Summary of Cashalo’s Privacy Policy 

1. Introduction

Paloo Financing, Inc. (the “Company”), doing business as Cashalo, along with its parent company, assigns, affiliates and related companies (the “Paloo Group”), is committed to protecting the privacy of its users.

The Privacy Policy outlines how user’s Personal Data is collected, processed, shared, and protected in compliance with the Philippine’s Data Privacy Act of 2012 (Republic Act No. 10173).

Personal Data, as defined under the Data Privacy Act, means any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

The Privacy Policy covers the following:

  • Users who access or register in Cashalo’s website, mobile app or other digital platforms (the “Cashalo Facility”).
  • Covers Personal Data collection, usage, storage and sharing with third parties.

The Privacy Policy does not apply to third-party websites or services linked to Cashalo Facility.

By using the Cashalo Facility, you are agreeing to the Privacy Policy and the processing of your Personal Data in the manner provided for in the Privacy Policy.

This summary of the Privacy Policy is being provided for your convenience only.  You must review, understand and agree to the full Privacy Policy found in the following link:  https://cashalo.com/privacy-policy/.  

If you do not agree to those terms, please do not use and exit the Cashalo Facility.

2.  When Collection of Personal Data Happens

Personal data is collected when a user does any of the following:

  1. uses the Cashalo Facility;
  2. creates or registers an account
  3. updates profile and other data submitted to the Cashalo Facility;
  4. makes a request, call or inquiry;
  5. submits documentation or information;
  6. when Company as the lender and User as the borrower enter into a business transaction;
  7. applies for a loan or other financial product;
  8. inquire, review or browse products and services available on the Cashalo Facility;
  9. receives a disbursement;
  10. pays using a bank, a payment gateway, a payment provider, or through other payment partners or channels;
  11. fails to perform any of his/her obligations under any financial product or service; or
  12. uses any feature of the products and services of the Cashalo Facility, and those provided by third party service providers.

Personal Data may also be collected when there is:

  1. User registration, loan application, loan processing, collection or remedial measures;
  2. User interaction with customer support;
  3. User avails of third-party services made available through the Cashalo Facility;
  4. Linking of User’s online accounts;
  5. User subscribes to receive information;
  6. User responds to the Company or the Cashalo Facility’s promotions;
  7. User is contacted or responds to the Company or the Cashalo Facility’s marketing representatives;
  8. User is referred to the Company by business partners and third parties;
  9. Company seek information from third parties about the User in connection with User’s availment of the products and services in the Cashalo Facility;
  10. As part of the loan processing and assessment;
  11. User browsing behavior, searches, transactions and referral information;
  12. User or visitor visits the Cashalo Facility, the User’s or visitor’s browser may send the Company Personal Data which the Company collects for statistical and internal record-keeping purposes; and/or
  13. In accordance with the Authorization and Consent to Collection below, Personal Data obtained, on a User’s behalf, from third parties with whom the User transacts, from whom the User availed of, is currently using, or have obtained a service or a product.

3.  The Types of Data Collected

The following are examples of the types of data that may be collected through the user’s access, use or availment of services within the Cashalo Facility:

A. Personal Identification Data

  • Full name, birth date, gender, citizenship, marital status
  • Home and work address, email, phone number

B. Financial and Employment Information

  • Employment details (company, salary, industry)
  • Bank account details and credit card information
  • Loan history, repayment records, and other financial data

C. Government-Issued IDs

  • Driver’s license, passport, or other official documents
  • Facial recognition data (if applicable)

D. Device and Log Data

  • Device type, IP address, OS version, unique device identifiers (IMEI, MAC address)
  • Website and app usage logs, including pages visited, time spent, and user actions

E. Location and Behavioral Data

  • GPS location (if permission is granted)
  • Browsing history, referral information, and search activity

F. Cookies and Tracking Technologies

  • Data from tracking tools (cookies, web beacons, APIs, SDKs)
  • Google Analytics and other analytics providers for insights

G. Information from Third Parties

Financial Institutions and Credit Bureaus

    • Loan and credit history from banks, credit card providers, and financial institutions
    • Data from public and private credit bureaus (e.g., Credit Information Corporation)

Social Media and Online Accounts

    • Data linked from Facebook, Lazada, or other e-commerce and mobile accounts
    • Data on purchases, transactions, and preferences

Identity and Verification Services

    • Identity validation from government agencies and third-party providers

Referrals and Marketing Partners

    • Data from referral programs

4.  Verification and Accuracy of Information

You must submit true and accurate information on the Cashalo Facility.

The Company will only be able to collect your Personal Data if you voluntarily submit the information to us.

If you choose not to submit your Personal Data or subsequently withdraw your consent to the Company’s use of your Personal Data, the Company may not be able to provide you with some or all of the services available through the Cashalo Facility.

Users may access and update your Personal Data submitted to the Company or via the Cashalo Facility at any time by e-mailing the Data Privacy Officer at dpo@cashalo.com or dpo@paloo.com.ph.

Users may also request for deletion of their Cashalo account and Personal Data by following the instructions found on the following link:  https://cashalo.com/privacy-policy/data-deletion/.

5.  Use or Purpose of Data Collection and Processing

The Company uses the collected data for various operational and business purposes, including:

a. to identify Users;

b. to contact Users in relation to their accounts;

c. to facilitate the Know-Your-Customer (KYC) process;

d. to maintain internal records;

e. to market and offering products and services to the User;

f. to conduct background check and identity verification;

g. to conduct and perform fraud monitoring, detection, analysis and prevention;

h. to prevent, detect and investigate actual or suspected crime ;

i. to conduct data analytics and tracking;

j. To conduct market research;

k. to conduct investigations relating to disputes, payment, suspected illegal activities or fraud;

l. to carry out marketing and promotions initiatives;

m. to analyse user behavior or for user profiling;

n. to develop, enhance and maintain a risk assessment process and model, offline and online;

o. to develop and generate a credit score, credit model and user model;

p. to enroll the user in group credit and/or life insurance;

q. to perform user location search for risk assessment process;

r. to execute, monitor, manage, and analyse the Cashalo Facility and to develop, enhance, and upgrade the features in the Cashalo Facility;

s. to respond to user queries, requests, and other related transactions;

t. to facilitate business transactions of the PFI Group;

u. to facilitate and as may be required as part of any financing or capital raising activity;

v. to initiate and maintain correspondence with the User;

w. to resolve complaints and handling requests and inquiries;

x. to monitor or record phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation and identity verification purposes;

y. to provide information to external parties such as government agencies, and other institutions as part of reportorial requirements;

z. to elicit user feedback, referrals, assessment, and participation; and

aa. for any other legal and/or regulatory purposes and legitimate business purposes and to carry out all mandatory administrative, operational and legal duties applicable to PFI and the PFI Group.

6. Data Sharing and Disclosure

The Company shares user data with third parties for specific purposes, ensuring compliance with applicable laws.

A. Internal Data Sharing

  • Data may be shared within the PFI Group for business operations purposes.

B. External Data Sharing

  1. Lenders and Financial Institutions
    • Banks, loan providers, and credit agencies receive data for loan processing and assessment.
    • Credit Information Corporation (CIC) and private credit bureaus analyze user creditworthiness.
  2. Payment and Transaction Partners
    • Payment gateways, banks, and e-wallet providers process transactions securely.
  3. Identity and Fraud Prevention Services
    • Third-party verification providers ensure secure and accurate user identification.
    • Anti-fraud agencies prevent financial crimes.
  4. Marketing and Business Partners
    • Partners like Lazada, insurance brokers, and telecom companies may receive data for promotional campaigns and service improvements.
  5. Government and Regulatory Agencies
    • User data may be disclosed for compliance with legal investigations and financial regulations.
  6. Debt Collection and Legal Enforcement
    • Collection agencies and legal representatives may access user data for unpaid loans.

The Company may also provide your information to third party service providers to provide any support or service with respect to any user transaction on the Cashalo Facility.

All data processing, sub-contracting or data sharing agreements will be in accordance with the requirements under the Data Privacy Act of 2012, or applicable laws and regulations.

If a user no longer wishes to share their Personal Data with third parties or wish to change their preferences in this respect, they can inform the Company in writing at dpo@cashalo.com or dpo@paloo.com.ph.

When the Company provides a user’s Personal Data to any of the above recipients, that recipient may process the user’s Personal Data on the Company’s behalf or for their own purposes. If the recipient processes the Personal Data for their own purposes, they will be responsible for compliance with any applicable law with regard to the user’s Personal Data.

7. Data Security and Retention

A. Security Measures

  • Data is encrypted and stored securely in cloud-based servers (AWS, Alicloud, Microsoft Azure).
  • Cashalo uses firewalls, access controls, and monitoring systems to prevent data breaches.
  • However, absolute security cannot be guaranteed due to evolving cybersecurity threats.

B. Data Retention Policy

  • User data is retained for as long as necessary for financial transactions, regulatory compliance, and business operations.
  • Some data may be stored even after account deletion for fraud prevention and regulatory compliance (including AMLA).
  • Users can request data deletion by contacting Cashalo’s Data Protection Officer.

8. User Rights and Control Over Personal Data

Users have the following rights regarding their Personal Data:

a. Right to Request for Special Privacy Protections – Users can request restrictions on certain uses and disclosures of their Personal Data.

b. Right to Inspect and Copy – Users can request details about the Personal Data collected.

c. Right to Request Confidential Communications – Users can request that they receive their Personal Data in a specific way or at a specific location.

d. Right to Amend or Supplement – Users can correct inaccurate or incomplete information.

e. Right to Erasure or Blocking – Users can request data deletion under certain conditions.

f. Right to Revoke Authorization – Users can revoke their consent at any given time.

g. Right to Be Notified of a Breach – Users will be informed if their data is compromised.

h. Right to a Paper or Electronic Copy of this Policy – Users have a right to request for a paper or electronic copy of this Privacy Policy.

If Users wish to exercise their rights as described above, or for complaints and other inquiries, users may email dpo@cashalo.com or dpo@paloo.com.ph.

Users retain control over their Personal Data and shall be responsible for maintaining the confidentiality of their own account and password.

The User agrees to immediately notify the Company of any unauthorized use or disclosure of the User’s account or password, any unauthorized activities under the User’s account, or any other breach of security.

The Company and/or the PFI Group will not be liable for any loss that the User may incur as a result of a third-party’s use of the User’s account or password, either with or without the User’s knowledge, without fault or negligence on the part of the Company and/or the PFI Group.

9. Third-Party Service

The Company’s service may contain third-party tracking tools from service providers. Such third parties may use cookies, APIs and SDKs in the services. The third parties may have access to information such as user device identifier, MAC address, IMEI, locale (specific information where a given language is spoken), geo-location information, and IP address.

10. Opting Out of Marketing Communication

Users may opt-out of receiving promotional emails or other notification channels from the Company by following the instructions in those emails or notification channels.

If a user opts out, the Company may still send non-promotional emails or notifications, such as emails or notifications about user’s account or pertaining to ongoing business transaction, or in the circumstances the Company deems that it is necessary to keep the user updated via written notice.

11. User Obligations

Users agree to inform the Company within fourteen (14) calendar days, in writing, if there are any changes to the information supplied to the Company, and to respond promptly to any request from the Company.

If user does not do so, the Company may:

  • be unable to provide new, or continue to provide all or part of the Cashalo service and reserve the right to terminate its relationship with you;
  • take actions necessary for the Company or a member of the PFI Group to meet the compliance or regulatory obligations; and/or
  • suspend, transfer or close your account(s) where permitted under local laws.

12. Disclosure Statements for Users and Reference Persons

Statement For Users

a. Payment. The Company uses and discloses Personal Data about users to other providers in order to obtain payment for the services the Company has provided.

b. Payment Reminders. The Company may use and disclose user’s Personal Data to contact and remind them about due payments.

c. Research. Personal Data may be used and disclosed for research purposes.

d. Marketing. The Company may use User’s contact details to communicate about products, promotions, or services.

e. Required by Law. As required by law, the Company will use and disclose User Personal Data, when the law requires the Company to report abuse or respond to judicial or administrative proceedings, or to law enforcement officials.

f. Law Enforcement. The Company may, and is sometimes required by law to, disclose user Personal Data to a law enforcement official for law enforcement purposes.

g. Other Uses and Disclosures.  If Users would like to receive a more detailed explanation of their rights, they may contact the Data Protection Officer at dpo@cashalo.com or dpo@paloo.com.ph.

Statement For Reference Persons, Related Party Contacts and Third-Party Contacts

If someone is identified by a user of the Cashalo Facility as a Reference Person, Related Party Contact or Third-Party Contact, the Company may contact those identified to ask for additional information about the User. Such Third Parties are not considered a co-maker of the loan and no attempts whatsoever shall be made to collect any payment from those Third Parties.

13. Changes to the Privacy Policy

  • The Company reserves the right to update the Privacy Policy at any time.
  • Significant changes will be communicated via email or a public notice.
  • Users are encouraged to regularly check the Privacy Policy for updates.

14. Authorization and Consent to Collection

The User consents to the access, possession, collection, storage, processing, use, analysis and/or distribution, disclosure, display, and delivery of any information (including Personal Data) related to the User, and to the transfer of such information to any third parties, including, but not limited to, the lenders, organizer/operator of payment facilities, third-party service providers, third-party partners, and third-party sellers, life insurance and credit insurance agencies/providers/brokers, assurance partners for cellular protection and device damage, public and private credit bureau(s) (e.g. Credit Information Corporation (“CIC”)), other credit agencies/organizations/institutions and governmental bodies/agencies, in accordance with the purpose(s) stated in the Privacy Policy, which I have read, understood, and hereby agree to.

The User acknowledges and authorises: 1) the regular submission and disclosure of the User’s basic credit data to the CIC as well as any updates or corrections thereof; and 2) the sharing of the User’s basic credit data with other lenders authorised by the CIC, and credit reporting agencies duly accredited by the CIC.

By accessing, registering or using the Cashalo Facility, the User gives consent and authorization and is deemed to make the following statement: –

“By downloading Cashalo, I hereby give consent to the collection and processing of my personal information in accordance with the purpose(s) stated in the Privacy Policy, which I have read, understood, and hereby agree to, including but not limited to determining my credit score and providing a loan.

I hereby certify that all the information provided by me is true and correct to the best of my knowledge, and that any misrepresentations or falsity therein will be considered as an act to defraud PFI, its partners and affiliates including the PFI Group.

I authorize PFI to verify and investigate the above statements/information as may be required, from the references provided and other reasonable sources.

For this purpose, I hereby waive my rights on the confidentiality of client information and expressly consent to the processing of any personal information and records relating to me that might be obtained from third parties, including government agencies, my employer, credit bureaus, business associates and other entities you may deem proper and sufficient in the conduct of my business, sensitive or otherwise, in accordance with Republic Act No. 10173 for the purpose of determining my eligibility for a loan which I am applying for, as well as those stated in the Privacy Policy, which I have read, understood, and hereby agree to.

I further agree that applications and all supporting documents and any other information obtained relative to this application shall be used by and communicated to PFI for the purpose of determining my eligibility for a loan which I am applying for, as well as those stated in the Privacy Policy, which I have read, understood, and hereby agree to.

I expressly and unconditionally authorize PFI to disclose to any bank or affiliate and other financial institution any information regarding me including the handling thereof to the Bangko Sentral ng Pilipinas, the Securities and Exchange Commission, Anti-Money Laundering Council, Credit Bureaus and/or any other governmental body.

In particular, I hereby acknowledge and authorize: 1) the regular submission and disclosure of my basic credit data (as defined under Republic Act No. 9510 and its Implementing Rules and Regulations) to the CIC as well as any updates or corrections thereof; and 2) the sharing of my basic credit data with other lenders authorized by the CIC, and credit reporting agencies duly accredited by the CIC.

I hereby consent to and authorize PFI and/or their third-party partners (such as, but not limited to, the CIC, PLDT, Smart Telecoms, Globe Telecom, TransUnion, CIBI, insurance brokers) for the purpose of providing the Services, including conducting user profiling, identify check and verification, fraud detection, monitoring and prevention, enrolment for insurance, credit investigation, credit scoring and credit collection, to obtain pertinent credit, transaction and Personal Data from his/her employer, banks, credit card companies, retailers, telecommunications providers, IT services, and other relevant institutions in the course of such investigation, to verify any and all of the collected information of User, to collect any and all information related thereto, and to process any such information, from whatever relevant source.

I further acknowledge, understand, accept and agree that my Personal Data may be shared to a business, corporate (i.e. registration using a referral code, link, banner or similar referral identification method) or individual (i.e. Member Get Member) who have referred me to register, obtain a loan or otherwise obtain or avail of the services from the Cashalo Facility using a unique identifier (i.e. reference code) from such corporation or individual.

I hereby consents to and authorizes the release by PFI, the PFI Group and its subsidiaries and affiliates, his/her employer, the banks, the credit card companies, and the institutions mentioned in the immediately preceding paragraph, of any and all information required by PFI, the lender, the PFI Group and its subsidiaries and affiliates and/or its third-party partners, such as, but not limited to, the following:

(a) Identity and credit information;

(b) Voice calling data records;

(c) SMS data;

(d) Data usage records;

(e) Promo subscription and redemption records;

(f) Customer relationship management records;

(g) Borrowing status;

(h) Recovery rate per borrower;

(i) Financial assets and liabilities;

(j) Regular spending and expenditure;

(k) Outstanding loans and/or liabilities at other financial institutions;

(l) Retail spending record; and

(m) information on fraud detection, monitoring and prevention.

For the avoidance of doubt, the I hereby acknowledges and agrees that PFI, as lender in the Cashalo Facility, may conduct the processing of Personal Data on its own, or at its sole discretion and option, outsource the processing and use of such information to third-party subcontractors and/or service providers, within or outside the Philippines. Such third parties may include, but are not limited to, any member of the PFI Group (excluding PFI) and their subsidiaries and affiliates, which in each case shall be subject to an agreement in accordance with law including compliance with the requirements under the Data Privacy Act.

For avoidance of doubt, I hereby acknowledges and agrees that PFI, its third-party subcontractors, the members of PFI Group (excluding PFI) and their subsidiaries and affiliates, may share any and all information relating to User to each other for legitimate business purposes such as credit investigation, credit scoring, Automated Decision Making, Profiling, credit collection, outsourcing of collections to third parties, remedial measure for collection (i.e. referral to agents and lawyers for collection), product and systems development, and the like.”

The foregoing consents and authorizations shall continue for the duration of, and shall survive the termination of any loan agreement(s) signed by the user, or any other transactions, dealings, arrangements and accounts which user may have with, or avail from, the Company through the Cashalo Facility.

Contact Us

For any questions, concerns or clarifications about this Privacy Policy, the Company may be contacted through the customer support system at dpo@cashalo.com or dpo@paloo.com.ph.

ACCEPTANCE

I confirm having read and understood and agree to this Privacy Policy.

DIGITALLY SIGNED

I HAVE READ THIS PRIVACY POLICY AND AGREE TO ALL OF THE PROVISIONS CONTAINED ABOVE AND ANY FUTURE REVISION TO THE PRIVACY POLICY. BY CLICKING THE “SIGN UP”, “CONNECT”, “REGISTER”, “SUBMIT” OR SIMILAR BUTTON ON ANY SOCIAL MEDIA OR PUBLIC PLATFORMS LINKED TO THE

This version of the Privacy Policy is updated as of August 8, 2024.