This notice explains how Alwan ("we", "the lender") processes the personal data of applicants and borrowers. The lender is a lending company. It lends to you directly and operates Alwan as its own online lending platform. The notice is given under Section 16 of the Data Privacy Act of 2012 (Republic Act No. 10173).
1. Who we are and how to reach us
- Personal information controller: Alwan. There is no other lender: Alwan does not pass your data to other lenders or to a marketplace.
- Data Protection Officer: through Support in the Alwan app
- Customer support and complaints: Support in the Alwan app, or the channels on our Contact page.
2. Scope
This notice covers the Alwan mobile app, this website and the lender's back-office systems. It applies to:
- people who create an Alwan account or verify their identity;
- credit applicants, including applicants who are declined;
- borrowers, including after everything they owe is paid;
- people a borrower names as a character reference (Section 4).
3. What we collect, why, and on what basis
"Required" means we cannot provide the service without it. Legal bases are those of Sections 12 and 13 of the Data Privacy Act. Consent is used only where we say so.
| Data | Examples | Source | Purpose | Legal basis | Required? |
|---|---|---|---|---|---|
| Identity | Name, date of birth, sex, nationality | You | Create your account, identify you, prevent fraud | Contract; legal obligation to identify customers | Required |
| Government ID | ID type, ID number, images of the front and back | You, through our identity-verification provider | Verify your identity | Legal obligation; contract | Required |
| Face images and verification results | Selfie, liveness result, face-match result | You, through our identity-verification provider | Confirm that the ID belongs to you and that you are present | Legal obligation; your consent to the verification step | Required for verification |
| Contact details | Mobile number, e-mail address, home and permanent addresses | You | Sign-in, one-time codes, service notices, statements, copies of your disclosures | Contract | Required |
| Financial profile | Declared monthly income range, source of income, employer name or nature of business, pay cycle and payday | You | Assess whether you can afford the credit you apply for; set due dates that suit your pay cycle | Contract (steps at your request before a contract) | Required to apply |
| Verified income and existing obligations | Monthly income confirmed from your documents; other loans you repay | You and your documents | Affordability | Contract | Required when requested |
| Character reference | Name, relationship and phone number of one person you choose | You | Verify your identity and the information you gave. Never used to collect | Contract; legitimate interest | As requested in the app |
| Credit records | Application, disclosure statements you accepted, agreement version, decision, cash-outs, installments, statements, payments, balance | Created in the service | Administer your credit line, receive repayments, keep accounts | Contract; legal obligation | Required |
| Credit assessment | Score, reasons, suggested limit, reviewer's evaluation, decision | Derived from the data above | Support the credit decision (Section 5) | Contract; legitimate interest in responsible lending | Required to apply |
| Payment and payout data | Payment references, amounts, payout account name and number (yours or the person you send to), cash-out purpose | You and our payment provider | Send cash-outs, receive repayments, reconcile | Contract | Required |
| Security data | Hashed PIN (never readable by staff), registered phone, sign-in and security events | Created in the service | Protect your account, detect fraud | Legitimate interest in security; legal obligation to secure data | Required |
| Consent and acceptance records | Which document and version you accepted, and when | Created in the service | Prove what you agreed to and when | Legal obligation; legal claims | Required |
| Device push token | Token that lets us send app notifications | Your device, if you allow notifications | Notices about your account | Consent (turn notifications off at any time) | Optional |
| Support and complaint records | Messages, attachments, complaint category and handling times | You | Answer requests and handle complaints | Contract; legal obligation | Optional |
| Marketing preference | Whether you opted in to promotions | You | Send promotions only if you opted in | Consent; withdraw at any time | Optional |
If you turn on fingerprint or face unlock in the app, the check happens on your phone. Alwan never receives your fingerprint or face data from it.
We do not collect: your contact list, location, call logs, SMS inbox, installed apps, social-media accounts, or photos other than those you take for identity verification.
4. Character references
If you name a character reference, we use their details only to verify your identity and the information you gave. We tell that person that you named them and how we obtained their details, and we offer to remove their data. A character reference is not a guarantor or co-maker, and we never contact them to collect what you owe. Before you name someone, please let them know.
5. Automated processing and credit assessment
When you apply, an automated assessment runs. It is profiling under the Data Privacy Act.
- What it does. It summarises your income, your existing obligations, the installments you would pay, your repayment history with us and how long you have had an account. The result is a score, reasons and a suggested limit.
- What it is not. It is advisory. A member of the lender's credit team reviews every application and decides. The assessment never approves or declines an application, and never sets your credit limit, by itself.
- What it does not use. Your source of income is recorded, but it does not change the score. The assessment never uses your contacts, location, device, social media, sex, religion or other sensitive information.
- Your rights. You may ask for the main reasons behind a decision, and ask us to correct information that was wrong.
More detail is in the Credit Assessment disclosure.
6. Who receives your data
We do not sell personal data.
Service providers process data on our instructions:
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database, sign-in and file storage | All data held in the service |
| Vercel | Website hosting | Requests to the website |
| Didit | Identity verification | ID images, selfie, verification results |
| Xendit | Payment collection and payouts | Amounts, references, payout account details |
| Resend | E-mail, including copies of your disclosures | E-mail address, message content |
| Sentry | Error monitoring | Technical error details; set not to collect IP addresses or personal data |
| Expo | App push notifications | Device push token, notification text (no amounts or personal details) |
Some of these providers process data outside the Philippines.
Authorities: the Securities and Exchange Commission, the Anti-Money Laundering Council, the National Privacy Commission, courts and other authorities, when the law requires it.
7. How long we keep your data
Personal data is kept for at most 3 years after your account is closed, unless a law requires us to keep it longer. Declined and withdrawn applications are kept for 12 months. See the Data Retention Policy.
8. How we protect your data
- Private storage: encrypted connections. Identity documents are kept in private storage and opened only through links that expire after a few minutes. Every staff view is recorded.
- Role-based access: each staff member sees only what their job requires. Support staff see masked data.
- Audit trails: decisions, agreement acceptances, complaint handling and configuration changes are recorded and cannot be edited.
- PIN protection: hashed PINs, with lockout after repeated wrong attempts.
If a personal data breach is likely to give rise to a real risk of serious harm, we notify the National Privacy Commission and the people affected within 72 hours of knowing about it.
9. Credit Information Corporation
The lender does not submit your data to the Credit Information Corporation and does not obtain CIC credit reports about you. We will update this notice before either starts.
10. Your rights
Under the Data Privacy Act you may:
- be informed about how your data is processed;
- access your data;
- object to processing that relies on consent or legitimate interest;
- correct inaccurate data;
- have data blocked or erased when it is no longer needed or was processed unlawfully. Records the law requires us to keep are kept for the legal period first;
- receive your data in a portable format, where applicable;
- be indemnified for damages;
- complain to the National Privacy Commission (privacy.gov.ph).
You can withdraw consent at any time. Withdrawal does not affect processing that has another legal basis.
To exercise a right, contact our Data Protection Officer through Support in the Alwan app.
11. Minors
The service is for adults only. We do not knowingly collect the data of anyone under 18.
12. Changes to this notice
We will show the new version and its date in the app and on this website before it applies. If a change needs your consent, we will ask for it.