Privacy Policy

Oriente Express Techsystem Corporation (the “Company” or “OETC”), its assigns, affiliates, and related companies in the conduct of its business in the Philippines (the “Oriente Group”) value the privacy of Cashalo Users and any person who shall use, access, download, browse, or register with the Cashalo service on the Cashalo website, its application (the “Cashalo Application”), or other related digital medium or media including social media (each and collectively the “Cashalo Facility”). This Privacy Policy is part of the Oriente Group’s commitment to respect and protect every personal data and information belonging to Users (as hereinafter defined) of the Cashalo Facility. We are committed to the protection of any and all personal data which may be provided by Cashalo Facility Users (as defined below) or visitors to the Cashalo Facility. This Privacy Policy has been prepared in accordance and in compliance with the laws of the Republic of the Philippines, and is for the exclusive use of OETC and the Oriente Group. OETC is committed to complying with the Republic Act 10173 and the Data Privacy Act of 2012, and its Implementing Rules and Regulations. This Privacy Policy sets out the policies of the Company, its assigns, affiliates, and related companies in relation to any and all types of Personal Data (as defined below) referred to in this Privacy Policy, including sensitive personal information. In this Privacy Policy, “Personal Data” means any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual, as defined under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (hereinafter referred to as the “Data Privacy Act”). Personal Data may be provided by individual users of the Cashalo Facility, including prospective lenders or borrowers (“you”, the “User” or “Users”), for the collection, use and disclosure by the Company, its assigns, affiliates, and related companies. 

All names and other Personal Data which relate to Users shall be handled the manner set out in this Privacy Policy. We only collect information where it is necessary for us to do so and we will only collect information if it is relevant in our dealings with Users. We will only keep User’s Personal Data for as long as we are either required by law or as is relevant for the purposes for which the information was collected. 

You may visit the Cashalo Facility and browse without having to provide Personal Data. During visits to the Cashalo Facility, you may choose to remain anonymous and at no time can we identify you unless you have a Cashalo Account and log on with a username and password. 

The scope of this Privacy Policy is limited to information collected or received by us through your use of the Cashalo Facility via the Cashalo website or Cashalo Application. We are not responsible for the actions of third parties or companies, the contents of their facilities, the use of information you provide to them, the information they provide to you or any products or services they may offer. Any link to those sites does not constitute our partnership with, sponsorship or endorsement of, or affiliation with, those parties or companies or their brands. 

By using the Cashalo services with the Cashalo Facility, whether via the Cashalo website or Cashalo Application, you are expressing your agreement to this Privacy Policy and the processing of your Personal Data in the manner provided in this Privacy Policy. If you do not agree to these terms, please do not use and exit the Cashalo Facility. 

When do we collect Personal Data 

We may collect Personal Data when: 

1. A user does one or more of the following: 

1. i. uses theCashaloFacility; 
2. creates or registers an account

iii. updates his/her profile and other data submitted to the Facility; 

1. iv. makes a request/call/inquiry;
2. submits documentation/information
3. whenthe lender and the User as borrower enter into a transaction 

vii. applies for a loan or other financial product; 

viii. inquire/review/browse products and services available in the Cashalo Facility; 

1. ix. receives a disbursement;
2. pays using a bank, a payment gateway, a payment provider, or through other payment partners/channels
3. fails to perform any of his/her obligations under any financial product/service; or

xii. uses any other feature (including features from the Member Get Member program) or products and services of the Cashalo Facility and those provided by its platform lenders or service providers (i.e. iPrice, EnsureMePh Insurance Broker, Inc), whether available now or as may be developed and made available in the future. 

1. Personal Data may also be collected: 

1. i. Registration Information – as part of the User’s registration, loan application, loan processing, collection and remedial measures
2. Customer Support – when the User interacts with theCashaloFacility’s customer service officers, collections officers and agents, for example, via telephone calls, letters, face-to-face meetings, online chat, social media, messaging apps, emails and other communications channels available now or as may be made available in the future; 

iii. Third Party Services – when the User chooses to avail of, use or subscribe to third-party services accessible or made available through the Cashalo Facility, (i.e. iPrice, EnsureMePh Insurance Broker, Inc), subject to such terms and conditions as may be imposed by such Third Party; 

1. Linking of Online Accounts – If you sign up forCashalousing your social media, e-commerce, transportation or other online/mobile account (the “Online Account”) or link your Cashalo Account to your Online Account or use certain other Cashalo Facility features, we may access information about you (and in linking your Cashalo Account to your Online Account you consent to us doing so) which you have voluntarily provided to the Online Account provider in accordance with the provider’s policies and we will manage your Personal Data which we have collected in accordance with the Cashalo Privacy Policy. 
2. v. Opt – In / Subscription – when the User subscribes to receive information or requests to be contacted, be included in an email or other mailing list;
3. Promotions – when the User respondsto the Company or theCashalo Facility’s promotions, initiatives or to any request for additional Personal Data; 

vii. Marketing – when the User is contacted by, and responds to, the Company or the Cashalo Facility’s marketing representatives and customer service officers; 

viii. Referrals – when the Company receives references from business partners and third parties, for example, where Users have been referred by them (i.e. the User uses a referral code from a company or under the Member Get Member program or a coupon code); 

1. Credit Investigation – when the Company or its affiliates seek information from third parties about the User in connection with theavailmentand use by the User of the products and services in the Cashalo Facility; 
2. Identity Verification – When as part of the loan processing and assessment, Personal Data of the User is collected from publicly available sources, including but not limited to social media, public repositories, websites, and similar sources;
3. Usage/BrowsingBehaviour- When information is collected using cookies, web beacons, web crawlers, flash cookies, general log information, mobile and browser information (in each case in accordance with the User’s permission settings in the application and in such devices), User browsing behaviour, User searches and transactions and referral information; 

xii. Log Data – When a User or visitor visits the Cashalo Facility, the User’s or visitor’s browser may send the Company Personal Data which the Company collects for statistical and internal record-keeping purposes. The process of collecting this information is called “Log Data”, and may include information such as the computer’s IP address, browser type, browser version, the visited pages of the Cashalo website, the time and date of the visit, time spent on the pages or other channels of the Cashalo Facility including the Cashalo Application, and other statistics; and/or 

xiii. Behavioural/Transaction/Financial data from other sources – In accordance with the Authorization and Consent to Collection below, Personal Data obtained, on a User’s behalf, from third parties with whom the User transacts, from whom the User availed of, is currently using, or have obtained a service or a product. 

The following Personal Data may be collected: 

1. the User’sfull name (first name, middle name, last name), permanent and residential address, current address, contact number/s, email address, birth date and/or age, gender, marital status, citizenship, educational attainment, employment information, financial capacity information, bank account details, credit card and/or financial account information, financial history and details of government-issued identifications which includes the User’s photo and facial information; 
2. b. private IDs, social media, e-commerce, transportation, or other online/mobile account details which prove the identity of the User;
3. c. other information from which the User’s identity may not be apparent or which may not reasonably and directly identify the User, and other information submitted when using theCashaloFacility; 
4. Personal Data relating to a third-party individual (e.g. information of your spouse, children, parents, and/or employees, etc.), including those submitted for the Member Get Member Program, Related Party Contact and Third Party Contact, and other references(including their gender, contact details).By submitting such information to us, you represent and warrant that you have obtained the consent of the third-party to provide us with their Personal Data for the respective purposes in accordance with this Privacy Policy (including sharing and disclosure of information to such third parties, if necessary) for the use by the Company and the lender such that it is considered as legally obtained by the Company and the lender, for the purposes and use as enumerated in this Privacy Policy; 
5. information fromthe User or fromthird parties including information obtained, upon and/or based on your authorization/consent, from any third-party including: 

Employment Information, i.e., employment history (including employer name and address), position, salary, local or foreign income tax returns (such as BIR form 1701), and other employment details; 

Credit/financial information holders, including banks, credit card companies, financial institutions, credit bureaus, credit scoring companies, credit organizations, and/or other third-party source holding information on any financial, transaction, or payment records of the User, and historical transactions that the User made or on the User’s behalf. This includes photos of debit/ATM cards and e-wallet information; 

Other relevant financial information such as home ownership (including landmarks, if any), length of stay at the residence and billing statements;  

1. Information related to the User from publicly available sources, including but not limited to social media, public repositories, websites, and similar sources;
2. Userbehaviouravailable and/or accessible in the medium of access (i.e. mobile device, web browser, desktop) including but not limited to traffic, usage, device, location, travel, GPS,  gallery, device ID, installed applications, camera, application usage and history, connectivity and other information generated, collected, stored or found in the User’s device (i.e. the mobile phone), access medium, a portal, or any other medium of access to the Cashalo Facility; 
3. Your opinions and views regarding theCashaloproducts and services, Merchant products and services, and other information from third party studies and research (as applicable); 
4. i. When you use theCashaloApplication on a mobile platform, we may collect and record certain information such as your unique device ID (persistent/non-persistent), the hardware type, media access control (“MAC”) address, international mobile equipment identity (“IMEI”), the version of your operating system (“OS”), your device name, your email address, your profile information (if connected to any social media account including Facebook), and your location based on your Internet Protocol (“IP”) address. This information is useful to us for troubleshooting and helps us to understand usage trends. Whenever you use the Cashalo Application, we may collect data about all of your interactions with the Cashalo Application or usage of certain features of the Cashalo Facility via server log files. This data is stored offshore within our cloud server; 
5. Our service may contain third-party tracking tools from our service providers (i.e.Google analytics). Such third parties may use cookies,application programming interfaces (“APIs”) and software development kits (“SDKs”) in our services to enable them to collect and analyse user information on our behalf. The third parties may have access to information such as your device identifier, MAC address, IMEI, locale (specific location where a given language is spoken), geo-location information, and IP address; 
6. We may collect “Log Data” which includes information such as the computer’s IP address, browser type, browser version, the visited pages of theCashalowebsite, the time and date of the visit, time spent on the pages or other channels of the Cashalo Facility including the Cashalo Application, and other statistics; 
7. Anonymous, technical, network, and interaction data generated or available in the device or any other access medium used to access or make use of theCashalo Facility;  
8. Information collected using cookies, web beacons, web crawlers, flash cookies, general log information, mobile and browser information (in each case in accordance with the User’s permission settings in the application and in such devices), User browsingbehaviour, User searches and transactions and referral information; and/or
9. Information provided and obtained from third partyserviceproviders (i.e. iPrice) accessible through the Cashalo Facility or the Cashalo Mobile Application.  

The above information may be obtained (from the User or on the User’s behalf from other sources) upon the User’s registration with the Cashalo Facility or upon the User’s application to avail of any Cashalo products and services. Creation of a user profile is optional only if the User is not yet applying for loans or third-party services offered in the Cashalo Application. 

However, a user profile will be mandatory to start the loan application and third-party services application process. Once a user profile is created, Cashalo will save the corresponding personal information collected so that the User will no longer need to re-upload the same each and every time the latter avails of a loan or third-party service from a lender or third party services provider. 

For clarification, although we previously requested access to the User’s phone contact lists, the same were never used for debt collection or to harass in any way the User or his/her contacts. Under this revised Policy, we no longer require access to the User’s phone contact lists, nor do we collect or process the same for Know-Your-Customer (KYC), fraud prevention, credit scoring, or any other valid purpose. Hence, it is understood that phone contact lists are not included in the term Personal Data. 

Collection of Information (i.e. Personal Data) by Third Parties 

We may feature product and partner information within the Cashalo Facility (i.e. iPrice). When interacting with such partner/third party, the partner may collect and use information about you as part of your review, inquiry and/or use of their products and services. These partners may (if you provided your consent and accepted their terms or use, privacy policy or similar document) use information about your visit to the Cashalo Facility for Cashalo services and third-party sites and applications by your computer or device in order to measure your interaction and response to the recommendations and/or product information for tracking purposes, performance, and to provide you with better and more appropriate recommendations or product information about goods and services of interest to you. This Privacy Policy does not apply to and we are not responsible for the data collection practices of these third-party sites, and we encourage you to check their privacy policies to learn more about their use of cookies and other technology.  

Subject to your acceptance of the partner/third party’s terms and conditions, and their privacy policy, such partner/third party may also share information about you and your use of their services to Cashalo and the Platform Lenders to be added to your profile and history and for purposes as provided under this Privacy Policy. 

Validity and Accuracy of Information Submitted 

Submission of True and Accurate Information – You must submit to us information including Personal Data which is true and accurate and not misleading, and you must keep it up to date and inform us of changes as soon as practicable. We reserve the right to request for documentation to verify information provided by you. 

Voluntary Submission of Personal Information / Personal Data – We will only be able to collect your Personal Data if you voluntarily submit the information to us. If you choose not to submit your Personal Data to us or subsequently withdraw your consent to our use of your Personal Data, we may not be able to provide you with some or all of the services available through the Cashalo Application or Cashalo Facility. You may access and update your Personal Data submitted to us at any time at dpo@cashalo.com or by raising a ticket via the Cashalo Privacy Portal located here. 

The Personal Data may be processed on behalf of the Company by personal information or personal data processors, including the lender, in each case mindful of Users’ and data subjects’ rights and the Company’s obligations under the Data Privacy Act of 2012. 

Authorization and Consent to Collection 

The User expressly and unconditionally consents to the access, possession, collection, storage, processing, use, analysis and/or distribution, disclosure, display, and delivery of any information (including Personal Data) related to the User, and to the transfer of such information to any third parties, including, but not limited to, the lenders, organizer/operator of payment facilities, third-party service providers, third-party partners, and third-party sellers, life insurance and credit insurance agencies/providers/brokers, assurance partners for cellular protection and device damage, public and private credit bureau(s) (e.g. Credit Information Corporation (“CIC”)), other credit agencies/organizations/institutions and governmental bodies/agencies, in accordance with the purpose(s) stated in the Privacy Policy, which I have read, understood, and hereby agree to. The User acknowledges and authorises: 1) the regular submission and disclosure of the User’s basic credit data (as defined under Republic Act No. 9510 and its Implementing Rules and Regulations) to the CIC as well as any updates or corrections thereof; and 2) the sharing of the User’s basic credit data with other lenders authorised by the CIC, and credit reporting agencies duly accredited by the CIC. 

By downloading and using the Cashalo Application and/or the Cashalo Facility, the User hereby expressly gives consent and authorization and is deemed to make the following statement: – “By downloading Cashalo, I hereby give consent to the collection and processing of my personal information in accordance with the purpose(s) stated in the Privacy Policy, which I have read, understood, and hereby agree to, including but not limited to determining my credit score and providing a loan. I hereby certify that all the information provided by me is true and correct to the best of my knowledge, and that any misrepresentations or falsity therein will be considered as an act to defraud Oriente Express Techsystem Corporation (OETC), its partners and affiliates including the Oriente Group. I authorize OETC to verify and investigate the above statements/information as may be required, from the references provided and other reasonable sources. For this purpose, I hereby waive my rights on the confidentiality of client information and expressly consent to the processing of any personal information and records relating to me that might be obtained from third parties, including government agencies, my employer, credit bureaus, business associates and other entities you may deem proper and sufficient in the conduct of my business, sensitive or otherwise, in accordance with Republic Act No. 10173 for the purpose of determining my eligibility for a loan which I am applying for, as well as those stated in the Privacy Policy, which I have read, understood, and hereby agree to. I further agree that applications and all supporting documents and any other information obtained relative to this application shall be used by and communicated to OETC for the purpose of determining my eligibility for a loan which I am applying for, as well as those stated in the Privacy Policy, which I have read, understood, and hereby agree to. I expressly and unconditionally authorize OETC to disclose to any bank or affiliate and other financial institution any information regarding me including the handling thereof to the Bangko Sentral ng Pilipinas, the Securities and Exchange Commission, Anti-Money Laundering Council, Credit Bureaus and/or any other governmental body. In particular, I hereby acknowledge and authorize: 1) the regular submission and disclosure of my basic credit data (as defined under Republic Act No. 9510 and its Implementing Rules and Regulations) to the Credit Information Corporation (CIC) as well as any updates or corrections thereof; and 2) the sharing of my basic credit data with other lenders authorized by the CIC, and credit reporting agencies duly accredited by the CIC. 

The User hereby consents to and authorizes OETC and the lender and/or their third-party partners (such as, but not limited to, JG Summit, the CIC, Robinsons Bank Corporation, Robinsons Retail Holdings Inc, Cebu Air, Inc., Meralco, PLDT, Smart Telecoms, Globe Telecom, TransUnion, CIBI, Compuscan, ShareTreats, EnsureMePh Insurance Broker, Inc, United Coconut Planters Life Assurance Corporation, iPrice) for the purpose of providing the Services, including conducting user profiling, identify check and verification, fraud detection, monitoring and prevention, enrolment for insurance, credit investigation, credit scoring and credit collection, to obtain pertinent credit, transaction and Personal Data from his/her employer, banks, credit card companies, retailers, telecommunications providers, IT services, and other relevant institutions in the course of such investigation, to verify any and all of the collected information of User, to collect any and all information related thereto, and to process any such information, from whatever relevant source. The User further acknowledges, understands, accepts and agrees that the User’s Personal Data may be shared to a business, corporate (i.e. registration using a referral code, link, banner or similar referral identification method) or individual (i.e. Member Get Member) who have referred the User to register, obtain a loan or otherwise obtain or avail of the services from the Cashalo Facility using a unique identifier (i.e. reference code) for such corporation or individual. 

The User hereby consents to and authorizes the release by OETC, the lender, the Oriente Group and its subsidiaries and affiliates, his/her employer, the banks, the credit card companies, and the institutions mentioned in the immediately preceding paragraph, of any and all information required by OETC, the lender, the Oriente Group and its subsidiaries and affiliates and/or its third-party partners, such as, but not limited to, the following: 

(a) Identity & credit information; 

(b) Voice calling data records; 

(c) SMS sending and receiving records; 

(d) Data usage records; 

(e) Promo subscription and redemption records; 

(f) Customer relationship management records; 

(g) Borrowing status; 

(h) Recovery rate per borrower; 

(i) Financial assets and liabilities; 

(j) Regular spending and expenditure; 

(k) Outstanding loans and/or liabilities at other financial institutions; 

(l) Retail spending record; and 

(m) information on fraud detection, monitoring and prevention 

For the avoidance of doubt, the User hereby acknowledges and agrees that OETC and/or a lender in the Cashalo Facility may conduct the processing of Personal Data on its own, or at its sole discretion and option, outsource the processing and use of such information to third-party subcontractors and/or service providers, within or outside the Philippines. Such third parties may include, but are not limited to, any member of the Oriente Group, OETC and its subsidiaries and affiliates, and JG Summit Group and its subsidiaries and affiliates, which in each case shall be subject to an agreement in accordance with law including compliance with the requirements under the Data Privacy Act of 2012. 

For avoidance of doubt, the User hereby acknowledges and agrees that lender, its third-party subcontractors, OETC and its subsidiaries and affiliates, and JG Summit Group and its subsidiaries and affiliates, may share any and all information relating to User to each other for legitimate business purposes such as credit investigation, credit scoring, Automated Decision Making, Profiling, credit collection, outsourcing of collections to third parties, remedial measure for collection (i.e. referral to agents and lawyers for collection), product and systems development, and the like. 

Use/Purpose of Personal Data 

Personal Data shall be processed, collected, used, disclosed, stored and retained for the following purposes: 

• i. to identify Users; 
• ii. to contact Users in relation to their registered account/s or requested information; 
• iii. to facilitate the Know-Your-Customer (KYC) process which includes the processing and registration of account/s to determine or assist in determination of decisions as part of screening of the investors, borrowers, registrations or loan applications, and/or to deliver our products and/or services to the User and any directly related purposes; 
• iv.to facilitate loan processing from application, review, monitoring, payment, collection and other remedial measures.  
• For the avoidance of doubt, third-party individuals shall not be considered co-makers of loans and no payment will be collected from them. The Personal Data of the Reference Person, Related Party Contact and Third Party Contact shall be used only to ask for additional information about our User who named the Third Party Contact as his/her reference person, to verify the information provided in a User’s application, and/or other information such as the User’s new address and/or new contact number, in the event that we have an important information for the User (for example, if a borrower defaults on his/her payment obligation to us) and the latter cannot be reached using the contact information that he/she provided to us; 

• v.to maintain internal records; 
• vi. to market and offering new, related or complementary products and services to the User; 
• vii. to conduct background check and identity verification; 
• viii. to conduct and perform fraud monitoring, detection, analysis and prevention; 
• ix. to prevent, detect and investigate actual or suspected crime and analyzing and managing commercial risks; 

• x. to conduct data analytics and tracking; 
• xi. to conduct market research to enable Oriente to understand and determine customer location, preferences and demographics, to develop special offers, products or marketing programs in relation to products and services (including finding the nearest store), and to improve (i.e., customized offers and products) such products and services 
• xii. to conduct investigations relating to disputes, payment, suspected illegal activities or fraud; 
• xiii. to carry out marketing and promotions initiatives relating to the Company, local affiliates of the Oriente Group, Oriente’s partners, and Oriente’s products and services, whether by electronic means, by email and post, or by telephone, SMS or social media, or by sending newsletters (for example, for the Users to be updated on new products or features and to publicize events, contests, demonstrations, loyalty programmes, and other activities organized by Oriente), also by using automated means. Such communications will relate to products and services of the financial products, services and the like. In addition, Oriente will process and share User data for market research, statistical analyses, or other research to improve its products, development of new products and customer satisfaction analysis; 
• xiv. to analyse User behavior or for user profiling, (e.g. in relation to financing products availed, provided, viewed, and searched) in order to improve, and develop better products and services in the Facility including to provide better matches among lenders and borrowers consistent with their respective priorities; 

• xv. to develop, enhance and maintain a risk assessment process and model, offline and online; 
• xvi. to develop and generate a credit score, credit model and user model; 
• xvii. to enrol/participate the user in group credit and/or life insurance, credit risk analysis, credit investigation, credit scoring and credit collection on the User; 
• xviii. to perform User location search; 
• xix. to execute, monitor, manage and analyse the Cashalo Facility and to develop, enhance, and upgrade the features, functions, products and services in the Cashalo Facility, including promotions, loyalty and reward programs; 

• xx. to respond to your queries, requests, and other related transactions; 
• xxi. to facilitate business asset transactions (which may extend to any mergers, acquisitions or asset sales) of the Oriente Group; 
• xxii. to facilitate and as may be required as part of any financing or capital raising activity (i.e. obtaining loans, credit facility, mortgage, assignment, assignment as a form of security or mortgage of loans); 
• xxiii. to initiate and maintain correspondence with the User via electronic mail (e-mail), SMS (short messaging service), in-app message/communication registered mail, phone calls or field visits; 
• xxiv. to resolve complaints and handling requests and inquiries; 

• xxv. to monitor or record phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation and identity verification purposes; 
• xxvi. to provide information to external parties such as government agencies, and other institutions as part of scientific research and/or study or for reportorial requirements as may be required by law and governmental regulations;  
• xxvii. to elicit user feedback, referrals, assessment, and participation; and 
• xxviii. for any other legal and/or regulatory purposes (including but not limited to obtaining legal advice and dispute resolution) and legitimate business purposes and to carry out all mandatory administrative, operational and legal duties applicable to OETC, the Oriente Group and its subsidiaries and affiliates pursuant to the prevailing laws and regulations. 

As some practical examples in connection with the above-mentioned uses and purposes, we may use Personal Data to: 

• a. allow log-ins and making of purchases over marketplace platforms which are operated under or under affiliation with the Cashalo service; 
• b. identify and recommend products and services available through or in association with the Cashalo Facility and/or the Cashalo Application; 
• c. operate and improve the Cashalo services or Cashalo Facility; 
• d. understand User preferences to enhance User experience and enjoyment using the Cashalo Service and/or the Cashalo Facility; 
• e. respond to User comments and questions or requests; 

• f. provide and deliver products and service based on User request or demand; 
• g. send related information, including confirmations, technical notices, updates, security alerts, support and administrative messages to Users; 
• h. communicate with Users about promotions, rewards, upcoming events, and other news about products and services offered by Cashalo and selected partners of Cashalo; and 
• i. link or combine with other information provided to us from third parties, to help understand User preferences with the aim of providing Users with better services. 

Sharing of Personal Data 

Your Personal Data may be shared with the Oriente Group and its affiliates in the conduct of its business for processing as may be required in the maintenance and performance of its duties and responsibilities under the Cashalo Facility, in accordance with applicable laws, rules and regulations. The Oriente Group or entities which are its subsidiaries or within its affiliate network may, as necessary, be engaged by OETC as subcontractors or data processors in each case with respect to the purposes enumerated above. 

Lender for Loan Processing and Management – OETC is mere operator of the Cashalo Facility, which is a platform through which third-party lenders (including Paloo Financing, Inc.) can offer their loan products to the User or borrower. It is the lenders that offer loan products and hold the appropriate license from the Securities and Exchange Commission to do so. As a borrower, your Personal Data will be shared with the lenders in order to allow the lenders to conduct loan processing (i.e. to process, review, approve/reject, maintain, repay, collect your loan as applicable) and to conduct identify verification, fraud detection, credit scoring, profiling, automated decision making, collection and other remedial measures and such other legitimate purposes in relation to the application, maintenance and collection of the lender’s financial products (i.e. loans) and services.  

Identity Verification – your information may be shared to identity and information verification, investigation, validation providers to confirm the trust and veracity of any information you provide. 

Purchaser of the Loan – Your information may also be shared with third-party purchasers of any loans including Non-Performing Loans. In the event that your loan or other financial product is assigned, ceded, taken over, purchased or is otherwise transferred to any other party, all your records, transactions, any other information (including personal and sensitive personal information) about you, as it relates to the issuance, history, basis, and status of such loan or financial instrument, shall be shared, transferred and delivered to such third party. 

Payment Gateway Providers – to the extent you use the services of a payment gateway provider for payment of any obligation, loan, instalment of any product or service in the Cashalo Platform, we may share your Personal Information to facilitate such payment. 

Disbursement of Loan Proceeds – we may share your data with banks, e-wallet, or other disbursement channels for the purpose of crediting/transferring/disbursing the proceeds of your loan. 

Credit Assessment – we may share your Personal Data to third-party credit organizations, credit bureaus, credit ratings/tools companies, fraud analysis and detection organizations and associations, public and private, (i.e. CIBI, Transunion, Globe, Smart, PLDT, etc.) including the Credit Information Corporation, defined above as the “CIC”, and governmental bodies/agencies for purposes of conducting credit analysis, credit scoring, profiling, automated decision making, fraud detection and identity verification. 

Government Institutions – we may share your Personal Data to the government, regulatory agencies, and fraud prevention agencies for purposes of identifying, preventing, detecting or tackling fraud, money laundering, or other crimes, and/or for other lawful purposes. 

Merger/Acquisition/Asset Sale – we may share your data to a business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale, or financing) involving all or a portion of the Oriente Group’s businesses. 

Collections Activities – we may share your Personal Data to collections agents, collections companies, and other third parties engaged to provide collections services. It may also be shared with collection and repossession agents and/or agencies in relation to the enforcement of repayment obligations for the loans or other debts and obligations. 

Service Providers – In some instances, we also share Personal Data with our suppliers and other third parties, including Oriente Group entities and other business partners who provide services to us. These include IT and technology service providers, communication services and printing providers, debt collection, tracing, debt recovery, fraud prevention, and credit reference agencies, and others. When we do so, we take steps to ensure they meet our data security standards, so that your Personal Data remains secure. 

Other Services/Activities – we may also provide your information to such other third party service providers (i.e. iPrice) from whom you availed of any product or service and to whom you have given consent to receive such information, including but not limited to the Oriente Group, JG Summit Group, Robinsons Bank, Robinsons Retail Inc.  

Other Authorized Activities – we may also provide your information to third parties service providers (e.g. aggregator platforms, technology providers, platform providers, credit insurance provider, online merchants) who are engaged, used, or are otherwise authorized by either, you, the lender or the Company to provide any support or service with respect to any transaction. Such information may also be provided to third party partners and merchants from whom you purchased/availed of a product/service in the Cashalo Platform (i.e. ShareTreats, Giftaway, Globe, Smart, PLDT, Amtrust. EnsureMePh Insurance Broker, Inc, Cocolife, etc.) 

All data processing, subcontracting or data sharing agreements will be in accordance with the requirements under the Data Privacy Act of 2012, or applicable laws and regulations as may be hereafter passed and implemented. To the extent that such processing, subcontracting, or data sharing requires notice or consent, we will provide or request for such notice and/or consent, in each case, prior to any processing or sharing of your Personal Data. 

We may release your information including Personal Data as permitted by law or when we believe that release is appropriate to comply with the law; enforce or apply our rights; or protect the rights, property, or safety of us or our users, or others. This includes exchanging information with other companies and organizations for fraud protection. We may share your information in connection with any merger, sale of our assets, or a financing or acquisition of all or a portion of our business to another company. We may share aggregate or anonymous information about you with advertisers, publishers, business partners, sponsors, and other third parties. 

If you no longer wish us to share your Personal Data with such person(s) or wish to change your preferences in this respect, please inform us in writing at dpo@cashalo.com or by raising a ticket via the Cashalo Privacy Portal located here. When we provide your Personal Data to any of the above recipients, that recipient may process your Personal Data on our behalf or for its/his/her own purposes. If the recipient processes the Personal Data for its own purposes, it/he/she will be responsible for due compliance with any applicable law with regard to your Personal Data. 

Storage of Personal Data 

Your Personal Data including your transaction data is stored in the secure third-party cloud service provided by our cloud service providers (Amazon and Alicloud) who are among the best-of-breed cloud providers in the industry. 

The data including Personal Data that we collect from you may be transferred to, and stored at, a destination outside the Philippines. It may also be processed by staff operating outside the Philippines who work for us or for one of our suppliers, in each case subject of an outsourcing agreement or data sharing agreement, as applicable. These staff members may be engaged in the fulfillment of your requests. By submitting your Personal Data, you agree to this transfer, storing or processing of data. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. We may also disclose your data to anyone we consider necessary in order to provide you with services in connection with an account. 

Retention of your Personal Data 

Your Personal Data will be retained by the Company for the duration of your activities and transactions in connection with the products and services availed of in this Cashalo Facility and/or for such period of time required for legal and regulatory and/or other legitimate business purposes, and will be disposed of in a secure manner that would prevent further processing, unauthorized access or disclosure to any other party or the public or prejudice your interest, provided that the Company may retain copies of your Personal Data in the Company’s archives for the purpose of determining its continuing obligations or pursuant to its bona fide record retention or data back-up policies, access to which shall be restricted on a need-to-know basis, as may be required under applicable laws and regulations. 

The Personal Data may likewise be retained for the purpose of fraud prevention, detection, and monitoring in accordance with the Company’s fraud detection and prevention policies, and any requirement imposed by any credit agency, bureau or agency in order to prevent fraud, identify theft, anti-money laundering, terrorist financing and other similar causes which are consistent with public policy and the public good. 

Security of your Personal Data 

The Company values Personal Data collected, used, retained and stored through the Cashalo Facility. The Company has adopted technical, organizational and physical measures to protect your Personal Data, 

We take reasonable measures to protect your information from unauthorized access or against loss, misuse, or alteration by third parties. 

Although we make good faith efforts to store the information collected on the Cashalo Facility and/or the Cashalo Application in a secure operating environment that is not available to the public, we cannot guarantee the absolute security of that information during its transmission or its storage on our system. Further, while we attempt to ensure the integrity and security of our network and systems, we cannot guarantee that our security measures will prevent third-party “hackers” from illegally obtaining access to this information. We do not warrant or represent that your information will be protected against, loss, misuse, or alteration by third parties. 

Access and Correction of Personal Data 

If you wish to exercise your right to access, correction, cancellation, portability and objection rights as described below, or for complaints and other inquiries, please email dpo@cashalo.com to the attention of Data Privacy Officer or raise a ticket via the Cashalo Privacy Portal located here: 

• to receive details of the source of the data, the purposes and methods of the processing, the logic applied to the processing, or if the latter is carried out with the help of electronic means, of the identity of data controller and data processors, the entities or categories of entity to which the data may be communicated and which may become aware of the data; 

• to update, correct, supplement, or delete the data, to block or render anonymous data that have been processed unlawfully, including data whose retention is unnecessary for the purpose for which such data have been collected or subsequently processed; to have a certification that the operations requested have been completed, as also related to their contents, to the entities to which the data were communicated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected; to receive Personal Data concerning you and copy or transmit it to another data controller (right to data portability); and 
• to object, on legitimate grounds, to the processing of data, despite the data being relevant to the purposes for which they were collected or to object, also partially (e.g. only in relation to certain communication means), to the data being processed in order to send advertising materials or for direct sales, or market research, or commercial information, profiling purposes, or to receive communications by traditional means only. 

Please note that if your Personal Data has been provided to us by a third-party (e.g. a referrer), you should contact that organization or individual to also make such similar queries, complaints, access and correction requests. 

Control over your Personal Data 

Users retain control over their Personal Data, and may amend their Personal Data registered over the Cashalo Facility database. 

The User shall be responsible for maintaining the confidentiality of his or her own Cashalo Account and password, as well as any and all applications submitted, obligations agreed to or entered into and all other activities occurring under the said account. The User agrees to immediately notify the Company of any unauthorized use or disclosure of the User’s account or password, any unauthorized activities under the User’s Cashalo Account, or any other breach of security. 

The Company and/or the Oriente Group will not be liable for any loss that the User may incur as a result of a third-party’s use of the User’s Cashalo Account or password, either with or without the User’s knowledge, without fault or negligence on the part of the Company and/or the Oriente Group. 

The User may be held liable for any damage or loss incurred by the Company or the Oriente Group in connection with or arising from a third-party’s use of the User’s Cashalo Account or password, without fault or negligence on the part of the Company or the Oriente Group. 

Third-Party Service 

Our service may contain third-party tracking tools from our service providers. Such third parties may use cookies, APIs and SDKs in our services to enable them to collect and analyse user information on our behalf. The third parties may have access to information such as your device identifier, MAC address, IMEI, locale (specific information where a given language is spoken), geo-location information, and IP address. 

Opting Out of Marketing Communication 

You may opt-out of receiving promotional emails or other notification channels from us by following the instructions in those emails or notification channels. If you opt out, we may still send you non-promotional emails or notifications, such as emails or notifications about your accounts or pertaining to our ongoing business including where due notices are required under law or regulation, for the purposes of User protection, or in the circumstances the Company deems that it is necessary to keep Users updated via written notice.  

User Obligations 

You agree to inform us promptly, and in any event, within 14 calendar days, in writing if there are any changes to your information supplied to us from time to time, and to respond promptly to any request from us. 

Where: 

• you fail to provide promptly any user information or Personal Data that we reasonably requested; 
• you withhold or withdraw any consents that we may need to process, transfer or disclose Personal Data for the purposes of use disclosed above in this Privacy Policy (except for purposes connected with marketing or promoting products and services to you); and/or 
• we have, or a member of the Oriente Group has, suspicions regarding financial crime or an associated risk; 

We may: 

• be unable to provide new, or continue to provide all or part of the Cashalo service to you and reserve the right to terminate our relationship with you; 

• take actions necessary for us or a member of the Oriente Group to meet the compliance or regulatory obligations; and/or 
• suspend, transfer or close your account(s) where permitted under local laws. 

Data Privacy Information Rights 

Users have the following rights regarding Personal Data: 

1 Right to Request Special Privacy Protections. You have the right to request restrictions on certain uses and disclosures of your Personal Data by a written request specifying what information you want to limit, and what limitations on our use or disclosure of that information you wish to have imposed. If you tell us not to disclose information, we will abide by your request, unless we must disclose the information for treatment or legal reasons. We reserve the right to accept or reject any other request, and will notify you of our decision. 

2 Right to Inspect and Copy. You have the right to inspect and copy your Personal Data, with limited exceptions. To access your Personal Data, you must submit a written request detailing what information you want access to, whether you want to inspect it or get a copy of it, and if you want a copy, your preferred form and format. We will provide copies in your requested form and format if it is readily producible, or we will provide you with an alternative format you find acceptable, or if we can’t agree and we maintain the record in an electronic format, your choice of a readable electronic or hard copy format. We will also send a copy to any other person you designate in writing. We will charge a reasonable fee which covers our costs for labour, supplies, postage, and if requested and agreed to in advance, the cost of preparing an explanation or summary. We may deny your request under limited circumstances. If we deny your request to access your personal records or the personal records of an individual you are representing because we believe allowing access would be reasonably likely to cause substantial harm to the customer, you will have a right to appeal our decision. 

3 Right to Request Confidential Communications. You have the right to request that you receive your Personal Data in a specific way or at a specific location. You may ask that we send information to a particular e-mail account or to your work address. We will comply with all reasonable requests submitted in writing which specify how or where you wish to receive these communications. 

4 Right to Amend or Supplement. You have a right to request that we amend your Personal Data that you believe is incorrect or incomplete. You must make a request to amend in writing, and include the reasons you believe the information is inaccurate or incomplete. We may deny your request if we do not have the information, if we did not create the information, if you would not be permitted to inspect or copy the information at issue, or if the information is accurate and complete as is. All information related to any request to amend will be maintained and disclosed in conjunction with any subsequent disclosure of the disputed information. 

5 Right to Revoke Authorization. Your consent is necessary before the Company can lawfully collect and process your Personal Data. You may revoke (take back) your consent at any time. For the avoidance of doubt, this does not invalidate any previous processing that the Company has performed in accordance with consent originally given. 

6 Right to Erasure or Blocking. You have the right to suspend, withdraw or order the blocking, removal or destruction of your Personal Data. You can exercise this right upon discovery and substantial proof of any of the following: 

1. i. Your Personal Data is incomplete, outdated, false, or unlawfully obtained.
2. It is being used for purposes you did not authorize.

iii. The data is no longer necessary for the purposes for which they were collected. 

1. You decided to withdraw consent, or you object to the processing and there is no overriding legal ground for processing.
2. The data concerns information prejudicial to the customer — unless justified by freedom of speech, of expression, or of the press; or otherwise authorized by law.
3. The processing is unlawful.

vii. The Company, or its Personal Data processor/s, violated your rights as a customer. 

7 Right to Be Notified of a Breach. You have the right to receive notifications of breaches of your Personal Data, as may be required by law. Aside from protecting you against unfair means of Personal Data collection, this right also requires the Company to notify you in a timely manner if your Personal Data has been compromised. If you have provided us with a current e-mail address, we may use e-mail to communicate information related to the breach. 

8 Right to a Paper or Electronic Copy of this Policy. You have a right to be notified of our legal duties and privacy practices with respect to your Personal Data, including a right to an electronic copy of this Privacy Policy, even if you have previously requested its receipt by e-mail. 

 

Disclosure Statements for Users and Reference Persons 

Statement For Users 

1 Payment. We use and disclose Personal Data about you to other providers under or in partnership with the Cashalo services, with an affiliate company or parent company and other vendors to obtain payment for the services we have provided. 

2 Payment Reminders. We may use and disclose your Personal Data to contact and remind you about due payments. 

3 Research. You agree that your Personal Data may be used and disclosed for research purposes; provided, that access is granted strictly on a need to know basis to protect customer confidentiality involving Personal Data. Separately, your personal records may be used for data analytics to create customer demographics and trends; however, these reports are generated in such a way that customer identities are anonymized. 

4 Marketing. We may use your contact details to communicate with you and give you information about products, promotions or services related to your loan applications or other services provided by Cashalo or an affiliate company or parent company and other business vendors that may be of interest to you. We may also contact you to ensure customer satisfaction regarding services provided, including identification of your concerns so that addressing of issues are assured. 

5 Required by Law. As required by law, we will use and disclose your Personal Data, but we will limit our use or disclosure to the relevant requirements of the law. When the law requires us to report abuse or respond to judicial or administrative proceedings, or to law enforcement officials, we will further comply with the requirement set forth below concerning those activities. We may disclose your Personal Data to an oversight facility for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. 

6 Law Enforcement. We may, and are sometimes required by law to, disclose your Personal Data to a law enforcement official for purposes such as identifying or locating a suspect, fugitive, material witness or missing person, complying with a court order, warrant, subpoena and other law enforcement purposes. 

7 Other Uses and Disclosures If you would like to have a more detailed explanation of these rights or if you would like to exercise one or more of these rights, please contact our Data Protection Officer at dpo@cashalo.com or by raising a ticket via the Cashalo Privacy Portal located here. 

 

Statement For Reference Persons, Related Party Contacts and Third-Party Contacts: 

Additional Information. If you are identified by a Cashalo User as a Reference Person, Related Party Contact or Third Party Contact, we may contact you to ask for additional information about our User who named you as his/her reference person, to verify the information provided in a User’s application, and/or other information such as the User’s new address and/or new contact number, in the event that we have important information for the User (for example, if a borrower defaults on his/her payment obligation to us) and we are unable to reach the User or borrower using the contact information that he/she provided to us. You are not considered a co-maker of the loan and no attempts whatsoever shall be made in order to collect any payment from you or to enforce any such remedial measures for the payment of said loan as against you. 

 

Statement For Users in relation to verification with Related Party Contacts and Third Party Contacts 

1 If you provide information of nominated Related Party Contacts and/or Third Party Contact, you understand, accept, and expressly and unconditionally consent to the sharing and disclosure of any information related to you (including your Personal Data and/or sensitive personal information), to your nominated Related Party Contacts and/or Third Party Contacts, as such Related Party Contact and Third Party Contact may be changed from time to time, for the purpose of: 

• (a) verifying any or all information about you (whether submitted by you or obtained from other sources) prior to, during and after the application, approval, and termination of the loan agreement; 
• (b) to inquire about, request for, ascertain or determine the whereabouts, contact information, financial status, and other information related to you (including making such inquiries as part of the loan collection process); 
• (c) for fraud, theft, or other investigation related to any suspected or actual criminal action or activity, in each case for the purpose of the review, processing, approval, administration, collection, servicing, sale, transfer, amendment, or such other matters in relation to an existing or future loan, which shall be implemented, in accordance with any mandatory applicable law or regulation as the same may be issued from time to time. 

2 In some instances, we also share Personal Data with our suppliers and other third parties, including Oriente Group entities and other business partners who provide services to us. These include IT and technology service providers, communication services and printing providers, debt collection, tracing, debt recovery, fraud prevention, and credit reference agencies, and others. When we do so, we take steps to ensure they meet our data security standards, so that your Personal Data remains secure. 

3 If you no longer wish us to share your Personal Data with such person(s) or wish to change your preferences in this respect, please inform us in writing at dpo@cashalo.com or by raising a ticket via the Cashalo Privacy Portal located here. When we provide your Personal Data to any of the above recipients, that recipient may process your Personal Data on our behalf or for its/his/her own purposes. If the recipient processes the Personal Data for its own purposes, it/he/she will be responsible for due compliance with any applicable law with regard to your Personal Data. 

Changes on our Privacy Policy 

This Privacy Policy may be updated from time to time and shall continue to remain in effect unless otherwise amended. If this Privacy Policy is changed, those changes will be posted on the Cashalo Facility and/or the Cashalo Application. The change will be effective when posted. Users availing Cashalo services and/or visitors to the Cashalo Facility are advised to check the Cashalo website and/or Cashalo Application on a regular basis to remain aware of the policies and practices of how information is collected and used. 

If significant changes to this Privacy Policy will affect certain Personal Data, the Company shall notify its Users through the email address provided or by posting a public notice on the Cashalo Application and/or Cashalo Facility. 

The foregoing consents and authorizations shall continue for the duration of, and shall survive the termination of any loan agreement(s) signed by the borrower, or any other transactions, dealings, arrangements and accounts which borrower may have with, or avail from, the Company and the lender through Cashalo services and/or the Cashalo Facility. 

This version of the Privacy Policy is updated as of 07 December 2021. 

 

Contact Us 

For any questions, concerns or clarifications about this Privacy Policy, the Company may be contacted through the customer support system at dpo@cashalo.com or by raising a ticket via the Cashalo Privacy Portal located here. 

ACCEPTANCE 

I confirm having read and understood and agree to this Privacy Policy. 

DIGITALLY SIGNED 

I HAVE READ THIS PRIVACY POLICY AND AGREE TO ALL OF THE PROVISIONS CONTAINED ABOVE AND ANY FUTURE REVISION TO THE PRIVACY POLICY. BY CLICKING THE “SIGN UP”, “CONNECT”, “REGISTER”, “SUBMIT” OR SIMILAR BUTTON ON ANY SOCIAL MEDIA OR PUBLIC PLATFORMS LINKED TO THE CASHALO SERVICES OR FACILITY, I UNDERSTAND THAT I AM CREATING A DIGITAL SIGNATURE, WHICH I INTEND TO HAVE THE SAME FORCE AND EFFECT AS IF I HAD SIGNED MY NAME MANUALLY.