Your information belongs to you.

1. Who we are

PesoJoy is operated by Joywon Lending Investor, Inc., company registration number CS201926247. For purposes of Republic Act No. 10173, also known as the Data Privacy Act of 2012, we act as the personal information controller for the personal data described in this Notice.

2. Scope of this Notice

This Notice applies when you visit the PesoJoy website, create an account, apply for or receive a loan, make repayments, contact support, or otherwise use our services. It also applies to data received from lawful identity, fraud prevention, payment, credit information, and public-record sources.

A separate just-in-time notice may appear before we ask for a specific permission or piece of information. That notice forms part of this Privacy Notice.

3. Personal data we process

4. App permissions

PesoJoy should request a device permission only when a feature needs it. We provide a just-in-time explanation before an optional permission is used. You may manage permissions in your device settings, although turning off a permission may stop the related feature from working.

5. How we use personal data

• Create, verify, and protect your account.
• Confirm identity and perform know-your-customer, anti-fraud, and other legal checks.
• Assess eligibility, creditworthiness, and affordability.
• Present loan offers, disclosures, fees, repayment schedules, and other terms.
• Disburse and service a loan, process payments, and maintain accurate records.
• Send application, account, security, payment, and collection notices.
• Provide support, resolve complaints, and exercise or defend legal claims.
• Improve service reliability and security using aggregated or de-identified information where practical.
• Meet reporting, audit, credit information, consumer protection, and regulatory obligations.

We do not sell personal data. We do not use a borrower's contacts or social media to publicly disclose a debt, shame a borrower, or pressure third parties to pay.

6. Lawful bases

Depending on the activity and type of data, we process personal data because:

• it is necessary to take steps at your request or perform a loan agreement;
• Philippine law or a lawful order requires it;
• we or an authorized third party have a legitimate interest, such as preventing fraud, securing the service, or recovering a lawful debt, and that interest does not override your fundamental rights;
• it is necessary to establish, exercise, or defend legal claims; or
• you gave specific, informed, and freely given consent where consent is required.

You may withdraw consent at any time. Withdrawal does not affect processing already lawfully completed and may not stop processing supported by another lawful basis.

7. Who may receive personal data

We disclose only what is necessary to authorized recipients, which may include:

• identity verification, fraud prevention, hosting, cybersecurity, communications, and customer support providers;
• banks, e-wallets, payment processors, and disbursement partners;
• the Credit Information Corporation and authorized credit bureaus or accessing entities, where permitted or required;
• professional advisers, auditors, insurers, and authorized collection service providers;
• courts, law enforcement, the Securities and Exchange Commission, the National Privacy Commission, and other lawful authorities; and
• a successor in a proposed or completed corporate transaction, subject to confidentiality and applicable law.

Service providers may process data only under written instructions, confidentiality duties, and appropriate safeguards. We remain accountable for personal data transferred to processors.

If data is processed outside the Philippines, we use contractual, organizational, and technical safeguards intended to provide a comparable level of protection.

8. Credit decisions and automated tools

Automated tools may help verify identity, detect fraud, assess credit risk, and support eligibility decisions. Inputs may include application information, repayment history, and data from lawful credit sources. These tools do not use your full contacts list, unrelated messages, or social media passwords.

Where an automated process is the sole basis for a decision that significantly affects you, we will provide information required by law and a way to request appropriate review or raise a concern.

9. How long we keep data

We keep personal data only for as long as necessary for the stated purpose, an active account or loan, legal and regulatory recordkeeping, fraud prevention, dispute resolution, and the establishment or defense of legal claims. We apply documented retention periods by record type and securely delete or de-identify data when it is no longer needed.

Data from incomplete, withdrawn, or declined applications is kept only for a limited period justified by fraud prevention, audit, complaints, or other lawful requirements. You may ask us about the period that applies to a specific record.

10. How we protect data

We use reasonable and appropriate organizational, physical, and technical safeguards based on the nature and risk of the processing. These may include encryption in transit and at rest, access controls, staff confidentiality, logging and monitoring, secure development practices, vendor reviews, backups, and incident response procedures.

No system is completely secure. If a personal data breach creates a risk that requires notification, we will notify affected users and the National Privacy Commission as required by law.

11. Your privacy rights

Subject to the Data Privacy Act and lawful limitations, you may have the right to:

• be informed about the processing of your personal data;
• access personal data and information about how it was processed;
• object to processing in applicable circumstances;
• correct inaccurate or incomplete personal data;
• request erasure, blocking, or suspension where legally available;
• receive data in a structured and commonly used format where data portability applies;
• withdraw consent where processing relies on consent;
• seek damages where provided by law; and
• file a complaint with the National Privacy Commission.

To protect your account, we may verify your identity before acting on a request. We will respond within the period required by applicable law and explain if a lawful exception applies.

12. Children

PesoJoy is intended only for people who are at least 18 years old and legally capable of entering a loan agreement. We do not knowingly offer loans to children. If you believe a child provided personal data, contact us so we can review and take appropriate action.

13. Changes to this Notice

We may update this Notice when our practices, services, or legal obligations change. We will post the updated Notice with a new effective date. If a change materially affects your rights or how we use personal data, we will provide an additional notice through an appropriate channel before the change takes effect where required.

14. Contact and complaints

You may contact the PesoJoy Data Protection Officer through the in-app Help Center or by written mail to our office. Please include your name, contact details, the nature of your request, and enough information for us to verify and respond.

You may also learn about your rights or file a complaint with the National Privacy Commission.