Privacy Notice

kvikuloan.ph is operated by Virix Labs. Full legal entity details are at the bottom of this notice under “Operating entity”.

Virix Labs acts as a disclosed Marketing and Technology Service Provider for Kviku Lending Co., INC. (Securities and Exchange Commission of the Philippines Reg. No. CS201918702, Certificate of Authority No. 3169), the SEC-licensed lender that issues the loans advertised on this site. Kviku is the operator of record under SEC MC 10 s.2021. Virix does not lend, decide, disburse, or collect.

For the pre-submission portion of your visit (browsing this site, filling in the application form, marketing analytics), Virix Labs is the Personal Information Controller (PIC) of the data you provide. For data submitted to Kviku via the application form, Kviku Lending Co., INC. becomes the PIC of record for the loan application, and Virix continues to act as a Personal Information Processor (PIP) for ancillary services strictly under written Data Sharing and Outsourcing Agreements between Virix and Kviku.

In plain English: until you press Apply Now, the data is with us. After you press Apply Now, the data is sent to Kviku and Kviku becomes the primary controller of your application data.

We collect only what is necessary to evaluate and process a loan application. Specifically:

• Identity data: full name, date of birth, gender, government-issued ID type and number.
• Contact data: mobile phone number, email address.
• Financial data: requested loan amount, term, employment information, monthly income, GCash or bank account number for disbursement.
• Application metadata: session identifiers, IP address, browser/device fingerprint, UTM source/medium/campaign, Meta Click ID (fbclid), referrer, timestamps, application progress events.
• Marketing identifiers: Meta Pixel cookies and equivalent identifiers used for advertising attribution via the Meta Conversions API (CAPI) under hashed-identifier matching.

We do not read your contact list, photo gallery, SMS messages (beyond a one-time OTP if you opt into 2FA), or any data not listed above. NPC Circular 2022-02 prohibits such collection; we comply.

• To pass the application to Kviku for credit scoring and loan-issuance decisioning.
• To verify your identity and reduce fraud.
• To communicate with you about your application status and the resulting loan agreement (if approved).
• To measure advertising effectiveness and attribute conversions to the campaigns that drove them — via Meta Pixel and CAPI.
• To comply with regulatory record-keeping under R.A. 9474, R.A. 10173, R.A. 9510, and the SEC OLP framework.

• Consent (DPA sec. 3(b)) — for collection of your identity, contact and financial data, and sharing it with Kviku for credit decisioning. You give consent by ticking the agreement checkbox on the application form.
• Contractual necessity (DPA sec. 12(b)) — for processing required to provide the loan if approved.
• Legal obligation (DPA sec. 12(c)) — for record-keeping under R.A. 9474 and SEC reporting.
• Legitimate interest (DPA sec. 12(f)) — for fraud prevention and marketing analytics, balanced against your rights.

You may withdraw consent at any time by emailing dpo@virixlabs.com. Withdrawal does not affect processing that has already taken place or processing under another legal basis.

• Kviku Lending Co., INC. — the lender. We pass your application to Kviku via secure API. Kviku's own privacy notice governs further processing on their side. Kviku DPO: dpo@kviku.ph.
• Meta Platforms, Inc. — hashed identifiers (SHA-256 of email/phone), event metadata, and the Meta Click ID are transmitted via the Conversions API for advertising attribution. We do not transmit unhashed identity data to Meta.
• Hosting and infrastructure providers — Vercel Inc. (web hosting), Contabo GmbH (proxy infrastructure for the Kviku API), and storage providers as Personal Information Processors strictly under contract.
• Authorities — when legally compelled (court order, NPC investigation, SEC inquiry, BIR audit, AMLC request).

We do not sell your personal data and we do not share it with marketing partners other than the attribution platforms named above. We do not share it with debt collectors — collection of any approved loan is performed solely by Kviku under its own privacy notice and the SEC MC 18 unfair-collection rules.

Some of our processors are located outside the Philippines (Vercel in the US, Contabo in Germany, Meta in the US and Ireland). For each such transfer we rely on contractual safeguards (Standard Contractual Clauses or equivalent) and the receiving party's commitments to protect the data at a level comparable to the DPA. You may request a copy of the relevant safeguards from our DPO.

• Application data passed to Kviku: retained by Kviku under their schedule (life of the loan plus the legally required period).
• Application metadata held by Virix: 24 months from submission, unless earlier deletion is requested and no legal obligation requires retention.
• Meta Pixel / CAPI hashed identifiers: retained by Meta under their own policy.
• Logs and security data: 12 months.

Under sections 16–18 of the DPA, you have the right to: be informed, access, correct, erase or block, object, port your data, claim damages, and file a complaint with the National Privacy Commission at privacy.gov.ph.

To exercise any of these rights, email dpo@virixlabs.com. We respond within 15 calendar days. For rights regarding data already passed to Kviku, contact dpo@kviku.ph.

We implement organisational, physical, and technical safeguards proportionate to the sensitivity of the data: TLS in transit, encrypted storage, access logging, least-privilege admin access, secrets management, regular vulnerability review, and a documented breach-response procedure. In the event of a personal data breach likely to result in serious harm, we will notify the NPC and affected data subjects within 72 hours per NPC Circular 16-03.

kvikuloan.ph uses first-party session storage and the Meta Pixel for advertising attribution and product analytics. You may opt out of advertising cookies by adjusting your browser settings or by emailing the DPO to request exclusion from CAPI-based attribution for your hashed identifiers.

Kviku loans are available only to Filipino citizens aged 21 and above. We do not knowingly collect data from anyone under 18. If you believe we have collected data from a minor, please contact the DPO and we will delete it.

We may amend this notice to reflect changes in law, regulation, or our practices. Material changes will be highlighted on this page. The “last updated” date at the top always reflects the current version.

• Virix Labs Data Protection Officer: dpo@virixlabs.com
• Kviku DPO (for data already shared with Kviku): dpo@kviku.ph
• National Privacy Commission: privacy.gov.ph · complaints@privacy.gov.ph