as required by any law or any government, quasi-government, administrative, court or tribunal;
8. strategic/business partners with whom we have a relationship with for specific products and services;
9. third-party collection agency;
10. any person connected to the enforcement or preservation of any of our rights under your agreements with us; and/or
11. any party authorized and/or consented by you.

5.Changes to Personal Data

You must keep the Personal Data provided to WeFund up-to-date and inform us of changes thereto. You are entitled to review the Personal Data that we have collected about you and request for corrections of the same. You have the right to update your Personal Data anytime. If there are any changes to your Personal Data or if you believe that your Personal Data that we hold is inaccurate, incomplete, misleading or not up-to-date, kindly write to us or email your request to our Data Protection Officer (“DPO”) via email dpo@juanhand.com by providing your registered name, registered mobile number, valid government I.D., and the details of your request, together with the supporting documents. We shall correct or update the information/data as soon as possible. For the avoidance of doubt, the DPO reserves the right to request further information or additional documents from you to verify your identity and the authenticity of the request made and any other information relating to the corrections requested.

6.Withdrawal of Consent

You may communicate your objection to our continued use, collection, and/or other acts of processing of your Personal Data for any valid purpose and in the manner as stated at any time by contacting us at our e-mail address. This shall be your mechanism to turn off or allow the permissions that were previously granted to us.

Please note that if you communicate your objection to the processing of certain Personal Data, depending on the nature and subject of your objection, the same may affect the timeline of your applications and/or our analysis of your creditworthiness. Our legal rights and remedies are expressly reserved in such events.

Provided further that the withdrawal of your consent or objection to the continued use, collection, and/or other acts of processing of your Personal Data while you still have contractual obligations under a loan agreement or any other contract with us does not deny us the right and the obligation to continue with the lawful processing of your Personal Data.

7.Removal of Personal Data

We shall retain your Personal Data, registration and transaction records with a third-party data storage providers for the period necessary to fulfill the purposes outlined or up to ten (10) years in adherence with the requirements of the National Privacy Commission and all other applicable laws and regulations; for the establishment, exercise or defense of legal claims; or for legitimate business purposes, which must be consistent with standards followed by the applicable industry.

Your Personal Data will be destroyed in irretrievable and unusable form in adherence with our physical and/or technical information security measures when retention is no longer allowed or required. The same will be disposed or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure of your personal information to any other party or the public or prejudice the interests of the data subjects.

We reserve the right to take necessary actions if we consider that such removal or cessation would hamper our fulfillment of our obligations under applicable laws.

We shall suspend, withdraw, or order the blocking, removal or destruction of your Personal Data from our system if we become aware or reasonably suspect that the Personal Data is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes; no longer necessary for the purposes for which they were collected, or once you withdraw consent or object to the processing, and there is no other legal ground or overriding legitimate interest for the processing.

8.Security

We will take reasonable efforts to protect personal data in our possession or our control by making reasonable physical, technical and organizational security arrangements to ensure the security and confidentiality of your personal data. Security measures will be implemented, and Personal Data will be processed in accordance with current data protection legislation/s and this Policy.

9.Portability

You have the right to receive your Personal Data which you have provided to us in a structured, commonly used and machine-readable format and you have a right to request that we transfer such Personal Data to another party.

If you wish for us to transfer the Personal Data to another party, we can only do so where it is technically feasible. We are not responsible for the security of the Personal Data or the processing of the same once received by a third party. We reserve our rights to refuse the transfer if such transfer would interfere with another person’s rights (e.g. where providing the Personal Data we hold about you would reveal information about another person).

10.Profiling

“Profiling” refers to any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.

You are hereby informed and you explicitly give consent to us to access and process your Personal Data by manual or automated processing and decision-making as the sole or partial basis, for the purpose of assessing your creditworthiness, or for compliance with any law, regulation, government requirement, treaty or policy in connection to combat money laundering, terrorism financing, fraud, assessment of risk and other offenses, or as required by or for purpose of any court, legal process, examination, inquiry, audit or investigation of any Authority.  User’s activities or accounts that are determined by our system which create a risk may be suspended or refused.

If your loan applications have been declined or accounts have been suspended or refused you may request reviewing of such decision by contacting us atcsph@Kidlatpeso.com. You may also object to the automated processing of your personal data, but doing so will prevent us from providing you with our services.

11.Your Rights under the Data Privacy Act

The Data Privacy Act (DPA) establishes that you have the following rights as a data subject:

1. You have the right to indicate your refusal or withdrawal of consent to the collection and processing of your personal data. You also have the right to be informed and to withhold your consent to further processing in case there are any changes or amendments to information given to you. Once you have notified us of the withholding of your consent, further processing of your personal data will no longer be done, unless the processing is required pursuant to a subpoena, lawful order, or as required by law.
2. You have the right to reasonable access to your personal data. Furthermore, you have the right to limit and prevent disclosure of your personal data and to receive notification of any possible breaches of your personal data.
3. You may also correct or remove any information that you think is inaccurate. You have the right to dispute any inaccuracy or error in your personal data. You may request for the correction or removal of any inaccuracy or error in your personal data by logging into your account or making a formal request with our Data Privacy Officer.
4. You have the right to the destruction of your personal data;
5. You have the right to damages; and
6. You have the right to lodge a complaint with the National Privacy Commission (NPC).

The rights herein above listed is not an exclusive list thereof. Please note that the enumerated rights and wording thereof is not an exact copy of those indicated in the DPA. Please check Chapter IV, Section 16 of the DPA for the exact list and rights you may have as a data subject. All the rights mentioned in such law are inherently incorporated into this Privacy Policy and may be freely exercised by you.

Throughout the processing of your Personal Data, your rights under the DPA, such as the (1) right to be informed, (2) right to object, (3) right to access, (4) right to rectification, 16 (5) right to erasure or blocking, and (6) right to damages, shall be upheld. Entities to whom we share your data will also respect the same rights.

If you would like to make any request in relation to your rights, please contact our DPO.

12.Your Rights under the Credit Information System Act

1. You shall have the right to have ready and immediate access to credit information pertinent to him subject to the payment of a prescribed fee;
2. You shall have the right to dispute erroneous, incomplete or misleading credit information;
3. You shall be entitled to a simplified dispute resolution process to fast track the settlement/resolution of disputed credit information;
4. You shall be informed of any correction or removal of any erroneous, incomplete or misleading information within 5 working days from verification or conclusion of an investigation or from deletion of the disputed information, as the case may be;
5. You shall be entitled to an indemnity in case of denial, without justification, of the aforementioned rights;
6. You shall be notified by a submitting entity of the latter’s obligation to submit and disclose basic credit data to WeFund; and
7. You shall have the right to know the causes of refusal of an application for credit facilities or services from a financial institution that uses credit data as basis or ground for such refusal.

13.Inquiries and Complaints

You have the right to object at any time to the processing of your Personal Data to the extent permitted under the Philippine law, and to the processing of your personal data for the Permitted Purpose. Any queries, requests, concerns, complaints or exercise of your rights regarding the use of your Personal Data may be raised to the respective DPO below:

Email: dpo@juanhand.com

WeFund commits to acknowledge your complaint in a prompt manner and will give you an estimated timeframe for when the company will respond to your complaint.

14.Changes to the Privacy Notice

Please note that we may update this Privacy Notice from time to time via posting on our website. You are advised to periodically view our website for any updates or the most current version of our Privacy Notice. If the Privacy Policy is updated, the said updated version shall apply to all of your information held and processed by WeFund henceforth. Your continuous use of any of the WeFund platforms shall signify your consent to the changes made to this Privacy Notice. If you do not consent to the updated terms thereby, you may contact our DPO.

15.Consent and Acknowledgement

By providing us with your Personal Data, you hereby consent to the usage, processing and/or disclosure of your Personal Data in accordance with this Privacy Notice to WeFund, its affiliates, subsidiaries, third party service providers, and partner institutions.

Version Date: March 2025