Eplayment Corporation ("Eplayment", "we", "us") is registered with the Bangko Sentral ng Pilipinas as an operator of payment systems (OPS Registration No. OPSCOR-2021-0002). Weav is Eplayment's payment gateway for businesses: it lets merchants accept payments from their customers through QR Ph, e-wallets, cards and over-the-counter partners, and pays the proceeds out to the merchant.
Eplayment respects your right to privacy and is committed to the data privacy principles of transparency, legitimate purpose and proportionality. We comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.
This Privacy Notice explains what personal data Weav collects, why, how it is used, shared, protected, kept and deleted, and your rights as a data subject.
Who this notice covers
- Merchants' people: the owners, authorized representatives and team members of businesses that use Weav, including people who sign in to the Weav dashboard.
- Payers: people who pay a Weav merchant through Weav's payment page or a payment channel Weav connects to.
- Visitors: people who browse the Weav website and API documentation, or contact us.
Consent and other lawful bases
By using Weav and providing us your personal data, you consent to its collection, use and processing as described in this Privacy Notice. If you do not agree, please do not use Weav.
Some processing does not depend on consent: we also process personal data to fulfill our contracts with merchants, to comply with our legal obligations (including the Anti-Money Laundering Act, as amended, and BSP regulations), and to protect our legitimate interests, such as preventing fraud.
Definition of terms
- Personal Information
- Any information, recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or that, put together with other information, would directly and certainly identify an individual.
- Sensitive Personal Information
- Personal information about an individual's marital status, age, birthdate, sex, gender, and information contained in government-issued identification documents, among others defined by law.
- Data Subject
- An individual whose personal, sensitive or privileged information is processed.
- Consent of the Data Subject
- Any freely given, specific, informed indication of will by which the data subject agrees to the processing of their personal information. It may also be given on their behalf by a lawful representative or a specifically authorized agent.
- Processing
- Any operation performed on personal data, including collection, recording, organization, storage, updating, retrieval, consultation, use, consolidation, blocking, erasure or destruction, whether by automated or manual means.
- Personal Data Breach
- A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.
What we collect and why
Merchant onboarding and verification
To verify a business before it can use Weav, as BSP and anti-money-laundering rules require, we collect information about the business and the people behind it, such as:
- names, contact details and positions of owners, beneficial owners and authorized representatives;
- government-issued IDs and the information in them;
- business registration documents, tax identification number and business address;
- the bank or e-wallet account where the merchant receives payouts.
Dashboard accounts
For each person who signs in to the Weav dashboard: name, email address, password (stored only in a form that cannot be read back), two-factor authentication settings, and a log of sign-ins and account changes that includes the IP address and browser used. We use these to run the account, keep it secure and keep an audit trail.
Payers
When you pay a Weav merchant, we process:
- the payment's amount, channel, status, time and reference numbers, including the references issued by your bank, e-wallet or payment partner;
- the IP address and browser you use when you first open a Weav payment page, to help prevent fraud and to meet anti-money-laundering rules;
- your name, which the merchant gives us with each payment;
- your email address and mobile number, if the merchant gives them to us, or if you give us your email address on Weav's payment page to get a receipt.
We use these to process your payment, to pass them to the bank, e-wallet or card processor that handles it (some, like card processors, need your name to check payments for fraud), and to email you a receipt when you have given an email address. We do not use them for marketing, and we do not sell them.
Weav never asks for your PIN, password or one-time code. Card details are entered on the card processor's own page; Weav does not receive or store them.
Website and documentation visitors
We use only the cookies needed to run the site and the dashboard (such as session cookies) and to remember your display preferences, like light or dark mode.
Customer support
When you contact us, we keep your messages and contact details to address and resolve your concern.
Legal compliance
We collect and keep personal data when needed to comply with our legal, regulatory and reporting obligations, and with lawful requests of regulators and law enforcement agencies.
If we ever need data for a purpose not covered by this notice, we will explain the purpose and our lawful basis before we collect it. If we need to process data for a purpose other than the one it was collected for, we will tell you clearly beforehand.
How we collect it
- Directly from you or your business during onboarding and verification;
- when you use the Weav dashboard or API, or open a Weav payment page;
- from the merchant you pay, and from the banks, e-wallets and payment partners that process the payment;
- when you browse the Weav website or contact our support team; and
- when complaints are lodged or investigations are conducted by regulators or law enforcement.
How we use it
- Know-your-customer and know-your-business checks, as required by law;
- processing payments, settlements, payouts, refunds and chargebacks;
- sending payers their payment receipts by email;
- responding to inquiries, requests, concerns and complaints;
- managing merchant accounts, and audit, administrative and operational tasks incidental to them;
- detecting, preventing and investigating fraud, money laundering and other crimes, and reporting to the Anti-Money Laundering Council when the law requires;
- activities you have consented to; and
- other activities permitted by law.
Data sharing and outsourcing
Within Eplayment, only the teams who need it to do their work (engineering, operations, compliance, support and finance) can access personal data, and only the data relevant to their tasks.
We share personal data only as needed with:
- the banks, e-wallets, card processors and over-the-counter partners that process a payment or payout;
- the merchant you pay, for the details of your own payment;
- verification partners that help us confirm identities during onboarding; and
- regulators, courts and law enforcement agencies, when the law requires.
Anyone we share data with is bound by contract to keep it confidential, protect it, and use it only for the purpose we shared it for. We do not sell personal data.
How long we keep it
We keep transaction records and the identification records of merchants for at least five (5) years from the date of the transaction or the closure of the account, as the Anti-Money Laundering Act requires, and longer when a case or investigation is pending. A payer's name is part of the transaction record and is kept with it. We keep a payer's email address and mobile number for up to 400 days after the payment, then delete them, and a payer's IP address and browser only as long as needed for fraud prevention and anti-money-laundering purposes. You may ask us to delete your data at any time; we will do so unless the law requires us to keep it. When the retention period ends or the data is no longer needed, we delete it securely.
How we protect it
We use reasonable and appropriate physical, technical and organizational measures to prevent the loss, destruction, misuse or alteration of your information. These include encryption (payers' names, email addresses and mobile numbers are encrypted when stored, and shown masked to merchants' teams), access controls, two-factor authentication for dashboard users, audit logs, and secured servers behind firewalls. Weav does not store card numbers.
Your rights as a data subject
Under the Data Privacy Act, you have the right:
- to be informed whether personal data about you will be, is being, or has been processed;
- to reasonable access to your personal data;
- to object to, or withhold consent to, its collection and processing;
- to suspend, withdraw, or order the blocking, removal or destruction of your personal data;
- to dispute inaccuracies or errors in your personal data and have them corrected, unless the request is vexatious or otherwise unreasonable;
- to obtain a copy of your data in an electronic or structured format that is commonly used and allows further use; and
- to file a complaint with the National Privacy Commission if you believe your privacy rights were violated, and to claim damages.
Some rights are limited where the law requires us to keep or process the data, for example transaction records kept under the Anti-Money Laundering Act.
Changes to this notice
We may update this Privacy Notice to reflect changes to Weav or to the law. If a change needs your consent, we will ask for it. Otherwise, changes take effect when they are posted here.
Contact us
For questions about this Privacy Notice or to exercise your rights, contact our Data Protection Officer at [email protected]. You can also reach Weav support at [email protected], or write to our main office at LG1 CapitolGreenstreet, Capitol Hills Drive, Matandang Balara, Quezon City 1119.