Privacy policy

Version: PH-PRIV-2026-09-25-v3. Effective date: 25 September 2026.

1. Controller and scope

Summarum Media Oy, registered in the Finnish Trade Register since 5 May 2017, Business ID 2823017-4, EU ID FIFPRO.2823017-4, VAT ID FI28230174, operates credum.ph and app.credum.ph under the Credum brand and is responsible for its own processing of your information. Address: Saastopankinranta 10 D, 00530 Helsinki, Finland. Contact [email protected] for service, privacy or data-rights requests.

This policy covers the comparison website, application form, referrals, return visits to results and related communications. You can send a privacy request by email without using a separate application form. If further identity evidence is necessary, we will explain an appropriate secure way to provide it.

2. What Credum is

Credum is free for applicants. We compare and refer applications to participating lenders, brokers and credit marketplaces. We do not lend money, decide whether a loan is granted or guarantee approval, amount, interest, fees, term or disbursement. Receiving partners assess applications under their own privacy notices.

We receive remuneration from participating partners for referrals or outcomes. Commercial relationships and expected remuneration can affect participation and ordering alongside eligibility, availability and previous performance. We do not compare the whole Philippine market.

3. Personal data we process

The questions you see depend on the requirements of programmes relevant to your application. We do not collect every field for every applicant.

3.1 Identification and contact

We collect your first and last names, email address, mobile number and date of birth. We do not request an identification-document number, photograph or scan for this application.

3.2 Financial, employment and application data

We collect the loan amount requested in Philippine pesos and the loan term in days. We record your declarations and consent choices. We do not request a bank-account number, income, employer, vehicle or housing information in this Philippine application.

3.3 Technical, usage and security data

We process your IP address, browser information, session and application references, form progress, source of the visit and timestamps. Browser-supplied device characteristics such as screen size and time zone, campaign and click identifiers, and interactions with offers can support operation, security and measurement. Credy receives the IP address with its application request. Marketing-related processing is separate from the permissions needed to handle the application.

3.4 Results and evidence of the service

We retain application and referral records: programmes considered and consulted, eligibility results, response status, provider reference numbers, continuation links, offer interactions and partner reports confirming an outcome or commission. We also retain the time and versions of terms, privacy information and consent choices accepted in the form.

Technical copies of partner requests and responses used for troubleshooting replace identity details, contact information, document numbers, birth dates, IP addresses and credentials with redaction markers. They retain the non-identity information needed to explain what was sent and why a response occurred.

4. Data Credum does not collect in the application

Credum does not request online-banking passwords, PINs, card security codes, full payment-card numbers, bank statements or account access, document photographs, biometrics, medical records, political or religious beliefs, sexual-life information or criminal records in this application. We do not obtain a credit-bureau report directly or collect the contents of your social-media profiles. Do not send these details in a message to us.

A lender may ask for additional information on its own site. Its processing is covered by its own notice and responsibilities.

5. Where we obtain data

We receive information from you through credum.ph and app.credum.ph; from information you enter on the website and carry into the application for review; from cookies, browser information and service interactions; and from partners returning application statuses, references, offers or outcomes. If you use a compatible assistant to prepare an application, we receive the details you ask it to submit for review.

6. Necessary purposes

We use the necessary application information to:

1. create, save and securely recover an application;
2. check required fields, adulthood, format and consistency;
3. match participating programme criteria against the amount, term, age and other relevant answers;
4. avoid duplicate referrals and misuse;
5. send the fields required by the relevant programme to obtain responses;
6. display offers, checked continuation links or alternatives, and allow return to a valid result;
7. record responses, choices and outcomes for support, reconciliation, quality control and legal claims;
8. meet legal obligations and respond to competent authorities;
9. protect the security and availability of the Service; and
10. produce aggregate service-performance measures.

• To provide the service you request: prepare, save and recover your application, check required answers, match programme criteria, refer the necessary information and display responses. We process ordinary information needed for those steps to perform our agreement with you or take the steps you request before it.
• To process sensitive personal information, including date-of-birth information, and make consent-based partner disclosures: we use your express choice for the specified application purposes and recipients. Programme-specific permissions are described in section 8.
• To operate and protect Credum: prevent misuse and duplicate referrals, investigate errors, maintain security and handle complaints. We use necessary, proportionate information for our legitimate interests in running and protecting the service, except where a specific consent or other legal condition is required.
• To meet legal obligations and respond to valid authority requests, and to establish, exercise or defend legal claims.
• To reconcile referrals and commissions, record outcomes and produce service-performance statistics, using data limited to those purposes.

If you omit a required answer, we cannot complete the relevant part of the service. If a field is required only by one programme, not providing it can prevent referral to that programme rather than authorising us to invent the answer.

7. Secondary purposes and how to refuse them

We use a separate optional choice for commercial messages rather than treating an application or enquiry as blanket marketing permission. You can withdraw that choice through the unsubscribe method in the message or by writing to [email protected]. Withdrawal does not cancel a referral you have already requested.

Website measurement and campaign attribution use the technologies described in the Cookie Policy. Cookie and browser choices are separate from accepting loan-application terms. A receiving lender is responsible for explaining its own marketing and application-related communications.

8. Consent

The application records your acceptance of Credum’s Terms and the privacy information presented with the form. When we ask for consent, the accompanying information states what the data is used for and the receiving programme. We retain the affirmative choice, time and applicable document version; we do not infer it from merely opening a page.

For Credy Philippines, we record your acceptance of the terms needed to submit the application and a separate affirmative data-processing consent associated with Credy’s privacy policy. The recorded choices accompany the application; accepting Credum’s Terms alone does not substitute for Credy’s separate data-processing choice.

Optional marketing is separate. To withdraw a consent given to Credum, email [email protected] and identify the consent concerned. We stop future processing covered solely by that consent. Withdrawal does not reverse a completed disclosure or remove records we must retain on another lawful ground. A partner that already received your information handles requests concerning its own copy under its notice.

9. Automated selection and profiling

We apply automated eligibility and ordering rules using relevant answers such as amount, term and age, required programme fields, duplicate-referral history, previous outcomes and commercial performance. The result determines which participating programmes can receive the application and the order of displayed responses. It is not a credit decision by Credum.

To report an error or exercise an applicable right to an explanation or review of our matching, contact [email protected]. We respond to the extent required by applicable law. A lender is responsible for its own credit assessment.

10. Who we share data with

10.1 Lenders, brokers and networks

Our Philippine application partner is Credy Philippines. We send the fields necessary for the selected programme, not every field to every listed business. More than one programme may receive an application. The recipient page explains the data sent with each recipient and links to partner information.

Lenders and brokers assessing an application generally determine their own purposes for assessment, applicant contact, lending, fraud prevention and legal compliance. A broker can refer an application onward under its own privacy notice. Read that notice before continuing with the provider.

10.2 Processors and technical providers

Providers supporting hosting, databases, delivery and security, communications, support and measurement process information for the relevant service. These include the European infrastructure used for the application, Cloudflare delivery/security and encrypted-backup services, Google for website tag management and configured measurement, and authorised Summarum services for referral and outcome reconciliation. Access is limited to the work or purpose concerned.

10.3 Authorities and legal claims

We disclose information where required by a valid legal obligation or authority request, or where necessary to establish, exercise or defend a legal claim.

11. Domestic and international transfers

Credum’s operator is in Finland, and application hosting, support, partners and technical services can involve processing outside the Philippines. Google and Cloudflare operate international services. A partner’s own notice describes its processing and further recipients.

We remain responsible for our disclosures and use appropriate contractual and security arrangements for the processing concerned. Where the GDPR applies to a transfer outside the European Economic Area, we use the applicable transfer mechanism, such as an adequacy decision or standard contractual clauses. Consent-based disclosures are limited to the application or separate purpose explained to you. Contact [email protected] for information about recipients and safeguards relevant to your data.

12. How we protect data

Application information is stored in our service databases and protected by access controls, authenticated administration and encrypted transmission. Identity fields marked sensitive, including name, email, phone and date of birth, are encrypted at application level using authenticated encryption. Encryption keys are managed separately from the data.

Not every attribute is individually encrypted. Loan amount, requested term, calculated age and other non-identity eligibility or service attributes are kept in structured form so that the service can match programmes and reconcile results. Database, server and access controls protect these records. Backups are encrypted; their purpose is recovery rather than routine use of applicant information.

We validate submitted information, restrict abusive requests, check lender continuation links and redact identity from diagnostic records. No system is completely secure. We investigate security incidents and make notifications required by applicable law.

13. Data we convert into hashes

We create keyed hashes of normalised phone numbers and email addresses to recognise recent applications and avoid duplicate referrals without routinely exposing the original contact details. We also use internal application and attribution identifiers to connect a referral with its outcome.

Where authorised advertising measurement uses identity matching, the service can produce one-way SHA-256 values from contact or identity fields instead of sending their original text. Click identifiers and some location or technical attributes may be transmitted without hashing for the relevant measurement purpose. These values are pseudonymous, not necessarily anonymous, and remain covered by this policy. Original contact information is retained in the protected application record.

14. Cookies and local storage

The application uses the encrypted sfs_session cookie to maintain access to your application for 24 hours, renewable with activity, and smoy_arm for up to one year to maintain a consistent service variant. The website also uses attribution and form identifiers and Google Tag Manager. Some form-related cookies contain an email address or a hashed email value, as specified in the Cookie Policy.

That policy lists the relevant first-party names, purposes, durations and browser controls. Cookie expiry does not itself delete the underlying application. You can manage stored cookies through your browser controls as described in that policy.

15. Applications prepared with artificial-intelligence assistants

If you use a compatible AI assistant, its provider handles the conversation under its own policies. Credum receives the information you ask it to prepare for review. Before confirmation, the review package is encrypted and held temporarily behind a private link for at most one hour. You must review your answers, make the required choices and confirm personally before the prepared application is submitted. The assistant cannot accept terms or consent for you. Do not share a review link.

16. Retention, erasure and restriction

Our standard retention period for enquiries, applications and associated service records is two years. This includes the records needed to handle the application, evidence your choices, reconcile referrals and respond to a complaint. We delete or irreversibly anonymise personal information when the retention period ends, unless a specific legal obligation or a concrete dispute requires a limited longer period.

A legal hold applies only to the records needed for the obligation or claim, with restricted use. It does not extend every applicant’s retention period. Records held solely for that purpose are removed when they are no longer required. Non-identifying aggregate statistics may be retained.

Unconfirmed assistant review links last at most one hour; application session cookies last 24 hours with renewal and the service-variant cookie lasts up to one year. These browser or temporary-state periods are distinct from the two-year application period. Independent partners retain their copies according to their own notices.

17. Privacy rights, withdrawal and restriction

Write to [email protected] with the subject “Privacy request”, your name and reply address, the information or interaction concerned, and what you want us to do. You may ask for access or a copy, correction, deletion or blocking, object to processing, withdraw consent and request portability where it applies. Include the correction sought when asking us to rectify an answer.

We may ask for proportionate evidence of identity or authority before releasing another person’s information. Do not email a full identity-document number or document photograph unless we arrange a necessary secure method. We explain any legal reason that prevents us from fully complying and handle requests within the applicable legal time limits.

You may complain to the National Privacy Commission. Processing by our Finnish-established operator may also be subject to GDPR rights; you may approach a competent European supervisory authority, including the Finnish Data Protection Ombudsman, where relevant. Our rights page explains how to contact us.

18. Minors

The Service is for adults aged 18 or over. Do not submit a child’s information. If you believe a child’s information has been submitted, contact [email protected] so we can prevent further referral and address the record under the applicable requirements.

19. Changes to this policy

We publish the current version and date at this URL. Material changes are communicated before applying where required, and we ask for a new choice where a new purpose or disclosure requires it. Updating this page does not retrospectively expand a consent you previously gave.

20. Consent for transfers requiring authorisation

When you request an application referral and confirm the relevant sharing choices, you authorise us to disclose the necessary personal information to the lenders, brokers or networks identified for processing that application. This includes the identity and financial application fields needed for the selected programme. The form’s affirmative choices and their recorded versions evidence that permission. Optional marketing and unrelated disclosures are not included merely because you request a loan comparison.