GDPR Credolab privacy statement for consumers in the European Union.
GDPR Credolab privacy statement for consumers in the European Union.
CredoLab GDPR Privacy Policy December 17, 2024
General information and contact details
CredoLab Pte. Ltd. ("CredoLab", "we", "us" or "our") take the protection and security of your personal data very seriously. This privacy notice sets out the data we collect and process about you through our products and services, the purposes of the data processing and how you can exercise your privacy rights under GDPR.
You maybe reading this notice because of a link provided by an organisation you are engaging (our customer), or you simply want more information on data processing in relation to our products and services.
Our customer and data supplier (you have engaged with) will have a lawful reason for collecting and processing your data and may have a separate relationship with you. It is separately required to provide you with information (for example through their own privacy notice) about how it collects and processes your data.
We have offices in several locations, and our registered office address is at:
CredoLab Pte. Ltd.
111 North Bridge Road,
#08-11 Peninsula Plaza,
Singapore, 179098
Our Company Registration Number is: 201601190K
If you have any questions about how we use your data, please contact our Data Protection Officer by email at privacypolicy@credolab.com.
We review this privacy notice on an annual basis, or sooner if changes to regulation require it or we change the way we process personal data.
This privacy notice was last updated on December 17, 2024.
Please read this notice if and when an organisation of your choice (our customer) has assigned to us your consent to access your personal data as a part of Anti-Fraud Services based on a separate agreement with us.
CredoLab is providing products and services to help financial and other organisations to produce real-time credit decisions. We use mobile and web device metadata and/or personal information provided by you to produce the alternative credit score via our proprietary technology.
This includes highly sophisticated algorithms and predictive analytics applied to metadata accessed via our mobile application (CredoApply), a mobile SDK (CredoSDK), and a Web JavaScript (Web SDK). We provide this alternative credit score only in relation to the service that you are applying for at the organisation of your choice(our customer). We do NOT share your alternative credit score with anyone else.
This still may sound complex, so an example is often the easiest way to explain:
More examples are included below describing why we collect your personal data.
It’s simple. Our application (CredoApply) will access and process such User’s Data, which can effectively be used in evaluating your solvency of and/or the interest in obtaining financial services. While collecting your data to calculate your alternative credit score, we use metadata to provide a segmented risk profile, generate an aggregated statistical information, and to improve and administer our current products and create new products. Your User’s Data will be stored directly at the servers of the financial organisation of your choice and only anonymous metadata will be processed by CredoLab on CredoLab’s secure servers. The above-mentioned techniques assist in keeping the data that is sent to our servers anonymous and secure and allows you to retain your raw information on your device.
CredoLab’s technology may access some or all of the following (or similar) data on your mobile and/or web device (your digital footprint):
While we cannot list out each and every type of data that we collect, our web technology collects (and uploads to our secured servers) only certain limited information. We’ve tried below to give you a general understanding of what types of data we collect and examples to help you see what we mean:
We call the metadata related to typing speed/cadence, UI interactions, gestures and every interaction that the user makes while the application for a loan via the app is completed Behavioural Biometrics Metadata. Details about such metadata is below:
An example of the data collected can be seen by using this demo link.
We DO NOT collect the actual fingerprints, voice recording or images. Regarding images (and just like every data we process), we only process the metadata, not the actual images. Furthermore, we process the date when a picture was taken, the resolution, tags (if enabled). Details of the metadata collected about images is here. Again, we do not collect or store the actual image.
The digital footprint on your device will be accessed only one-time, upon your application for specific financial service (loan, credit card etc.), and NOT persistently, NOT in the background, NOT in the foreground. The information collected by us is similar to the types of information captured by common web analytics tools.
Pursuant to GDPR, there must be a lawful basis for processing personal data, such as data subject’s consent, performance of a contract with a data subject, a legal obligation or the legitimate interests.
We collect your data only after we have also collected your consent either directly to us (via CredoApply) or via the financial organisation you are interacting with (CredoSDK, CredoWeb). We will NOT and cannot extract your data without your consent.
We do NOT request for your data from our customers (organisations that you have engaged with) without your consent and do NOT collect or process it without your consent. We/organisation that you have engaged with will also ask you to click on a button that says “proceed with credit analysis”, or similar, before commencing a credit scoring assessment on your mobile phone/web device.
You can be assured that we protect the information we collect. By using our products or services, you agree to the collection, use, and sharing of your data in accordance with this privacy notice. You may change and revoke your ‘access to data’ permissions at any time by using your phone/device settings.
We use your data to assess your creditworthiness for a service of your choice (loan, credit card etc.) with the organisation of your choice (our customer). Organisation of your choice may use CredoLab’s assessment as part of their decision process whether or not to grant you a loan or other financial service.
We also use your data to:
We handle all personal and sensitive user data securely, including transmitting it using modern cryptography (for example, over HTTPS). Although our mobile SDK may use some sensitive data, we use that data only to assess the application for a loan or a credit card with the organisation of your choice and not for advertising purposes.
As explained above under "What do we do", the User’s Data collected by our technology is not disclosed to any third party, except for the financial organisation to which you have applied for a financial service (our customer). We neither use the anonymous metadata for advertising purposes, nor sell your personal and/or sensitive user data. We may however provide the results of the processing of such metadata to the organisation of your choice, that receives some limited pseudonymised information about you including the result of your credit scoring assessment.
I.e., we share the result of your credit assessment with the organisation you are applying for a financial service. The result of your credit assessment that we share, depends solely on your potential willingness to disclose your information in order to get the services you have requested the organisation of your choice. We also share your potential willingness to communicate directly with the organisation of your choice, if requested by the organisation. We do NOT share the raw data collected from you with any person including the organisation.
We may also share your data in the following ways: when required by competent authority or necessary to comply with a valid legal process; when required to protect and defend the rights or property of CredoLab, including the security of our products and services; when necessary to protect the personal safety, property or other rights of the public, CredoLab or its customers or employees; or in connection with a sale of all or part of our business. If we are involved in a merger, acquisition or asset sale, we will abide by this privacy notice, and any affected users will be informed if we transfer any personal data to a third party or if personal data becomes subject to a different privacy notice as a result.
Your data maybe transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.
Our group companies, data suppliers, customers and third-party service providers operate around the world. This means that when we collect your data we may process it in any of these countries.
However, we have taken appropriate safeguards to require that your data will remain protected in accordance with this privacy notice.
These include implementing the European Commission’s Standard Contractual Clauses for transfers of data between our group companies, which require all group companies to protect data they process from the EEA and UK in accordance with European Union and UK data protection law.
Our Standard Contractual Clauses can be provided on request. We have implemented similar appropriate safeguards with our data suppliers, customers and third-party service providers and partners and further details can be provided upon request.
We retain the data we collect from you for the length of time necessary to fulfil the specific purpose or purposes for which it has been collected (for example, to provide our customers with a service you have requested or for our customers to comply with applicable legal requirements, such as anti-money laundering).We may also keep it to comply with our legal obligations, resolve any disputes and enforce our rights.
Once the respective purpose ceases to apply, we will either delete or anonymise the personal data or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your data and isolate it from any further processing until deletion is possible.
To implement and improve the functionality of CredoLab’s technology and to update the credit scorecards developed for our clients, we will keep your data for up to 3 (three) years unless you or organisation of your choice (our customer) request us to delete your data at an earlier date.
If you have questions about or need further information concerning how long we keep your data for, please contact us using the contact details provided below.
Due to how CredoLab process data, your personal data is pseudonymised, therefore we are unable to fulfil your rights directly as it is not possible for CredoLab to identify you as an individual.
To exercise any of the right outlined below, please consult with the organisation you have been interacting with. They will then be able to provide CredoLab with information to assist in exercising your rights.
As an individual, you have rights under the GDPR regarding the use of your data, these are:
You are not required to pay any charge for exercising your rights. We have one calendar month to respond to you. If CredoLab are unable to comply with your request, we will provide you with an explanation.
We appreciate that at CredoLab we may not always get things right and it is regrettable for us as an organisation when we receive a complaint. We take all complaints seriously and can assure you we will do our best to deliver a satisfactory outcome. If you do wish to complain about how your personal data is used by CredoLab then please write to us at: privacypolicy@credolab.com.
You may also contact us by mail at:
CredoLab Pte. Ltd,
#12-01 Capital Tower,
168 Robinson Road,
Singapore 068912.
CredoLab will investigate your complaint and aim to respond within 10 working days. This allows us time to investigate your complaint thoroughly.
Where you believe that CredoLab have not taken our responsibilities with your data seriously, you have the right to complain to a relevant Data Protection Authority or regulator who governs GDPR. Click here for more information.
This privacy notice relates also to the Anti-Fraud Checks services, provided by us as a reseller of the iovation Inc., a Delaware corporation (“iovation”), with a place of business at 555 SW Oak Street, Floor 3, Portland, Oregon 97204 (the “Anti-Fraud Services”), based on the OEM (Original Equipment Manufacturer) Agreement of August 19, 2019 (the “OEM Agreement”). Under the OEM Agreement CredoLab acts as an official reseller of the Anti-Fraud Services provided by iovation. “Anti-Fraud Checks” means the fraud detection and prevention solution offered by iovation Inc. to help stop online and mobile fraud in real-time using a unique device intelligence approach that leverages accurate recognition, multi-device associations, history, and detailed fraud evidence.
CCPA Privacy Policy
Credolab supplemental privacy statement for Californian consumers.
TruValidate Anti-fraud Privacy Policy
Credolab supplemental privacy statement for clients using the Anti-Fraud solution of TransUnion TruValidate.
Kebijakan Privasi
Credolab privacy statement in Bahasa language for consumers in Indonesia.
CredoLab Website Cookie Policy
Credolab privacy statements for visitors of this website.