Bills Payment Access for
Every Filipino.

We only collect your data when your business registers to become an authorized partner merchant and downloads our App. We process both Personal Information and Sensitive Personal Information (under the Data Privacy Act of 2012), including:

Merchant Corporate Profile: Registered business name, business address, Tax Identification Number (TIN), DTI/SEC registration documents, and corporate bank account details for settlement.

Authorized Representative Data: Full name, mobile number, corporate email address, and copies of government-issued IDs for mandatory Know Your Customer (KYC) and anti-fraud verification.

Transaction & Billing Logs: Reference numbers, biller accounts, payment status, transaction history, and amounts processed through your merchant portal.

Technical & Device Data: IP addresses, operating system version, unique device identifiers, and security event logs to prevent fraudulent platform takeovers.

To facilitate smooth bill payments and secure transactions, our mobile application will explicitly request your consent to access specific features on your mobile device:

Camera Access: Used strictly to scan QR codes (such as QR Ph codes) or to take photos/uploads of physical billing statements and business verification documents.

Location-Based Services: Used to verify that financial transactions originate within authorized geographic parameters, helping us comply with Anti-Money Laundering (AML) geofencing policies and detect anomalous, fraudulent logins.

We collect and process your information based on legitimate business purposes, fulfillment of our commercial contract, and statutory compliance with the Bangko Sentral ng Pilipinas (BSP) regulations:

To register, verify, and maintain your partner merchant profile.

To route, execute, and settle bill payments between you and your customers.

To perform identity verification, risk assessments, and credit-worthiness filtering.

To comply with statutory legal mandates under the Republic Act No. 9160 (Anti-Money Laundering Act).

We do not sell corporate or personal data. However, in order to process transactions, settle payments, comply with legal and regulatory obligations, prevent fraud, and operate our services, information may be shared securely with authorized third parties under appropriate contractual, confidentiality, and data protection arrangements, including Data Sharing Agreements (DSAs) where applicable.

Your information may be shared with:

Integrated Payment Gateways and Settlement Partners – Authorized payment service providers, e-wallet operators, banks, clearing and settlement networks, billers, and other financial institutions involved in the routing, authorization, processing, reconciliation, and settlement of transactions.

Regulatory and Government Authorities – The Bangko Sentral ng Pilipinas (BSP), Anti-Money Laundering Council (AMLC), National Privacy Commission (NPC), courts, law enforcement agencies, and other government authorities where disclosure is required, authorized, or permitted by applicable laws, regulations, supervisory requirements, audits, investigations, or lawful orders.

All third parties receiving information are required to maintain appropriate confidentiality, privacy, and security safeguards consistent with applicable laws and regulatory requirements.

Kabayad Corporation implements organizational, physical, and technical security measures designed to protect personal information, transaction data, and business information against unauthorized access, disclosure, alteration, misuse, loss, or destruction.

Our security measures include:

Encryption of data in transit using Transport Layer Security (TLS).

Encryption of sensitive data at rest where appropriate.

Role-Based Access Control (RBAC).

Principle of Least Privilege access controls.

Multi-Factor Authentication (MFA) for privileged and administrative access.

Secure authentication and password management.

Continuous monitoring of system activity and security logs.

Fraud detection and transaction monitoring controls.

Regular vulnerability assessments, penetration testing, security patching, and malware protection.

Network security controls including firewalls, intrusion detection/prevention systems, and endpoint protection.

Business Continuity Management (BCM), disaster recovery planning, and secure data backups.

Employee confidentiality obligations and mandatory information security awareness training.

Security incident response procedures for identifying, containing, investigating, and remediating cybersecurity and data privacy incidents.

Kabayad Corporation retains personal information, business information, merchant records, customer identification records, and transaction records only for as long as necessary to fulfill the purposes for which they were collected, provide our services, comply with legal and regulatory obligations, resolve disputes, enforce agreements, prevent fraud, and support legitimate business operations.

Records shall be retained in accordance with applicable laws, regulations, and regulatory requirements, including those issued by the Bangko Sentral ng Pilipinas (BSP), the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent authorities, as well as applicable accounting, taxation, and audit requirements.

Transaction records, merchant identification records, customer due diligence records, and related compliance documentation shall be retained for at least five (5) years from the date of the transaction, termination of the business relationship, account closure, or such other period as may be required under applicable laws and regulations, whichever is later.

Records may be retained beyond the minimum retention period where necessary to comply with legal obligations, regulatory directives, supervisory examinations, audits, investigations, litigation, dispute resolution proceedings, fraud monitoring activities, enforcement actions, or other legitimate business and compliance purposes.

Upon expiration of the applicable retention period, records shall be securely disposed of, anonymized, or rendered permanently inaccessible using industry-accepted destruction methods designed to prevent unauthorized access, recovery, reconstruction, or misuse of the information.

Where immediate deletion is not technically feasible, such information shall be securely archived, access-restricted, and permanently disposed of as soon as practicable in accordance with applicable legal and regulatory requirements.

Under the Data Privacy Act of 2012 (DPA), your authorized representatives retain distinct legal controls:

Right to be Informed: Knowing how your data is treated (this notice).

Right to Access: Requesting exact summaries of your data profiles under our custody.

Right to Rectification: Mandating speedy updates to outdated or incorrect business profiles.

Right to Erasure or Blocking: Ordering the removal of profiles when legal purposes terminate.

Right to File a Complaint: Elevating compliance disputes directly to the National Privacy Commission (NPC).

For questions regarding your data privacy rights or to submit an information access request, please contact our designated Data Privacy Officer (DPO):

Attn: Data Privacy Officer

Company Name: KABAYAD Corporation

Office Address: 17 Athens Street, Vista Verde Executive Village

San Isidro, Cainta, Rizal, Philippines, 1900

Email Address: dpo@kabayad.com

Contact Number: +639176305789