Swyftly
Swyftly

Privacy Policy

Last Updated: May 26, 2026

Swyftly Technologies Inc., operating under the business name Payswyftly ("Swyftly," "Payswyftly," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and retain personal information in compliance with the Data Privacy Act of 2012 (R.A. 10173), the rules of the National Privacy Commission (NPC), the Anti-Money Laundering Act (AMLA), the Terrorist Financing Prevention and Suppression Act (TFPSA), and BSP Circular No. 982.

Processing personal information is essential to operating a regulated payment system, performing Know Your Customer (KYC) and Customer Due Diligence (CDD), screening against sanctions lists, and reporting Covered and Suspicious Transactions to the Anti-Money Laundering Council (AMLC) as required by law.

1. Scope and Application

This Privacy Policy applies to all personal information we collect or process in connection with our website, dashboards, APIs, and payment gateway services (collectively, the Services). It applies to the following data subjects:

  • Merchants: Business clients and their authorized representatives, directors, officers, shareholders, and Ultimate Beneficial Owners (UBOs) who use our Services.
  • Customers: End users who initiate or receive payments through our Merchants using our Services.
  • Visitors: Individuals who browse our website, request information, or interact with our marketing channels.
  • Counterparties: Beneficiaries, senders, agents, or other persons whose information is provided to us in connection with a transaction.

2. Information We Collect

Consistent with our KYC/CDD obligations, we collect, store, and process the following categories of information:

Merchant and Entity KYC Data

Information required to onboard and maintain a Merchant relationship, including:

  • Business name, trade name, and primary address.
  • Articles of Incorporation, By-Laws, SEC Registration, General Information Sheet (GIS), BIR Form 2303, and Business Permit.
  • Board Resolution authorizing the engagement, Fund Flow Diagram, and a description of the nature of business.
  • Two (2) valid government-issued IDs of authorized representatives, signatories, directors, and Ultimate Beneficial Owners (UBOs) holding twenty percent (20%) or more of the company's shares.
  • Bank account information used for settlement, including bank certification letters where required.
  • For high-risk Merchants, Enhanced Due Diligence (EDD) information such as audited financial statements, BIR Form 1701 (ITR), organizational structure, partnership agreements, MTPP and KYC/EDD policies, proof of business address (POA) within the last three (3) months, site visit records, sworn certifications, and certification video call recordings.

Individual KYC Data (for Remittance and End Users)

  • Full name, date and place of birth, and nationality.
  • Residential address, contact number, and email address.
  • Government-issued ID details (e.g. Passport, driver's license, PRC license).
  • Name of beneficial owner or beneficiary, where applicable (e.g. for remittance or insurance-related transactions).
  • Source of funds, source of wealth, and nature of business or employment.

Transaction Data

Details related to each payment, including amounts, currency, timestamps, payment method, sender and recipient references, settlement records, and reconciliation data.

Customer Payment Information

Information that a Customer provides during a transaction, such as name, contact information, and payment reference IDs. Swyftly does not store complete, unencrypted payment card numbers; sensitive card data is handled by PCI DSS-compliant processors.

Risk and Compliance Data

Information generated by our systems and compliance reviews, including:

  • Customer risk scores and risk classifications (Low, Medium, or High).
  • Politically Exposed Person (PEP) and sanctions screening results against local and international lists, including the Office of Foreign Assets Control (OFAC) list, the European Consolidated List, the United Nations Consolidated List of Terrorists, and the UK-HMT Financial Sanctions List.
  • Records of Covered Transaction Reports (CTRs), Suspicious Transaction Reports (STRs), internal investigations, and related case files.
  • Annual Compliance Update Forms and Ongoing Customer Due Diligence (OCDD) documentation.

Technical and Device Data

IP addresses, device and browser fingerprints, geolocation signals, session logs, and similar telemetry used for fraud analytics, security, and transaction monitoring.

3. How We Use Your Data

We process personal information for the following purposes:

  • Service Delivery: To onboard Merchants, process transactions, perform settlements, and operate the Swyftly payment gateway.
  • Regulatory Compliance: To perform KYC and CDD, identify and verify UBOs, conduct sanctions and PEP screening, monitor transactions, file CTRs and STRs with the AMLC, and comply with directives, freeze orders, and asset preservation orders issued by the AMLC, the Court of Appeals, the BSP, and other competent authorities.
  • Risk Management: To compute and update Client Risk Scores, conduct Enhanced Due Diligence (EDD) and Enhanced Ongoing CDD where triggered (e.g. by changes in entity structure, chargeback rates above 2%, unusual volume spikes, or other risk events), and detect fraud or suspicious activity.
  • Customer Support: To respond to inquiries, resolve disputes and chargebacks, and communicate operational notices.
  • Service Improvement: To analyze usage patterns, improve our products, and enhance the security and resilience of our platform.
  • Legal Defense: To establish, exercise, or defend legal claims, and to comply with subpoenas and lawful court processes.

5. Disclosures and Data Sharing

Swyftly does not sell personal data. We disclose information only as necessary to deliver the Services and to comply with our regulatory and legal obligations.

  • Financial Partners: Acquiring banks, payment networks, and partners (e.g. GCash, Maya, InstaPay, QRPH) required to authorize, clear, and settle a transaction.
  • Verification and KYC Vendors: Identity verification, address verification, document authentication, biometric, and fraud-screening providers engaged under written agreements with appropriate confidentiality and security commitments.
  • Regulators and Authorities: The Bangko Sentral ng Pilipinas (BSP), Anti-Money Laundering Council (AMLC), National Privacy Commission (NPC), Bureau of Internal Revenue (BIR), Securities and Exchange Commission (SEC), law enforcement agencies (e.g. NBI, PNP), and courts of competent jurisdiction, in response to lawful orders, examinations, or our reporting obligations.
  • Third-Party Reliance Partners: Where permitted by law, we may rely on a third party that has performed equivalent KYC/CDD, subject to a written sworn certification and our ability to obtain identification documents from them without delay. Swyftly nonetheless retains full and ultimate responsibility for identifying customers.
  • Service Providers: Cloud hosting, communications, analytics, customer support, and professional advisors (e.g. auditors, legal counsel) who process information on our behalf under appropriate data processing agreements.
  • Corporate Transactions: Counterparties and their advisors in connection with mergers, acquisitions, financing, or reorganizations, subject to confidentiality obligations.

Where personal data is transferred outside the Philippines, we ensure that the transfer is subject to a comparable level of protection through contractual safeguards or other appropriate mechanisms.

6. Data Security Measures

We implement administrative, technical, and physical safeguards to protect your data, including:

  • Security Standards: Adherence to industry best practices for information security and PCI DSS-aligned controls for payment data.
  • Encryption: Industry-standard encryption for data in transit (TLS 1.3) and at rest (AES-256).
  • Access Controls: Role-based access control (RBAC), least-privilege provisioning, and Multi-Factor Authentication (MFA) for administrative systems and the centralized customer records database.
  • Monitoring: 24/7 security monitoring, electronic AML and verification systems, anomaly detection, and regular vulnerability and penetration testing.
  • Personnel Controls: Background checks, confidentiality undertakings, periodic AML/CTF and data privacy training, and an Annual Compliance Acknowledgement signed by all personnel.

7. Data Retention

In compliance with the AMLA, BSP regulations, and the AMLC's Guidelines for the Digitization of Customer Records (DIGICUR Guidelines), customer identification data, account files, and business correspondence are retained for at least five (5) years after the business relationship has ended or the account has been closed.

Records relating to ongoing investigations, pending money-laundering or terrorist-financing cases, or accounts that are the subject of a court case, are retained beyond the five (5) year period until the AMLC Secretariat or competent authority confirms that the case has been resolved, decided, or terminated with finality.

Customer records are digitized from receipt, creation, or opening and stored in a centralized "end-to-end" digital database maintained at our head office, enabling timely and secure submission to the AMLC. After the applicable retention period expires, personal data is securely destroyed or anonymized in line with applicable Data Privacy regulations.

8. Data Breach Protocol

In the event of a personal data breach that is likely to result in a real risk of serious harm, we will:

  • Implement immediate containment, eradication, and forensic investigation measures.
  • Notify the National Privacy Commission (NPC) and affected data subjects within seventy-two (72) hours of knowledge of the breach, in accordance with NPC Circular 16-03.
  • Coordinate with the BSP, AMLC, and other regulators where required, and provide the information necessary to support their oversight.
  • Implement remediation measures and post-incident reviews to prevent recurrence.

9. Your Rights as a Data Subject

Subject to the Data Privacy Act and our legal and regulatory retention obligations, you have the right to:

  • Be Informed: Know whether personal data pertaining to you is being or has been processed, and the purposes thereof.
  • Access: Request reasonable access to your personal information held by us.
  • Rectification: Request correction of inaccurate or incomplete personal data.
  • Erasure or Blocking: Request deletion or blocking of personal data, subject to legal retention requirements (e.g. AMLA's five-year rule).
  • Object: Object to processing based on consent or legitimate interests, where applicable.
  • Data Portability: Receive a copy of your personal data in a structured, commonly used format, where technically feasible.
  • File a Complaint: Lodge a complaint with the National Privacy Commission if you believe your rights have been violated.

Note that records required for AML/CTF reporting, including CTRs, STRs, and related investigation materials, are confidential by law and cannot be disclosed to the data subject. We are also legally prohibited from tipping off any customer about an ongoing or completed STR investigation.

10. Contact Us

For any questions about this Privacy Policy, to exercise your data subject rights, or to reach our Data Protection Officer, please contact us at dpo@swyftly.ph