Privacy notice

Pre-launch preview. Applications are closed while operator and recipient details are completed.

Operator and contact

[OPERATOR_NAME], registration [OPERATOR_REGISTRATION], at [OPERATOR_ADDRESS], operates the BigLoans referral service at https://bigloans.ph. Our privacy contact is [PRIVACY_EMAIL] and our Data Protection Officer is [DPO_NAME]. Effective date [EFFECTIVE_DATE]. Notice version 2026-10-v12.

Information and purposes

We process the name, email, phone, requested amount, date of birth, gender, marital status, employment, income, location, bank or wallet selection and government identification details you choose to submit. Required fields depend on the partner check. We do not request passwords for bank accounts, address books, contact lists, photos or precise device location. Do not provide another person’s details.

Your request and specific consent enable contact verification and the partner checks described below, including processing of sensitive details such as age, marital status and government identifiers. You may leave before submitting and use the public catalog. Without required details and consent we cannot perform the personalised checks. Account sign in uses a code sent to the email address you supply.

Service security records, referral clicks, partner conversion reports and commission balances support service delivery, abuse prevention and settlement. We rely on the applicable contract, legal obligation or documented legitimate interests for these distinct purposes. We do not use legitimate interests as a substitute for a required lawful ground for sensitive information. We record your choices, time and the notice shown.

Recipients and transfers

The recipient register below identifies the enabled lenders and service providers, their purposes, locations and roles. Only reviewed recipients may receive data. Contact verification sends your email to the listed verification services. An integration provider routes eligible application checks to enabled lenders. Lenders decide on credit under their own notices and contracts.

The application server and primary database are in the Philippines. The recipient register discloses processing elsewhere, including support, email and backups. Our approved contracts specify permitted processing, security, rights assistance and transfer safeguards. Philippine hosting does not by itself keep all processing in the Philippines.

Offer selection and remuneration

We receive referral commissions. Partner availability, reviewed eligibility rules and, when enabled, historical commission estimates and controlled offer-count experiments can influence which offers appear and their order. This service does not approve credit or determine lender terms. No model promises the lowest price or a complete market comparison. Ask our privacy contact for an explanation, human review or to object to profiling. We will assess the request and offer a public catalog route where available.

How long records remain

Application and partner response details are scheduled for removal after 90 days from application creation, unless an active request or documented legal hold prevents safe deletion. Inactive account identifiers are reviewed after 365 days. Closed privacy-case content is scheduled for removal after 365 days. Essential sessions expire after two idle hours; account access also requires a new sign in after 24 hours. Recovery tokens expire within 30 days and can be revoked.

Restricted financial, referral, consent and audit evidence is retained for 730 days under [RESTRICTED_RECORDS_BASIS], subject to recorded legal holds and the approved disposal process. These identifiers may remain personal data even after an account is erased. Backup copies expire within 30 days under the approved backup procedure. Before a backup is put back into service, deletion records must be reapplied. We explain any retained records and the reason when answering an erasure request.

Your choices and rights

Use My account to download linked account records and submit access, correction, deletion or complaint requests. Contact [PRIVACY_EMAIL] for guest records, blocking, objection, withdrawal, portability, a human explanation, or assistance if you cannot access the account. We verify identity proportionately and use a secure delivery channel. Do not send government ID images in ordinary email unless we have arranged a suitable secure method.

We aim to acknowledge requests within two business days and provide a substantive response within 15 business days, or explain what further work is needed. These are service targets, not a statement of a universal statutory deadline. We state reasons for any lawful restriction or partial response. You may complain to the National Privacy Commission at https://privacy.gov.ph/ without first exhausting our process.

Withdrawing optional permission does not affect the service or undo processing already lawfully performed. Withdrawal of permission needed for pending partner checks may prevent those checks. We will explain limitations once another controller has received data. No marketing subscription is created by an application. Marketing campaigns and third-party advertising pixels are disabled.

Security and updates

We use access controls, encryption of stored personal records, authenticated staff access and operational procedures to protect data. Report a suspected exposure to [PRIVACY_EMAIL]. Changes in recipients, purposes or material processing terms require updated notices and, where necessary, a new choice before the changed processing occurs.