Android Privacy Policy

XLKash Lending Corp. ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and safeguard your information when you use our mobile application ("App") to access loan services in the Philippines. By using our App, you agree to the terms of this Policy.

1 DATA WE COLLECT

We only access and collect your personal information when you voluntarily provide it or explicitly consent to our access. XLKash Lending Corp. collects your personal information only when necessary and relevant to our transactions with you. We may collect the following categories of data:

A. Personal Information

Identification Documents: Government-issued IDs, selfie verification.
Personal Details: Name, gender, educational background, marital status.
Professional or employment Details: Company information, industry, years of working.
Contact Details: Email address, phone number, address and emergency contacts (Includes contact person's name, relationship, and mobile number).
Financial Information: Bank account details, credit history, income information.

B. Device & Technical Information

Device Data: Device type, device name, device brand, operating system (type, version), unique device identifiers (Android ID, MAC address, GAID), Wi-Fi information (Wi-Fi name, carrier name, Wi-Fi connection status), Local IP address, screen resolution, root status, emulator usage status, browser type and settings, device storage capacity, device memory data, app version.
Location Data (Rough location information): GPS address, latitude, longitude
Device Memory Data: Total memory space and usage memory space

C. Behavioral Data

Borrowing history, repayment behavior, and interactions with our customer support.

D. Third-Party and External Data

We may also collect data from external sources, including but not limited to:

Your Submission: Information you directly provide (e.g., account updates, loan applications).
Account Analysis: Behavioral insights derived from how you use our services.
Public Registries: Publicly available data from government databases or registries.
Authorities: Information shared by government agencies, regulators, or law enforcement.
Telecom Providers: Mobile network operator data (e.g., carrier details) with your consent.
Third Parties: Data obtained from partners, service providers, or publicly accessible platforms.

Key Conditions:

We collect such data only with your explicit consent or where permitted by law (e.g., regulatory requirements).
You warrant that all submitted information is accurate and not misleading.
Xlkash reserves the right to request additional documentation to verify your identity or data.

2 PURPOSES OF DATA COLLECTION

We use your data for the following lawful bases:

1. Loan Processing

Authenticate your identity to comply with KYC and AML regulations.

2. Fraud Prevention

Detect and prevent fraudulent transactions or account takeovers.

3. Credit Assessment

Conduct credit checks to evaluate your financial credibility.

4. Financial Profiling

Analyze your financial needs, spending patterns, and risk profile.

5. Account Management

Maintain and secure your accounts, including transactions and security protocols.

6. Data Analytics

Generate insights to improve products, services, and operational efficiency.

7. Credit History Management

Retain and reference credit records for current or future loan evaluations.

8. Service Improvement

Enhance app functionality, user experience, and personalized loan offers.

9. Customer Support

Address inquiries, resolve disputes, send updates/reminders, and handle complaints.

10. Marketing & Promotions

Send transaction updates, reminders, and promotional offers (with your consent).

11. Debt Recovery

Enforce repayment obligations and recover overdue payments.

12. Record Verification

Cross-check data accuracy with third parties to ensure reliability.

13. Experience Enhancement

Optimize app functionality, user experience, and business processes.

14. Business Operations

Support financial planning, risk monitoring, audits, and decision-making.

15. Legal Compliance

Respond to subpoenas, regulatory requests, or court orders.

3 THE WAY OF DATA COLLECTION

If you decide to open an XLKash Lending Corp. Account and provide your personal information to use our services (such as submitting loan applications, contacting us for support, or other related purposes), we will collect, process, and share various types of information. Rest assured, we will only retain and use this information for as long as necessary to fulfill the stated purposes or as required by law.

4 PERMISSIONS AND PURPOSE

To deliver seamless services and ensure account security, XLKash Lending Corp. requires specific device permissions:

A. Internet Access

Enable data transmission between your device and our servers for service functionality. Ensure real-time updates and secure communication.

B. Network State Check (ACCESS_NETWORK_STATE)

Monitor network connectivity to optimize app performance and stability.

C. Notifications (POST_NOTIFICATIONS)

Send urgent alerts (e.g., transaction confirmations, security reminders). Deliver personalized promotions and service updates.

D. Wi-Fi State Access (ACCESS_WIFI_STATE / CHANGE_WIFI_STATE)

Optimize network performance by analyzing Wi-Fi connectivity. Automatically switch to more reliable networks for uninterrupted service.

E. Location Access (ACCESS_COARSE_LOCATION)

Provide location-based services. Enhance fraud prevention by cross-referencing geographic data.

F. Camera Access

Capture ID documents and live selfies for KYC verification. Enable document scanning and biometric authentication.

5 DELETION OR MODIFICATION OF YOUR PERSONAL INFORMATION

A. Modification of Personal Information

You may update or correct your personal information by:

Request Method: Submit an email to [email protected] specifying the data to be modified.
Processing Timeline: We will review and update your data within 5 business days of receiving the request.
Verification: For critical information, identity verification documents may be required.

B. Deletion of Personal Information

You may request deletion of your personal data through:

Voluntary Deletion Request: Email [email protected] with a clear request to delete all or part of your data. Data will be purged within 15 natural days after verification.
Manual Deletion Feature: Use the "Account Settings" section in the XLKash Lending Corp. app to delete your account and data.

C. Exceptions

The following data cannot be deleted: legally mandated records (e.g., loan contracts, repayment history) and data shared with third-party service providers.

6 DATA DISCLOSURE

XLKash Lending Corp. takes your privacy seriously and will only share Personal Information as explicitly permitted under this Privacy Policy. We may disclose your data to:

Internal Affiliates and Service Providers: XLKash Lending Corp.'s holding companies, subsidiaries, contractors, and professional advisers.
Credit and Financial Institutions: Credit bureaus, insurers, and financial service providers for risk assessment and loan underwriting.
Legal and Regulatory Entities: Government regulators, law enforcement, or courts to comply with legal obligations.
Business Partners: Strategic partners and assignees/transferees for specific products, promotions, or services.
Other Legitimate Recipients: Enforcement agents and any party explicitly authorized by you.

7 DATA RETENTION

We retain your data only for as long as necessary to fulfill the purposes outlined in this Policy or as required by Philippine law:

Personal, Behavioral & Third-Party Data: Retained for 3 years after your last transaction or immediately deleted upon account closure.
Device Data (Active): Retained for 90 days.
Device Data (Backup): Retained for up to 3 years for fraud prevention.
Device Memory Data: Active records retained for 90 days; backups up to 3 years.
Legal and Regulatory Requirements: 5-7 years as mandated by regulators.

8 YOUR RIGHTS UNDER THE DATA PRIVACY ACT (DPA)

As a user of XLKash Lending Corp., you are entitled to the following rights under Philippine law. Contact us at [email protected] to exercise these rights:

Right to Be Informed

Know what personal data we collect and how we use it.

Right to Access

Request a copy of your personal data held by us.

Right to Rectification

Request corrections to inaccurate or incomplete data.

Right to Erasure

Request deletion of your personal data unless legally retained.

Right to Restrict Processing

Object to processing your data for specific purposes.

Right to Data Portability

Request your data in a structured, machine-readable format.

Right to File a Complaint

Raise objections regarding the handling of your Personal Information in accordance with Philippine law.

9 PROTECTION OF PERSONAL INFORMATION

XLKash Lending Corp. is committed to safeguarding your personal information through a multi-layered security framework that aligns with Philippine law and international best practices (e.g., ISO 27001):

Data Encryption

TLS 1.3 in transit, AES-256 at rest.

Access Controls

Role-based permissions and MFA.

Network Security

Firewalls, intrusion detection, and quarterly penetration testing.

Data Backup

Daily incremental, weekly full backups in secure facilities.

Employee Training

Annual security training and role-specific workshops.

Incident Response

Notification within 72 hours of discovery.

10 SENSITIVE DATA COLLECTION AND HANDLING

All collected sensitive data will be transferred to our secure server at cl.xlkashlending.com. We ensure the security and confidentiality of data during transmission.

11 THIRD-PARTY SDKS AND SERVICES

To enhance service delivery, we integrate trusted third-party SDKs and services:

Firebase SDK

Purpose: Notifications, analytics, and error monitoring.

Data Processed: Device information and usage logs.

Adjust SDK

Purpose: Advertising analytics and user attribution.

Data Processed: Advertising IDs and in-app activity.

Face ID SDK

Purpose: KYC verification and fraud prevention.

Data Processed: Facial biometrics (encrypted).

12 CHILDREN'S PRIVACY

Our App is not intended for users under 18 years old. Parents/guardians must supervise minors' use.

13 CHANGES TO THIS POLICY

We reserve the right to update this Privacy Policy from time to time to reflect regulatory changes, operational improvements, or enhanced user protections. All updates will be promptly published on our Customer Service and through in-app notifications.

14 USER AGREEMENT

By continuing to use XLKash Lending Corp.'s services after changes to this Privacy Policy take effect, you expressly agree to the revised terms. Your ongoing use constitutes acceptance of the updated Policy.

15 CONTACT US

For questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us at:

[email protected]

Privacy Policy