At Templetech Finance Corp. doing business under the names Tendo and Tendo by Tonik (“Tendo,” “Company,” “we,” “our,” “us”), we are committed to safeguarding your privacy and protecting your Personal Data. We comply with Republic Act No. 10173 or the Data Privacy Act of 2012 (“DPA), its Implementing Rules and Regulations (“IRR”), and the issuances of the National Privacy Commission (“NPC”) in relation thereto (collectively, “Data Privacy Laws”). We also follow industry-recognized standards to keep your information safe. When we share your Personal Data with our affiliates or trusted partners, we do so securely and in accordance with the Data Privacy Laws.

• Introduction
  • Personal Information Controller
  • Personal Information Processor
  • Not Covered in This Data Privacy Notice
• What Personal Data we collect
  • User-Provided Personal Data
  • Sensitive Personal Information
  • Social Media Log-In Data
  • Application Data
  • Automatically Collected Data
  • Personal Data We Receive From Other Sources
• How We Use Your Personal Data
  • Legal Bases for Processing Your Personal Data
  • Commitment to Fair and Professional Collections
  • Credit Bureaus
  • Managing Log-Ins Using Third-Party Accounts
• How we retain your personal data
• How we keep your personal data safe
• Your rights and how we respect them
• How We Notify You of Changes to Our Data Privacy Notice
• How to contact us

• Introduction

  This Data Privacy Notice and Consent Form (“Notice”) sets out the information you need to understand what data we obtain about you. It also explains our data privacy practices and policies. Through this Notice, we aim to help you make an informed decision and exercise meaningful control over your data. It describes our practices regarding the collection, use, disclosure, retention, disposal, and other processing of Personal Data when you:

  1. Use Tendo services, including the Tendo Platform as defined below, and related services, sales, marketing, after sales, or events, (“Services”);” or
  2. Otherwise communicate with us.

  Communications may include channels such as, but not limited to, Viber, WhatsApp, in-app messages or calls, email, SMS, or other similar platforms that Tendo may adopt in the future.

  This Notice explains Tendo’s commitment to protecting your privacy and handling your data responsibly. It describes how we collect, process, store, and dispose of your Personal Information and Sensitive Personal Information (collectively “Personal Information” or “Personal Data”) in accordance with the Data Privacy Laws. We encourage you to read this Notice carefully, as it sets out how we protect and use your Personal Information. If you do not agree with any part of this Notice, please discontinue using our Services, including the Tendo Platform, immediately.

  Tendo is a financing company duly organized and existing under the laws of the Republic of the Philippines with Company Registration No. CS201820732. We are licensed by the Securities and Exchange Commission (SEC) to operate as a financing company under Certificate of Authority No. 1228.

  You may register for and use the Tendo mobile application or website (collectively, “Tendo Platform”) to access our Services and, subject to our Terms and Conditions, apply for a loan product offered by Tonik Digital Bank, Inc. (“Tonik”). Tendo operates the Tendo Platform and provides related technology, customer onboarding, and servicing support, while Tonik is responsible for assessing, approving, granting, and managing loans. To provide our Services and facilitate access to Tonik’s loan products, we need to collect certain Personal Information from you. This allows us to verify your identity, evaluate and facilitate your access to and use of the Tendo Platform, and ensure that our Services are delivered securely and efficiently.

  Personal Information Controller

  A Personal Information Controller (“PIC”) is an organization that determines the purposes and means of processing your Personal Data.

  Tendo is the PIC for your Personal Data for activities related to:

  1. loans obtained prior to 1 June 2025; and
  2. Tendo Platform account creation and other Tendo Platform-related activities for which Tendo independently determines the purposes and means of processing Personal Data.

   

  Personal Information Processor

  A Personal Information Processor (“PIP”) is an organization that processes Personal Data on behalf of, and under the instructions of, a PIC.

  For loan applications involving loans granted by our licensed and regulated banking partner, Tonik, through the Tendo Platform starting 1 June 2025, Tonik acts as the PIC, while Tendo acts as its PIP.

  Tendo processes your Personal Data on Tonik’s instruction, in accordance with applicable Data Privacy Law and Tonik’s Data Privacy Notice and Data Privacy Statement.

  Tonik, as the lender responsible for these loan transactions, is the Personal Information Controller. Tendo processes your Personal Data on Tonik’s behalf and does not independently determine the purposes and means of such processing.

  Tendo and Tonik are committed to protecting the security and confidentiality of your Personal Data and ensuring that it is processed only for legitimate and lawful purposes.

  To learn more about Tonik’s data privacy practices, or to exercise your data protection rights concerning these processing activities, please contact Tonik directly at [email protected] or at +63 2 5322 2645.

  Not Covered in This Notice

  Our website and applications may include links to third-party websites or social media features, such as the Facebook “Like” button. These third-party websites and features may be subject to their own terms of use and privacy policies. Tendo does not control, and is not responsible for, how these third parties independently handle your Personal Data or content.

  Some of these features may collect your IP address, track your activity on our website, or use cookies to function properly. They may be hosted by third parties or directly on our website. Your use of such features may be subject to the privacy policies of the respective third-party providers.

  Some of these features may collect your IP address, track your activity on our website, or use cookies to function properly. They may be hosted by third parties or directly on our website. Your use of these features may be subject to the privacy policies of the respective third-party providers.

  We encourage you to review the privacy policies of any external websites or services you access through the Tendo Platform to understand how they collect and use your Personal Data. Tendo is not responsible for the independent data processing practices of these third parties, except to the extent otherwise required by applicable law.

  We encourage you to review the privacy policies of any external websites or services you visit or access through the Tendo Platform to understand how they collect and use your Personal Information. Tendo is not liable for any independent data processing practices of these third parties, except to the extent otherwise required by applicable law.

• What Personal Data We Collect

  Personal Data refers to any information that identifies you, or from which your identity can be reasonably determined, whether directly or indirectly. This may include your name, contact details, address, identification information, or device identifiers, depending on how you interact with us. It does not include aggregated or anonymized data which cannot be reasonably used to identify you.

  We collect various types of Personal Data when you:

  1. download or use the Tendo Platform;
  2. create an account or apply for access to our Services;
  3. communicate with us through chat, email, or customer support;
  4. join our events, participate in our contests and promotional activities (including, but not limited to, raffles, giveaways, incentive programs, surveys, customer engagement campaigns, and other marketing initiatives), respond to surveys, or visit our office;
  5. participate in loan applications, verification, servicing, processing or collection activities undertaken by Tendo on behalf of Tonik; or
  6. are referred to us by your employer or when your employer provides employment-related information for verification and loan administration purposes, in line with your company’s data privacy policy and the applicable Data Privacy Laws.

  Sharing your Personal Data with us is generally voluntary. However, if you choose not to provide certain information, we may not be able to offer and deliver specific Services, respond to your requests, or enable certain features or tools that require such data.

  If you share someone else’s Personal Data with us (e.g., as a referral or a potential employee), please make sure that that the person is aware of this Notice, has been informed of the intended disclosure, and has given the necessary consent or that you otherwise have a lawful basis and appropriate authority to share their Personal Data with Tendo.

  USER-PROVIDED PERSONAL DATA

  We may collect the following types of Personal Data from you:

  1. Personal identifiers. Your basic contact and profile information, such as your name, email address, home or mailing address, phone number, social media account names, registered devices, gender, age, and any user IDs you use when communicating with us (e.g., Viber, WhatsApp, etc.);
  2. Payment information. Details needed to process your payments, including your billing address, bank account information, and credit, debit, or other payment card information;
  3. Transaction information. Records of your purchases, use of our Services, or transactions facilitated through Tendo, including purchases made through the Tendo Platform;
  4. Fraud prevention information. Data used to help detect, identify, and prevent fraud, such as device trust scores, and location information;
  5. Financial information. Details such as your salary, income, and assets that may be needed for credit risk assessment and scoring in connection with loan applications submitted through the Tendo Platform;
  6. Government ID data. Information contained in your valid government-issued IDs, collected and used to verify your identity or as otherwise required by law;
  7. Professional and employment-related information. Information about your employment, such as your job title, role, employer, work location, and employment status (including but not limited to resignation, termination, probationary or regular status, and other related changes). We may also collect or verify this information directly from your employer, including loan administration, repayment monitoring, and continued eligibility assessment, in accordance with applicable Data Privacy Laws;
  8. Audio-visual materials. Your photo, as well as images or footage captured and/or recorded through our CCTV, and other related security or monitoring systems, or during marketing and/or public filming events or sessions, including but not limited to, recording of virtual, live, or in-person workshops. This may also include audio-video recordings and transcripts of meetings;
  9. System and application access data; internet and electronic network activity information. If you are given access to Tendo’s systems, we may collect information needed for such access, including but not limited to, system IDs, LAN IDs, e-mail or messaging accounts, mainframe IDs, system passwords, internet or other electronic network activity information, such as your activity logs and electronic content created using Tendo systems;
  10. Other Information you provide to us. Content from your communications with us, such as your exchanges with our employees and customer support teams across different forms and channels, including social media. This also includes your product and service history, and correspondence sent to our dedicated mailboxes or other electronic channels, such as those supported by Artificial Intelligence (“AI”) tools used to assist our personnel when interacting with you; and
  11. Inferences drawn from your Personal Data. Insights or conclusions we may derive based on your interactions, preferences, interests and transactions.

  SENSITIVE PERSONAL INFORMATION

  Sensitive Personal Information refers to Personal Data that includes your race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations; details relating to your health, education, genetic or sexual life; information about any proceeding for any offense committed or alleged to have been committed by you, including the outcome of such proceedings; information issued by government agencies that is unique to you, such as but not limited to, social security numbers, health records, licenses or their denials, suspensions or revocations, and tax returns; and any information that an executive order or act of Congress requires to be kept classified.

  When you use our Services, and only when necessary, with your consent or as otherwise permitted by law, we may also process certain types of Sensitive Personal Information, including:

  1. Financial data, to the extent classified as Sensitive Personal Information under the Data Privacy Laws;
  2. Biometric data, where classified as Sensitive Personal Information under ; and/or
  3. Social security information and other government-issued identifiers.

  PAYMENT DATA

  We may collect information required to facilitate your loan disbursement or process payments, in connection with loans granted such as your payment instrument numbers, identifying details, and the security code linked to your chosen payment method or instrument.

  SOCIAL MEDIA LOG-IN DATA

  For your convenience, we may allow you to create or access your account using your existing social media credentials, such as your Facebook or Apple ID, or other similar accounts.

  APPLICATION DATA

  We may collect certain additional data from your device if you choose to grant us access or permissions, including:

  1. Location Information: With your consent, we may access your mobile device’s location, either continuously or only while you are using the Tendo Platform, to support location-based Services. You may change or revoke these permissions at any time through your device settings;
  2. Device Access. We may request access to features of your mobile device, such as the camera, microphone, storage, GPS, and similar functionalities. You may modify or disable these permissions at any time through your device settings; and
  3. Push Notifications. We may send you push notifications about your account, transactions, or features of the Tendo Platform. If you prefer not to receive these notifications, you may turn them off through your device settings.

  This information helps us maintain the security and proper functioning of the Tendo Platform, troubleshoot issues, and support our internal analytics and reporting.

  AUTOMATICALLY COLLECTED DATA

  When you use the Tendo Platform or our Services, we may use cookies and similar technologies to automatically collect, record, store, and otherwise process the following types of Personal Data:

  1. Usage Data. Information about how you interact with our Services, such as Tendo Platform launches, browsing activity, Tendo Platform engagement, IP address, GPS or other device-based location data, unique identifiers, and other details on how you engage with our Services, content, and advertisements; and
  2. Device Information. Data that identify your device or provide information about it, such as your device ID, browser type, and similar technical information.

  We evaluate website performance using Google Analytics, which utilizes cookies and similar identifiers to gather information such as how often you visit our website, which pages you access, and the sites you visited before ours. For more details on how Google Analytics collects and processes Personal Data, please refer to Google’s Privacy Policy.

  We use cookies and similar technologies to recognize you when you visit our website or use the Tendo Platform. These technologies and tools help us understand your usage patterns, remember your preferences, and enhance your overall experience. You may manage your cookie preferences at any time through your browser settings.

  PERSONAL DATA WE RECEIVE FROM OTHER SOURCES

  Tendo may also collect your Personal Data from sources other than directly from you. These may include individuals, or organizations acting on your behalf, our business partners, and third parties who help us deliver our Services, strengthen security, prevent fraud, enhance our Services, and improve your overall experience.

  For example, if you choose to sign in or connect to our Services using a social media account like Facebook, you allow Tendo to collect, store, and process certain Personal Data from that platform. Similarly, Tendo may obtain Personal Data from your employer to verify and monitor your employment status and determine your continued eligibility for loan products offered by Tonik through the Tendo Platform. Such information may also be processed for loan administration, repayment monitoring, and other purposes described in this Notice. Where consent is required under applicable Data Privacy Laws, your employer's disclosure of your employment-related information to Tendo and Tonik shall be subject to your consent and authorization as provided hereunder.

  Any information we receive will be collected, stored, and processed in line with this Notice and our Terms of Use. For the avoidance of doubt, Terms of Use refers to the agreement governing your access to and use of our Services, including any applicable rules, guidelines, and conditions.

• How we use your personal data

  We use the information we collect or receive for the following purposes:

  1. To facilitate your registration, access to, and use of the Tendo Platform and related Services. This includes facilitating applications for loan products offered by Tonik, managing your Tendo Platform account, and providing information about financial products and services offered by Tonik, our affiliates, and merchant partners;
  2. To support the delivery and administration of the Services and facilitate loan-related activities on behalf of Tonik. These activities may include processing, sending notifications, preparing loan statements, providing customer service and support, conducting surveys, offering Services, implementing upselling and cross-selling campaigns, administering rewards and loyalty programs, and implementing promotional contests and other activities as well as marketing initiatives. We may contact you through various communication methods such as the Tendo Platform, mail, phone, SMS, Viber, WhatsApp, fax, email, online channels, internet, mobile, social media, chat, biometrics, and other similar technological tools. You may decline or opt out of receiving marketing and promotional communications from Tendo at any time by updating your communication preferences through your account profile and settings on the Tendo Platform, or by contacting Tendo Customer Care via email. Your opt-out will not affect service-related, transactional, regulatory, or other non-marketing communications that are necessary or permitted in connection with your account;
  3. To verify your identity, conduct applicable Know-Your-Customer (KYC) and other verification procedures and regulatory checks, and confirm the authority of individuals acting on your behalf. This includes responding to requests, inquiries, or instructions from you or your authorized representatives;
  4. To perform our contractual obligations relating to the Tendo Platform and support Tonik in assessing and monitoring your eligibility for its loan products. This may include obtaining information directly from your employer to verify and monitor your employment status and continued eligibility, where authorized by you or otherwise permitted by applicable Data Privacy Laws;
  5. To authenticate your identity when accessing the Tendo Platform or conducting certain transactions. Where permitted by law and enabled by you, this may include the use of facial, fingerprint, or voice recognition technologies;
  6. To maintain, develop, offer and/or improve the Tendo Platform and other related Services. This includes enhancing their features, functionality, security, and user experience;
  7. To provide relevant and accurate information, newsletters, and communications about Tendo, Tonik, our affiliates, or merchant-partners. This may include marketing financial products and services offered by Tonik, conducting market research, developing or refining Tendo Platform and other related Services, personalizing our customer service interactions, and developing promotional initiatives;
  8. To facilitate payment processing, loan servicing, repayment arrangements, and collection activities on behalf of Tonik, as applicable. For loans previously extended by Tendo, this may include administering outstanding obligations and enforcing Tendo's contractual rights;
  9. To support Tonik in conducting credit evaluations, credit scoring, risk assessments, including statistical trend analysis, and fraud prevention activities. This may include verifying financial and employment information, conducting applicable anti-money laundering (AML) and sanctions checks, obtaining information from authorized sources, such as, but not limited to, tax agencies, financial institutions, government agencies, credit bureaus, and other verification service providers;
  10. To support business operations, including risk management, regulatory reporting, credit bureau reporting, systems and process development and improvement, insurance-related activities, audits, and other administrative tasks, as applicable to Tendo’s responsibilities and its arrangements with Tonik;
  11. To monitor and record calls and electronic communications for documentation, quality assurance, customer service and support, personnel training, investigations, dispute resolution, litigation, and fraud prevention, where permitted by law;
  12. To protect your Personal Data, secure the Tendo Platform, prevent unauthorized transactions, safeguard your accounts and financial information processed in connection with the Services;
  13. To comply with applicable legal, regulatory, and compliance obligations, including lawful requests and disclosure requirements imposed by courts, tribunals, regulators, tax authorities, law enforcement agencies, and other competent government bodies. This includes supporting compliance with KYC, AML, and sanctions monitoring requirements;
  14. To support lawful initiatives of financial institutions, industry associations, and relevant financial regulatory or self-regulatory organizations, where applicable to the Services and permitted by law;
  15. To undertake automated processing of your Personal Data. where necessary and legally permitted, to fulfill any or all of the above purposes; and,
  16. To perform any other processing activities that are directly related to, and compatible with, the purposes identified in this Notice, subject to applicable Data Privacy Laws.

  Tendo further processes the different categories of Personal Data for the following purposes and legal bases. Where Tendo processes Personal Data on behalf of Tonik, such processing is undertaken in accordance with Tonik's instructions and the applicable Data Privacy Laws:

  Purpose	Legal Basis
  Managing our contractual relationship with you	Necessary for the performance of a contract to which you are a party
  Operating and managing our business operations including or being part of the provision of our Services to our partners and their employees, or contractors	Necessary for the performance of a contract, where applicable, or justified by our legitimate interest in ensuring the proper functioning of our business operations
  Performing our obligations in the course of or in connection with Services you request, administering our business, and managing user accounts (e.g., facilitation of account creation and log-in processes)	Necessary for the performance of a contract to which you are a party, or justified by our legitimate interest in administering and maintaining the Tendo Platform, as applicable
  Fulfilling and managing your loan applications, payments, inquiries, transactions, exchanges, and other Services made through the Tendo Platform	Necessary for the performance of a contract or for taking steps at your request before entering into a contract, where applicable. Processing may also be justified by legitimate interests or other lawful bases, depending on the specific activity
  Conducting customer or supplier due diligence, KYC, and verification procedures; sanctions screening, credit risk evaluation; and activities relating to loan underwriting, origination, disbursement, servicing, and collection, including activities performed by Tendo on behalf of Tonik	Necessary for compliance with applicable legal obligations, performance of a contract, or legitimate interests, as applicable to the particular processing activity. Where consent is required by law, processing shall be subject to such consent
  Disclosing or processing information as required by different government agencies, such as the Anti-Money Laundering Council (AMLC), Bangko Sentral ng Pilipinas (BSP), SEC, and other similar supervising authorities, including responding to lawful requests for access, preservation or disclosure of Personal Data	Necessary for compliance with a legal obligation to which we are subject
  Facilitating communications with you, including through AI-assisted tools where applicable, contacting you in emergencies, and providing requested or administrative information, such as service updates, new features, and changes to terms and conditions or policies	Necessary for the performance of a contract or justified by our legitimate interests in maintaining effective communications, as applicable. Consent shall be obtained where required by law
  Complying with applicable legal and regulatory requirements	Necessary for compliance with a legal obligation to which we are subject
  Monitoring your use of our systems (including the Tendo Platform, other applications, and tools)	Justified by our legitimate interests in preventing misuse, ensuring compliance, and protecting our systems and business operations
  Improving the security and functioning of the Tendo Platform, networks, and information systems	Justified by our legitimate interests in maintaining secure and properly functioning systems and improving the user experience
  Undertaking data analytics, including analytics or AI applications, such as machine learning to assess and improve business performance or provide better user experience. This may include marketing analytics and analytics relating to events or meetings	Justified by our legitimate interests in improving business operations and Services, where applicable. Consent or another appropriate lawful basis shall be relied upon where required by law.
  Marketing our Services to you, subject to your applicable choices and the section on using Personal Data for marketing purposes	Based on your consent where required by applicable Data Privacy Laws, or our legitimate interests where legally permissible and supported by an appropriate assessment
  Using audio, video, or transcripts captured during live or recorded events or meetings, including virtual events or webinars, to inform interested stakeholders about the content of such sessions, including through online publication or marketing purposes	Based on your informed consent before the relevant processing activity, where consent is required

  Where we rely on our legitimate interests as the legal basis for processing, we assess whether those interests are overridden by your own interests, fundamental rights, or freedoms. This assessment takes into account:

  1. the transparency we provide about our processing activities;
  2. our adherence to privacy-by-design principles;
  3. our regular conduct of privacy risk assessments; and,
  4. your rights in relation to these relevant processing activities.

  If you would like more information on how we assess and balance these interests, please feel free to contact us.

  We will obtain your prior consent for processing activities where consent is required under applicable Data Privacy Laws. Where processing is based on another lawful ground, we may process your Personal Data without consent, subject to the requirements and safeguards prescribed by law.

  Legal Bases for Processing Your Personal Data

  We will not process your Personal Information for purposes other than those communicated to you, unless such processing is legally required or authorized, or is necessary to protect your vital interests.

  As a data subject, you may object to the processing of your Personal Information where such processing is based on our legitimate interests, subject to the Data Privacy Laws. However, there may be circumstances where we cannot accommodate your request, particularly where processing is necessary to comply with a legal obligation or to fulfil a contract with you.

  Where the collection of certain categories of Personal Data is required by law or necessary for the performance of a contract with you, failure to provide such information may prevent us from complying with our legal obligations, providing our Services, or fulfilling the terms of our contract. In such cases, we may be unable to continue our relationship with you.

  As a financing company regulated and supervised by the SEC, BSP, NPC, and the AMLC, Tendo is required to comply with applicable laws and regulations, including relevant anti-money laundering and data protection requirements. Certain data processing activities necessary for legal and regulatory compliance, such as AML requirements, regulatory reporting, and other mandated processes, may be undertaken without your consent, as permitted by law.

  We ensure that all such processing is conducted strictly in accordance with applicable laws and only to the extent necessary for the relevant legal and regulatory purposes.

  Commitment to Fair and Professional Collections

  Tendo is committed to conducting all collection activities, including those undertaken on behalf of Tonik, in a fair, lawful, and professional manner. We strictly prohibit any abusive, unfair, or deceptive collection practices.

  • No Harassment or Threats

    We will never use threats, intimidation, or any form of harassment, whether verbal, written, electronic, or otherwise, to collect payments. Our representatives are required to conduct collection efforts professionally, respectfully, and in accordance with applicable laws and ethical standards.

  • Protection Against Unauthorized Disclosure

    Your Personal and Sensitive Information will not be shared with unauthorized third parties. It will not be used to shame, pressure, or publicly expose you. We will not disclose borrower information to your contacts, employer, or any other individual except:

    1. when required or permitted by applicable law;
    2. when necessary to comply with applicable legal or regulatory compliance; or
    3. when you have given explicit consent or authorization, including for disclosures expressly described in this Notice.

  Any such disclosure shall be limited to information reasonably necessary for the relevant lawful purpose.

  • Responsible Communication

    We will communicate with you only through approved and lawful channels. All communications will be professional, factual, and respectful. You may request reasonable adjustments to how we contact you, and we will accommodate such requests where practicable and compliant with law.

  • Compliance and Reporting

    If you have any concerns regarding our collection practices or the handling of your Personal Information, you may reach out to our Data Protection Officer (DPO) at [email protected]. We are committed to addressing your concerns and inquiries promptly, professionally, and in compliance with applicable regulations. You may also seek further guidance from the SEC or other relevant regulators, as appropriate.

• How we share your personal data

  Your Personal Information will be kept confidential and will be shared only for the purposes listed and explained in this Notice, or as otherwise permitted or required by applicable law. We carefully select our partners based on their reputation, reliability, and the quality of the services they provide. We maintain long-standing and trusted relationships with all Third-Party Entities we work with. The use, protection, and security of your Personal Information are governed by binding contractual obligations and data protection safeguards. For purposes of this Notice, Third Party Entities include our loan partners, credit assessment partners, collection partners, information technology vendors, and other parties that support the provision of our Services and the fulfillment of our legal and regulatory obligations.

  We may share your Personal Information with the following entities, among others, as applicable:

  1. Tonik
     1. As the lender and PIC for loans offered through the Tendo Platform, Tonik receives your Personal Information necessary for loan application, processing, evaluation, approval, disbursement, administration, servicing, and collection. Tendo processes relevant Personal Data on Tonik's behalf in accordance with their respective roles and applicable agreements;
     2. Tonik may further share your Personal Information with its affiliates and other authorized recipients in accordance with its Data Privacy Statement and applicable data privacy laws;
  2. Firms and organizations supporting our operations
     1. Entities that assist us or Tonik, as applicable, in:
        1. conducting KYC checks, customer due diligence, and background verification;
        2. assessing creditworthiness and conducting fraud prevention checks;
        3. collecting payments and recovering debts; or,
        4. providing operational, technological, or administrative services;
  3. Service Providers Receiving or Providing Products and Services
     1. Any firm, organization or person that:
        1. supplies products or Services to us; or,
        2. receives products or Services from us for the purpose of providing or facilitating such products and Services

     where the disclosure is necessary for the relevant service and is permitted under applicable law;

  4. Persons Authorized to Act on Your Behalf
     1. Any person whom you have authorized to act on your behalf, or who is legally authorized to manage your affairs, including where you are unable to do so, subject to appropriate verification of that person's identity and authority;
  5. Payment Systems
     1. Any payment network or service provider used for:
        1. disbursement of loan proceeds; or,
        2. payment collection and settlement of loans;
  6. External Data Sources and Verification Partners which include, but are not limited to the following:
     1. Telecommunication companies;
     2. Utility companies;
     3. Remittance and money transfer providers;
     4. Financial service providers;
     5. Financial institutions;
     6. Financing companies;
     7. Banks;
     8. Your employer; and,
     9. Other service providers.
     Your Personal Data may be shared with them, where necessary and lawfully permitted, for purposes of:
     1. creditworthiness assessment, background checks, credit scoring and investigation, and data analytics;
     2. statistical studies, business development, Tendo Platform improvement, and enhancement of credit scoring algorithms;
     3. developing effective service delivery and payment collection strategies;
     4. improving customer experience and customer assistance;
     5. direct marketing of Tendo and Tonik’s financial products and services as well as partner offerings;
     6. fraud detection, investigation, and prevention; and,
     7. all activities relating to loan applications, evaluation, automated processing, KYC compliance (SEC, BSP, and AMLC), credit verification, credit scoring, disbursement, servicing, and payment collection.

     Disclosures involving your employer shall be limited to lawful and authorized purposes, including employment verification and other purposes described in this Notice;

  7. Authorities Involved in Anti-Terrorism Efforts
     1. Relevant local or foreign authorities, where disclosure is required or permitted by applicable law, for the detection, investigation, and prevention of terrorism and related offenses;
  8. Parties Involved in Business Transfers
     1. Any person or organization to whom we may sell, transfer, or negotiate the sale or transfer of:
        1. our business or any part of it; or,
        2. any of our rights or obligations under an agreement with you,

     where such disclosure or transfer is permitted by applicable law and subject to appropriate data protection safeguards.

     This includes the transfer, assignment, or sale of your loans to banks or financial providers such as Tonik. If such transfer, assignment, or sale occurs, the transferee, assignee, or purchaser may use your Personal Information in the same manner described in this Notice;

     For clarity, as of 1 June 2025, loans granted by Tonik through the Tendo Platform are owned by Tonik. Any transfer or assignment of such loans shall be governed by the applicable Loan Documents and undertaken by the party legally entitled to effect the transfer or assignment.

  9. Regulatory Agencies and Government Authorities
     1. Relevant regulators, government authorities, and law enforcement agencies, as applicable, including but not limited to:
        1. BSP;
        2. SEC;
        3. AMLC;
        4. Bureau of Internal Revenue;
        5. National Bureau of Investigation; and,
        6. Office of the Ombudsman,

     including their authorized counterparts overseas, when required by law or regulation; and,

  10. Credit Bureaus and Similar Organizations
      1. Entities that:
         1. provide centralized application-matching and fraud detection services;
         2. assist lenders and businesses in evaluating whether to extend credit or offer payment terms; or,
         3. support responsible lending and risk-management practices.

  Credit Bureaus

  When you apply for a loan, we may check the following records about you:

  1. information you voluntarily supplied to us or authorized us to collect; and,
  2. information obtained from credit bureaus.

  Whether or not your application is approved, credit bureaus will record that we conducted a search on your credit file. This “search footprint” may be visible to other lenders. Multiple credit applications made within a short period may affect your ability to obtain credit, regardless of whether those applications were accepted or declined.

  Credit bureaus provide us with public information, shared credit data, and fraud prevention records, which may include details of previous credit applications and the management of your past and existing accounts.

  We may also conduct periodic checks with credit bureaus during the course of our relationship. Information you provide in your applications will be submitted to credit bureaus and recorded by them. We, and other authorized organizations, may access and use this information for fraud prevention, AML regulations compliance, and credit assessment. Credit bureaus may also use the information for statistical analysis. Information held by credit bureaus may be disclosed to us and to other organizations for purposes including but not limited to:

  1. preventing fraud and money laundering, and assessing applications for credit, or related facilities;
  2. recovering debts and tracing your whereabouts;
  3. managing credit accounts and determining appropriate credit limits;
  4. verifying your identity;
  5. making decisions on credit and related facilities for you, your financial associate(s), household members, or your business;
  6. checking details on insurance proposals and claims; and,
  7. conducting background checks on job applicants and employees.

  When you borrow from us, we will report details of your loan and your repayment behavior to credit bureaus. If you do not pay in full and on time, credit bureaus will record the outstanding debt and, where applicable, how long the debt remains unpaid. Other organizations may access this information, which may affect your ability to obtain credit in the future.

  If you fall behind on your payments and no full payment or acceptable repayment arrangement is received, a default notice may be recorded with the credit bureaus. Records shared with credit bureaus may remain on file for a retention period after your account is closed, whether outstanding amounts were settled or written off following a default.

  If you provide false or inaccurate information and we have reasonable grounds to suspect fraud, we may record this and share it with fraud prevention organizations, including law enforcement agencies, which may access and use this information.

  We and other organizations may also access and use the information recorded by fraud-prevention agencies in other countries, where permitted by law.

  Managing Log-Ins Using Third-Party Accounts

  The Tendo Platform allows you to register and sign in using third-party account credentials (such as your Apple ID). When you choose this option, we may receive certain profile information about you from your third-party provider. The specific information shared will depend on the provider, but may include your name, email address, and any other details you have chosen to make available on such third-party platform.

  We will use the information received solely for the purposes described in this Notice or those otherwise communicated to you at the point of collection. Please note that we do not control, and are not responsible for, how your third-party provider independently collects, uses, or shares your Personal Information. We encourage you to review their privacy notice to understand their data processing activities, and to adjust your privacy settings or preferences within their sites or application, as needed.

  Using Personal Data for Marketing Purposes

  We may send commercial or marketing emails to individuals at our client companies and to others with whom we maintain, or seek to establish business relationships, in compliance with applicable laws. These communications may contain web beacons, cookies, or similar technologies that allow us to determine whether a message was opened, read, or deleted, as well as any links you clicked. When you click a link in a marketing email, cookies may track the pages you visit and the content you access on our website, even if you are not logged in.

  Some marketing communications may contain additional privacy information, as required by law. You may update your marketing preferences or opt out of receiving marketing communications at any time through the available unsubscribe mechanism or by contacting us through the channels identified in this Notice.

  If you use the Tendo Platform, you may receive notifications relating to your account, transactions, or Services. With your consent, we may send push notifications or alerts to your device, even when you are not logged in. You may manage or disable these notifications through the application settings or your device permissions, as applicable.

  Tendo uses customer relationship management (“CRM”) technology to manage and monitor our marketing activities. Our CRM systems may contain Personal Data relating to individuals at client companies or potential business partners. This may include contact details, publicly available information, such as executive profiles, press releases, or social media posts, your responses to marketing emails, including web activity resulting from such emails, your interactions with our website, and other information relevant to our business relationship.

  We may combine publicly available information with data collected through our emails, websites, the Tendo Platform, and personal interactions. This may include data from our career and corporate websites, as well as information gathered when you sign up, log in, or connect using your social media accounts. We use this combined data to enhance your experience with Tendo and support the purposes outlined in this Notice.

Cross-Border Sharing of Information

We may share your Personal Data with Tonik, our affiliates, third-party partners, and authorized service providers, some of whom may be located outside your country of residence. This may involve cross-border data transfers of your Personal Data to jurisdictions that may have different data protection standards from those applicable in your home country.

When transferring your Personal Data internationally, we will comply with applicable Data Privacy Laws. We implement appropriate safeguards, including contractual data protection clauses or other lawful transfer mechanisms, to ensure that your Personal Information remains protected throughout the transfer process.

• How we retain your personal data

  We retain your Personal Information for as long as necessary to fulfil the purposes described in this Notice, to establish, exercise, or defend legal claims, for legitimate business purposes, or as may be required by law.

  We will retain your Personal Information and records for at least five (5) years from the termination of our contractual relationship or the date of your last transaction, whichever is later. This retention period complies with applicable rules set forth by the BSP and SEC.

  In compliance with the Anti-Money Laundering Act (AMLA) and its IRR, certain records shall be retained beyond this five (5)-year period. If a money laundering case is filed involving your account or transactions, we are required to retain the relevant records until the case is fully resolved, decided, or terminated with finality.

  Once the applicable retention period has expired and provided there is no ongoing legal obligation or legitimate business need, we will securely dispose of, or anonymize, your Personal Information to prevent unauthorized access or disclosure.

  If you wish to have your Personal Information deleted or withdraw your consent for its processing, you may contact us. We will accommodate your request within a reasonable period, unless doing so conflicts with our obligations under BSP, SEC, AMLC, or other applicable regulations.

• How we keep your personal data safe

  We store your information in secure electronic data centers, and where necessary, in physical records and paper files. We implement a combination of administrative, physical, and technical security measures to protect your Personal Data, including:

  1. firewalls, and encrypted data transmission;
  2. strict physical access controls; and
  3. role-based access limited to authorized personnel.

  However, despite these measures, it is important to note that no method of electronic transmission or storage is entirely secure. While we strive to prevent unauthorized access or breaches, external factors beyond our control may occasionally compromise data security. Nevertheless, we continuously monitor, review, and enhance our security controls to reduce the risk of unauthorized access or data compromise.

• Your rights and how we respect them

  As a data subject, you are entitled to the rights provided under the Data Privacy Laws. These include:

  • Right to Access: You may request information about the Personal Data we hold about you, including how it is collected, processed, stored, and used.
  • Right to Correct: You may request the correction of any inaccurate, incomplete, or outdated Personal Data.
  • Right to Object: You may object to the processing of your Personal Data, including for direct marketing, automated processing, or profiling. However, we may continue processing your Personal Data if required by law, to comply with a contract, or for any other legitimate purposes.
  • Right to Withdraw Consent: If processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing prior to such withdrawal.
  • Right to Erasure (Data Deletion): You may request deletion of your Personal Data in circumstances allowed by law. We will comply, unless legal or regulatory obligations require retention.
  • Right to Data Portability: When applicable, you may request your Personal Data in a structured, commonly used, and machine-readable format, and transfer it to another service provider.
  • Right to File a Complaint: You may lodge a complaint with us or with the NPC. If applicable, you may also escalate your concerns to the BSP or other regulators.
  • Right to Be Informed of a Data Breach: If a breach involving your Personal Data occurs, we will notify you promptly and take appropriate actions in compliance with the DPA.
  • Right to Damages: You may be entitled to compensation if your rights under the DPA are violated.

  To exercise these rights, please contact us through the details provided below. We may request proof of identity and such other additional information to ensure that requests are made by the legitimate data subject.

  If we cannot comply with your request due to legal or regulatory constraints, we will inform you of the reasons.

• How We Notify You Of Changes To Our Data Privacy Notice

  We may update this Notice from time to time to reflect changes in our business practices or legal requirements. Updates will be indicated by an updated “Last Revised” date and will take effect immediately upon posting. For material changes, we will notify you through email, mobile messaging channels, and other communication platforms (e.g., Viber and WhatsApp, among others), or prominent notices within the Tendo Platform or our Services. Continued use of the Tendo Platform, our Services and other relevant Tendo systems, if any, after such updates constitutes your acceptance of any updates made.

• How to Contact Us

  For questions about our data privacy practices, and/or to exercise your rights under the Data Privacy Laws, you may contact:

  Data Protection Officer
  Templetech Finance Corp.
  doing business under the names Tendo and Tendo by Tonik
  Unit 602, 6/F, West Wing, The Offices at Estancia,
  Meralco Avenue, Pasig City, Philippines 1605
  Email: [email protected]

• Consent and Authorization

  By clicking or checking “I accept,” “I agree,” or any similar option in relation to this Notice, you confirm that you have read and understood its contents and provide your consent for us to process your Personal Data for the purposes described herein, where such consent is required under applicable law.

  When you sign up with Tendo, you authorize us, where permitted by applicable law, to collect and verify information from various services and networks, including telecommunication companies, utility companies, credit bureaus, government agencies, remittance and transfer companies, financial service providers, financial institutions, financing companies, banks, your employer, and other service providers, whether online or otherwise, for the purposes described in this Notice.

  In particular, you expressly authorize your employer, including its duly authorized representatives, to disclose to Tendo and Tonik, as applicable, information concerning your employment status, including resignation, termination, probationary or regular status, and related changes. You consent to Tendo's collection, receipt, verification, and processing of such information, including on behalf of Tonik, for employment verification, loan eligibility assessment, loan administration, repayment monitoring, and other purposes described in this Notice.

  You may withdraw your consent through the channels identified in this Notice, subject to applicable law. Withdrawal will not affect processing lawfully undertaken before withdrawal or processing that may continue on another lawful basis.

  Customer Acceptance

  ☐ I confirm that I have read and understood this Data Privacy Notice and Consent Form and expressly provide my consent and authorization for the processing activities described in the Consent and Authorization section, to the extent that consent is required by applicable law.

• click image to view pdf in a new tab
• click image to view pdf in a new tab