A legal article in the Philippine context

I. Overview

Deleting personal information from a lending app in the Philippines is a data privacy, consumer protection, and financial records issue. Borrowers often want their data deleted after paying a loan, uninstalling an app, experiencing harassment, discovering unauthorized access to contacts, or receiving collection messages even after full settlement.

In the Philippines, a borrower has rights under the Data Privacy Act of 2012, general privacy principles, consumer protection rules, and applicable financial regulations. These rights include the right to be informed, to access personal data, to object to certain processing, to request correction, to request blocking or removal in proper cases, and to complain when personal data is misused.

However, the right to delete personal information is not absolute. A lending app may be legally allowed or required to retain certain records for legitimate purposes, such as accounting, audit, fraud prevention, regulatory compliance, tax documentation, anti-money laundering obligations, legal defense, or proof of loan transactions. The proper legal remedy is therefore not always total deletion of all records. In many cases, the borrower should demand cessation of unlawful processing, deletion of unnecessary data, correction of inaccurate data, removal from marketing or contact lists, restriction of access, blocking of data used for harassment, and confirmation that contact-list data and other excessive data have been erased.

The central rule is: a lending app may process only personal data that is lawful, necessary, proportionate, transparent, and connected to a legitimate purpose. Once the purpose has been fulfilled, or once processing becomes unlawful, excessive, inaccurate, or abusive, the borrower may demand appropriate deletion, blocking, correction, or restriction.

II. Why Lending Apps Collect Personal Information

Online lending apps collect personal information to evaluate loan applications, verify identity, assess credit risk, disburse proceeds, collect payments, comply with law, prevent fraud, and communicate with borrowers.

Common data collected may include:

Full name;
Date of birth;
Address;
Mobile number;
Email address;
Employment details;
Employer name and contact details;
Government-issued ID;
ID number;
Selfie or facial image;
Bank account or e-wallet details;
Loan application details;
Income information;
Device information;
IP address;
Location data;
Contact list;
Photos or storage data;
SMS or call information;
Social media information;
References;
Payment history;
Credit behavior;
Collection records;
Complaint records.

Some of this data may be reasonably necessary for lending. Other data, especially broad access to contact lists, photos, storage, location, and device content, may be excessive depending on how it is collected and used.

III. Personal Information and Sensitive Personal Information

The Data Privacy Act distinguishes between ordinary personal information and sensitive personal information.

A. Personal Information

Personal information is information from which a person’s identity is apparent or can be reasonably and directly ascertained. It may include:

Name;
Address;
Mobile number;
Email address;
Employment details;
Account details;
Photographs;
Loan records;
Device identifiers;
Contact information.

B. Sensitive Personal Information

Sensitive personal information receives stronger protection. It may include:

Government-issued ID numbers;
Financial information;
Health information;
Biometric information;
Information relating to proceedings or offenses;
Data about race, religion, marital status, age, or similar legally protected categories, depending on context.

Lending apps often collect sensitive personal information when they require ID cards, selfies, bank details, income documents, or other financial records.

IV. Data Privacy Principles

A lending app must comply with the basic principles of data privacy.

A. Transparency

The borrower must be informed of what personal data is collected, why it is collected, how it will be used, who will receive it, how long it will be retained, and how the borrower can exercise privacy rights.

A vague privacy policy is not enough if the app collects invasive data without clear explanation.

B. Legitimate Purpose

The lender must process data for a lawful and legitimate purpose. Identity verification, loan processing, fraud prevention, and lawful collection may be legitimate. Public shaming, harassment of contacts, threats, and unauthorized disclosure are not legitimate purposes.

C. Proportionality

The lender must collect and use only data that is necessary and not excessive. If a loan can be processed without copying the borrower’s entire phonebook, then contact-list scraping may be disproportionate.

Proportionality is often the strongest issue in lending app complaints.

V. Is There a Right to Deletion?

Philippine data privacy law recognizes rights that may support deletion, blocking, removal, destruction, or restriction of personal data in proper cases. A borrower may request deletion or blocking when personal data is:

Incomplete;
Outdated;
False;
Unlawfully obtained;
Used for unauthorized purposes;
No longer necessary for the purpose collected;
Used for harassment;
Excessive or disproportionate;
Processed despite withdrawal of consent where consent is the basis;
Processed in violation of the borrower’s rights;
Retained beyond a lawful period;
Shared with unauthorized third parties.

The borrower should frame the request carefully. Instead of simply saying “delete everything,” it is often better to demand specific actions:

Delete all contact-list data;
Delete uploaded photos not needed for legal records;
Delete marketing data;
Stop processing data for collection after full payment;
Block data from collection agents;
Correct payment status;
Remove inaccurate delinquency records;
Stop contacting third persons;
Delete data obtained without consent;
Confirm retention only of legally required records.

VI. Deletion Is Not Always Immediate or Total

A lending app may refuse full deletion of all records if it has a lawful basis to retain some data.

Possible lawful retention purposes include:

Proof of loan contract;
Payment records;
Accounting and audit;
Tax compliance;
Regulatory reporting;
Anti-fraud investigation;
Defense against legal claims;
Compliance with court orders;
Credit reporting obligations, if lawful and accurate;
Complaint handling;
Prevention of duplicate fraudulent applications;
Statutory recordkeeping.

However, lawful retention does not permit the lender to keep using data for harassment, marketing, public shaming, or unauthorized disclosure.

The proper balance is: retain only what the law requires or legitimate business necessity justifies; delete or anonymize what is unnecessary, excessive, unlawfully obtained, or no longer needed.

VII. When a Borrower Has Fully Paid the Loan

After full payment, the lender may no longer have a legitimate basis to continue collection activity. The borrower should demand:

Account closure;
Certificate of full payment;
Correction of account status;
Stoppage of all collection calls and messages;
Recall of account from collection agencies;
Deletion of unnecessary personal data;
Deletion of contact-list data;
Cessation of contact with references, employer, relatives, and phonebook contacts;
Correction of credit reporting;
Removal from marketing lists;
Written confirmation of retained records and legal basis for retention.

The lender may retain payment and contract records, but it should not continue using the borrower’s data for debt collection after settlement.

VIII. When the Loan Is Still Unpaid

If the loan remains unpaid, the lender may still process some borrower information for lawful collection. However, even then, processing must be fair, lawful, proportionate, and not abusive.

The lender may generally keep:

Loan contract;
Borrower identity data;
Payment history;
Statement of account;
Official contact details;
Lawful collection records.

But the lender should not:

Contact unrelated phonebook contacts;
Shame the borrower online;
Post the borrower’s photo;
Send threats to relatives;
Use obscene language;
Disclose the loan to the employer without lawful basis;
Use fake legal notices;
Process excessive device data;
Continue using data for undisclosed purposes.

A borrower with an unpaid loan may still demand deletion of excessive or unlawfully obtained data, but the lender may retain data necessary for legitimate collection and legal claims.

IX. When the Loan Was Never Applied For by the Person

If a person receives collection messages from a lending app but never applied for the loan, the situation may involve identity theft, fraud, or erroneous data processing.

The person should immediately demand:

Copy of the loan application;
Proof of identity verification used;
Disbursement details;
Account or e-wallet where proceeds were sent;
IP address or device information used for application, where available;
Deletion or blocking of the false account;
Cessation of collection;
Correction of records;
Removal from credit reporting;
Investigation for identity theft.

The person should also consider filing a police report, data privacy complaint, and complaint with the proper regulator.

X. When the App Accessed Phone Contacts

Many abusive lending app cases involve contact scraping. The borrower installs the app, grants permissions, and later the app contacts relatives, friends, co-workers, employers, or random phonebook entries.

This may raise serious privacy issues.

A. Why Contact Access Is Questionable

A lender may ask for references, but copying the entire contact list may be excessive. Contact persons are not borrowers and may not have consented to their data being processed.

B. What to Demand

The borrower should demand:

Deletion of all contact-list data obtained from the device;
Identification of third parties to whom contact data was disclosed;
Cessation of messages to all contacts;
Written confirmation that contacts were not retained or shared;
Removal of all contact data from collection systems;
Sanctions against collectors who used the data for harassment.

C. Contacts May Also Complain

People contacted by the lender may also have privacy rights. If their names, numbers, or relationship to the borrower were processed without lawful basis, they may file their own complaints or provide witness statements.

XI. When the App Posted Personal Information Online

If a lending app or collector posted the borrower’s name, photo, ID, loan details, accusations, or shame messages online, the borrower should act quickly.

A. Immediate Steps

Take screenshots;
Save the URL;
Capture date and time;
Capture account name and profile link;
Save comments, shares, and reactions;
Report the post to the platform;
Demand immediate takedown;
Demand deletion from lender’s systems;
File data privacy and cybercrime-related complaints, where appropriate.

B. Deletion Demand

The borrower should demand:

Immediate takedown of all public posts;
Deletion of images, IDs, and loan details used for shaming;
Written confirmation that collectors are prohibited from reposting;
Identification of persons who posted or authorized the post;
Preservation of internal records for investigation.

Deletion should not destroy evidence before the borrower has preserved it. Save evidence first, then demand takedown.

XII. Uninstalling the App Is Not Enough

Uninstalling the lending app from a phone does not necessarily delete data already uploaded to the lender’s servers.

Uninstalling may:

Remove the app from the device;
Stop some future data access;
Prevent new permissions;
Reduce notifications.

But it does not necessarily:

Delete borrower records from the lender;
Delete contact-list data already uploaded;
Delete ID photos from the lender;
Stop collection agencies;
Correct account status;
Remove credit reports;
Delete data shared with third parties.

A formal deletion or restriction request is still needed.

XIII. Revoking App Permissions

The borrower should revoke unnecessary app permissions in phone settings.

Common permissions to review:

Contacts;
Camera;
Photos and videos;
Files and storage;
Location;
Microphone;
SMS;
Phone logs;
Notifications;
Nearby devices;
Accessibility access.

Revocation helps prevent further data access, but it does not delete data already collected.

XIV. Deleting the Account Inside the App

Some lending apps provide an account deletion feature. If available, the borrower may use it after saving evidence and payment records.

Before deleting the account, the borrower should save:

Loan agreement;
Loan account number;
Payment records;
Receipts;
Full payment confirmation;
Statement of account;
Chat messages;
Harassment evidence;
Privacy policy;
Terms and conditions.

The borrower should not delete access to evidence before a dispute is resolved.

XV. Requesting a Certificate of Full Payment First

If the loan has been paid, it is advisable to request a certificate of full payment before or alongside deletion.

This certificate should state:

Borrower’s full name;
Loan account number;
Date of full payment;
Amount paid;
Confirmation that no balance remains;
Name of lender;
Authorized representative or official channel;
Date of issuance.

This document protects the borrower if the lender later claims unpaid balance.

XVI. Identifying the Proper Entity Behind the App

Many lending apps use brand names that differ from the registered company name. A deletion request should be sent to the correct legal entity.

The borrower should identify:

App name;
Registered company name;
SEC registration details, if available;
Certificate of authority details, if available;
Business address;
Customer service email;
Data Protection Officer contact;
Privacy policy contact information;
Collection agency name, if applicable;
Payment channels.

If the borrower does not know the registered company, the app store listing, privacy policy, loan agreement, official receipt, or payment instructions may provide clues.

XVII. Data Protection Officer

Organizations that process personal data should have a person or office responsible for data protection compliance. The borrower should address privacy-related requests to the lender’s Data Protection Officer or designated privacy contact.

A deletion request should ideally be sent to:

Data Protection Officer email;
Customer service email;
Official complaint channel;
Registered office address;
In-app support, if available.

The borrower should keep proof of sending.

XVIII. What to Include in a Deletion Request

A deletion request should be clear, specific, and evidence-based.

It should include:

Borrower’s full name;
Registered mobile number;
Email address used in the app;
Loan account number;
App name;
Date of loan;
Payment status;
Specific data requested to be deleted;
Reason for deletion;
Demand to stop processing;
Demand to stop contacting third persons;
Demand for confirmation;
Attachments, such as proof of full payment;
Valid ID, if reasonably required for verification;
Deadline for response.

The borrower should not send more personal data than necessary. If identity verification is required, redact sensitive details when possible unless full copy is legally necessary.

XIX. Sample Deletion Request After Full Payment

Subject: Request for Deletion, Blocking, and Restriction of Personal Data After Full Payment

I am a borrower of [App Name] under Loan Account No. ________. I fully paid the loan on ________ through ________, with reference number ________. Attached is proof of payment.

Since the purpose of collection has been fulfilled, I request the following:

Close my loan account and mark it fully paid;
Issue a certificate or written confirmation of full payment;
Stop all collection calls, texts, emails, and messages;
Recall my account from all collection agents;
Delete all unnecessary personal data no longer required for legal or regulatory retention;
Delete all contact-list data obtained from my device;
Delete any photos, IDs, or files not legally required to be retained;
Stop processing my data for marketing or promotional purposes;
Stop contacting my relatives, employer, references, or phone contacts;
Confirm what records you will retain, the legal basis for retention, and the retention period.

Please provide written confirmation of action taken.

XX. Sample Deletion Request for Contact-List Harassment

Subject: Demand to Delete Contact-List Data and Stop Unauthorized Third-Party Contact

I discovered that [App Name] or its collectors contacted persons from my phone contacts regarding my loan. These persons are not parties to the loan and did not consent to the processing of their personal data for collection or harassment.

I demand that you:

Immediately stop contacting all persons in my contact list;
Delete all contact-list data obtained from my device;
Identify whether such data was shared with collection agencies or third parties;
Instruct all agents to delete copies of such data;
Confirm in writing that my contacts will no longer be messaged or called;
Preserve internal records for investigation.

Your continued use of contact-list data for collection, shaming, or pressure is unauthorized, disproportionate, and unlawful.

XXI. Sample Request When Person Did Not Apply for the Loan

Subject: Demand to Stop Processing and Delete Fraudulent Loan Account

I received collection messages from [App Name] regarding Loan Account No. ________, but I did not apply for this loan and did not receive any proceeds.

I demand that you:

Stop all collection activity immediately;
Provide a copy of the loan application and verification documents allegedly used;
Provide the disbursement account or channel where proceeds were sent;
Block the disputed account pending investigation;
Delete or restrict all personal data unlawfully processed under my name;
Correct any credit reporting or internal delinquency record;
Stop contacting my relatives, employer, and other third persons;
Provide written confirmation of your investigation.

I reserve the right to file complaints for identity theft, unauthorized processing of personal information, and other legal violations.

XXII. Sample Request to Stop Marketing

Subject: Withdrawal of Consent to Marketing and Request for Removal From Promotional Lists

I request that [App Name] remove my name, mobile number, email address, device identifiers, and account details from all marketing, promotional, reloan, and advertising lists.

I withdraw any consent previously given for marketing communications. Please stop sending loan offers, promotional messages, app notifications, emails, calls, and SMS. This request does not affect any lawful recordkeeping you may be required to perform, but it bars further marketing use of my personal data.

Please confirm removal from your marketing database.

XXIII. What the Lending App Should Do After Receiving the Request

A responsible lender should:

Acknowledge the request;
Verify the requester’s identity;
Check account status;
Determine what data can be deleted;
Determine what data must be retained;
Stop unlawful processing immediately;
Notify collection agents;
Correct inaccurate records;
Delete unnecessary data;
Restrict retained data;
Stop marketing communications;
Provide written response;
Explain legal basis for any retained data;
Provide complaint escalation channel.

Failure to respond may support a complaint.

XXIV. When the Lender Refuses Deletion

A lender may refuse total deletion if it has a lawful basis for retention. However, it should explain the basis.

A proper refusal should state:

Which data will be retained;
Why it must be retained;
Legal or business basis for retention;
Retention period;
Security safeguards;
Whether data will be shared;
Whether collection or marketing will stop;
How the borrower can appeal or complain.

A vague refusal such as “we cannot delete your data” without explanation may be challenged.

XXV. Data That May Be Retained Lawfully

A lending app may be justified in retaining:

Loan contract;
Payment records;
Receipts;
Official transaction logs;
Identity verification records reasonably necessary to prove the transaction;
Complaint records;
Accounting records;
Regulatory compliance records;
Records needed for legal defense;
Fraud prevention records.

But retention should be limited and secure. The data should not be used for unrelated purposes.

XXVI. Data That Should Usually Be Deleted or Restricted After Purpose Ends

Depending on the facts, the borrower may demand deletion or restriction of:

Contact-list data;
Photos from the device not needed for the loan;
Location logs not necessary for records;
Marketing profile;
Promotional lists;
Collection notes after account closure, except internal compliance records;
Duplicative ID copies;
Unnecessary selfies or images;
Chat data not needed for compliance;
Third-party contacts;
Device permissions and identifiers not needed after closure;
Data held by unauthorized collectors.

The lender must justify continued retention of such data.

XXVII. Contacting Collection Agencies

If the lender endorsed the account to a collection agency, deletion or restriction must extend to the agency.

The borrower should demand that the lender:

Recall the account;
Inform collectors that the account is paid or disputed;
Instruct collectors to stop processing data;
Instruct collectors to delete unnecessary copies;
Stop further disclosure;
Provide the name of collection agency;
Provide confirmation that third-party processing has ended.

If the collection agency continues harassment, it may be separately liable.

XXVIII. Credit Reporting Records

Deletion from the lending app does not automatically delete credit bureau or credit information records. If the app reported the loan to a credit database, the borrower should request correction or update.

The borrower may demand:

Update account as fully paid;
Correct inaccurate delinquency status;
Remove disputed or unlawful charges;
Rectify identity theft records;
Provide information on where the data was reported;
Confirm correction was sent to credit reporting entities.

Credit records may not be deleted simply because the borrower dislikes them, but they must be accurate, fair, and lawfully processed.

XXIX. Data Retention Period

Borrowers should ask how long the lender will retain data.

A proper retention policy should specify:

Categories of data;
Purpose of retention;
Retention period;
Legal basis;
Deletion or anonymization schedule;
Security safeguards;
Third-party processors;
Contact for privacy requests.

Indefinite retention without justification may be questionable.

XXX. Withdrawal of Consent

Many apps rely on user consent for some forms of data processing. A borrower may withdraw consent for processing that is based solely on consent, such as marketing or optional data use.

However, withdrawal of consent does not automatically erase processing based on other lawful grounds, such as contract performance, legal compliance, or legitimate claims.

For example:

The borrower may withdraw consent to marketing;
The borrower may demand deletion of contact-list data;
The lender may still retain loan contract records for lawful purposes;
The lender may still process data needed for a pending legal claim.

Consent withdrawal is strongest against optional or excessive processing.

XXXI. Right to Object

A borrower may object to processing based on improper, excessive, or unauthorized purposes.

The borrower may object to:

Marketing;
Contact-list use;
Public posting;
Third-party disclosure;
Data sharing with unrelated affiliates;
Profiling beyond loan necessity;
Processing after full payment for collection;
Processing based on inaccurate account status.

Once the borrower objects, the lender should stop processing unless it can show a lawful basis.

XXXII. Right to Correction

Sometimes the issue is not deletion but correction.

The borrower may request correction of:

Wrong name;
Wrong phone number;
Wrong payment status;
Incorrect outstanding balance;
False delinquency;
Wrong employer;
Duplicate account;
Wrong ID number;
Wrong credit report;
Wrong collection endorsement.

Correction is important because lenders may claim they cannot delete records but must still ensure accuracy.

XXXIII. Right to Access

Before demanding deletion, the borrower may request access to personal data held by the lender.

The borrower may ask:

What personal data do you hold?
Where did you obtain it?
Why are you processing it?
Who received it?
Was it shared with collection agencies?
Was it shared with credit bureaus?
How long will it be retained?
What data was collected from my device?
Did you collect my contacts?
Did you collect location or photo data?

This access request helps identify what to delete.

XXXIV. Right to Data Portability

Where applicable, a borrower may request a copy of personal data in a structured or commonly used format, especially transactional data. This may help the borrower preserve records before account deletion.

XXXV. Privacy Policy Review

The borrower should review the app’s privacy policy. Important sections include:

Data collected;
Purpose of collection;
App permissions;
Third-party sharing;
Collection agencies;
Credit reporting;
Retention period;
Deletion request procedure;
Data Protection Officer contact;
Jurisdiction and dispute process.

If the app’s actual conduct differs from its privacy policy, this supports a complaint.

XXXVI. App Permissions and Excessive Consent

Some lending apps request broad permissions at installation. Consent may be invalid or questionable if it is bundled, forced, unclear, or excessive.

Problematic practices include:

“Accept all” permission before seeing loan terms;
Contact-list access required for small loans;
Storage access not clearly explained;
Location tracking unrelated to loan;
SMS access used for profiling without clear notice;
Use of contacts for shaming;
No option to refuse optional data processing;
Privacy policy written in vague language.

The borrower may argue that consent was not validly obtained for excessive data processing.

XXXVII. Data of Third Persons

Lending apps may process data of people who are not borrowers, including references, relatives, employers, and phone contacts.

This is a serious issue because third persons often did not consent.

A borrower may request deletion of third-party data uploaded from the borrower’s phone. Third persons may also directly demand:

Stop contacting them;
Delete their number;
Explain how their data was obtained;
Stop associating them with the borrower’s loan;
File privacy complaints.

A reference is not automatically a co-maker, guarantor, or debtor.

XXXVIII. Special Protection for Employers and Workplace Contacts

Contacting an employer about a borrower’s loan can cause reputational and employment harm. The borrower may demand deletion of employer contacts unless necessary and lawfully obtained.

The lender should not:

Disclose loan details to HR;
Shame the borrower at work;
Threaten workplace visits;
Send fake legal notices to the employer;
Demand salary deduction without authority;
Contact co-workers from the phonebook.

If the borrower provided employer information for income verification, the lender’s use should be limited to that purpose unless another lawful basis exists.

XXXIX. When Data Is Used for Harassment

Data deletion becomes urgent when the lender uses data for harassment.

Examples:

Sending messages to all contacts;
Posting ID and photo online;
Calling the employer;
Threatening relatives;
Creating group chats;
Sending defamatory messages;
Releasing loan details;
Using vulgar language;
Sending fake legal notices;
Continuing collection after full payment.

In these cases, the borrower should demand not only deletion but also cessation, takedown, investigation, and sanctions.

XL. Filing a Complaint With the National Privacy Commission

If the lending app ignores the request, refuses without basis, misuses data, or continues harassment, the borrower may file a complaint with the National Privacy Commission.

A. Possible Grounds

Unauthorized processing;
Excessive data collection;
Malicious disclosure;
Unauthorized disclosure;
Improper disposal or retention;
Failure to secure personal data;
Failure to respect data subject rights;
Failure to respond to access, correction, deletion, or blocking requests;
Contact-list harassment;
Public shaming.

B. Evidence

Attach:

Loan records;
Privacy request sent to the app;
Proof of receipt;
App privacy policy;
Screenshots of app permissions;
Messages from collectors;
Messages sent to contacts;
Social media posts;
Proof of full payment, if applicable;
Written responses or refusal;
ID of complainant;
Affidavits of contacted persons, if available.

C. Relief

The borrower may request:

Deletion or blocking of unlawfully processed data;
Cessation of processing;
Takedown of posts;
Correction of inaccurate records;
Investigation;
Penalties where applicable;
Referral for prosecution in serious cases.

XLI. Complaint With the Lending or Financing Regulator

If the app is operated by a lending or financing company, the borrower may also complain to the regulator supervising such companies.

Possible issues include:

Abusive collection;
Harassment;
Contact-list shaming;
Failure to disclose data practices;
Unfair lending practices;
Excessive fees;
Failure to issue payment confirmation;
Continued collection after full payment;
Unregistered app operation;
Failure to respond to complaints.

Data privacy complaint and lending regulation complaint may be filed separately because they address different violations.

XLII. Cybercrime and Criminal Remedies

If the lending app or collectors use personal information for threats, cyberlibel, identity theft, fake documents, or public shaming, criminal remedies may be considered.

Possible criminal issues include:

Cyberlibel;
Grave threats;
Light threats;
Unjust vexation;
Coercion;
Falsification;
Identity theft;
Unauthorized access;
Malicious disclosure of personal data;
Usurpation of authority if pretending to be police, court, or government officers.

The borrower should preserve electronic evidence before requesting takedown.

XLIII. Civil Remedies

A borrower may seek civil remedies if misuse or refusal to delete data caused harm.

Possible civil claims include:

Damages for violation of privacy;
Moral damages for humiliation, anxiety, or besmirched reputation;
Actual damages for job loss or financial harm;
Exemplary damages for oppressive conduct;
Injunction to stop disclosure;
Takedown orders;
Correction of records;
Attorney’s fees where justified.

Civil remedies may be appropriate for severe harassment, employer contact, public posts, or continued collection after full payment.

XLIV. Preservation of Evidence Before Deletion

A borrower should not rush to delete everything before saving evidence. If the app deletes records, the borrower may lose proof of payment, harassment, excessive charges, or privacy violations.

Before deletion, save:

Loan agreement;
App screenshots;
Privacy policy;
Terms and conditions;
Payment receipts;
Full payment confirmation;
Balance screen;
Messages from collectors;
Contact harassment evidence;
Social media posts;
App permission screenshots;
Account details;
Complaint messages sent.

Preserve evidence first, then request deletion or takedown.

XLV. How to Document a Deletion Request

The borrower should create a clear record of the request.

Recommended steps:

Send by email to official support and DPO email;
Send through in-app support if available;
Send to registered office by courier if serious;
Save proof of sending;
Take screenshots of submitted ticket;
Record ticket number;
Follow up in writing;
Keep all replies;
Avoid purely verbal requests;
Ask for written confirmation of deletion.

If the matter escalates, this record proves that the lender was given notice.

XLVI. Reasonable Verification by the Lender

A lender may ask the requester to verify identity before deleting data. This is reasonable because the lender must avoid deleting or disclosing data to an impostor.

However, verification should be proportionate. The lender should not demand excessive new personal data.

Reasonable verification may include:

Registered mobile number;
Email used for account;
Loan account number;
Masked ID;
Payment reference;
Date of birth;
Security question;
Last payment amount.

If asked for a full ID copy, the borrower may ask if a redacted copy is acceptable, showing only necessary details.

XLVII. Deletion of Data From Device vs. Company Servers

The borrower should distinguish between:

A. Device Deletion

This includes uninstalling the app, clearing cache, revoking permissions, deleting downloaded files, and removing app data from the phone.

B. Server Deletion

This requires the lender to delete or restrict data stored in its systems, cloud servers, databases, backups, and collection platforms.

C. Third-Party Deletion

This requires deletion or restriction by collection agencies, payment processors, credit reporting entities, marketing vendors, and affiliates.

A proper deletion request should cover all three where applicable.

XLVIII. Backups and Archived Records

A lender may say that data remains in backups for a limited period. This may be acceptable if:

Backups are secure;
Data is not actively used;
Backup retention period is limited;
Data will be overwritten or deleted according to schedule;
Access is restricted;
Data is restored only for legitimate purposes.

The borrower may ask for the backup retention period.

XLIX. Anonymization as an Alternative

If the lender must retain transaction statistics but no longer needs identifiable data, it may anonymize records.

Anonymized data should no longer identify the borrower. Proper anonymization may allow the lender to keep aggregate records without retaining personal identity.

The borrower may request anonymization where deletion is not feasible.

L. Special Issue: Government ID and Selfie Deletion

Lending apps often require government ID and selfie verification. These are sensitive because they can be misused for identity theft.

After account closure, the borrower may request:

Deletion of duplicate ID copies;
Restriction of access to retained ID images;
Confirmation that IDs are not shared with collectors;
Deletion of biometric templates, if any;
Security measures for retained verification records;
Retention period for ID images.

If the lender refuses, it should explain the legal basis and retention period.

LI. Special Issue: Bank and E-Wallet Details

Bank and e-wallet details should be protected. After full payment or account closure, the borrower may demand:

Deletion of saved disbursement account for future loans;
Removal from auto-debit or payment authorization, if any;
Confirmation that no further deductions will occur;
Restriction of access to bank details;
Deletion of unnecessary payment tokens;
Correction of payment status.

Unauthorized deductions may raise separate legal issues.

LII. Special Issue: Location Data

Some lending apps collect location data. The borrower may question whether this is necessary for loan processing.

The borrower may demand:

Deletion of historical location data;
Cessation of location tracking;
Explanation of why location was collected;
Identification of third parties who received it;
Restriction of any retained location logs.

Location data can reveal sensitive personal patterns and should not be collected excessively.

LIII. Special Issue: SMS, Call Logs, and Device Data

Some apps seek access to SMS, call logs, or device information for credit scoring. This may be intrusive.

The borrower may demand:

Deletion of SMS-derived data;
Deletion of call-log-derived data;
Explanation of data collected;
Stoppage of device profiling;
Deletion of device identifiers where no longer needed;
Confirmation that such data is not shared with collectors.

The app must justify why such data is necessary and proportionate.

LIV. Special Issue: Marketing and Reloan Offers

Even after full payment, many apps continue sending loan offers. The borrower may demand removal from marketing lists.

The request should include:

Stop SMS loan offers;
Stop app push notifications;
Stop emails;
Stop calls from agents;
Stop sharing data with affiliates;
Delete marketing profile;
Do not use payment history for promotional targeting.

Marketing consent can usually be withdrawn.

LV. Special Issue: Deletion After App Ban or Closure

If a lending app has disappeared, been removed from app stores, or stopped responding, the borrower should still attempt to identify the registered company.

Possible sources:

Old loan agreement;
Official receipt;
Payment channel;
Privacy policy screenshot;
App store history;
SMS sender name;
Email domain;
Collection messages;
SEC registration references;
Bank or e-wallet merchant name.

If the company cannot be reached, the borrower may file complaints with available evidence.

LVI. Special Issue: Foreign Lending Apps

Some apps may be foreign-operated or use foreign servers. If they operate in the Philippines or process data of Philippine borrowers, Philippine privacy and lending rules may still be relevant depending on the circumstances.

The borrower should identify:

Local entity;
Foreign operator;
Philippine representative;
Privacy policy jurisdiction;
Payment channels;
Collection agents in the Philippines;
Local registration.

Complaints may be more difficult if no local entity exists, but evidence should still be preserved.

LVII. Special Issue: Minors and Unauthorized Loans

If a minor’s personal data was used in a lending app, the issue is serious.

Concerns include:

Capacity to contract;
Unauthorized processing of minor’s data;
Identity theft;
Use of parent’s ID;
Contacting minors for collection;
Posting minor’s information;
Harassment of a child.

Parents or guardians should immediately demand deletion, blocking, investigation, and cessation of collection.

LVIII. Special Issue: Deceased Borrower

If the borrower has died, relatives may request closure, cessation of collection, and restriction of processing, especially if collectors harass family members.

The lender may need to retain records for estate claims, but it should not harass relatives or disclose unnecessary information.

Family members should provide:

Death certificate;
Proof of relationship;
Loan account details;
Demand to stop contacting unrelated persons;
Request for statement of account if estate settlement is needed.

Relatives are not automatically personally liable unless they separately obligated themselves or estate rules apply.

LIX. What If the Lender Says “You Agreed in the App”?

A lender may argue that the borrower agreed to data processing by accepting app terms. This does not automatically defeat a deletion request.

Consent may be challenged if:

It was not informed;
It was not specific;
It was bundled with unrelated permissions;
It was required for excessive data;
It allowed disproportionate processing;
It was used for harassment;
It covered third-party contacts who did not consent;
It was inconsistent with law.

The law does not allow a lender to contract out of basic privacy rights.

LX. What If the Lender Says “We Need It for Collection”?

If the loan is unpaid, some collection-related processing may be legitimate. But the lender must still show necessity and proportionality.

The borrower may respond:

You may contact me through official channels;
You may keep loan records necessary for lawful collection;
You may not contact unrelated third persons;
You may not post my data online;
You may not retain excessive contact-list data;
You may not use fake legal threats;
You may not process inaccurate balances;
You must provide a statement of account.

Lawful collection is different from data abuse.

LXI. What If the Lender Says “We Need It for Legal Compliance”?

The lender may retain certain records for legal compliance. The borrower should ask:

Which specific data?
Which law or regulation requires retention?
How long will it be retained?
Who can access it?
Will it be shared with collectors?
Can unnecessary data be deleted?
Can retained data be restricted or archived?
Can marketing use be stopped?

Legal compliance does not justify retaining everything forever.

LXII. Complaint Letter Structure

A formal complaint about refusal to delete data should include:

Name of complainant;
App name;
Company name, if known;
Loan account number;
Chronology of events;
Data collected;
Data misuse or excessive processing;
Deletion request sent;
Lender’s response or failure to respond;
Harm suffered;
Evidence attached;
Legal rights invoked;
Relief requested.

The complaint should be factual and organized.

LXIII. Reliefs to Request in a Privacy Complaint

The borrower may request:

Deletion of unlawfully collected data;
Blocking of disputed account;
Correction of payment status;
Takedown of posts;
Cessation of contact-list use;
Identification of third-party recipients;
Recall of data from collection agencies;
Removal from marketing lists;
Written confirmation of retention basis;
Sanctions;
Damages through proper forum;
Referral for criminal investigation if warranted.

LXIV. Risks of Publicly Posting the Lender’s Employees

Borrowers often retaliate by posting collectors’ numbers, photos, or personal information. This can create legal risks for the borrower.

Safer approach:

Preserve evidence privately;
Report to authorities;
Send formal complaints;
Avoid doxxing;
Avoid threats;
Avoid posting unverified accusations;
Redact personal information when sharing publicly.

The borrower’s legal position is stronger when the response remains lawful.

LXV. If the App Keeps Re-Uploading or Reposting Data

If data is repeatedly reposted after takedown, the borrower should:

Capture each repost;
Save URLs;
Identify accounts used;
Report to platform;
Notify lender of continuing violation;
File supplemental complaint;
Request urgent action from authorities;
Consider cybercrime or civil remedies.

Repeated publication may aggravate liability.

LXVI. If the App Shares Data With Affiliates

Some apps share borrower data with affiliates, related lending apps, marketing partners, or collection networks. The borrower may suddenly receive loan offers or collection messages from other app names.

The borrower should demand:

List of affiliates or third parties who received data;
Legal basis for sharing;
Withdrawal of marketing consent;
Deletion from affiliate databases;
Stop to cross-app collection harassment;
Confirmation that data sharing has ceased.

Data sharing must be disclosed and lawful.

LXVII. If the Borrower Used Multiple Lending Apps

A borrower using multiple apps should send separate deletion or restriction requests to each app. Deleting data from one app does not delete it from others.

Prepare a tracking sheet:

App	Company	Loan status	Request sent	Response	Follow-up
App 1	Company A	Paid	Date	Pending	Date
App 2	Company B	Disputed	Date	Refused	Complaint filed

This prevents confusion and helps organize complaints.

LXVIII. Statutory and Regulatory Recordkeeping vs. Privacy Rights

The conflict between deletion and retention is common. The proper approach is not all-or-nothing.

A lender may retain what it must, but should:

Minimize retained data;
Restrict access;
Stop active processing;
Stop marketing;
Stop harassment;
Delete excessive data;
Anonymize where possible;
Secure archives;
Provide retention explanation;
Delete after retention period expires.

A borrower may accept legitimate retention while insisting on deletion of abusive or excessive data.

LXIX. Practical Step-by-Step Guide

Step 1: Save Evidence

Before deleting the app or account, save loan records, payment proof, messages, and screenshots.

Step 2: Pay or Clarify the Loan Status

If paid, secure proof. If unpaid or disputed, request a statement of account.

Step 3: Revoke App Permissions

Remove access to contacts, photos, location, SMS, and storage.

Step 4: Use In-App Account Deletion if Available

Do this only after saving evidence.

Step 5: Send Written Deletion Request

Send to customer service, DPO, and official email.

Step 6: Ask for Confirmation

Request written confirmation of what was deleted, retained, and why.

Step 7: Follow Up

If no response, send a follow-up with prior reference.

Step 8: File Complaint

If ignored or refused without basis, file with the proper authority.

Step 9: Monitor Contacts and Credit Records

Ask contacts to report messages. Check for continued collection or inaccurate reporting.

Step 10: Escalate if Harassment Continues

Consider privacy, regulatory, cybercrime, criminal, or civil remedies.

LXX. Practical Checklist Before Sending a Deletion Request

Prepare:

Full name used in app;
Mobile number used;
Email used;
App name;
Registered company name, if known;
Loan account number;
Proof of full payment, if paid;
Statement of account, if disputed;
Screenshots of personal data misuse;
App permission screenshots;
Names and numbers of collectors;
Messages sent to contacts;
Social media posts;
Privacy policy;
Demand letter draft;
Valid ID for verification, preferably redacted where acceptable.

LXXI. Common Mistakes

Borrowers often make these mistakes:

Uninstalling the app and assuming data is deleted;
Deleting evidence before filing complaints;
Sending deletion requests only through chat without proof;
Ignoring full payment certification;
Posting sensitive documents online;
Sending IDs to fake customer support pages;
Paying fixers to “delete data”;
Not revoking app permissions;
Not informing contacts to preserve harassment messages;
Accepting vague replies from the lender;
Failing to identify the actual company behind the app;
Not following up in writing.

LXXII. Frequently Asked Questions

1. Can I force a lending app to delete all my personal information?

Not always. The app may retain records required for legal, accounting, regulatory, fraud prevention, or legal defense purposes. But you may demand deletion of unnecessary, excessive, unlawfully collected, or abusive data.

2. Does uninstalling the app delete my data?

No. It removes the app from your phone but does not automatically delete data already uploaded to the lender’s servers.

3. Can I demand deletion after fully paying the loan?

Yes. You can demand account closure, cessation of collection, deletion of unnecessary data, deletion of contact-list data, removal from marketing lists, and confirmation of retained records.

4. Can the app keep my loan records after payment?

Yes, to the extent needed for lawful recordkeeping, audit, tax, regulatory compliance, fraud prevention, or legal defense. But it should not use them for harassment or unrelated marketing without lawful basis.

5. Can I demand deletion of my phone contacts from their system?

Yes. Contact-list data is often excessive and may involve third persons who did not consent.

6. Can the app contact my references after deletion request?

Only if there is a lawful and proportionate basis. It should not harass references, disclose loan details unnecessarily, or contact random phonebook entries.

7. What if the app refuses to delete my data?

Ask for the legal basis and retention period. If the refusal is unjustified or the app continues misuse, file a complaint with the National Privacy Commission and other appropriate regulators.

8. What if the app posted my ID or photo online?

Save evidence first, then demand takedown and deletion. Consider privacy, cybercrime, defamation, and regulatory complaints.

9. Can I withdraw consent to marketing?

Yes. You may demand removal from promotional calls, texts, emails, notifications, and reloan offers.

10. What if I never applied for the loan?

Demand proof of application and disbursement, immediate blocking of the account, cessation of collection, deletion or restriction of falsely processed data, and investigation for identity theft.

11. Can my contacts file complaints too?

Yes. If their personal data was used or they were harassed, they may file their own privacy or harassment complaints.

12. Should I send my ID to request deletion?

The lender may reasonably verify identity, but verification should be proportionate. Use official channels only and redact unnecessary details where acceptable.

LXXIII. Conclusion

Deleting personal information from a lending app in the Philippines is not as simple as uninstalling the app. Data may remain in the lender’s servers, collection systems, backups, affiliate databases, credit reports, and third-party processors.

A borrower has the right to demand deletion, blocking, correction, restriction, and cessation of unlawful processing when data is excessive, inaccurate, unlawfully obtained, no longer necessary, or used for harassment. After full payment, the borrower should demand account closure, certificate of full payment, deletion of unnecessary data, removal from marketing lists, deletion of contact-list data, and recall from collection agencies.

At the same time, a lender may retain limited records for lawful purposes such as accounting, regulatory compliance, fraud prevention, and legal defense. The key is proportionality: the lender may keep what the law reasonably requires, but it may not continue abusive, excessive, deceptive, or unauthorized processing.

The best approach is to preserve evidence first, revoke app permissions, send a written deletion request to the lender and its Data Protection Officer, demand confirmation of action taken, and escalate to the proper authorities if the app refuses, ignores the request, contacts third persons, posts personal data, or continues harassment.