PRIVACY POLICY
PeraSure is an online lending platform operated by SULIT LENDING CORPORATION, a corporation duly registered in the Philippines with SEC Registration No. 2020100002616-03 and Certificate of Authority No. 3333. Our registered office is located at 2322 Cityland Herrera Tower, No. 98 V.A. Rufino cor. Valero St., Salcedo Village, Makati City, Philippines.
This Privacy Policy explains how SULIT LENDING CORPORATION, operating under the product name PeraSure, collects, uses, stores, shares, discloses, and protects personal data when users access or use the PeraSure website, Android application, mobile web services, and related digital services (hereinafter referred to as "Platform"). In this Privacy Policy, "Company", "we", "us" or "our" refers to SULIT LENDING CORPORATION, and "User", "you" or "your" refers to any person who accesses, downloads, registers for, applies for, or uses the PeraSure services.
For privacy-related concerns, account deletion requests, or questions about your personal data, you may contact our Data Protection Officer at customercare@perasure.ph or +63 9615138998.
In this Privacy Policy, "Personal Data" means any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. This includes sensitive personal information as defined under the Data Privacy Act, such as biometric data, government-issued identification numbers, and financial information.
The scope of this Privacy Policy is limited to information collected or received by us through your use of the Platform. We are not responsible for the actions of third parties or companies, the contents of their facilities, the use of information you provide to them, the information they provide to you or any products or services they may offer. Any link to those sites does not constitute our partnership with, sponsorship or endorsement of, or affiliation with, those parties or companies or their brands.
By using the services provided by the Platform, whether via the website or application, you are expressing your agreement to this Privacy Policy and the processing of your Personal Data in the manner provided herein. ˙If you do not agree to these terms, please do not use and immediately exit the Platform.
We collect information to provide better service to our users. We will not collect your personal data without your permission. In accordance with the principle of proportionality under the the Data Privacy Act of 2012 (the "Data Privacy Act"), we endeavor to only collect personal data that is adequate, relevant, and not excessive in relation to the declared and specified purposes for which it is processed.
When joining as a member, we may collect the following information for the user's personal identification: (1) full name, (2) email address, (3) residential address, (4) phone number, (5) Guarantors or Character References information, if provided by you, (6) employment information, (7) monthly income, (8) date of birth, (9) gender, (10) government-issued ID information, (11) beneficiary's bank account information, (12) Social Media account, (13) biometric data consisting of facial recognition elements in order to corroborate your identity, and (14) other information that users opt to provide through the Platform.
We collect information about the device you use and your interactions with the Platform, which helps us provide, secure, and improve our services.The information and permissions we collect include (1) approximate location, (2) Guarantors or character references information, if provided by you, (3) camera access for identity verification photos, (4) government ID images, face photos, or other KYC images that you capture or explicitly select through the system picker, (5) device information, (6) listed financial applications, (7) financial SMS access and (8) phone number. We only collect permissions that are necessary for a specified and legitimate purpose.
You may manage, disable, or revoke app permissions at any time through your device settings. Please note that disabling certain permissions may affect the availability or functionality of related services, such as identity verification, location-based verification, or notification services.
During the loan application and identity verification process, you may be asked to capture or upload government ID images, face photos, or other KYC-related images. These images are collected only when you take a photo using the camera or explicitly select an image through the system picker. We use these images for identity verification, OCR processing, fraud prevention, loan application review, and compliance with applicable laws and regulations.
We do not request permission to access your external storage, and we do not scan, read, or upload files from your device storage without your explicit action.
During the loan application process, you may provide guarantor or character reference information, such as name, mobile number, and relationship to you. You may enter this information manually or, where supported, select a contact through your device's system contact picker.
We do not request permission to read your contact list, and we do not scan, store, or upload your full address book. If you use the system contact picker, we only receive the specific contact information that you choose to provide for the loan application.
We collect approximate location while the app is in foreground during the loan application process to support application verification, fraud prevention, service eligibility and loan processing. We do not collect precise location or background location.
As a part of our loan journey, we require guarantors or character references information, if provided by you The User guarantees that he or she has obtained the consent of the guarantor or character references before listing them in such roles.
We require camera permission to enable you to take photos and upload the same on the Platform during your loan application journey for verification purposes.
We collect your phone number to verify your identity and ensure smooth communication during the loan application process. We use your phone number to send verification codes, loan application updates, and important notifications related to your loan. This helps us confirm that you are the legitimate applicant and allows us to promptly contact you regarding any issues or requirements during the loan journey. We will not use your phone number for any other purposes without your explicit consent. You have the option to choose not to provide your phone number, but this may affect your ability to complete the loan application process smoothly.
PeraSure checks package identifiers on its predefined financial-app list to determine whether those apps are installed on your device. For each detected app, PeraSure collects its package identifier, app name, version name and code, first installation time, last update time, and system-app status.
This information is encrypted on your device before upload and transmitted over HTTPS to PeraSure's server at https://api.perasure.ph for loan eligibility assessment, credit-risk assessment, and fraud prevention. PeraSure does not sell this information, use it for advertising or marketing, or disclose it to third parties for their own purposes.
If you grant SMS access, we check SMS messages stored on your device from the past 180 days for predefined financial keywords associated with banks, e-wallets, lending, payments, transfers, and repayments. For each matching message, we collect the sender or address, full message body, associated contact identifier (if available), message type, received and sent times, SIM subscription ID, read status, subject, and service-center address.
Before upload, these records are encrypted on your device. The encrypted file is transmitted over HTTPS to a signed cloud-storage upload address issued by our servers at https://api.perasure.ph, and the encrypted upload reference is sent to the same server. We use this data only for loan and credit-risk assessment, identification of existing financial obligations, and fraud prevention. We do not sell this data, use it for advertising or marketing, or disclose it to third parties for their own purposes. Unmatched message content is not transmitted. If SMS permission is not granted, we cannot access or transmit your SMS data. You may revoke SMS access at any time through Android Settings. Declining access will not prevent you from submitting a loan application, but may limit automated credit-risk assessment.
The device information we collect may include device brand, model, manufacturer, operating system version, Android ID, Android Advertising ID, application package name, network type, Wi-Fi connection status and related network information, device configuration, screen information, battery status, memory and storage information, sensor information, camera capability information, device security status, system language, and app usage or event logs generated when you use the Platform. Based on the combination of device attributes described above, our systems may automatically generate a unique device identifier (a 'device key') that is associated with your device throughout your use of the Platform. This device key is used exclusively for device-risk assessment, fraud detection, and security purposes, including verifying device consistency across sessions and identifying devices that may be associated with fraudulent activity. The device key is not used for advertising or marketing purposes.
We use this information to verify device consistency, protect user accounts, prevent fraud, assess application risk, maintain the security and stability of the Platform, diagnose technical issues, support loan application processing, and comply with applicable legal and regulatory obligations.
We do not collect your call logs, precise location, or external storage files through this device information collection. As part of our fraud prevention and credit risk assessment procedures, we may query and record information regarding specific categories of applications installed on your device. The information collected in this regard may include application package names, app labels, version numbers, installation times, update times, and system-app status, limited to applications that are relevant to assessing your financial profile and creditworthiness, such as financial services, banking, e-wallet, lending, and payment applications. This targeted application data is used solely to evaluate your eligibility for our financial products, detect potentially fraudulent activities, and assess credit risk, and will not be used for any other purpose without your separate consent.
You must submit to us information including Personal Data which is true, accurate and not misleading, and you must keep it up to date and inform us of changes as soon as practicable. We reserve the right to request documentation to verify information provided by you.
We will only be able to collect your Personal Data if you voluntarily submit the information to us. If you choose not to submit your Personal Data to us or subsequently withdraw your consent to our use of your Personal Data, we may not be able to provide you with some or all of the services available through the Platform.
You have the privacy right to your personal data. Our company will only disclose your personal data to third parties under the following circumstances. The relevant institutions will collect, use, and/or disclose your personal data within the scope of your authorization and consent, and subject to appropriate data sharing or outsourcing agreements as required under the Data Privacy Act:
(a) disclosure to our employees, agents, holding companies, subsidiaries and affiliates;
(b) disclosure to enable you to trade and/or use services that you desire with the specific written or recorded consent of the User;
(c) disclosure to the Credit Information Corporation (CIC) and/or CIC-accredited credit bureaus and special accessing entities (SAEs), for the purpose of obtaining, verifying, and updating your credit data or credit reports, as may be necessary for your loan application, account management, credit evaluation, monitoring, or as required by Republic Act No. 9510 (Credit Information System Act) and the Data Privacy Act;
(d) disclosure of information upon orders of a court of competent jurisdiction or any government office or agency authorized by law;
(e) disclosure to collection agencies, counsels and other agents engaged by us to enforce our rights against the User, provided that such collection agencies comply with the Securities and Exchange Commission (the "SEC") Memorandum Circular No. 18, series of 2019 on Prohibition on Unfair Debt Collection Practices;
(f) disclosure to third party service providers for the purpose of assisting or rendering services to us in the administration of our lending business (including fund lenders, payment partners, post-loan partners, third-party verification service providers, messages service providers, call-out service partners, technical infrastructure and hosting providers, application performance monitoring and telemetry service providers, fraud detection and risk assessment service providers), subject to appropriate data sharing or outsourcing agreements; and
(g) disclosure to third parties such as insurance companies, solely for the purpose of insuring us against the User’s default or other credit loss and the User from fraud or unauthorized charges.
Personal Data shall be processed, collected, used, disclosed, stored, and retained for the following purposes, which are declared and specified in accordance with the principle of legitimate purpose under the Data Privacy Act:
(a) to authenticate the identity of Users and conduct background checks and identity verification;
(b) to contact Users in relation to their registered account/s or requested information, and to respond to User queries and requests, resolve complaints and handle requests and inquiries;
(c) to process registration of account/s and to determine or assist in determination of decisions as part of screening of the investors, borrowers, registrations or loan applications, and/or to deliver our products and/or services to the User and any directly related purposes;
(d) to facilitate loan processing from application, review, monitoring, payment, collection and other remedial measures;
(e) to maintain internal records;
(f) to request, obtain, and process your credit data or credit reports from CIC and/or its accredited bureaus, for credit evaluation, decisioning, risk assessment, account management, collections, dispute resolution, and other lawful purposes related to lending operations, with your express consent as required under Republic Act No. 9510 (Credit Information System Act) and the Data Privacy Act of 2012;
(g) to develop and generate a credit score, credit model and user model, including through automated decision-making and profiling; you shall be informed of the existence of such automated processing and its significance;
(h) to automatically generate a unique device identifier ('device key') derived from collected device attributes, for the purpose of device-risk reporting, fraud prevention, and maintaining the security and integrity of the Platform, as part of our automated processing and profiling activities; you shall be informed of the existence of such automated processing and its significance;
(i) to conduct and perform fraud monitoring, detection, analysis and prevention; to prevent, detect and investigate actual or suspected crime and analysing and managing commercial risks; and to perform research on data to conduct investigations relating to disputes, payment, suspected illegal activities or fraud;
(j) to conduct data analytics and tracking, and to conduct market research to enable the Company to understand and determine customer location, preferences and demographics to develop special offers, products or marketing programs in relation to products and services, and to improve (i.e. customized offers and products) such products and services;
(k) to market and offer new, related or complementary products and services to the User, and to carry out marketing and promotions initiatives relating to the Company, local affiliates of the Company, the Company’s partners, and other Company’s products and services, whether by electronic means, by email and post, or by telephone, SMS or social media, or by sending newsletters, including by using automated means, subject to your separate and freely given opt-in consent;
(l) to develop, enhance and maintain a risk assessment process and model, offline and online;
(m) to enrol/participate the user in group credit and/or life insurance, credit risk analysis, credit investigation, credit scoring and credit collection on the User;
(n) to perform User location search;
(o) to execute, monitor, manage and analyse the Platform and to develop, enhance, and upgrade the features, functions, products and services in the Platform, including promotions, loyalty and reward programs;
(p) to facilitate business asset transactions (which may extend to any mergers, acquisitions or asset sales) of the Company;
(q) to facilitate and as may be required as part of any financing or capital raising activity (i.e. obtaining loans, credit facility, mortgage, assignment, assignment as a form of security or mortgage of loans);
(r) to initiate and maintain correspondence with the User via electronic mail (e-mail), SMS (short messaging service), in-app message/communication, registered mail, phone calls or field visits;
(s) to monitor or record phone calls and customer-facing interactions for quality assurance, employee training and performance evaluation and identity verification purposes;
(t) to provide information to external parties such as government agencies, and other institutions as part of scientific research and/or study;
(u) to conduct targeted application inventory queries on your device, limited to categories of applications relevant to financial profiling, for the purpose of credit risk assessment, fraud detection, and determining your eligibility for our loan products;
(v) for any other legal and/or regulatory purposes (including but not limited to obtaining legal advice and dispute resolution) and legitimate business purposes and to carry out all mandatory administrative, operational and legal duties.
5.1 By proceeding with your loan application on the Platform and using the facial recognition feature, you hereby give your express and unequivocal consent to the Company to collect, use, process, and store your biometric data (i.e., your facial data). We collect your facial data by requesting you to take a live face photo during the facial recognition process and will use and process it for the following purposes:
(a) to verify your identification;
(b) to prove the loan is applied by yourself, at the time of loan application and any other time thereafter, including when there is a dispute regarding the loan; and
(c) to prevent loan fraud.
5.2 This information will be uploaded to our server https://api.perasure.ph. You expressly authorise us to retain and hold your facial data until you fully repay the loan and other amounts payable, if any, or such longer period as may be required by applicable law, e.g., applicable statute of limitations, etc. If you need to delete your face photo data immediately, you shall notify us via email to customercare@perasure.ph.
5.3 We will not share your face photo with third parties except for the purpose of presenting evidence to a court or arbitral tribunal in the resolution of a loan-related dispute and when ordered to do so by a court of competent jurisdiction or any government office or agency authorized by law. You acknowledge and agree that these courts, tribunals and/or authorities will retain your data for the duration mandated by applicable law.
6.1 We will retain and hold your Personal Data only for as long as is required by applicable law and necessary to allow the purpose for which the data is collected and used. We shall retain personal data of borrowers only for as long as necessary for the fulfillment of the purposes for which the data was obtained, for the establishment, exercise, or defense of legal claims, or as provided by law.
6.2 Thereafter, we shall endeavor to ensure the secure and proper disposal and destruction of personal data in a manner that would render further processing impossible. If you need to request immediate deletion of your data, you shall notify our customer service center via email to customercare@perasure.ph, subject to any legal obligations that may require us to retain certain data.
7.1 The Company values Personal Data collected, used, retained and stored through the Platform. The Company has adopted technical, organizational and physical measures to protect your Personal Data in accordance with the applicable laws and regulations.
7.2 We take reasonable measures to protect your information from unauthorized access or against loss, misuse, or alteration by third parties, including encryption of personal data during storage and while in transit.
7.3 Although we make good faith efforts to store the information collected on the Platform in a secure operating environment that is not available to the public, we cannot guarantee the absolute security of that information during its transmission or its storage on our system. Further, while we attempt to ensure the integrity and security of our network and systems, we cannot guarantee that our security measures will prevent third-party hackers from illegally obtaining access to this information. To the fullest extent permitted by law, we do not warrant or represent that your information will be absolutely protected against loss, misuse, or alteration by third parties.
8.1 In the event of a personal data breach that is likely to give rise to a real risk of serious harm to any affected data subject, we will notify the National Privacy Commission and the affected data subjects within seventy-two (72) hours upon knowledge of, or when there is reasonable belief that, a personal data breach requiring notification has occurred, in accordance with Section 38 of the Implementing Rules and Regulations (the "IRR") of the Data Privacy Act.
8.2 The notification shall describe the nature of the breach, the personal data possibly involved, and the measures taken by the Company to address the breach, including measures to reduce the harm or negative consequences of the breach.
9.1 We may transfer, store and/or process your Personal Data to a recipient outside the Philippines in connection with the purposes described in this Privacy Policy, in accordance with applicable laws and regulations. By using the Platform and submitting your Personal Data, you hereby expressly consent to such transfer, storage, and/or processing of your Personal Data. We shall ensure that any such transfer is made only to countries, jurisdictions or organizations that provide an adequate level of protection for personal data, or pursuant to appropriate contractual safeguards, or with your consent as provided herein, in accordance with the Data Privacy Act, its IRR and applicable NPC issuances.
9.2 Where personal data is transferred to a third-party service provider outside the Philippines, we shall ensure that such third party is bound by contractual obligations equivalent to those imposed on us under the Data Privacy Act. You acknowledge and agree that, notwithstanding such contractual safeguards, the laws of the country to which your Personal Data is transferred may differ from the laws of the Philippines.
9.3 To comply with regulatory Know-Your-Customer (KYC) requirements and ensure secure identity verification, the personal and sensitive identity information you provide (including but not limited to government-issued IDs, facial biometric data, and personal profiles) will be securely transmitted, processed, and stored utilizing cloud infrastructure. Specifically, this data will be uploaded to the Huawei Cloud Object Storage Service (OBS) at the following dedicated endpoint:
dxcloud-sg-ph-prod.obs.ap-southeast-3.myhuaweicloud.com
You agree to inform us promptly, and in any event, within fourteen (14) calendar days, in writing if there are any changes to your information supplied to us from time to time, and to respond promptly to any request from us, if:
(a) you fail to provide promptly any user information or Personal Data that we reasonably requested;
(b) you withhold or withdraw any consents that we may need to process, transfer or disclose Personal Data for the purposes of used disclosed above in this Privacy Policy (except for purposes connected with marketing or promoting products and services to you); and/or
(c) we have, or a member of the Company has, suspicions regarding financial crime or an associated risk,
we may:
(i) be unable to provide new, or continue to provide all or part of the services to you and reserve the right to terminate our relationship with you;
(ii) take actions necessary for us or a member of the Company to meet the compliance or regulatory obligations; and/or
(iii) suspend, transfer or close your account(s) where permitted under local laws.
11.1 Under the Data Privacy Act of 2012, you have the following rights as a data subject:
(a) Right to be Informed: You have the right to be informed whether your personal data is being, or has been, processed, including the existence of automated decision-making and profiling, before entry into any contract or agreement, or before your data is collected.
(b) Right to Access: You have the right to reasonable access to your personal data in the possession of the Company, including the sources from which personal data were obtained, the purposes for which they are processed, and the names and addresses of recipients.
(c) Right to Object: You have the right to object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling. When you object, we shall no longer process your personal data unless there is a legal ground or overriding legitimate interest for the processing.
(d) Right to Erasure or Blocking: You have the right to suspend, withdraw, or order the blocking, removal, or destruction of your personal data from our filing system upon discovery and substantial proof that the data is incomplete, outdated, false, or unlawfully obtained, or is no longer necessary for the purposes for which it was collected.
(e) Right to Rectify: You have the right to dispute the inaccuracy or error in your personal data and have us correct it immediately and accordingly.
(f) Right to Data Portability: Where your personal data is processed by electronic means and in a structured and commonly used format, you have the right to obtain a copy of such data in an electronic or structured format that is commonly used and allows for further use.
(g) Right to Damages: You shall be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, taking into account any violation of your rights and freedoms as a data subject.
(h) Right to File a Complaint: You may file a complaint with the National Privacy Commission (the "NPC") if your personal information has been misused, maliciously disclosed, or improperly disposed of, or if any of your data privacy rights have been violated. The NPC may be contacted at info@privacy.gov.ph or through its official website at www.privacy.gov.ph.
11.2 The exercise of the aforementioned rights must be carried out in writing by email to our Data Protection Officer at the following contact details:
customercare@perasure.ph
Attention: Data Protection Officer
11.3 After the application has been submitted, the Company will issue its determination within a reasonable period, and in any event within thirty (30) days from receipt of the request, unless a longer period is required by law or the complexity of the request.
12.1 The Company has appointed a Data Protection Officer ("DPO") who is responsible for overseeing the Company's data protection strategy and its implementation to endeavor to ensure compliance with the Data Privacy Act and applicable NPC issuances.
12.2 The DPO may be contacted at the details provided in paragraph 11.2 above for any queries, concerns, or requests relating to the processing of your personal data.
13.1 The Platform may use cookies, web beacons, and similar tracking technologies to enhance your experience, analyze usage patterns, and deliver personalized content. Cookies are small data files stored on your device when you visit our Platform.
13.2 You may control the use of cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Platform. By continuing to use the Platform, you consent to our use of cookies in accordance with this Privacy Policy.
14.1 You may request deletion of your PeraSure account and personal data through the account deletion instructions available at: https://www.sulitlending.com/perasure/delete-account. This page provides the steps for submitting an account deletion request, including in-app guidance and a video demonstration.
14.2 You may also submit an account deletion request by contacting our Data Protection Officer at customercare@perasure.ph.
14.3 Upon receiving a verified deletion request, we will delete or anonymize personal data that is no longer necessary for the purposes described in this Privacy Policy. Certain information may be retained where retention is required or permitted by applicable law, regulation, fraud prevention, dispute resolution, credit reporting, accounting, audit, or loan servicing obligations. Where retention is required, we will retain the relevant data only for the period necessary to satisfy such obligations and will protect it in accordance with this Privacy Policy.
15.1 This Privacy Policy may be updated from time to time and shall continue to remain in effect unless otherwise amended. If this Privacy Policy is changed, those changes will be posted on the Platform. The change will be effective when posted. Users availing services and/or visitors to the Platform are advised to check the website on a regular basis to remain aware of the policies and practices of how information is collected and used.
15.2 If significant changes to this Privacy Policy will affect certain Personal Data, the Company shall notify its Users through the email address provided or by posting a public notice on the Platform at least fifteen (15) days prior to the effectivity of such changes, where practicable.
15.3 The foregoing consents and authorizations shall continue for the duration of, and shall survive the termination of any loan agreement(s) signed by the borrower, or any other transactions, dealings, arrangements and accounts which borrower may have with, or avail from, the Company and the lender through services and/or the Platform, subject to the data retention and disposal provisions in Section 6 of this Privacy Policy.
This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of the Philippines. Any court action arising out of or in connection with this Agreement shall be filed in the proper courts of Manila City, to the exclusion of all other courts. By agreeing to this Agreement, you irrevocably submit to such venue.
17.1 If you need help from us when there are any information, errors, doubts about the changes in your account without your permission or any of your transactions, you shall notify our customer service center via email at customercare@perasure.ph or immediately write to the corresponding department with the following information:
(a) Your name and account name;
(b) The time and date of such transactions or changes;
(c) Error description and reference code (if applicable);
(d) Contact name and address, including email address (if any).
17.2 We will immediately investigate any errors or unusual activities reported and will inform you of the results as soon as possible.
17.3 For data privacy-related concerns, please contact us at customercare@perasure.ph. You may also file a complaint with the National Privacy Commission at info@privacy.gov.ph or through www.privacy.gov.ph.