Kevra Privacy Policy

For purposes of this Privacy Policy, unless the context requires otherwise:

1. "Kevra" refers to the Kevra mobile application, website, related services, and digital platforms.

2. "We", "us", or "our" refers to KVIKU LENDING CO. INC., WAVES FOR WATER ORGANIZATION, INC., and authorized affiliates, service providers, or partners providing services for Kevra within the authorized scope.

3. "User" or "you" refers to any individual who accesses, registers, applies for a loan, or uses Kevra services.

4. "Personal Information" refers to information that can directly or indirectly identify an individual, including personal identity information, sensitive personal information, financial information, device information, loan information, transaction information, and other information related to you.

5. "Loan Services" refers to loan application, identity verification, credit limit assessment, loan review, loan approval, disbursement, repayment management, overdue account management, customer support, complaint handling, and other services provided through Kevra.

6. "Developer Company" refers to the company responsible for Kevra application development, system maintenance, technical support, security maintenance, and platform operation support, namely WAVES FOR WATER ORGANIZATION, INC.

7. "Loan Service Provider" or "Licensed Lending Company" refers to the company responsible for loan services, loan review, disbursement, repayment management, overdue account management, collection compliance, and lending business regulatory responsibilities, namely KVIKU LENDING CO. INC.

The developer company and the loan service provider of Kevra are not the same company.

WAVES FOR WATER ORGANIZATION, INC., as the technical service provider, is responsible for application development, technical maintenance, system security, function support, and platform operation maintenance of Kevra.

KVIKU LENDING CO. INC., as the loan service provider, is responsible for loan services provided through Kevra, including loan application review, credit assessment, loan approval, disbursement, repayment management, overdue account management, customer service, complaint handling, and compliance obligations required by applicable laws and regulations.

For personal information processing related to loan services, KVIKU LENDING CO. INC. generally acts as the primary personal information controller and is responsible for determining the purposes and methods of personal information processing in relation to loan services.

WAVES FOR WATER ORGANIZATION, INC., within the authorized scope, processes necessary personal information as a technical service provider only for application operation, system maintenance, security protection, troubleshooting, data transmission, function support, and other authorized technical service purposes.

We process your personal information in accordance with the principles of data minimization, legality, fairness, transparency, and necessity.

Kevra collects only the information necessary to provide services, including account registration, identity verification, loan application, loan review, repayment management, customer support, risk control, account security, and legal compliance.

3.1 Information You Provide to Us

When you register an account, submit a loan application, complete your profile, upload materials, contact customer support, or use Kevra services, we may collect the following information:

1. Full name

2. Mobile phone number

3. Email address

4. Date of birth

5. Gender

6. Nationality

7. Residential address

8. Employment information

9. Income information

10. Government-issued identification information

11. Identity document photos

12. Selfie photos or liveness verification photos

13. Bank account or e-wallet information

14. Loan application information

15. Loan amount, loan term, repayment plan, and repayment records

16. Customer service inquiries, complaints, feedback, and communication records

17. Emergency contact information manually provided by you, if required for loan application or account verification

Kevra does not read your phone contacts or address book. If emergency contact information is required, it must be manually entered by you.

3.2 Financial and Loan-Related Information

To provide loan services, we may collect and process the following information:

1. Loan application materials

2. Loan review results

3. Credit assessment information

4. Risk assessment information

5. Disbursement records

6. Repayment records

7. Outstanding balance

8. Transaction records

9. Payment confirmation records

10. Loan agreements and disclosure document records

11. Account status and repayment history

The above information is used only for loan application review, loan servicing, repayment processing, risk management, dispute resolution, legal compliance, and regulatory requirements.

3.3 Device Information

Kevra may collect limited device information, including:

1. Device model

2. Operating system version

3. App version

4. Device identifiers permitted by the operating system

5. IP address

6. Network status

7. Crash logs

8. App performance data

9. Device information related to account security

Device information is used to protect your account security, prevent unauthorized access, identify abnormal activities, maintain app stability, troubleshoot technical issues, improve service quality, and support fraud prevention.

Kevra does not use device information for unauthorized advertising, unrelated user profiling, or sale to third parties.

3.4 Camera and User-Uploaded Files

Kevra may request access to your camera when you actively choose to perform the following actions:

1. Take photos of identity documents

2. Take selfie photos

3. Take photos of income proof or other supporting materials

4. Submit materials required for identity verification or loan application

Camera access is enabled only when you actively choose to take or upload relevant materials. Kevra does not access your camera in the background.

If Kevra supports image or file upload through the system photo picker or file picker, Kevra only accesses the files you actively choose to upload and does not scan or read your full photo library.

3.5 Data Minimization Principle

Kevra follows the principle of data minimization and only collects information necessary for account registration, identity verification, loan application, loan review, repayment management, account security, customer support, and legal compliance.

For the iOS version of Kevra, we do not request device permissions unrelated to core loan services, nor do we collect your personal information without your explicit authorization or a valid legal basis.

If new information or system permissions are required for future features, Kevra will explain the purpose, scope, and processing method before collection through the app, system permission prompts, Privacy Policy updates, or other appropriate means, and will obtain your authorization where required by law.

We may collect your personal information through the following methods:

1. Information you directly submit through the Kevra app, website, forms, or customer support channels

2. Information generated during your use of Kevra services

3. Information submitted through camera capture, file upload, or system picker

4. Information generated during loan application, loan review, repayment processing, and customer support

5. Information obtained from identity verification service providers, payment partners, risk assessment partners, credit institutions, regulatory sources, or other lawful partners with your authorization or where permitted by law

6. Information required to be processed pursuant to laws, regulations, regulatory requirements, lawful requests from judicial authorities, administrative authorities, or other competent authorities

We will not collect your personal information without a valid legal basis, reasonable purpose, or necessary authorization.

Kevra may collect, use, process, store, and disclose your personal information for the following purposes:

5.1 Account Registration and Account Management

1. Create and maintain your Kevra account

2. Verify your mobile phone number

3. Verify your identity

4. Manage account settings

5. Send account-related notifications

6. Protect account security

5.2 Identity Verification

1. Verify your true identity

2. Confirm that the loan application is submitted by you

3. Review identity documents and selfie photos

4. Prevent identity theft, impersonation, and fraudulent applications

5. Meet legal, regulatory, and compliance requirements

5.3 Loan Application and Review

1. Receive and process loan applications

2. Assess loan eligibility

3. Review personal, employment, income, and financial information

4. Conduct credit assessment and risk assessment

5. Make loan approval or rejection decisions

6. Generate loan agreements, repayment schedules, and related disclosure documents

5.4 Disbursement and Repayment Management

1. Process loan disbursement

2. Maintain loan accounts

3. Manage repayment schedules

4. Confirm repayment records

5. Send repayment reminders and account notifications

6. Update loan status

7. Handle overdue accounts and repayment disputes

5.5 Risk Control and Fraud Prevention

1. Identify, prevent, and investigate fraudulent activities

2. Prevent unauthorized account access

3. Monitor abnormal activities

4. Maintain risk assessment models

5. Protect the legitimate rights and interests of users, the platform, and partners

6. Improve the security of loan services

5.6 Customer Support and Dispute Resolution

1. Respond to your inquiries, requests, complaints, or feedback

2. Verify account identity during customer support communications

3. Investigate transaction errors, repayment issues, or account abnormalities

4. Handle service disputes and user complaints

5. Improve customer service quality

5.7 Legal and Regulatory Compliance

1. Comply with applicable laws and regulations

2. Fulfill regulatory, audit, tax, anti-money laundering, and record-keeping obligations

3. Respond to lawful requests from government agencies, regulators, courts, law enforcement authorities, or other competent authorities

4. Protect the legitimate rights and interests of Kevra, users, or third parties

5. Cooperate with dispute resolution, investigations, legal proceedings, or rights claims

5.8 Service Improvement

1. Improve app stability and performance

2. Troubleshoot failures and technical issues

3. Optimize user experience

4. Improve product features

5. Conduct internal data analysis

6. Maintain system security and service quality

5.9 Marketing and Service Notifications

Where consent is required by law, Kevra may send you marketing, educational, or service-related information about Kevra products and services.

You may opt out of marketing communications at any time.

However, even if you opt out of marketing communications, Kevra may still send you necessary account, security, loan, repayment, contract, overdue account, or legal compliance-related notifications.

Kevra may process your personal information based on one or more of the following legal bases:

1. Your consent

2. Performance of a contract or taking necessary steps before entering into a contract

3. Compliance with legal and regulatory obligations

4. Legitimate business interests, including fraud prevention, account security, loan risk management, and service improvement

5. Protection of the legitimate rights and interests of Kevra, users, or third parties

6. Other lawful bases permitted by applicable laws

Kevra does not sell or trade your personal information.

We disclose personal information only when necessary, lawful, reasonable, and related to the purposes described in this Privacy Policy.

7.1 Disclosure to the Loan Service Provider and Affiliates

Your personal information may be disclosed to KVIKU LENDING CO. INC. and its authorized affiliates, subsidiaries, officers, employees, representatives, or service teams for loan service operation, compliance management, account management, customer service, risk control, and repayment management.

7.2 Disclosure to the Developer and Technical Service Provider

Your necessary personal information may be disclosed to WAVES FOR WATER ORGANIZATION, INC. for Kevra application technical maintenance, system operation, security protection, troubleshooting, data transmission, function support, and platform service assurance.

WAVES FOR WATER ORGANIZATION, INC. shall not use your personal information for unauthorized purposes.

7.3 Disclosure to Third-Party Service Providers

Kevra may share necessary information with authorized third-party service providers, including:

1. Identity verification service providers

2. Cloud storage and server service providers

3. Payment processing partners

4. Banks, e-wallet providers, or fund transfer partners

5. Customer service providers

6. Notification service providers

7. Risk assessment and anti-fraud service providers

8. Data security and system maintenance service providers

9. Legal, audit, tax, or compliance advisers

Third-party service providers may process personal information only within the authorized scope and must take appropriate confidentiality and security measures.

7.4 Disclosure to Payment Partners and Financial Institutions

Kevra may disclose necessary information to banks, e-wallets, payment processors, fund transfer service providers, or other financial institutions to support loan disbursement, repayment processing, payment confirmation, refunds, transaction reconciliation, and dispute resolution.

7.5 Disclosure to Credit Institutions

Where permitted by law and with your consent where required, Kevra may disclose relevant loan and credit information to authorized credit institutions, credit information companies, credit bureaus, or credit reporting agencies for credit assessment, credit reporting, dispute handling, and legal compliance.

7.6 Disclosure to Collection and Legal Service Partners

If you fail to perform your repayment obligations under the loan agreement, Kevra may disclose necessary account and loan information to authorized collection partners, legal advisers, or debt recovery service providers for overdue account management, repayment communication, debt recovery, and legal proceedings.

Such disclosure will comply with applicable laws, reasonable collection practices, and data protection requirements.

7.7 Disclosure to Regulatory and Legal Authorities

Where required by law or reasonably necessary, Kevra may disclose personal information to government agencies, regulators, courts, law enforcement authorities, tax authorities, or other competent authorities to satisfy legal processes, regulatory investigations, audits, compliance obligations, or legitimate rights protection.

7.8 Disclosure Due to Business Changes

In the event of a merger, acquisition, restructuring, financing, asset transfer, or similar business transaction, personal information may be transferred as part of the relevant business assets. We will require the recipient to comply with applicable data protection obligations and confidentiality requirements.

To support the normal operation of Kevra and the provision of loan services, we may use authorized third-party service providers or SDKs to provide identity verification, risk control, anti-fraud detection, payment processing, system security, data storage, notification, customer support, app performance analysis, and troubleshooting services.

To the extent necessary to achieve the above purposes, third-party service providers or SDKs may process information you actively submit, identity verification materials, device information, network information, transaction information, risk control information, app usage records, or technical logs.

Risk control or anti-fraud services may process device model, operating system version, IP address, network status, device security status, login records, basic sensor data, and other information necessary to identify abnormal behavior, prevent fraudulent applications, and protect account security.

The specific data processing scope of third-party service providers or SDKs depends on the actual functions integrated into Kevra, system permission authorization, and related service needs.

We will reasonably evaluate third-party service providers and require them to process relevant information only within the authorized purpose, take reasonable security and confidentiality measures, and not use your personal information for unauthorized purposes.

Kevra does not sell your personal information.

You should ensure that the personal information submitted to Kevra is true, accurate, complete, and up to date.

Kevra may request additional materials or documents to verify your identity, account information, loan application, or repayment records.

If your information changes, you should promptly update it in Kevra or contact us to make corrections.

If you provide false, inaccurate, outdated, or incomplete information, Kevra may be unable to provide services, process your loan application, maintain your account, or continue providing loan services.

When you register an account, submit personal information, apply for a loan, use Kevra services, or authorize specific processing activities, you consent to Kevra processing your personal information in accordance with this Privacy Policy.

You may withdraw your consent at any time by contacting us at help@kevrapro.com.

Please note that withdrawal of consent may affect Kevra's ability to continue providing some or all services to you, especially where such information is essential for identity verification, loan review, repayment management, risk control, legal compliance, or contract performance.

Withdrawal of consent does not affect personal information processing already completed before the withdrawal, nor does it affect Kevra's continued processing of necessary information based on legal requirements, contractual obligations, or legitimate interests.

Kevra may use automated processing, scoring models, or risk assessment tools to assist in loan eligibility assessment, fraud identification, credit risk management, and platform security protection.

You may object to automated processing to the extent permitted by applicable laws.

However, if such processing is necessary for loan application review, risk assessment, or fraud prevention, Kevra may be unable to continue providing relevant loan services.

Kevra adopts reasonable and appropriate administrative, organizational, technical, and physical security measures to protect personal information from the following risks:

1. Unauthorized access

2. Unauthorized disclosure

3. Loss

4. Misuse

5. Alteration

6. Destruction

7. Fraudulent use

Security measures may include encrypted transmission, access control, secure protocols, internal permission control, audit mechanisms, employee confidentiality obligations, and system security monitoring.

Please note that no method of electronic transmission or storage can guarantee absolute security. Kevra takes reasonable measures to protect your personal information but cannot guarantee that information security will not be affected by any form of risk.

Kevra retains personal information only for the period necessary to fulfill the purposes for which it was collected, or for the period required or permitted by applicable laws and regulations.

13.1 Account and Identity Information

Personal identity information, identity verification records, and account records may be retained for up to ten (10) years after your last transaction, account closure, or the starting date required by law, whichever is later, to meet customer identification, regulatory compliance, anti-money laundering, fraud prevention, audit, and dispute resolution needs.

13.2 Loan and Transaction Records

Loan agreements, repayment records, payment confirmations, transaction records, and account history may be retained for up to ten (10) years after your last transaction, account closure, or the starting date required by law, whichever is later, for legal compliance, audit, tax, dispute resolution, fraud prevention, and regulatory requirements.

13.3 Customer Support and Complaint Records

Customer service inquiries, complaints, dispute records, and related communications may be retained for up to ten (10) years from the end of the relevant communication or event for service quality management, dispute handling, complaint follow-up, and legal protection.

13.4 Marketing and Analytics Data

Marketing preferences and analytics data not required for legal or loan service purposes will be retained only for the necessary period, generally not exceeding two (2) years, or deleted after you withdraw consent, unless a longer retention period is permitted by law.

After the retention period expires, Kevra will securely delete, anonymize, or destroy personal information to prevent unauthorized access, use, or disclosure.

You have the right to request deletion of your Kevra account.

14.1 In-App Account Deletion Path

You may submit an account deletion request through the following path:

Me > About Us > Delete Account

After you submit a deletion request, Kevra will verify your identity and process your request within a reasonable period.

14.2 Data Processing After Account Deletion

After account deletion, Kevra will delete or anonymize personal information that is no longer necessary.

However, Kevra may continue to retain necessary information as required by law in the following circumstances:

1. Legal and regulatory compliance

2. Anti-money laundering requirements

3. Fraud prevention

4. Security investigations

5. Audit and tax obligations

6. Outstanding loan obligations

7. Unresolved disputes, complaints, or investigations

8. Legal requests, litigation, or rights claims

If you have an outstanding loan, incomplete repayment, unresolved dispute, or ongoing investigation, account deletion will not immediately delete necessary records related to loans, identity, transactions, compliance, or legal obligations.

Under applicable Philippine data privacy laws, you, as a data subject, may have the following rights:

1. Right to be informed about the collection and use of your personal information

2. Right to object to the processing of your personal information

3. Right to access your personal information

4. Right to request correction of inaccurate or outdated information

5. Right to request deletion or blocking of processing, subject to legal and contractual limitations

6. Right to data portability

7. Right to withdraw consent

8. Right to claim compensation for damages caused by unlawful or improper processing, where applicable

9. Right to file a complaint with the National Privacy Commission of the Philippines

You may exercise these rights by contacting us at help@kevrapro.com.

To protect account security, Kevra may require you to complete identity verification before processing your request.

Where applicable, you may have rights related to credit information, including:

1. Right to request access to your credit information

2. Right to dispute inaccurate credit information

3. Right to be informed of corrections to credit data

4. Right to obtain remedies under applicable credit information laws

Credit information-related requests may require identity verification and will be processed in accordance with applicable procedures and legal requirements.

You agree to:

1. Provide true, accurate, complete, and up-to-date information

2. Promptly update information when it changes

3. Use Kevra only for lawful purposes

4. Not submit false, misleading, fraudulent, or unauthorized information

5. Cooperate with reasonable identity verification, compliance review, and security requests

Kevra may suspend, restrict, or terminate services to you under the following circumstances:

1. You fail to provide necessary information

2. The information you submit is false, misleading, incomplete, or outdated

3. You withdraw consent necessary for core service processing

4. There is suspected fraud, misuse, security risk, or illegal activity

5. Laws, regulations, regulators, or competent authorities require Kevra to take relevant measures

Kevra services are intended only for users who have reached the age required by applicable laws and are eligible to enter into loan agreements.

Kevra does not knowingly collect personal information from minors.

If Kevra discovers that personal information of a minor has been collected without an appropriate legal basis, Kevra will take steps to delete or restrict the relevant information, unless retention is required by law.

Kevra services are primarily intended for users in the Philippines.

If personal information needs to be accessed, processed, or stored outside the Philippines due to authorized service providers, technical support, cloud services, or system maintenance, Kevra will take reasonable measures to ensure that such processing is appropriately protected, including contractual obligations, access controls, security measures, and applicable data protection requirements.

Kevra may update this Privacy Policy from time to time to reflect changes in services, legal requirements, technology, or business operations.

The updated version will be published in the app, on the website, or through other appropriate channels.

If relevant changes materially affect the processing of your personal information, Kevra will notify you through reasonable means.

Your continued use of Kevra after the update becomes effective means that you accept the updated Privacy Policy.

Kevra may update this Privacy Policy from time to time to reflect changes in services, legal requirements, technology, or business operations.

The updated version will be published in the app, on the website, or through other appropriate channels.

If relevant changes materially affect the processing of your personal information, Kevra will notify you through reasonable means.

Your continued use of Kevra after the update becomes effective means that you accept the updated Privacy Policy.

If you have any questions, concerns, requests, complaints, or reports regarding this Privacy Policy or the processing of your personal information, please contact us at:

Email: help@kevrapro.com

Company Information:

Developer / Technical Service Provider: WAVES FOR WATER ORGANIZATION, INC.

Loan Service Provider: KVIKU LENDING CO. INC.

Business Name: Kevra

SEC Registration No.: CS201918702

Certificate of Authority No.: 3169

Registered / Business Address of Loan Service Provider: 18A Trafalgar Plaza, 105 H.V. Dela Costa St., Salcedo Village, Makati City

The Kevra Customer Support Team will handle your request within a reasonable period in accordance with applicable laws and internal procedures.