Privacy Policy

LenderLink, Inc. (“Company,” “we,” “our,” or “us”) operates BidaCredit (the “App”). We value your privacy and are committed to protecting your personal data in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) (“DPA”), its Implementing Rules and Regulations (“IRR”), and issuances of the National Privacy Commission (“NPC”). 

This Privacy Policy explains how we collect, use, process, store, share, and protect your personal data, and informs you of your rights as a data subject. 

By using the App, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy and voluntarily consent to the processing of your personal data as described below. 

This Privacy Policy applies to all users of the App, including registered and unregistered users, and covers all processing of personal data collected through the App, related services, and third-party integrations. 

This Policy also governs personal data collected through affiliated websites, customer support channels, surveys, and communications sent by the Company. By accessing or using the App, you acknowledge that you have read and understood this Policy. 

We may collect and process the following categories of personal data: 

1. Basic Information – Full name, email address, contact details, and login credentials. 
2. Linked Accounts – Data provided when registering via Google, Facebook, or Apple, subject to your privacy settings with these providers. 
3. Sensitive Personal Information – Government-issued ID, financial/credit details, biometric information (e.g., profile photo, facial recognition data, fingerprints, voice recognition, and other identifiers) when strictly necessary and with your explicit consent. 
4. Device and Usage Data – IP address, device identifiers, app usage statistics, crash reports, geolocation, and mobile usage data (e.g., calls, SMS, top-up patterns, SIM data, subscription details). 
5. Employment and Financial Data – Employment details, income, payment transaction information, financial profile, credit standing, and loan payment history where relevant. 
6. User Content – Profile photos and any content you voluntarily upload or share through the App or on third-party platforms (Facebook, Instagram, X.com, LinkedIn, TikTok). 
7. Inferred Data – Behavioral insights, preferences, and trends generated from analytics and profiling activities to personalize your experience. 
8. Communications Data – Records of communications with customer support, surveys, or feedback forms. 

We may also collect non-identifying or aggregated data (e.g., anonymized insights) which, when not linked to your identity, is used for analytics and product improvement. 

When linking to third-party platforms (Google, Facebook, Apple), we may receive additional data from those platforms as allowed by your permissions, such as profile image, friend lists, or usage metadata. 

1. Directly from You – During registration, form submissions, and communications, feedback, support tickets, or KYC verification. 
2. Automated Means – Cookies, analytics, usage logs, and crash reports, pixel tags, and mobile analytics SDKs. 
3. Third-Party Sources – From telecommunications providers, credit bureaus, public and private credit information providers, and other financial institutions, subject to applicable laws. 
4. Partners and Affiliates – Where you engage with our authorized partners, affiliates, or marketing campaigns, we may receive limited personal data, consistent with applicable consents and agreements. 

By using the App, you expressly consent and authorize the Company, its employees, agents, partners, and representatives to collect, retrieve, process, use, and store your Personal Information and Sensitive Personal Information for the purposes described in this Privacy Policy, including but not limited to: 

1. Identity and Verification – Full name, birthdate, government identification numbers, photographs, biometric data (facial recognition, fingerprints, voice recognition), mobile phone number, and related identifiers. 
2. Credit Assessment – Loan history, borrower profile, payment behavior, financial information, and other details for credit scoring, underwriting, fraud prevention, background verification, and related purposes. 
3. Third-Party Collection – Collection of personal data from other personal information controllers (e.g., telecommunications companies, private/public credit bureaus, financial institutions) for credit scoring, credit risk assessment, fraud prevention, and data analytics. 
4. Data Sharing – Sharing of your data, including mobile number, email, tax identification number (“TIN”), SSS, GSIS, and address, with third-party credit scoring providers for credit investigation, profiling, fraud prevention, and updating of credit scores. 
5. Direct Marketing – Use of your personal data for direct marketing of products and services offered by the Company or its authorized partners, unless you opt out. 
6. Disclosure to Other Lenders – Authorization to share or access loan account information, borrower history, and other credit information with other lenders and third parties for creditworthiness determination and legal purposes. 
7. Research and Development – Aggregated or anonymized data may be processed for research, analytics, and service innovation. 
8. Legal Defense – Use of your data to establish, exercise, or defend legal claims. 

You may withdraw your consent at any time by contacting our Data Protection Officer, subject to legal or contractual constraints. Withdrawal will not affect processing done prior to withdrawal. 

We may also request “just-in-time” consent at the moment of collecting certain Sensitive Personal Information (e.g., when uploading biometrics) to complement this general consent. 

We process Personal Data only when there is a lawful ground under the DPA and related regulations. Depending on the type of information and the purpose of processing, we rely on the following bases: 

1. Consent 

Your explicit and informed consent is required for the collection and use of certain Personal Data, particularly Sensitive Personal Information such as government-issued IDs, biometric information (e.g., profile photo), and data obtained from third-party integrations (Google, Apple, and Facebook). 

Consent also applies when we share your information with the Credit Information Corporation (“CIC”) or enable optional features like social media sharing. 

You may withdraw consent at any time by contacting our Data Protection Officer, without affecting processing carried out before withdrawal. 

In certain cases, we will only process Sensitive Personal Information if we also have your explicit consent or as otherwise permitted by law. 

 2. Contractual Necessity 

 

We process data when necessary to perform our obligations under a contract with you, or to take steps at your request before entering into such contract. This includes: 

1. Creating and managing your account; 
2. Authenticating your identity; 
3. Providing access to your CIC credit report; and 
4. Enabling features of the App, such as credit education activities, progress tracking, and reporting tools. 
5. Without this data, we may not be able to provide you with the full functionality of the App. 

 3. Legal Obligation 

We process data where required to comply with applicable laws and regulations, such as: 

1.  The DPA and issuances of the NPC; and 
2. Lawful orders, subpoenas, or directives from competent courts, regulators, or government agencies. 

4. Legitimate Interests 

We may process Personal Data where necessary to pursue our legitimate business interests, provided that these do not override your fundamental rights and freedoms. These purposes include: 

1. Detecting and preventing fraud or misuse of the App; 
2. Ensuring the security and integrity of our systems and data; 
3. Monitoring usage, troubleshooting, and improving the App’s functionality and features; and 
4. Supporting internal operations such as audits, risk management, and corporate governance. 

We rely on legitimate interest for internal operations (such as fraud detection or analytics) only after balancing with your rights. 

4. Vital Interests and Public Interest (where applicable) 

In exceptional cases, we may process data to protect your life, health, or safety, or that of another person when you are unable to provide consent. 

We may also process data where required to assist duly authorized public authorities, including the CIC, in carrying out tasks in the public interest or under lawful mandate. 

• Your personal data may be used for: 
• Account creation, verification, and authentication; 
• Communication of updates, notices, and support; 
• Personalization of the App experience; 
• Analytics, data profiling, and service improvements; 
• Advertising and marketing (with your consent); 
• Credit scoring; 
• Research, product development, and enhancement of features (e.g. credit education modules); 
• Security monitoring (detecting unusual login activity, preventing abuse); 
• Marketing communications (where permitted by you); 
• Generating aggregated or anonymized data for trends or reports; 
• Fraud detection, risk management, and background verification; and 
• Compliance with regulatory and legal obligations. 

We may share your data with or in connection with: 

1. Service Providers and Processors – Hosting, analytics, cloud, and credit scoring services, bound by confidentiality and data protection obligations. 
2. Credit Bureaus and the CIC – To obtain, update, or verify your credit report or score. 
3. Partners and Affiliates – For credit investigation, loan underwriting, fraud prevention, and (with your consent) marketing. 
4. Regulatory Authorities or Courts – As required by law or lawful order. 
5. Business Transactions – In connection with mergers, acquisitions, or restructuring. 
6. Cross-Border Transfers – When stored or processed outside the Philippines, with safeguards consistent with the DPA.We may share your data with: 

• • Service Providers – Hosting, analytics, cloud providers, and credit scoring services. 
  • Partners and Affiliates – For credit investigation, loan underwriting, fraud prevention, and marketing (with consent). 
  • Regulatory Authorities – When required by law. 
  • Cross-Border Transfers – Cloud storage outside the Philippines with safeguards in line with the DPA. 
  • Business Transactions – Mergers, acquisitions, or restructuring where data may be transferred. 
  • While we strive to select reputable and reliable partners, it is important to exercise caution that these websites operate under their own distinct privacy statements, which are beyond our control. To further protect yourself, we recommend reviewing the privacy policies of these websites before providing any personal information. 

We do not sell your personal data to unrelated third parties and marketers.. 

You have the right to: 

1. Be informed of how your data is processed; 
2. Access, correct, or update your data; 
3. Object to processing or withdraw consent at any time; 
4. Request erasure or blocking of unlawfully processed data; 
5. Receive compensation for damages sustained due to violations of your rights; 
6. Obtain a copy of your data (data portability); and 
7. File a complaint before the NPC. 

You may exercise your rights by contacting our Data Protection Officer (see Section 13), subject to verification of your identity prior to processing any request. 

You may request access, correction, deletion, or blocking of your data. We will respond within a reasonable period (e.g., 30 calendar days) unless extended for lawful reason. 

You may exercise these rights at no cost, except where requests are excessive or manifestly unfounded, in which case we may charge a reasonable administrative fee. 

We may decline requests that are repetitive, overly burdensome, or pose excessive technical difficulty, or where retention is required by law. 

Data Retention – We retain your Personal Data only for as long as necessary to fulfill the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law. The applicable retention period may vary depending on the type of data, the purpose of collection and processing, and applicable legal, regulatory, or operational requirements. 

Once your Personal Data is no longer needed, or where there is no lawful or business purpose for its continued retention, we will take appropriate steps to securely delete, destroy, or anonymize such data, or otherwise restrict access or use, except where retention is necessary to comply with legal obligations, ensure safety and security, or detect and prevent fraud, consistent with applicable laws and regulations. 

We regularly back up data and maintain redundant storage to guard against data loss. Retention periods depend on data type and purpose. 

We may keep residual copies (e.g., log archives) for a limited period even after deletion from active systems. 

Despite these safeguards, no method of electronic transmission or storage is fully secure. Users should also take precautions such as safeguarding credentials and ensuring device security. 

Data Security – We implement appropriate organizational, physical, and technical safeguards to protect your Personal Data against unauthorized access, alteration, disclosure, loss, or destruction. These measures include access controls, encryption, secure storage, and other safeguards in line with industry standards and regulatory requirements. Access to Personal Data is restricted to authorized personnel who have a legitimate need to know and are bound by strict confidentiality obligations. All processing is carried out in an authorized and secure manner to uphold the confidentiality, integrity, and availability of your data. 

We do not knowingly collect data from individuals under 18 years old without parental consent. Parents/guardians may contact us if they believe a minor has provided personal data without authorization. 

If we become aware that a minor has provided personal data without parental consent, we will promptly delete it. 

You may withdraw consent at any time by contacting our DPO. However, withdrawal may affect or limit your ability to use certain features or services within the App. 

In the event of a personal data breach that is likely to compromise your rights, we will notify you and the NPC without unreasonable delay, including details about affected data, mitigation steps, and contact information, in accordance with the DPA and NPC Circulars. 

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or in-App notifications. It is your responsibility to review the Privacy Policy regularly.  Continued use of the App after updates constitutes acceptance of the revised Policy. 

For questions, concerns, or to exercise your data privacy rights, please contact: 

Roselle Perez-Bariuan 

Data Protection Officer 

Email: dpo@lenderlink.ph 

Address: Unit 1206C, 12F, The Trade and Financial Center, Bonifacio Global City Taguig 1634 

Phone: 0908 906 4899 

Governing Law and Jurisdiction 

These Terms shall be governed by and construed in accordance with the laws of the Republic of the Philippines. Any dispute, controversy, or claim arising from or relating to these Terms shall be subject to the exclusive jurisdiction of the proper courts of Taguig City, Philippines, to the exclusion of all other venues, unless otherwise required by applicable law. 

Survival 

The provisions of these Terms which by their nature should survive termination or discontinuation of your use of the App shall remain in full force and effect, including but not limited to provisions relating to intellectual property, indemnity, disclaimers, limitations of liability, governing law, and dispute resolution. 

Indemnity 

You agree to indemnify, defend, and hold harmless the Company, its affiliates, partners, shareholders, directors, officers, employees, agents, contractors, service providers, suppliers, and successors from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable attorney’s fees) arising out of or related to: (i) your use of the App; (ii) your breach of these Terms or any applicable law; or (iii) any infringement of third-party rights resulting from your conduct. 

Assignment and Subcontracting 

The Company may assign, transfer, or subcontract any of its rights or obligations under these Terms without your prior consent. You may not assign or transfer your rights or obligations without the Company’s prior written approval. 

Entire Agreement 

These Terms, together with the Privacy Policy and any additional terms incorporated by reference, constitute the entire agreement between you and the Company and supersede all prior or contemporaneous agreements, communications, or understandings, whether oral or written, relating to the subject matter herein. 

Severability 

If any provision of these Terms is held invalid, illegal, or unenforceable under applicable law, the remaining provisions shall remain valid and enforceable to the fullest extent permitted by law. 

 No Waiver 

The failure of the Company to enforce any right or provision under these Terms shall not constitute a waiver of such right or provision unless expressly confirmed in writing by an authorized representative of the Company. 

Prohibited Conduct 

You are prohibited from collecting or harvesting any personally identifiable information from the App, using the App’s communication systems for unauthorized solicitation, or engaging in hacking, scraping, distribution of unauthorized vouchers or codes, or any activity deemed unlawful or in violation of these Terms. Any violation may subject you to civil, administrative, and criminal liability under applicable law.