Cashalo Privacy Portal

Privacy Notice

This privacy notice is intended to provide you with the information required under the Philippines’ Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its corresponding implementing rules and procedures (“IRR”), and other issuances of the National Privacy Commission (“NPC”) (hereinafter, collectively referred to as the “DPA”), regarding how Paloo Financing Inc ("PFI" or "Cashalo") processes your personal data and/or sensitive personal data you submit via this privacy portal (hereinafter, collectively referred to as “Personal Data”).

(a) The Personal Information Controller (PIC) and the recipients of Personal Data

PFI is an independent PIC of your Personal Data submitted via this portal. PFI’s registered address is at 6F Cyber One Building, 11 Eastwood Avenue, Eastwood City Cyberpark, Bagumbayan, Quezon City. PFI’s Data Protection Officer can be reached out to using this privacy portal (preferred) or dpo@cashalo.com.

(b) Personal Data collected
You have control over the Personal Data you wish to submit via this privacy portal. In general, the bare minimum Personal Data we mandatorily require to address your privacy request is your mobile number used to register with Cashalo, e-mail address, the nature of you relationship with the relevant data controller, and a description of your privacy request. However, on a case-to-case basis, we may require you to provide a copy of your government-issued ID to allow us to verify your identity.

(c) Purpose of collection of Personal Data and the applicable legal basis
On the basis of our legal obligation under the DPA:
• your email is used for the purpose communicating with you with respect to your privacy request and verification of your identity;
• the nature of your relationship with the relevant controller is used for the purpose of addressing your privacy request and verification of your identity; and
• the description of your privacy request is used for the purpose of your privacy request.

When we require a copy of your government-issued ID, we will obtain your consent to process the same for purposes of verifying your identity.

(d) Period of storage of your Personal Data
Subject to exception under the DPA, your Personal Data will be stored for ten (10) years on the basis of our legitimate interest to evidence our compliance with our legal obligation under the DPA to properly and timely address your privacy request. Once your privacy request has been resolved, your Personal Data will be archived and will only be accessed in case the regulators demand evidence of the resolution of your privacy request.

(e) Your data subject rights
You have the following data subject rights under the DPA:
• Right to be informed (Section 16(a) & 16(b), DPA)
• Right of access (Section 16(c), DPA)
• Right to rectification (Section 16(d), DPA)
• Right to erasure or blocking (Section 16(e), DPA)
• Right to damages (Section 16(f), DPA)
• Right to data portability (Section 18, DPA)
• Right to object (Section 34(b), IRR).

Featured portals

Cashalo
You can raise a privacy request for Cashalo using the options provided.

Suggested forms

Exercise right to erasure or blocking in Cashalo
If you want to delete your Cashalo account, please log-in to your Cashalo Application and then go to "Settings" and select "Delete Cashalo Account". Follow the instruction to delete your account.
Exercise right to access in Cashalo
You can use this form to exercise your data subject right to access personal data related to you.
Raise other privacy concerns in Cashalo
You can use this form to raise other privacy concerns.
TPC/RPC in TPC/RPC
If you received a text message from Cashalo that you were nominated by a user of the Cashalo application (“Cashalo User”) to be his/her loan reference for a current or future loan application. This means that the Cashalo User represented (1) that you are either the Cashalo User’s family member/friend/current co-worker, (2) that you can verify the information the Cashalo User submitted or will submit together with his/her current or future loan application, and (3) that you gave your consent to Cashalo contacting you in case we are unable to reach the Cashalo User. Based on this representation, the Cashalo User provided Cashalo the following personal data about you: (1) Name, (2) Mobile Number, and (3) Gender (the “Personal Data”). The Personal Data will only be used for the above purposes and will be retained for ten (10) years after end of the business relationship with the Cashalo User. If you disagree to be a reference, you can express your disagreement via the below ticketing system. If you raise a ticket, we will automatically consider it as a request to delete your Personal Data. The Personal Data, as a general rule, will be deleted within thirty (30) working days from submission of the ticket.