1. Introduction
This policy explains how we collect, use, store, share, protect, and dispose of personal data in the course of providing our financial and lending services.
2. Personal data we collect
We collect personal, sensitive personal, and financial information necessary for loan processing, account management, and regulatory compliance.
Personal information
- Full name
- Home and work address
- Contact details (mobile, email, landline)
- Date of birth, age, nationality, and civil status
Sensitive personal information
- Government-issued IDs (e.g., UMID, Driver’s License, Passport, TIN, SSS)
- Employment details
- Income and financial capacity
- Bank statements, payslips, and COE
- Beneficiary or dependent information
Financial & transaction information
- Loan application details
- Payment history
- Credit standing
- Collateral information, if applicable
Information collected through interactions
- Call recordings
- Emails and online forms
- CCTV footage at DCFC offices
- Website and digital platform activity logs
Information from third-party sources
- Credit bureaus
- Partner banks
- Insurance companies
- Government agencies (e.g., SSS, BIR, SEC)
3. Legal basis for processing
- Contract — processing necessary for loan evaluation, approval, servicing, and account management
- Legal obligation — compliance with AMLA, KYC, BIR, SEC, and other regulatory requirements
- Legitimate interest — fraud prevention, credit risk assessment, and identity verification
- Consent — for marketing, optional services, and non-mandatory data collection
4. Purpose of processing
- Loan application evaluation and verification
- Credit scoring and risk assessment
- Insurance underwriting and claims processing
- Customer onboarding and account servicing
- Collections and payment monitoring
- Compliance with AMLA, KYC, and regulatory reporting
- Customer support and dispute resolution
- Marketing of products and services, with consent
- Business analytics and service improvement
5. Data sharing and disclosure
We share personal data only when necessary, lawful, and consistent with the purposes stated in this policy.
Financial institutions
We may share data with insurance companies, banks, financing companies, and credit bureaus for credit evaluation, loan and insurance underwriting, risk assessment, fraud prevention, and regulatory compliance. All such sharing is covered by a Data Sharing Agreement or equivalent legal instrument.
Collection agencies and service providers
Accredited collection agencies may process data for overdue-account collection, skip tracing, repayment arrangements, and enforcement of contractual obligations. We may also engage processors for IT, cloud hosting, customer service, document management, and consent-based marketing. These parties operate under appropriate data-sharing or outsourcing agreements and security obligations.
Government agencies and cross-border transfers
We may disclose data to AMLC, BIR, SEC, law enforcement, and other agencies as required by law. Where a provider or financial partner uses systems outside the Philippines, we ensure adequate safeguards and compliance with NPC requirements.
6. Your rights
Under RA 10173, you have the following rights:
- Right to be informed
- Right to access
- Right to rectification
- Right to erasure or blocking
- Right to object
- Right to data portability
- Right to damages
- Right to file a complaint with the NPC
7. Data security measures
DCFC implements administrative, physical, and technical safeguards, including privacy policies and training, secure office premises and controlled storage access, encryption, firewalls, multi-factor authentication, regular backups, and audit logging.
8. Data breach management
Our breach-response protocol includes immediate containment and assessment, escalation to the Data Protection Officer, notification to the NPC within 72 hours when required, notification to affected individuals where there is a risk of harm, and documentation of all incidents.
9. Policy updates
We may update this policy to reflect changes in regulations or business processes. Updates will be posted on our website or communicated through appropriate channels.