XLKASH Lending Privacy Policy

XLKASH Lending Corp.(“Company”), its assigns, and related companies in the conduct of its business value the privacy of XLKASH Lending Users and any person who use, access, download, browse, or register with the XLKASH Lending service on the XLKASH Lending website, its application (“XLKASH Lending Application”), or other related digital medium or media including social media (“XLKASH Lending Facility”) in compliance with the Republic Act 10173 or the Data Privacy Act of 2012, and its Implementing Rules and Regulations. This Privacy Policy sets out the policies of the Company, its assigns, and related companies in relation to any and all types of personal information described in this Privacy Policy, including sensitive personal information.

This Privacy Policy applies solely to the XLKASH LENDING application ("App") owned and operated by XLKASH Lending Corp. ("Company"). Last updated: AUGUST 2023.

If you have any questions, concerns, or suggestions, please contact us at 09774871003.

The Information We Collect

To avoid fraud, when you sign up for XLKASH LENDING account, in addition to your login username and password, we will also ask for your name, email address birthday, gender. We need your authorization and/or permission to your Call Log Information,camera,Media/Photos/Files,SMS,Contacts,APP Installed,location, phone book, internet and any other information access.

Call Log Information

By making voice calls to you and collecting your call records, This will allow us to verify that you have installed our app on your phone and received a voice call from us with a code. Specifically, we will monitor your call logs to see if you received the dynamic password verification logs sent by our app.On the other hand,this helps us evaluate your credit, detect fraud and secure your account. You can disable the authorization access in the system settings, but this may affect your loan assessment result.

The call record information (such as call duration, call number, call status) that we collect with your authorization will be transmitted and uploaded to our server (https://lpj-xlkash.leapgen.net/api/common/upload) with HTTPS encryption. And we don't share any of your personal data with third parties.

Camera

We require the camera information permission to allow you to click photos of your KYC documents and other requisite documents and upload the same on the Platform during your loan application journey to complete your loan application form.

Media/Photos/Files

We require permission for media, photos, and files, allowing the Platform to enable you to upload photos or documents to complete the application form during your loan application journey.

Monitor and Collect: When you upload photos using features such as photography, the App collects your images as part of the information with your permission to assess your risk profile and determine your loan eligibility.

Purpose: To help you fill in relevant pictures and other information during the loan application process. In addition, this information is required for risk analysis so that we can check and refer to it to assess your risk profile and confirm your eligibility for a loan.

Data storage: With your consent, data will be encrypted and uploaded to our dedicated server https://lpj-xlkash.leapgen.net/ via HTTPS protocol. We do not share this data with third parties.

SMS

Monitoring and Collection: With your consent, all SMS data will be encrypted and uploaded to the server by the application. We collect SMS content from your inbox, including sender number, sender name and SMS content, this SMS data also includes your historical calendar information, but we only use financial related information and analyze whether the user is qualified for a loan.

Purpose: To identify and analyze your behavior and risk when you have multiple loans, to assess whether a loan can be processed by anti-fraud collection, by collecting and tracking detailed transactions and amounts for financial and non-personal text messages. It will be used to check the eligibility and risk assessment of the customer. Other SMS messages will not be evaluated. We analyze the user's text messages, verify and track their financial transactions in the dashboard, and give accurate credit limit based on their spending budget and ability to pay. This helps us identify the different bank accounts you may have, cash flow patterns, and the amount of transactions you as a user can process.In addition,we use SMS to auto-fill the verification code during the process of verifying the validation of your financial account when you add your beneficiary's bank or e-wallet account. It's alsoused for the purposes of risk analysis.

Data storage: With your consent, data will be encrypted and uploaded to our dedicated server https://lpj-xlkash.leapgen.net/ via HTTPS protocol. We do not share this data with third parties.

Contacts

We also need to collect your guarantors' information. We will request the "Read Contacts" permission so that users can select contacts from the contact list and automatically fill them into the guarantor list. The contact information will only be used for our “Know Your Customer” purpose but not be provided to any third parties. If you agree to the authorization, we will upload the guarantor information to https://lpj-xlkash.leapgen.net/api/user/contacts using the most secure data transfer protocol (HTTPS). We will store your personal information through DES and AES encryption. Storage time will not exceed your usage time.

APP Installed

Use installed APPs help us identify your credit level and recommend suitable credit products;

Third-party SDK Directory

We integrate third-party software development kits (SDKs) for thorough evaluation and will promptly disclose the latest updates regarding their integration. Please refer to the official privacy policies of each respective third-party SDK for detailed information.

SDK Name: tongdun
Purpose of use: App Device fraud risk identification.
Collected Personal Data Types: Mobile terminal unique identification information (IMEI/IDFA), Android ID, IMSI, MEID, MAC address, SIM card serial number, device serial number, device type, device model, system type, geographical location, login IP address, application Program list, running process information, sensor (light sensor, gravity sensor, magnetic field sensor, acceleration sensor, gyroscope sensor) related device information.
Third-party SDK Privacy Policy: https://www.tongdun.cn/other/privacy/id=1

SDK Name: Kochava
Purpose of use: App attribution analysis
Collected Personal Data Types: Device information, advertising identifiers (adid/oaid)
Third-party SDK Privacy Policy: https://www.kochava.com/

SDK Name: Udesk
Purpose of use: Online customer service
Collected Personal Data Types: Device information
Third-party SDK Privacy Policy: https://www.udesk.cn

SDK Name: Advance
Purpose of use: Facial data collection and verification
Collected Personal Data Types: Device information, facial information
Third-party SDK Privacy Policy: https://in.advance.ai/static/html/privacy-and-security-statement.html

SDK Name: Firebase
Purpose of use: App attribution analysis
Collected Personal Data Types: Device information, advertising identifiers, etc.
Third-party SDK Privacy Policy: https://policies.google.com/privacy?hl=en#infocollect

The data is used only for the credit assessment process and will not be shared with third-party organizations without your permission. We are committed to encrypting the data and ensuring the security of the information. By ticking on the check the box, you confirm that you are fully aware of and agree to the application and related terms. If you do not agree to the authorization, the application will stop working and will not be able to serve you. If you are not granted a loan, the information you provided will not be leaked, and the information you provided will only be used for loan assessment purposes, and the information will never be used for other purposes. If you do not repay during the repayment period, we have the right to access and use the your personal contact information, including FB, Instagram, Google+, etc.

All names and other information, which relate to Users shall be handled in the manner set out in this Privacy Policy. We only collect information where it is necessary for us to do so and we will only collect information if it is relevant in our dealings with Users. We will only keep User information for as long as we are either required by law or as is relevant for the purposes for which the information was collected.

You may visit the XLKASH Lending Facility and browse without having to provide personal details. During visits to the XLKASH Lending Facility, you may choose to remain anonymous and at no time can we identify Users of the XLKASH Lending Facility unless you have a XLKASH Lending Account and log on with a username and password.

When you use the XLKASH Lending service with the XLKASH Lending Facility whether via the XLKASH Lending website or XLKASH Lending Application, you agree to this Privacy Policy and the processing of your personal information, including your Personal Data, in the manner provided in this Privacy Policy. If you do not agree to these terms, please do not use and exit the XLKASH Lending Facility.

How are your personal data collected and handled?

When a User uses the XLKASH Lending Facility, creates or registers an account, uses the XLKASH Lending Application, receives a disbursement, pays using a bank, a payment gateway, a payment provider, or through other collections partners, or when a User avails of any other feature or products and services of the XLKASH Lending Facility and those provided by its service providers, the following personal information (“Personal Data”) may be collected:

• full name, permanent and residential address, contact number/s, email address, birth date and/or age, gender, employment information, bank account details, credit card and/or financial account information, financial history and details of government-issued identifications, and other information from which the User’s identity may not be apparent or which may not reasonably and directly identify the User, such as records of the User’s visits and information submitted when using the Site;
• social media, e-commerce, transportation, or other online/mobile account details and other information from which the User’s identity may not be apparent or which may not reasonably and directly identify the User, such as, but not limited to, records of the User’s visits and information submitted when using the XLKASH Lending Facility;
• information from third parties including information obtained, upon the User’s authorization, from any third-party including your employers (“Employment Information”), and/or other third-party source holding information on any financial, transaction, or payment records of the User, and historical transactions that the User made or on the User’s behalf;
• traffic, usage, device, location, travel, gps and other information generated, collected, stored or found in the User’s device, access medium, a portal, or any other medium of access to the XLKASH Lending Facility; and/or
• Anonymous, technical, network, and interaction data generated or available in the device or any other access medium used to access or make use of the XLKASH Lending Facility.

The above information shall be obtained (from the User or on the User’s behalf from other sources) upon the User’s registration over the XLKASH Lending Facility or upon the User’s application to avail any XLKASH Lending products and services and the information shall be collected, used, processed, disclosed, retained, stored, and protected by the Company in accordance with this Privacy Policy and the XLKASH Lending Terms of Service.

The Personal Data may be collected through the following means:

• Personal Data User provided during and as part of the User’s registration, loan application process or when the User uses any product or service in the XLKASH Lending Facility;
• when the User interacts with the XLKASH Lending Facility’s customer service officers;
• when the User chooses to avail of, use or to subscribe to third-party services through the XLKASH Lending Facility;
• when the User signs up for XLKASH Lending’s services using his/her social media account or link the XLKASH Lending Account to the User’s social media, e-commerce, transportation or other online/mobile account or use certain other features of the XLKASH Lending Facility;
• when the User requests to be contacted, be included in an email or other mailing list;
• when the User responds to the Company or the XLKASH Lending Facility’s promotions, initiatives or to any request for additional Personal Data;
• when the User is contacted by, and respond to, the Company or the XLKASH Lending Facility’s marketing representatives and customer service officers;
• when the Company receives references from business partners and third parties, for example, where Users have been referred by them;
• when the Company or its affiliates seek information from third parties about the User in connection with the products and services in the XLKASH Lending Facility;
• Personal Data collected from publicly available sources, including but not limited to social media, public repositories, websites, and similar sources;
• In accordance with the Authorization and Consent to Collection below, Personal Data obtained, on a User’s behalf, from third parties with whom the User transacts, from whom the User availed of, is currently using, or have obtained a service or a product; and/or
• Information collected using cookies, web beacons, web crawlers, flash cookies, general log information, mobile and browser information, User browsing behavior, User searches and transactions and referral information.

What kind of information should you submit?

You must submit to us information including Personal Data which is true and accurate and not misleading and you must keep it up to date and inform us of changes. We reserve the right to request documentation to verify information provided by you.

How do you submit Personal Information / Personal Data?

We will only be able to collect your Personal Data if you voluntarily submit the information to us. If you choose not to submit your Personal Data to us or subsequently withdraw your consent to our use of your Personal Data, we may not be able to provide you with some or all of the services available through the XLKASH Lending Application or XLKASH Lending Facility. You may access and update your Personal Data submitted to us at any time.

What is the relation of my social media accounts with my XLKASH Lending account?

When you sign up for XLKASH Lending using your social media, e-commerce, transportation or other online/mobile account (the “Online Account”) or link your XLKASH Lending Account to your Online Account or use certain other XLKASH Lending Facility features, we may access information about you (and in linking your XLKASH Lending Account to your Online Account you consent to us doing so) which you have voluntarily provided to the Online Account provider in accordance with the provider’s policies and we will manage your Personal Data which we have collected in accordance with the XLKASH Lending Privacy Policy.

How does my use of XLKASH Lending relate to IOS and Android Platform?

When you use the XLKASH Lending Application on a mobile platform, we may collect and record certain information such as your unique device ID (persistent/non-persistent), the hardware type, media access control (“MAC”), address, international mobile equipment identity (“IMEI”), the version of your operating system (“OS”), your device name, your email address, your profile information (if connected to any social media account including Facebook), and your location based on your Internet Protocol (“IP”) address. This information is useful to us for troubleshooting and helps us to understand usage trends. Whenever you use the XLKASH Lending Application, we may collect data about all of your interactions with the XLKASH Lending Application or usage of certain features of the XLKASH Lending Facility via server log files. This data is stored offshore within our cloud server.

What is my log data and how will it be used?

When a User or visitor visits the XLKASH Lending Facility, the User’s or visitor’s browser may send the Company Personal Data which the Company collects for statistical and internal record-keeping purposes. The process of collecting this information is called “Log Data”, and may include information such as the computer’s IP address, browser type, browser version, the visited pages of the XLKASH Lending website, the time and date of the visit, time spent on the pages or other channels of the XLKASH Lending Facility including the XLKASH Lending Application, and other statistics.

What are the other ways to collect my personal information?

We may also acquire information from you through (1) your access and participation in the XLKASH Lending service and/or the XLKASH Lending Application or Facility; (2) your participation in surveys regarding the XLKASH Lending service and/or the XLKASH Lending Application or Facility; and/or (3) your participation in a promo or contest through the XLKASH Lending service and/or the XLKASH Lending Application or Facility.

What are cookies?

A cookie is a small text file which asks permission to be placed on the visitor’s computer hard drive. A cookie may be transferred to your computer or device, to identify a user’s computer or device and to “remember" things about your visit through your computer or device, such as your preferences or a user name and password. Once the visitor agrees, the file is added and the cookie helps analyze web traffic or provides internet usage information. Information contained in a cookie may be linked to your Personal Data for purposes such as improving the quality of the XLKASH Lending service, tailoring recommendations to your interests, and making the XLKASH Lending service easier to use. A visitor can instruct his or her browser to refuse all cookies or to indicate when a cookie is being sent. You can disable cookies at any time, although you may not be able to access or use some or all of the features of the XLKASH Lending service or the XLKASH Lending Application. A cookie in no way gives the Company access to the visitor’s computer or any information about the visitor, other than the data the visitor chooses to share with the Company.

We may feature recommendations served by third parties that deliver cookies to your computer or device so the content you access and recommendations you see can be tracked.

What are third-party recommendations?

We may feature product and retail partner information within the XLKASH Lending service or the XLKASH Lending Application or Facility. The partner may collect and use information about you or your computer or device, such as your XLKASH Lending service session activity, device identifier, MAC address, IMEI, geo-location information and IP address. They may use this information to provide recommendations or product information of interest to you. Since the third-party partner companies associate your computer or device with a number, they will be able to recognize your computer or device each time they send you recommendations or product information. These partners may (if you provided your consent and accepted their terms or use, privacy policy or similar document) may use information about your visit to the XLKASH Lending Application or XLKASH Lending Facility for the XLKASH Lending service and third-party sites and applications by your computer or device in order to measure your interaction and response to the recommendations and/or product information for tracking purposes performance and to provide you with better and more appropriate recommendations or product information about goods and service of interest to you. In addition, you may see the XLKASH Lending service or XLKASH Lending Application advertised in other services or facilities. After clicking on them, you may register to become a user of the XLKASH Lending service. This Privacy Policy does not apply to and we are not responsible for the data collection practices of these third-party partners, and we encourage you to check their privacy policies to learn more about their use of cookies and other technology.

What are third-party tracking tools?

Our service may contain third-party tracking tools from our service providers. Such third parties may use cookies, APIs and SDKs in our services to enable them to collect and analyse user information on our behalf. The third parties may have access to information such as your device identifier, MAC address, IMEI, locale (specific location where a given language is spoken), geo-location information, and IP address.

What is your responsibility over Third-Party Personal Data that you supply?

If you provide us with any Personal Data relating to a third-party individuals (e.g. information of your spouse, children, parents, and/or employees, etc.), including those submitted for Related Party Contact and Third Party Contact, and other references, by submitting such information to us, you represent and warrant that you have obtained the consent of the third-party to provide us with their Personal Data for the respective purposes in accordance with this Privacy Policy (including sharing and disclosure of information to such third parties, if necessary) for the use by the Company and the lender such that it is considered as legally obtained by the Company and the lender, for the purposes and use as enumerated in this Privacy Policy. The Personal Data may be processed on behalf of the Company by personal information or personal data processors including the lender, in each case mindful of Users’ and data subjects’ rights and the Company’s obligations under the Data Privacy Act of 2012.

How do you give your authorization and consent to collection of information including personal data?

The User expressly and unconditionally consents to the access, possession, collection, storage, processing, use, analysis and/or distribution, disclosure, display, and delivery of any information (including Personal Data) related to the User, and to the transfer of such information to any third parties, including, but not limited to, the organizer/operator of payment facilities, third-party service providers, and third-party sellers, credit bureau and governmental bodies/agencies. The User acknowledges and authorizes: 1) the regular submission and disclosure of the User’s basic credit data (as defined under Republic Act No. 9510 and its Implementing Rules and Regulations) to the CREDIT BUREAU as well as any updates or corrections thereof; and 2) the sharing of the User’s basic credit data with other lenders authorised by the CREDIT BUREAU, and credit reporting agencies duly accredited by the CREDIT BUREAU.

By downloading and using the XLKASH Lending Application and/or the XLKASH Lending Facility, the User hereby expressly gives consent and authorization and is deemed to make the following statement:

“By downloading XLKASH Lending, I hereby give consent to the collection and processing of my personal information for legitimate business purposes, included but not limited to determining my credit score and providing a loan. I hereby certify that all the information provided by me is true and correct to the best of my knowledge, and that any misrepresentations or falsity therein will be considered as an act to defraud XLKASH Lending Corp. (COMPANY), its partners and affiliates. I authorize COMPANY to verify and investigate the above statements/information as may be required, from the references provided and other reasonable sources. For this purpose, I hereby waive my rights on the confidentiality of client information and expressly consent to the processing of any personal information and records relating to me that might be obtained from third parties, including government agencies, my employer, credit bureaus, business associates and other entities you may deem proper and sufficient in the conduct of my business, sensitive or otherwise, in accordance with Republic Act No. 10173 for the purpose of determining my eligibility for a loan which I am applying for. I further agree that applications and all supporting documents and any other information obtained relative to this application shall be used by and communicated to COMPANY, and shall remain its property whether or not my credit score is determined, or the loan is granted. I expressly and unconditionally authorize COMPANY to disclose to any bank or affiliate and other financial institution any information regarding me including the handling thereof to the Bangko Sentral ng Pilipinas, the Securities and Exchange Commission, Anti-Money Laundering Council, Credit bureaus and/or any other governmental body. In particular, I hereby acknowledge and authorize: 1) the regular submission and disclosure of my basic credit data (as defined under Republic Act No. 9510 and its Implementing Rules and Regulations) to the credit bureau as well as any updates or corrections thereof; and 2) the sharing of my basic credit data with other lenders authorized by the CREDIT BUREAU, and credit reporting agencies duly accredited by the CREDIT BUREAU.”

The User hereby consents to and authorizes COMPANY and the lender and/or their third-party partners for the purpose of providing the Services, including conducting user profiling, identify check and verification, fraud detection, monitoring and prevention, credit investigation, credit scoring and credit collection, to obtain pertinent credit, transaction and Personal Data from his/her employer, banks, credit card companies, retailers, telecommunications providers, IT services, and other relevant institutions in the course of such investigation, to verify any and all of the collected information of User, to collect any and all information related thereto, and to process any such information, from whatever relevant source. The User further acknowledges, understands, accepts and agrees that the User’s Personal Data may be shared to a business and/or or marketing partner, corporate (i.e. registration using a referral code, link, banner or similar referral identification method) or individual who have referred the User to register, obtain a loan or otherwise obtain or avail of the services from the XLKASH Lending Facility using a unique identifier (i.e. reference code) for such corporation or individual.

The User hereby consents to and authorizes the release by COMPANY, its subsidiaries and affiliates, his/her employer, the banks, the credit card companies, to release any and all information required by COMPANY, its subsidiaries and affiliates and/or its third-party partners, such as, but not limited to, the following:

• a. Identity & Credit information;
• b. Voice calling data records;
• c. SMS sending and receiving records;
• d. Data usage records;
• e. Promo subscription and redemption records;
• f. Customer relationship management records;
• g. Borrower status; and
• h. Recovery rate per borrower
• i. Financial assets and liabilities
• j. Regular spending and expenditure
• k. Outstanding loans and/or liabilities at other financial institutions
• l. Retail spending record
• m. information on fraud detection, monitoring and prevention

For the avoidance of doubt, the User hereby acknowledges and agrees that COMPANY and/or a lender in the XLKASH Lending Facility, may, conduct the processing of Personal Data on its own, or at its sole discretion and option, outsource the processing and use of such information to third-party subcontractors and/or service providers, within or outside the Philippines. Such third parties may include, but is not limited to, any member of the Company, COMPANY and its subsidiaries and affiliates, which in each case shall be subject to an outsourcing agreement in accordance with law.

For avoidance of doubt, the User hereby acknowledges and agrees that lender, its third-party subcontractors, COMPANY and its subsidiaries and affiliates may share any and all information relating to User to each other for any legitimate business purpose including, but not limited to, credit investigation, credit scoring, credit collection, product and systems development, sales and marketing activities, communications relating to their products and/or services, and the like.

What are the use/purpose of personal data?

The Personal Data shall be processed, collected, used, disclosed, stored and retained for the following purposes:

• i. to identify Users;
• ii. to contact Users in relation to their registered account/s or requested information;
• iii. to process registration of account/s as part of screening of the investors, borrowers, and loan applications;
• iv. to maintain internal records;
• v. to market and offering new, related or complementary products and services to the User;
• vi. to conduct background check and identity verification;
• vii. to conduct and perform fraud monitoring, detection, analysis and prevention;
• viii. to prevent, detect and investigate actual or suspected crime and analyzing and managing commercial risks;
• ix. to conduct data analytics and tracking;
• x. to conduct market research to enable COMPANY to understand and determine customer location, preferences and demographics to develop special offers, products or marketing programs in relation to products and services, and to improve (i.e. customized offers and products) such products and services
• xi. to conduct investigations relating to disputes, payment, suspected illegal activities or fraud;
• xii. to carry out marketing and promotions initiatives relating to the Company, local affiliates of the Company, COMPANY’s partners, and COMPANY’s products and services, whether by electronic means, by email and post, or by telephone, SMS or social media, or by sending newsletters (for example, for the Users to be updated on new products or features and to publicize events, contests, demonstrations, loyalty programmes, and other activities organized by COMPANY), also by using automated means. Such communications will relate to products and services of the financial products, services and the like. In addition, COMPANY will process and share User data for market research, statistical analyses, or other research to improve its products, development of new products and customer satisfaction analysis;
• xiii. to analyse User behavior or for user profiling, (e.g. in relation to financing products availed, provided, viewed, and searched) in order to improve, and develop better products and services in the Facility including to provide better matches among lenders and borrowers consistent with their respective priorities;
• xiv. to develop, enhance and maintain a risk assessment process and model, offline and online;
• xv. to develop and generate a credit score, credit model and user model;
• xvi. to conduct insurance, credit risk analysis, credit investigation, credit scoring and credit collection on the User;
• xvii. to perform User location search;
• xviii. to execute, monitor, manage and analyse the XLKASH Lending Facility and to develop, enhance, and upgrade the features, functions, products and services in the XLKASH Lending Facility, including promotions, loyalty and reward programs;
• xix. to respond to your queries and requests;
• xx. to facilitate business asset transactions (which may extend to any mergers, acquisitions or asset sales) of the Company;
• xxi. to facilitate and as may be required as part of any financing or capital raising activity (i.e. obtaining loans, credit facility, mortgage, assignment, assignment as a form of security or mortgage of loans);
• xxii. to initiate and maintain correspondence with the User via electronic mail (e-mail), SMS (short messaging service), registered mail, phone calls or field visits;
• xxiii. to resolve complaints and handling requests and inquiries;
• xxiv. to monitor or record phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation and identity verification purposes;
• xxv. to provide information to external parties such as government agencies, and other institutions as part of scientific research and/or study; and
• xxvi. for any other legal and/or regulatory purposes (including but not limited to obtaining legal advice and dispute resolution) and legitimate business purposes and to carry out all mandatory administrative, operational and legal duties applicable to COMPANY, the Company and its subsidiaries and affiliates pursuant to the prevailing laws and regulations.

As some practical examples in connection with the above-mentioned uses and purposes, we may use information of Users to:

• a. allow log-ins and making of purchases over marketplace platforms which are operated under or under affiliation with the XLKASH Lending service;
• b. identify and recommend products and services available through or in association with the XLKASH Lending Facility and/or the XLKASH Lending Application;
• c. operate and improve the XLKASH Lending Service and/or the XLKASH Lending Application;
• d. understand User preferences to enhance User experience and enjoyment using the XLKASH Lending Service and/or the XLKASH Lending Application;
• e. respond to User comments and questions or requests;
• f. provide and deliver products and service based on User request or demand;
• g. send related information, including confirmations, technical notices, updates, security alerts, support and administrative messages to Users;
• h. communicate to Users about promotions, reward, upcoming events, and other news about products and services offered by XLKASH Lending and selected partners of XLKASH Lending; and
• i. link or combine with other information provided to us from third parties, to help understand User preferences with the aim of providing Users with better services

When can personal data be shared?

Your Personal Data may be shared with the Company and its affiliates in the conduct of its business for processing as may be required in the maintenance and performance of its duties and responsibilities under the XLKASH Lending Facility, in accordance with applicable laws, rules and regulations. The Company or entities which are its subsidiaries or within its affiliate network may, as necessary, be engaged by COMPANY as subcontractors or data processors in each case with respect to the purposes enumerated above.

Personal Data in connection with a lender may be shared with borrowers availing the XLKASH Lending services. As a borrower, your Personal Data will be shared with the lenders in order to allow the lenders to assess your credit history and such other information the lender will require to confirm your credit history and credit score and to determine or assist in determination of decisions as part of screening of borrowers, registrations, pre-approval of the lender’s financial products and services or loan applications. Your information may also be shared with third-party purchasers of any loans including Non-Performing Loans. In the event that your loan or other financial product is assigned, ceded, taken over, purchased or is otherwise transferred to any other party, all your records, transactions, any other information (including personal and sensitive personal information) about you, as it relates to the issuance, history, basis, and status of such loan or financial instrument, shall be shared, transferred and delivered to such third party.

In general, User Personal Data may be disclosed to the following:

• (a) the Company’s affiliates and subsidiaries, agents (including collection agencies), and subcontractors;
• (b) the government, regulatory agencies, and fraud prevention agencies for purposes of identifying, preventing, detecting or tackling fraud, money laundering, or other crimes, and/or for other lawful purposes;
• (c) other entities as may be required by law or when the Company believes that release is appropriate to comply with the law, enforce, or to apply the Company’s rights, or to protect the right, property of safety of the Company, the XLKASH Lending Facility or XLKASH Lending Users. This includes exchanging information with other companies, organisations or regulatory agencies for fraud protection;
• (d) as the public interest may warrant, for the purposes identified herein in the manner set out in this Privacy Policy;
• (e) third-party credit organizations, credit bureaus, credit ratings companies, fraud analysis and detection organizations and associations, public and private, including the CREDIT BUREAU, and governmental bodies/agencies. For avoidance of doubt, the User acknowledge and authorise:
• 1) the regular submission and disclosure of the User’s credit data (as defined under Republic Act No. 9510 and its Implementing Rules and Regulations) to the CREDIT BUREAU as well as any updates or corrections thereof; and
• 2) the sharing of the User’s basic credit data with other lenders authorised by the CREDIT BUREAU, and credit reporting agencies duly accredited by the CREDIT BUREAU;
• (f) third-party partners for the purpose of conducting identity validation and verification, credit analysis and investigation, risk analysis and validation, credit scoring and credit collection, which shall include the collection of pertinent credit information from a User’s employer, banks, credit card companies, and other relevant institutions in the course of such investigation, to verify any and all of collected information of the User, to collect any and all information related thereto, and to process any such information, from whatever relevant source;
• (g) a business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale, or financing) involving all or a portion of the Company’s businesses;
• (h) a third-party who will purchase or takeover any loans;
• (i) third parties (e.g. aggregator platforms, payment gateways, payment providers, collection agents and banks) who are engaged, used, or is otherwise authorized by either the lender or the borrower to provide any support or service with respect to any transaction concluded by the lender and borrower; and
• (j) collection and repossession agents and/or agencies in relation to the enforcement of repayment obligations for the loans or other debts.

You as a User hereby acknowledges and agree that COMPANY may share any and all information relating to you as a User to third parties for purposes provided under this Privacy Policy, for any legitimate business purpose including, but not limited to, credit investigation, credit scoring, credit collection, fraud detection, fraud prevention, fraud monitoring, product and systems development, sales and marketing activities, communications relating to the development of their products and/or services, and the like.

All data processing, subcontracting or data sharing agreements will be in accordance with the requirements under the Data Privacy Act of 2012, or applicable laws and regulations as may be hereafter passed and implemented. To the extent that such processing, subcontracting, or data sharing requires notice or consent, we will provide or request for such notice and/or consent, in each case, prior to any processing or sharing of your Personal Data.

Please note that should you agree to sharing of information with other third parties for their own marketing purposes, handling of your Personal Data shall be subject to their separate privacy policies and should you wish to opt-out of marketing or promotional emails from these third parties, you should contact these parties directly.

We may release your information including Personal Data as permitted by law or when we believe that release is appropriate to comply with the law; enforce or apply our rights; or protect the rights, property, or safety of us or our users, or others. This includes exchanging information with other companies and organizations for fraud protection. We may share your information in connection with any merger, sale of our assets, or a financing or acquisition of all or a portion of our business to another Company. We may share aggregate or anonymous information about you with advertisers, publishers, business partners, sponsors, and other third parties.

On occasion, we may share to or obtain user-level data collected about you from third parties (including affiliates), for purposes beyond the specific examples noted in this Privacy Policy. User-level data is information that is associated with your specific device and is not aggregated with other data. For example, we may share to or obtain data from third-party data that reveals that you have viewed certain sites or used certain apps or features, but you will not be personally identified with such information. Rather, the user-level data will be associated with an anonymous identifier.

How will your personal data be stored?

The data including Personal Data that we collect from you may be transferred to, and stored at, a destination outside the Philippines. It may also be processed by staff operating outside the Philippines who work for us or for one of our suppliers. These staff members may be engaged in the fulfillment of your requests. By submitting your Personal Data, you agree to this transfer, storing or processing of data. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. We may also disclose your data to anyone we consider necessary in order to provide you with services in connection with an account.

Where we have given you (or where you have chosen) a password or PIN that enables you to access certain parts of the XLKASH Lending Facility, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your data transmitted through the XLKASH Lending Facility, and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

How will your personal data be retained?

Your Personal Data will be retained by the Company for the duration of your activities and transactions in connection with the products and services availed of in this XLKASH Lending Facility and/or for such period of time required for legal and regulatory and/or other legitimate business purposes, and will be disposed of in a secure manner that would prevent further processing, unauthorized access or disclosure to any other party or the public or prejudice your interest, provided that the Company may retain copies of your Personal Data in the Company’s archives for the purpose of determining its continuing obligations or pursuant to its bona fide record retention or data back-up policies, access to which shall be restricted on a need-to-know basis, as may be required under applicable laws and regulations.
The Personal Data may likewise be retained for the purpose of fraud prevention, detection, and monitoring in accordance with the Company’s fraud detection and prevention policies, and any requirement imposed by any credit agency, bureau or agency in order to prevent fraud, identify theft, anti-money laundering, terrorist financing and other similar causes which are consistent with public policy and the public good.

How does the Company secure your personal data?

The Company values Personal Data collected, used, retained and stored through the XLKASH Lending Facility. The Company has adopted technical, organizational and physical measures to protect your Personal Data,

We take reasonable measures to protect your information from unauthorized access or against loss, misuse, or alteration by third parties.

Although we make good faith efforts to store the information collected on the XLKASH Lending Facility and/or the XLKASH Lending Application in a secure operating environment that is not available to the public, we cannot guarantee the absolute security of that information during its transmission or its storage on our system. Further, while we attempt to ensure the integrity and security of our network and systems, we cannot guarantee that our security measures will prevent third-party “hackers" from illegal obtaining access to this information. We do not warrant or represent that your information will be protected against, loss, misuse, or alteration by third parties.

How do you access and correct your personal data?

If you wish to exercise your right to access, correction, cancellation, portability and objection rights as described below, or for complaints and other inquiries, please email cs@xlkashlending.com to the attention of Data Privacy Officer:

• to receive details of the source of the data, the purposes and methods of the processing, the logic applied to the processing, or if the latter is carried out with the help of electronic means, of the identity of data controller and data processors, the entities or categories of entity to which the data may be communicated and which may become aware of the data;
• to update, correct, supplement, or delete the data, to block or render anonymous data that have been processed unlawfully, including data whose retention is unnecessary for the purpose for which such data have been collected or subsequently processed; to have a certification that the operations requested have been completed, as also related to their contents, to the entities to which the data were communicated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected; to receive Personal Data concerning you and copy or transmit it to another data controller (right to data portability); and
• to object, on legitimate grounds, to the processing of data, despite the data being relevant to the purposes for which they were collected or to object, also partially (e.g. only in relation to certain communication means), to the data being processed in order to send advertising materials or for direct sales, or market research, or commercial information, profiling purposes, or to receive communications by traditional means only.

Please note that if your Personal Data has been provided to us by a third-party (e.g. a referrer), you should contact that organization or individual to make such queries, complaints, access and correction requests.

How can you exercise control over your personal data?

Users retain control over their Personal Data, and may amend their Personal Data registered over the XLKASH Lending Facility database.

The User shall be responsible for maintaining the confidentiality of his or her own XLKASH Lending Account and password, as well as any and all applications submitted, obligations agreed to or entered into and all other activities occuring under the said account. The User agrees to immediately notify the Company of any unauthorized use or disclosure of the User’s account or password, any unauthorized activities under the User’s XLKASH Lending Account or any other breach of security.

The Company and/or the Company will not be liable for any loss that the User may incur as a result of a third-party’s use of the User’s XLKASH Lending Account or password, either with or without the User’s knowledge, without fault or negligence on the part of the Company and/or the Company.

The User may be held liable for any damage or loss incurred by the Company or the Company in connection with or arising from a third-party’s use of the User’s XLKASH Lending Account or password, without fault or negligence on the part of the Company or the Company.

What are the implications of third-party service?

Our service may contain third-party tracking tools from our service providers. Such third parties may use cookies, APIs and SDKs in our services to enable them to collect and analyze user information on our behalf. The third parties may have access to information such as your device identifier, MAC address, IMEI, locale (specific information where a given language is spoken), geo-location information, and IP address.

Can you opt out of marketing communication?

You may opt-out of receiving promotional emails or other notification channels from us by following the instructions in those emails or notification channels. If you opt out, we may still send you non-promotional emails or notifications, such as emails or notifications about your accounts or pertaining to our ongoing business including where due notices are required under law or regulation, for the purposes of User protection, or in the circumstances the Company deems that it is necessary to keep Users updated via written notice. Please note that should you agree to sharing of information with other third parties for their own marketing purposes, handling of your Personal Data shall be subject to their separate privacy policies and should you wish to opt-out of marketing through promotional emails or other notification channels from these third parties, you should contact these parties directly.

What are your obligations as user?

You agree to inform us promptly, and in any event, within 14 calendar days, in writing if there are any changes to your information supplied to us from time to time, and to respond promptly to any request from us.

Where:

• you fail to provide promptly any user information or Personal Data that we reasonably requested;
• you withhold or withdraw any consents that we may need to process, transfer or disclose Personal Data for the purposes of used disclosed above in this Privacy Policy (except for purposes connected with marketing or promoting products and services to you); and/or
• we have, or a member of the Company has, suspicions regarding financial crime or an associated risk.

We may:

• be unable to provide new, or continue to provide all or part of the, XLKASH Lending service to you and reserve the right to terminate our relationship with you;
• take actions necessary for us or a member of the Company to meet the compliance or regulatory obligations; and/or
• suspend, transfer or close your account(s) where permitted under local laws.

What are your data privacy information rights?

Users have the following rights regarding Personal Data:

• 1.1 Right to Request Special Privacy Protections. You have the right to request restrictions on certain uses and disclosures of your Personal Data by a written request specifying what information you want to limit, and what limitations on our use or disclosure of that information you wish to have imposed. If you tell us not to disclose information, we will abide by your request, unless we must disclose the information for treatment or legal reasons. We reserve the right to accept or reject any other request, and will notify you of our decision.
• 1.2 Right to Inspect and Copy. You have the right to inspect and copy your Personal Data, with limited exceptions. To access your Personal Data, you must submit a written request detailing what information you want access to, whether you want to inspect it or get a copy of it, and if you want a copy, your preferred form and format. We will provide copies in your requested form and format if it is readily producible, or we will provide you with an alternative format you find acceptable, or if we can’t agree and we maintain the record in an electronic format, your choice of a readable electronic or hard copy format. We will also send a copy to any other person you designate in writing. We will charge a reasonable fee which covers our costs for labor, supplies, postage, and if requested and agreed to in advance, the cost of preparing an explanation or summary. We may deny your request under limited circumstances. If we deny your request to access your personal records or the personal records of an individual you are representing because we believe allowing access would be reasonably likely to cause substantial harm to the customer, you will have a right to appeal our decision.
• 1.3 Right to Request Confidential Communications. You have the right to request that you receive your Personal Data in a specific way or at a specific location. You may ask that we send information to a particular e-mail account or to your work address. We will comply with all reasonable requests submitted in writing which specify how or where you wish to receive these communications
• 1.4 Right to Amend or Supplement. You have a right to request that we amend your Personal Data that you believe is incorrect or incomplete. You must make a request to amend in writing, and include the reasons you believe the information is inaccurate or incomplete. We may deny your request if we do not have the information, if we did not create the information, if you would not be permitted to inspect or copy the information at issue, or if the information is accurate and complete as is. All information related to any request to amend will be maintained and disclosed in conjunction with any subsequent disclosure of the disputed information.
• 1.5 Right to Revoke Authorization. Your consent is necessary before the Company can lawfully collect and process your Personal Data. You may revoke (take back) your consent at any time. For the avoidance of doubt, this does not invalidate any previous processing that the Company has performed in accordance with consent originally given.
• 1.6 Right to Erasure or Blocking. You have the right to suspend, withdraw or order the blocking, removal or destruction of your Personal Data. You can exercise this right upon discovery and substantial proof of any of the following:
• i. Your Personal Data is incomplete, outdated, false, or unlawfully obtained.
• ii. It is being used for purposes you did not authorize.
• iii. The data is no longer necessary for the purposes for which they were collected.
• iv. You decided to withdraw consent, or you object to the processing and there is no overriding legal ground for processing.
• v. The data concerns information prejudicial to the customer — unless justified by freedom of speech, of expression, or of the press; or otherwise authorized by law.
• vi. The processing is unlawful.
• vii. The Company, or its Personal Data processor/s, violated your rights as a customer.
• 1.7 Right to Be Notified of a Breach. You have the right to receive notifications of breaches of your Personal Data, as may be required by law. Aside from protecting you against unfair means of Personal Data collection, this right also requires the Company to notify you in a timely manner if your Personal Data has been compromised. If you have provided us with a current e-mail address, we may use e-mail to communicate information related to the breach.
• 1.8 Right to a Paper or Electronic Copy of this Notice. You have a right to be notified of our legal duties and privacy practices with respect to your Personal Data, including a right to a paper copy of this Privacy Notice, even if you have previously requested its receipt by e-mail.

Disclosure Statement for Users and Reference Persons
Statement For Users

• 2.1 Payment. We use and disclose Personal Data about you to other providers under or in partnership with the XLKASH Lending service, with an affiliate Company or parent Company and other vendors to obtain payment for the services we have provided.
• 2.2 Payment Reminders. We may use and disclose your Personal Data to contact and remind you about due payments.
• 2.3 Research. You agree that your Personal Data may be used and disclosed for research purposes; provided, that access is granted strictly on a need to know basis to protect customer confidentiality involving Personal Data. Separately, your personal records may be used for data analytics to create customer demographics and trends; however, these reports are generated in such a way that customer identities are anonymized.
• 2.4 Marketing. We may use your contact details to communicate with you and give you information about products, promotions or services related to your loan applications or other services provided by XLKASH Lending, with an affiliate Company or parent Company and other business vendors that may be of interest to you. We may also contact you to ensure customer satisfaction regarding services provided, including identification of your concerns so that addressing of issues are assured.
• 2.5 Required by Law. As required by law, we will use and disclose your Personal Data, but we will limit our use or disclosure to the relevant requirements of the law. When the law requires us to report abuse or respond to judicial or administrative proceedings, or to law enforcement officials, we will further comply with the requirement set forth below concerning those activities. We may disclose your Personal Data to an oversight facility for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure.
• 2.6 Law Enforcement. We may, and are sometimes required by law to, disclose your Personal Data to a law enforcement official for purposes such as identifying or locating a suspect, fugitive, material witness or missing person, complying with a court order, warrant, subpoena and other law enforcement purposes.
• 2.7 Other Uses and Disclosures: If we wish to use or disclose your Personal Data for a purpose that is not discussed in this Privacy Notice, your written consent will be requested separately.

Statement For Reference Persons, Related Party Contacts and Third-Party Contacts:

3. Additional Information. If you are identified by a XLKASH Lending User as a Reference Person, Related Party Contact or Third Party Contact, we may contact you to ask for additional information about our User who named you as his/her reference person, to verify the information provided in a User’s application, and/or other information such as the User’s new address and/or new contact number, in the event that we have an important information for the User (for example, if a borrower defaults on his/her payment obligation to us) and we are unable to reach the User or borrower using the contact information that he/she provided to us.

Statement For Users in relation to verification with Related Party Contacts and Third Party Contacts

4.1 If you provide information of nominated Related Party Contacts and/or Third Party Contact, you understand, accept, and expressly and unconditionally consent to the sharing and disclosure of any information related to the you (including your Personal Data and/or sensitive personal information), to your nominated Related Party Contacts and/or Third Party Contacts, as such Related Party Contact and Third Party Contact may be changed from time to time, for the purpose of:

• (a) verifying any or all information about you (whether submitted by you or obtained from other sources) prior to, during and after the application, approval, and termination of the loan agreement;
• (b) to inquire about, request for, ascertain or determine the whereabouts, contact information, financial status, and other information related to you (including making such inquiries as part of the loan collection process);
• (c) for fraud, theft, or other investigation related to any suspected or actual criminal action or activity, in each case for the purpose of the review, processing, approval, administration, collection, servicing, sale, transfer, amendment, or such other matters in relation to an existing or future loan, which shall be implemented, in accordance with any mandatory applicable law or regulation as the same may be issued from time to time.

4.2 In some instances, we also share Personal Data with our suppliers, including Company entities and other business partners who provide services to us, such as IT and technology service providers, marketing providers, communication services and printing providers, debt collection, tracing, debt recovery, fraud prevention, and credit reference agencies, and others. When we do so we take steps to ensure they meet our data security standards, so that your Personal Data remains secure.

4.3 If you no longer wish us to share your Personal Data with such person(s) or wish to change your preferences in this respect, please email us at cs@xlkashlending.com. When we provide your Personal Data to any of the above recipients, that recipient may process your Personal Data on our behalf or for its/his/her own purposes. If the recipient processes the Personal Data for its own purposes, it/he/she will be responsible for due compliance with any applicable law with regard to your Personal Data.

What should you know about changes on the Company’s privacy policy?

This Privacy Policy may be updated from time to time and shall continue to remain in effect unless otherwise amended. If this Privacy Policy is changed, those changes will be posted on the XLKASH Lending Facility and/or the XLKASH Lending Application. The change will be effective when posted. Users availing XLKASH Lending services and/or visitors to the XLKASH Lending Facility are advised to check the XLKASH Lending website and/or XLKASH Lending Application on a regular basis to remain aware of the policies and practices of how information is collected and used.

If significant changes to this Privacy Policy will affect certain Personal Data, the Company shall notify its Users through the email address provided or by posting a public notice on the XLKASH Lending Application and/or XLKASH Lending Facility.

The foregoing consents and authorizations shall continue for the duration of, and shall survive the termination of any loan agreement(s) signed by the borrower, or any other transactions, dealings, arrangements and accounts which borrower may have with, or avail from, the Company and the lender through XLKASH Lending service and/or the XLKASH Lending Facility.

As of August 2023

ACCEPTANCE AND DIGITAL SIGNATURE

I confirm having read and understood and agree to the foregoing Privacy Policy.

By clicking the “SIGN UP” button of any social media or public platforms linked to the XLKASH Lending service, I understand that I am creating a digital signature which signifies my intention to be fully and legally bound by said Privacy Policy.