Privacy Policy

Zpay Philippines Corp. (“Zpay”, “we”, “us”) is committed to protecting your personal data. This policy explains what we collect, how we use it, and the rights you have under Republic Act 10173 (the Data Privacy Act of 2012) and its implementing rules.

We collect personal data you provide to us directly, including:

• Identity data — full name, date of birth, government ID details for KYB/KYC.
• Contact data — email address, phone number, postal address.
• Financial data — bank account details for settlement, card data is tokenized and not stored.
• Usage data — pages viewed, actions taken, device and browser metadata.

We process personal data under the lawful criteria in Sections 12 and 13 of the Data Privacy Act — including consent, contract performance, legal obligation, and legitimate interest. For sensitive personal information, we rely on consent and explicit legal authority.

• To operate, secure, and improve the Zpay services.
• To verify identity for KYB/KYC under BSP and AMLA requirements.
• To process payments, settle funds, and produce reports.
• To communicate service-critical updates and, with consent, marketing.
• To meet legal, regulatory, and audit obligations.

Personal data is kept only as long as needed for the purposes above, unless a longer period is required by law (for example, anti-money laundering records are retained for at least five years after the end of the business relationship).

We share data with vetted processors who help us deliver the service (cloud hosting, identity verification, fraud screening, customer support tooling). Processors are bound by contract to use data only for the purposes we specify.

We may share data with regulators, courts, or law enforcement where required by law.

Under the Data Privacy Act you have the right to:

• Be informed about processing of your personal data.
• Access your personal data.
• Object to processing, where applicable.
• Correct inaccurate data.
• Request erasure or blocking, subject to legal limits.
• Request data portability.
• Lodge a complaint with the National Privacy Commission.
• Be indemnified for damages arising from unlawful processing.

Address concerns to our Data Protection Officer at dpo@zpay.ph. We aim to respond within 15 working days.

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph. The NPC accepts complaints under NPC Circular 16-04 and related rules.

We use strictly necessary, analytics, and marketing cookies. You can manage your preferences from our Cookie Policy or by re-opening the cookie banner from the footer.

We may update this policy from time to time. We will notify users of material changes via the dashboard and on this page. The “Last updated” date above always reflects the current version.