BPI Direct BanKo Data Privacy Statement

BPI Direct BanKo Inc. (“Banko”) is committed to protecting your personal and account information. We adhere to strict confidentiality standards and comply with applicable regulations. Any information you provide with the Bank will not be disclosed to any person or entity without your express consent , unless disclosure is required by the law.

BPI Direct BanKo Data Privacy Statement

Our privacy policy values and protects your personal information under the Republic Act No. 10173, known as the Data Privacy Act of 2012 and the laws of the Philippines. Personal information refers to any information or data that can be used to identify or contact an individual

This Privacy Policy explains how we collect, use, protect, and share your information when you access our websites, and/or apply for and avail of any of our products and services. In addition to this policy, the coverage of privacy practices for our customers who apply for and obtain products and services from us, including, but not limited to deposits, loans and such other products and services that the Bank may offer from time to time.

BPI Direct BanKo Data Privacy Practices

The data privacy practices described in this Statement are intended for individuals in the Philippines that are designed to comply with the Data Privacy Act of 2012 (R.A.10173) ,its implementing rules, circulars, including all other applicable obligations and regulatory requirements, or as may be reasonably necessary to enable us to conduct our banking and other business interests.

When accessing our corporate website and/or availing our products and services, you acknowledge and agree that your information may be transferred to and be processed in the Philippines in accordance with applicable legal and regulatory standards for data protection.

What we may collect from you

When you apply or avail of any product or service that BPI Direct BanKo offers or when you interact with our employees, authorized representatives, agents or perspective employee, we collect your personal information. Theses may include, among others:

• personal information such as your name, birthdate, gender, nationality, address, contact details, marital status;
• Specimen signatures;
• employment details;
• Assets and business details;
• Government ID details;
• Images via CCTV and other similar recording devices and processes which may be observed when visiting our offices and/or using our other facilities and voice recordings of our conversations with you; and
• Account transactions, movements, and interactions with third parties such as merchants (e.g., utility companies, etc.)

We may, as and when necessary, in connection with our promotion or provision of services or products to you, seek to verify the foregoing information with third-party entities or publicly available sources including (but not limited to) social media networks/ platforms, government regulators, judicial, supervisory bodies, tax authorities or courts of competent jurisdiction and, in the process, gain additional information about you.

In the course of availing our products and services, we also collect information about your transactions and dealings which include your account activities, movements and interactions with third parties such as merchants and utility companies.

When you access our websites, we may provide information about the Bank as well as information regarding our products and services. In the course of using our network of websites and electronic platform, we may collect non- personal information such as those provided by your device which may include the IP address, operating system, browser type and version, and other machine identifiers. We may track your location if you use our location-based content such as branch or ATM locators. We may likewise use web analytics tools, including those of third parties, which use cookies to collect anonymous information and data generated in connection with your activities when you visit the pages and our websites.

To help us improve our services and products , we may also collect, use, process, analyze and keep your personal information and opinions or comments made known to us via feedback or responses to surveys or any other interaction that you had with our employees, authorized representatives, agents and service providers.

How we use your information

We use the information collected to deliver and provide the products and services that you have availed to:

• fulfillment, delivery, support, and maintenance of BPI Direct BanKo facilities, products and services;
• approve, facilitate, administer and process applications and transactions;
• respond to queries, requests and complaints and improve how we interact with you;
• communicate with you including the sending of statements and/or billings, administrative communications about any account you may have with us or about future changes to this privacy statement;
• design new or enhance existing products and services provided by the Bank;
• perform demographic and behavioral analysis to understand market’s needs, wants and trends to be able to improve and recommend suitable products and services;
• personalize the appearance of our websites and include location-based services such as finding the nearest ATMs or branches;
• pcommunicate with you regarding the Bank’s products and services information, including offers, promotions, discounts, rewards; advisories and to personalize your experience with our various touch points such as, but not limited to, branches, ATM, other bank channels, telemarketing, e-mail, SMS, messaging services/apps and social media platforms/networks/apps and other marketing channels;
• perform certain protective safeguards against improper use or abuse of our products and services including fraud prevention;
• comply with our operational, audit, administrative, credit risk management processes, policies and procedures, the terms and conditions governing our products, service facilities and channels, BPI Direct BanKo rules and regulations, legal and regulatory requirements of government regulators, judicial, supervisory bodies, tax authorities or courts of competent jurisdiction, as the same may be amended or supplemented from time to time;
• to utilize data analytics that will help the organization improve and develop customer experiences and assistance;
• comply with applicable laws of Philippines and those of other jurisdictions including the United States Foreign Account Tax Compliance Act (FATCA), the laws on the prevention of money laundering including the provisions of Republic Act No. 9160 (Anti-Money Laundering Act of 2001 (AMLA), as amended and the implementation of know your customer and sanction screening checks;
• comply with legal and regulatory requirements such as submission of data to credit bureaus, credit information companies, the Credit Information Corporation (CIC) (pursuant to RA No. 9510 and its implementing rules and regulations) responding to court orders and other instructions and requests from any local or foreign authorities including regulatory, governmental, tax and law enforcement authorities or other similar authorities;
• background checks through character reference verification; and
• perform such other activities permitted by the law or with your consent.

Further, if you are, become, or apply to become a client of any of our affiliates or parent bank, BPI Direct BanKo and the parent bank and/or affiliate/s concerned has the option, but not the obligation to, rely upon, use, and share your relevant personal and/or account information for any of the following purposes:

• to facilitate your account opening or application with the concerned Parent or affiliate/s;
• to validate, consolidate or update your customer information records and/or credit history;
• to provide consolidated billings, depositor investment summaries or other reports as you may request;
• to send you advisories, reminders, announcements, promotions, offers, invitations and other notifications;
• for research purposes or to design banking, financial, securities and investment or other related products or services for your use, as well as to improve customer experience and assistance;
• additional background checks through character reference verification; and
• to comply with a legal obligation to which BPI Direct BanKo or the concerned parent bank or affiliate/s is subject.

We may transfer, store, and/or process your personal data outside the Philippines (i.e. entering into a cloud-based system) pursuant to any business purpose that you have authorized or due to a legal obligation and mutual agreements with other jurisdictions in light of relevant laws and jurisprudence. In doing so, we will comply with the Data Privacy Act of 2012 and its implementing rules and regulations.

How we use your information

We may share your personal information with our parent bank, affiliates and third parties, under an obligation of confidentiality.

• We may share personal information with various units within BPI Direct BanKo in order to better understand the way you use our products and services. This will allow us to improve our services and offer you opportunities to obtain such other useful products and services that may deliver greater value to you.
• We may share information with our parent bank and affiliates to likewise offer you additional products and services that we believe you might find interesting.
• We may share with outsourced service providers and perspective outsourced service providers that we engaged to support us in promoting or delivering our services or products to you. These may involve anonymous or aggregated information to help improve our products, services, and content.
• We may also engage third parties to help us operate our business. These include support in:
  
  • verifying your personal information
  • assisting in business operations
  • complying with legal requirements such as court orders;
  • enforcing our terms of use including, among others, our rights as creditor to customers availing of our loan or credit products, or such other applicable policies with respect to the services that we provide;
  • addressing fraud, security or technical issues, to respond to an emergency or otherwise to protect the rights property or security of our customers or third parties; and
  • carrying out all other purposes set out above.

We wish to assure you that we do not, and will not, sell personal data to any third parties. All our engagements with third parties shall be fully compliant with our obligation of confidentiality imposed on us under the applicable agreements and/or terms and conditions or any other applicable laws that govern our relationship with you.

How we use your information

With BPI Direct BanKo, we prioritize the confidentiality, integrity and security of your personal information. We strictly enforce our privacy policy across all operations and have implemented robust physical, technological and procedural safeguards to protect your information from unauthorized access, use, alteration and disclosure. When partnering with third-party service providers, we require them to uphold our stringent data protection standards, ensuring your personal information is safeguarded with the same level of security we apply within our organization.

We fully recognize the value of your personal information particularly as it may include sensitive personal information such as your name, contact numbers, government-issued IDs, etc. Appropriately, we strive to maintain the confidentiality, integrity and availability of your personal information by employing physical, technological and procedural safeguards, such as but not limited to, protecting your personal data using a secured server behind a firewall, deploying encryption on computing devices, and physical security controls. We likewise restrict access to your personal data only to qualified and authorized personnel who hold your personal data with strict confidentiality. We train our employees to properly handle your information.

How long do we keep your information

Your personal information shall only be retained for as long as necessary:

• for the fulfillment of the declared, specified, and legitimate purpose, or when the processing relevant to the purpose has been terminated;
• for the establishment, exercise or defense of legal claims; or
• for legitimate business purposes, which must be consistent with standards followed by the applicable industry or approved by appropriate government agency.

Retention of your personal data shall be up to its intended purposes only, taking into consideration the retention period of documents as mandated by laws, the Bangko Sentral ng Pilipinas (BSP), the Bureau of Internal Revenue (BIR) and other regulatory agencies. After cessation of legal, regulatory, or business purposes, we retain your personal information for at least five (5) years or pursuant to applicable laws and regulations (such as but not limited to banking laws, AML law, statutes of limitations, the DPA, and its IRR, among others).

How do we dispose your information

Your personal data shall be disposed of in a secure manner by overwriting, degaussing, &/or shredding any personal information that is deemed no longer necessary or no longer serves the purposes stated in this Privacy Policy. In all instances, our manner of disposal shall ensure that the personal information shall no longer be retrieved, processed, or accessed by unauthorized persons.

You Have Rights

• Access, update, or delete your data
• Limit or object to processing
• Withdraw marketing consent
• Request data transfer

BPI Direct BanKo is committed to ensuring that you are fully aware of your data protection rights under the Data Privacy Act of 2012. As a data subject, you are entitled to the following:

• The right to access – Subject to the applicable service fee, you have the right to request copies of your personal data from BPI Direct BanKo.
• The right to rectification – You have the right to request correction of any information you believe is inaccurate. Likewise, you also have the right to update and provide additional information if you believe that the personal information we have about you is incomplete.
• The right to erasure – You have the right to request the erasure or deletion of your personal data under certain conditions. However, this may affect the way we provide products and services to you
• The right to restrict processing – You have the right to restrict the processing of your personal data under certain conditions.
• The right to restrict processing – You have the right to restrict the processing of your personal data under certain conditions.
• The right to data portability – You have the right to request the transfer of your personal data that we have collected to another organization or directly to you under certain conditions.

Additionally, you have also certain rights, which includes:

• the right not to receive marketing promotions;
• the right not to share your information with our subsidiaries and affiliates or with other companies that we have business with, provided that such information is not critical nor required by applicable laws and regulations in maintaining the services that you have availed with us;
• the right to provide you with information that we currently have about you subject to restrictions applied to us as a bank and a company operating in the Philippines by certain laws and regulations; and
• the right to update your information.

How to Contact Us

For any queries, clarifications or requests on any aspect of this Statement, the exercise of your rights pertaining to your personal information or to provide any feedback that you may have about our processing of personal information, please visit any of our branches or get in touch with our Contact Center at 99999-00 LSB(572) or (052)732-3002 local 82600 and e- mail us at [email protected]

You may also write to our Data Privacy Officer at:

DATA PRIVACY OFFICER
BPI Direct BanKo, Inc.
220 Ortigas Avenue, BanKo Center, North
Greenhills, San Juan City, Philippines
[email protected]

For complete reference on the Republic Act No. 10173 or the Data Privacy Act of 2012, you may access the National Privacy Commission Website at https://privacy.gov.ph.

Changes to Our Data Privacy Statement

We may modify or amend this Data Privacy Statement from time to time to comply with relevant laws and regulations applicable to us or how we process, obtain, collect, record, organize, store, update, modify, use, access, protect, and share your personal information. Any relevant updates will be posted on the BPI Direct BanKo corporate website.

Definition of Terms

Personal Information – refers to any information whether recorded in a material form or not from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

Websites - corporate website, social media pages and online banking facilities.

Sensitive Personal Information/Data - refers to personal information:

• About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
• About an individual's health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
• Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
• Specifically established by an executive order or an act of Congress to be kept classified.