Privacy Policy

This is the Privacy Notice of Kredua for its Philippine edition (pages under /ph/ and content with the “ph-” prefix). It explains which personal data we collect, what we use it for, whom we share it with and how you can exercise your rights, in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations and the issuances of the National Privacy Commission (NPC).

1. Personal information controller

RR Digital (trade name: Kredua), Brazilian tax registration CNPJ , with address at Rua Balbino Bento da Silva, 02, União dos Palmares/AL, CEP 57800-000, Brazil. Contact e-mail: [email protected].

Data Protection Officer: [email protected]. This is the channel for questions about this notice and for the exercise of your rights.

2. Personal data we collect

  • Data you give us: name, e-mail address and, only when we ask for it expressly, mobile number, when you answer a test, subscribe to our recommendations or write to us through the contact form. Also the answers you give in the tests (for example the amount you are looking for, your work situation, your income range or whether you currently have debts), which do not include your TIN, SSS or PhilSys number, bank or e-wallet details, or sensitive personal information.
  • Browsing data: IP address, approximate country, device and browser type, pages visited, source of the visit (UTM parameters) and identifiers from cookies or similar technologies, as described in section 9.
  • E-mail interaction data: opens, clicks and unsubscriptions, when you receive our communications.

We do not collect sensitive personal information as defined by the Data Privacy Act, and we do not access the Credit Information Corporation, any credit bureau or any credit history. The data you enter on the website of a financial institution when applying for a product is processed by that institution, not by Kredua.

3. Purposes and lawful basis of processing

Primary purposes (necessary for the service you request):

  • Showing you the content of the site and computing the result of the tests (legitimate interest and performance of the service you requested).
  • Answering your enquiries sent through the contact form or by e-mail (performance of the service you requested).
  • Sending you by e-mail the recommendations about credit cards, loans and finance that you agreed to receive by ticking the box in the test or the form (your consent).
  • Keeping the site secure and preventing fraud and abuse (legitimate interest).
  • Complying with legal obligations and responding to lawful requests from authorities (legal obligation).

Secondary purposes (not necessary for the service; you can object to them without affecting the service):

  • Producing aggregated usage statistics to improve the site.
  • Showing advertising and measuring its performance, including personalised advertising by third parties through cookies, on the basis of your consent.

If you do not want your data processed for the secondary purposes, write to [email protected] or adjust your cookie preferences. Refusing will not prevent you from accessing the content.

4. Automated decision-making

The tests apply simple rules (for example, the amount you indicate decides which review we show you). We do not make decisions with legal effects on you; the approval of any product is always decided by the financial institution. With your consent, advertising platforms may build profiles to personalise ads; you can object from the cookie settings.

5. Sharing and personal information processors

We do not sell your personal data. We share it only with providers that render services to us and act as personal information processors, under contract and following our instructions:

  • E-mail delivery: MailerSend and our own e-mail automation system, which stores your name, e-mail address and interactions with the messages.
  • Hosting and infrastructure: OVH (servers in Europe and Canada) and Cloudflare (content delivery network, security and DNS).
  • Measurement and advertising: Google (Google Ad Manager/AdSense, Google Analytics, Google Tag Manager) and Meta (pixel and Conversions API), only when you accept the corresponding cookies. When we send a conversion event to these platforms from our server, the e-mail address travels encrypted with an irreversible hash function.
  • Authorities, when a law, a court order or a lawful request from the NPC or another competent authority requires it.

The financial institutions whose websites we link to are independent personal information controllers: when you press “Go to the official website” you leave Kredua and the privacy notice of the institution applies. We do not send them your data.

6. Cross-border transfers

The controller is established in Brazil and some processors (Google, Meta, Cloudflare, MailerSend, OVH) process data in the United States, Canada or the European Union. These transfers are made under contracts that oblige the processor to protect the data with a level equivalent to this notice and to the Data Privacy Act, and Kredua remains accountable for the personal data it transfers, as the Act requires.

7. Retention

  • E-mail subscription data: while you remain subscribed and up to 24 months after your last interaction; after you unsubscribe, we keep your e-mail address on a suppression list only so that we do not write to you again.
  • Test answers and associated contact data: 24 months from the last interaction.
  • Contact form messages: 12 months from the reply.
  • Technical and security logs: up to 12 months.
  • Cookies: for the duration indicated in section 9.
  • When the period ends, the data is deleted or anonymised, unless it must be kept to establish, exercise or defend legal claims.

8. Your rights as a data subject and how to exercise them

Under the Data Privacy Act you have the right to be informed, to object to processing, to access your personal data, to rectify inaccurate data, to erase or block data that is incomplete, outdated, unlawfully obtained or no longer necessary, to data portability, to damages for violations of the Act, and to withdraw consent at any time.

To exercise them, send an e-mail to [email protected] with: your name, the e-mail address you registered with, a clear description of the right you are exercising and, if we have reasonable doubts about your identity, a copy of a valid ID. We will reply within 15 working days. The request is free of charge.

If you believe your rights have been violated, you may file a complaint with the National Privacy Commission (privacy.gov.ph). We ask you to write to us first: most issues are resolved with one e-mail.

9. Cookies and similar technologies

We use cookies and similar technologies (browser local storage, pixels in e-mails) for the following purposes:

  • Necessary: remembering your cookie decision (consent_policy, 12 months), remembering that you already completed a test (completed_<test>, until you clear your browser data) and protecting the site against automated traffic (Cloudflare security cookies, up to 1 year).
  • Preferences and attribution: anonymous visitor and session identifiers (kredua_anon, 30 days; kredua_session, 30 minutes) and source of the visit (kredua_utm, 24 hours).
  • Statistics: Google Analytics (_ga, _ga_*, up to 2 years), in aggregated form.
  • Advertising: Google Ad Manager/AdSense (IDE, __gads, __gpi, up to 13 months) and Meta (_fbp, _fbc, up to 90 days). Google, as a third-party vendor, uses cookies to serve ads based on previous visits to this and other websites; you can opt out of personalised advertising at adssettings.google.com.

On your first visit we show you a notice to accept or refuse non-necessary cookies. You can also block or delete them from your browser settings (Chrome, Firefox, Safari, Edge). Refusing them does not prevent you from browsing: you will only see non-personalised ads and your visit will not be counted in the statistics.

10. E-mail communications

We only send you e-mails if you agreed to receive them. Every message identifies the sender, carries a one-click unsubscribe link and a technical unsubscribe header (List-Unsubscribe); the unsubscription takes effect within 24 hours at most. Our e-mails inform about reviews and content recommendations: they do not communicate approvals, granted limits or offers in your name, and they never ask for passwords, OTPs or payments.

11. Minors

Kredua’s content and tests are addressed to people aged 18 and over. We do not knowingly collect data from minors. If we detect a registration by a minor, we delete it; if you are a parent or guardian and believe a minor gave us their data, write to the Data Protection Officer.

12. Security

We apply organisational, physical and technical measures appropriate to the risk: TLS encryption on every connection, role-based access control, encrypted backups, access logging and periodic review of processors. No system is infallible; if a personal data breach occurs that is likely to give rise to a real risk of serious harm to you, we will notify the National Privacy Commission and the affected data subjects within 72 hours of knowledge, as the Act requires.

13. Changes to this notice

We may update this notice to adapt it to legal or service changes. The current version will always be published on this page with its update date and, if the change is relevant to the data we already process, we will inform you by e-mail.

14. Contact

For any matter about this notice or about your data: [email protected]; or by post to RR Digital, Rua Balbino Bento da Silva, 02, União dos Palmares/AL, CEP 57800-000, Brazil.

Last updated: 19/09/2026