Effective Date: October 16, 2026

Last Updated: October 16, 2026

PESO GABAY PRIVACY POLICY

Credible Lending Inc. (“Credible Lending”), a lending corporation organized and existing under the laws of the Republic of the Philippines, operates the online lending platform “Peso Gabay” (the “Platform”). Credible Lending and Peso Gabay are collectively referred to as the “Company”, “we”, “us” or “our”. We take your privacy very seriously.

Before availing of our services, please read this Privacy Policy carefully to understand what Personal Data we collect and how it will be used. The Company collects, stores, shares, uses, processes, and protects your Personal Data in accordance with this Privacy Policy and the laws of the Republic of the Philippines, including the Data Privacy Act of 2012 (Republic Act No. 10173) (the “DPA”), its Implementing Rules and Regulations (the “IRR”), and the issuances of the National Privacy Commission (“NPC”). All Personal Data is processed in adherence to the principles of transparency, legitimate purpose, and proportionality.

We may update this Privacy Policy from time to time. Material revisions will be published on the Platform and, where required, notified to you. By accessing the Platform or availing of our products and/or services, you confirm that you have read, understood, and accepted this Privacy Policy.

1. PERSONAL DATA WE COLLECT

When you register on the Platform and apply for our products and/or services, we may collect the following categories of Personal Data (the enumerations are examples and not exhaustive):

• Identity data – name, date and place of birth, nationality, civil status, gender, photographs, and signature specimens;
• Contact details data – residential address, mobile number, and email address;
• Government-issued data – government-issued identification documents and numbers (e.g., PhilSys/National ID, UMID, driver’s license, passport, TIN);
• Bank/E-wallet details data – bank account or e-wallet details for loan disbursement and repayment;
• Education and employment data – educational attainment, occupation, employer, income, and length of service;
• Financial and credit data – credit history and standing, your loan applications and transactions with us, and information obtained from the Credit Information Corporation (CIC), credit bureaus, banks, and other financial institutions;
• Device and usage data – device identifiers (e.g., IMEI, device ID), device model and operating system, mobile network provider, approximate location, and your use of the Platform; and
• Reference and guarantor data – the personal data of the references and/or guarantors you provide to us (see Section 3).

2. PURPOSES OF PROCESSING

We collect and process the above Personal Data for the following purposes:

1. To identify and verify your identity, including the conduct of “Know Your Client” (KYC) procedures;
2. To process, evaluate, disburse, service, collect, and manage your loan applications and accounts, including credit investigation, credit scoring, credit verification, risk profiling, and automated decision-making to determine your eligibility for our products and services;
3. To comply with our legal and regulatory obligations, including anti-money laundering and counter-terrorism financing laws and the requirements of the Securities and Exchange Commission (SEC), the Anti-Money Laundering Council (AMLC), the CIC, and other supervising agencies;
4. To prevent, detect, and investigate fraud and other unlawful activities, and to secure your account;
5. To contact and communicate with you through SMS, phone calls, email, and in-app notifications, and to address your requests, queries, and complaints;
6. To promote our products and services and measure consumer interest in them;
7. To conduct data and risk analysis and improve our products, services, and your experience;
8. To protect the legal and business interests of the Company in judicial, quasi-judicial, administrative, or criminal proceedings, and to comply with valid court orders and legal processes.

If you are unwilling to submit your Personal Data for the above purposes, we may not be able to provide our products and services to you.

3. REFERENCES AND GUARANTORS

As part of the loan application, you will be asked to manually provide the details of references and/or guarantors, such as their name and mobile number. We process such information only for the proper identification and verification of your identity, fraud prevention, credit evaluation, and compliance with the anti-money laundering and terrorism prevention laws of the Republic of the Philippines.

It is your obligation to inform your nominated references and/or guarantors that you have provided their details to us and to obtain their consent. We do not access, collect, or read the contact list stored on your device.

In compliance with NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, you may disable features and functionalities relating to the disclosure of your references’ and/or guarantors’ personal data within the Platform after the completion of the loan processes for which such data was collected.

4. DEVICE PERMISSIONS USED BY THE PLATFORM

The Platform only requests device permissions that are suitable, necessary, and not excessive for KYC verification, determining creditworthiness, and fraud prevention:

4.1 Camera and Photos

We request access to your device’s camera so you can capture photographs of yourself and your documents during the loan application, for KYC verification and anti-fraud inspection, including face recognition to authenticate your identity. We only collect the photos you take or actively select and upload during the application. We do not access any other photos in your device’s gallery. Such information is encrypted.

4.2 Approximate Location

We collect the approximate location of your device to determine the serviceability of your loan application and for fraud prevention. Such information is encrypted.

4.3 Device Information

We collect device information (such as device identifiers, model, and operating system) to verify that you are using your own device and to prevent account takeover and fraud. Such information is encrypted.

5. DISCLOSURE AND SHARING OF PERSONAL DATA

We do not sell your Personal Data. We may share your Personal Data with the following categories of recipients, only to the extent necessary for the purposes stated above, or when required by law or with your consent:

• Banks, e-wallet providers, and other financial institutions, for loan disbursement and repayment collection;
• Credit bureaus, the CIC, and credit scoring service providers;
• IT and cloud service providers, for data storage and processing;
• Collection partners;
• Our affiliates and business partners, under appropriate data sharing agreements; and
• Government institutions and regulators (e.g., the SEC, the AMLC, the Bureau of Internal Revenue, and the NPC), or a transferee in case of merger or acquisition.

Before sharing your Personal Data where consent is required, we will ask you to click the “Accept” option in the Platform. Clicking “Accept” constitutes your electronic signature and signifies that you have read, understood, and accepted this Privacy Policy. If you do not agree, you may click “Reject”, but you will not be able to use the Platform’s services.

Personal data shared with third parties is covered by appropriate agreements to ensure it is adequately safeguarded. The Company is not responsible for the collection or use of your Personal Data by third-party websites or applications outside the Platform.

6. INTERNATIONAL TRANSFERS

Where necessary for data storage or service delivery, your Personal Data may be transferred to and processed in countries outside the Philippines, including through cloud service providers. In such cases, we ensure through contractual obligations or other similar guarantees that your Personal Data is protected to the standards required by the DPA and its IRR. By using our services, you consent to such transfers.

7. SECURITY

We implement organizational, administrative, technical, and physical security measures to protect your Personal Data against loss, misuse, unauthorized access or disclosure, alteration, or destruction, including:

• Encryption of Personal Data at rest and in transit;
• Secured servers, firewalls, and access controls;
• One-Time Passwords (OTP) and identity verification;
• Restricting access to qualified and authorized personnel bound by strict confidentiality obligations; and
• Requiring third-party service providers to protect personal data to our security standards.

8. RETENTION AND DELETION

We retain your Personal Data only for as long as necessary for the purposes stated above, to comply with legal and regulatory obligations, or as necessary to establish, exercise, or defend legal claims. Records of transactions and customer identification records are retained for at least ten (10) years from the date of the transaction or the closing of the account, subject to exceptions under applicable laws. Personal Data that is no longer necessary is disposed of securely and in accordance with applicable regulations.

If you wish to stop using our services and request the deletion of your Personal Data, you may email cs@pesogabay.com or call our customer service hotline at +63 09124049679. Your Personal Data will be deleted after the lapse of the applicable retention period.

9. YOUR RIGHTS AS A DATA SUBJECT

Under the DPA, you have the right to be informed of and to access the Personal Data we hold about you; to request the correction of inaccurate or incomplete data; to request the deletion or blocking of your data (subject to our legal retention obligations); to object to its processing, including for direct marketing, profiling, or automated decision-making; to receive your data in a structured, commonly used, and machine-readable format; and to claim indemnification for damages arising from unauthorized or unlawful processing of your Personal Data.

To exercise these rights, or for any inquiries or complaints regarding the processing of your Personal Data, please contact our Data Protection Officer at cs@pesogabay.com. If you believe we have not addressed your request or complaint appropriately, you have the right to file a complaint with the National Privacy Commission at https://privacy.gov.ph.

10. ACCURACY OF PERSONAL DATA

You are responsible for ensuring that the Personal Data you provide is complete, accurate, true, and correct, and for informing us promptly of any changes. Please keep your account details, PINs, and passwords secure, and be cautious of phishing and other fraud. The Company will only communicate with you through its official channels.

11. MINORS

Minors shall not use our products and/or services. We do not knowingly collect Personal Data from minors. If you believe we hold the Personal Data of a minor, please contact us and we will delete it.

12. CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy from time to time to keep it consistent with applicable legal and regulatory requirements. Updates will be posted on the Platform.

13. CONTACT US

If you have any questions, requests, or complaints regarding this Privacy Policy or the processing of your Personal Data, please contact us through any of the following channels:

• Customer Service Hotline: +63 09124049679
• Email / Data Protection Officer: cs@pesogabay.com