Privacy Policy

This Privacy Policy (“Policy”) describes how Tiwala Lending Investor, Inc. (“Company”, “we”, “us”, or “our”), operator of the Tiwala Express mobile application (“App”), collects, uses, stores, shares, and protects the personal information of users (“you” or “User”) in connection with the App and this website.

Tiwala Express is in development. This Policy applies to this website now, and to the App when it is released. It is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations. By using this website, or by downloading, registering, or using the App once it is available, you acknowledge the practices described here.

1. Compliance with Philippine data privacy law

We comply with the Data Privacy Act of 2012 and its Implementing Rules and Regulations. We process personal data fairly, lawfully, and transparently, and follow the principles of transparency, legitimate purpose, and proportionality.

2. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee compliance with the Data Privacy Act and to protect personal data. You may contact the DPO at:

• Email: [email protected]
• Support: [email protected]
• Customer service: [email protected]
• Address: 105 5-D2, 5th Floor, Valero Once Center, Valero Street, Salcedo Village, Bel-Air, City of Makati 1227

3. Information we collect

When the App is available, we may collect the following categories of personal and sensitive personal information. This website itself does not ask you to submit an application.

3.1 Information you provide

• Full legal name, date of birth, gender, civil status, and nationality
• Government-issued ID, such as SSS, GSIS, PhilHealth, passport, driver’s license, UMID, or voter’s ID
• Residential and permanent address
• Mobile number and email address
• Employment information, including employer, position, income, and length of employment
• Business information where an application is for business financing
• Bank account or e-wallet details for disbursement and repayment
• Loan details you choose to submit, such as purpose, amount, and preferred terms

3.2 Information collected automatically

• Device model, operating system, and device identifiers needed to run and secure the App
• IP address, mobile network, and approximate location, where you allow it
• App usage logs and interaction data
• SMS data only if you grant that permission, and only for the purposes in Section 4

3.3 Information from third parties

• Credit bureau reports, including the Credit Information Corporation (CIC), where the law allows
• Identity verification and KYC service providers
• Partner financial institutions and payment processors

4. Permissions on your phone

The App may ask for the permissions below. Each request is separate, and each one explains why it is needed. You can refuse or later turn a permission off in your device settings. Some checks may then be unavailable.

4.1 SMS

We use the mobile number you give us to send service messages that are not marketing. These include one-time passwords, security alerts, application updates, disbursement and repayment notices, repayment reminders, and customer-service messages.

If you expressly allow it, the App may read SMS from a limited recent period that is relevant to an application, identity checks, risk assessment, fraud prevention, account security, or repayment capacity. That may include the sender, message content, time, and records tied to transactions, income, bills, or account security.

We do not use SMS data for advertising, sell it, or use it for a purpose unrelated to the lending service. We do not disclose it to an unrelated third party without your consent, unless the law allows it. You may ask us to delete personal data by emailing [email protected]. We will respond within 3–5 business days after we verify the request, except where the law, a loan record, an audit, a dispute, or a regulator requires us to keep it.

4.2 Camera

To meet SEC and other know-your-customer requirements, the App may use the camera only while you start an identity check. The camera is used to photograph a government ID, take a selfie or liveness check, confirm that you match the ID, and reduce identity fraud. The App does not use the camera in the background, does not record unrelated audio or video, and does not open your photo library or other local files for this purpose.

4.3 Approximate location

The App does not ask for precise GPS and does not track your location in the background. To confirm that a service is available and to reduce fraud, we may use the address you type, the broad region suggested by your IP address or network, or non-precise location you choose to allow. That information is not used for advertising.

4.4 Installed applications

If you expressly allow it, the App may collect the names, package names, versions, and install or update times of applications on the device, together with related device-risk signals. The purpose is to detect fraud, bots, cloned devices, emulators, and similar risks. We do not read chats, files, photos, or account contents inside other apps. This information is not used for advertising and is not sold.

4.5 Emergency contacts

We may ask for up to two references: name, relationship, and phone number. You enter these yourself. We do not upload your full address book or any contact you did not choose to submit. Please provide a reference only if you have a proper basis to do so. References are used for identity checks, application review, account security, fraud prevention, or lawful repayment communication. They are not used for advertising.

4.6 Device and app status

We may collect device model and brand, operating system, app version, language, network type, carrier, IP address, crash logs, and security events. We do not collect IMEI, IMSI, or SIM serial numbers for marketing. This information keeps the App working, supports security, and helps us meet legal duties.

5. Why we process personal data

Each purpose rests on a lawful basis under the Data Privacy Act:

• Application review, credit assessment, and underwriting — contract and legitimate interest
• Identity checks and fraud prevention — legal obligation and legitimate interest
• Disbursement and repayment — contract
• Customer support — legitimate interest and consent
• Reports required by the SEC or other authorities — legal obligation
• Improving the service — legitimate interest
• Marketing — only with a separate consent

6. Sharing

We do not sell personal information. We may share it with:

• Credit bureaus and the Credit Information Corporation, where the law requires it
• Providers who host systems, process payments, verify identity, or send SMS, under a contract that limits their use of the data
• Collection agents, only under a data-processing agreement and SEC Memorandum Circular No. 18, Series of 2019
• Regulators, courts, and law enforcement when the law requires it
• A buyer or successor if the business is merged, sold, or reorganized

7. Collection practices

In line with SEC Memorandum Circular No. 18, Series of 2019 and Republic Act No. 11765, we commit that:

• We will not contact people in your contact list to collect a debt
• We will not send harassing, threatening, or abusive messages
• We will not publish your debt or personal information
• Collection is done only by identified, authorized personnel
• You may complain to the SEC about abusive collection

8. How long we keep data

• Records of an active loan: for the life of the loan and up to five (5) years after it is fully paid
• Declined applications: up to two (2) years
• Identity records: for the period required by KYC and anti-money-laundering rules
• Marketing data: until you withdraw consent

After that, we delete the data or anonymize it.

9. Security

We use technical and organizational measures suited to the data, including encryption in transit, access limits for staff, security reviews, and a process for incidents. If a breach is likely to affect your rights, we will notify the proper authority within 72 hours and tell affected people without undue delay.

10. Your rights

Under the Data Privacy Act you may:

• Be informed of how your data is collected and used
• Access a copy of the personal data we hold
• Correct data that is wrong or incomplete
• Erase or block data when the law allows it
• Object to processing based on legitimate interest, including direct marketing
• Data portability, where it applies, in a commonly used format
• Complain to the National Privacy Commission

If a lending decision uses automated scoring, you may ask for that fact and request a review by a person. Write to [email protected]. We will answer within fifteen (15) business days.

11. Cookies and this website

This website does not use tracking or advertising cookies. The App, once released, may use analytics tools that collect usage data needed to understand performance. You can limit analytics in your device settings.

12. Minors

The service is not for anyone under 18. We do not knowingly collect a minor’s personal data. If you believe we have, contact us and we will delete it.

13. Changes

We may update this Policy. We will post the new version on this website and, once the App is live, notify users of a material change at least seven (7) days before it takes effect.

14. Contact

• Company: Tiwala Lending Investor, Inc.
• App: Tiwala Express
• SEC Registration No.: 2026070257152-03
• Authority to Operate No.: L-26-1120-9
• DPO: [email protected]
• Customer service: [email protected]
• Support: [email protected]
• Address: 105 5-D2, 5th Floor, Valero Once Center, Valero Street, Salcedo Village, Bel-Air, City of Makati 1227

This Policy is in English. If a translation conflicts with it, the English text prevails.

See also the Terms & Conditions.

Last updated: October 22, 2026