Data Privacy Statement

Privacy Practices

Bank of Makati (A Savings Bank), Inc. is committed to keep your personal and account information safe when you avail our products and services. We are totally committed in complying with Data Privacy Act of 2012 (R.A. No. 10173) and its implementing rules and regulations.

It is our policy to respect and uphold your data privacy rights, and we ensure that all personal data collected are processed pursuant to the general principles of transparency, legitimate purpose, and proportionality as stated in the Data Privacy Act of 2012.

Additional details of our practices relating to data privacy are provided in our privacy notices posted within our premises.

Our Products and Services

What Personal Data We Collect from You

Name, address, picture, contact information, email address, signature, civil status, nationality, birth date, birthplace, SSS/GSIS number, TIN, educational background, social media accounts, employment details, and financial records(bank accounts and loans).

How We Collect Your Personal Data

If you avail of our products and services, we have forms to be filled up depending on the products and services you wish to avail.

If you wish to avail of deposits, you are required to fill up our “Customer Information Form”. If you wish to avail of our loan products, you are required to fill up our “Business Loan Application Form”, Credit Application Form for Housing Loan”, “Credit Application Form for Consumer Loan”, and “Credit Application Form for Microfinance Loans”.

In the process of your application, we also collect information through credit investigation and background investigation.

Our premises is protected by Close-circuit television (CCTV) hence, any information collected through CCTV are processed accordingly and with confidentiality. Our security personnel may likewise ask you to fill-up our visitors log sheet in which you will provide your name, contact number, company, purpose of visit and show identification document when you visit any of our office.

Purpose of Collecting Your Personal Data

• To process your accounts if you apply for loan and/or open deposit accounts with us;
• To collect data for KYC purposes as required by the Bangko Sentral ng Pilipinas;
• To disclose information as required under the law (BSP, NPC, AMLC, etc);
• To share with our third-party service provider such as collection agency; and
• To ensure safety and security.

How We Use Your Personal Information

We use personal data collected to:

• Deliver and provide the products and services that you avail, such as to process applications and transactionsfor loans and deposits, respond to queries, requests and complaints and to improve how we interact with you;
• Send you statements, billings, notices and other such documents necessary for continued use of our products andservices;
• Conduct studies and researches to develop new products or to improve our existing products and services;
• Perform profile analysis, modeling and analytics to better understand needs, preferences and market trends forthe development of more suitable products and services;
• Reach out to you regarding products and services information, including offers, promotions, discounts, rewards;
• Know your experience with us thru our various touchpoints such as branches, call center, telemarketing, email,messaging and other channels;
• Determine the effectiveness and sufficiency of our marketing efforts and initiatives;
• Provide location-based services such as finding the nearest ATM or branch to you, as well as extending out ourother services to you;
• Perform certain protective safeguards against improper use or abuse of our products and services including fraudprevention;
• Comply with our operational, audit, administrative, credit and risk management processes, policies and procedures, the terms and conditions governing our products, services, facilities and channels, the Bangko Sentral ng Pilipinas rules and regulations, legal and regulatory requirements of government regulators, judicial, supervisory bodies, tax authorities or courts of competent jurisdiction, as the same may be amended or supplemented from time to time
• Comply with applicable laws of the Philippines and those of other jurisdictions to which the Bank has legal or contractual obligation to comply, the laws on the prevention of money laundering, terrorist financing and proliferation financing such as the provisions of Republic Act No. 9160(Anti-Money Laundering Act of 2001), as amended, and the implementation of know-your- customer and sanction screening checks;
• Comply with legal and regulatory requirements such as submission of data to credit bureaus, credit informationcompanies, the Credit Information Corporation (CIC) (pursuant to RA No. 9510 and its implementing rules and regulations), responding to court orders and other instructions and requestsfrom any local or foreign authorities including regulatory, governmental, tax and law enforcement authorities or other similar authorities, and
• Perform other activities permitted by law or with your consent.

How Long Do We Keep Your Personal Data

Personal data will not be retained by the Bank longer than necessary. The minimum retention period is five (5) yearsbecause we adhere to the applicable laws and regulations, such as BSP Circular No. 720 and Republic Act No. 9160(Anti-Money Laundering Act of 2001), as amended.

How We Store Your Personal Data

It is our practice that all documents must be inventoried and classified according to the Bank’s protection of therecords and information security classification. We determine the storage requirements of every document either storedin permanent vault or in a non-fire resistant cabinet in a fire-rated environment, whichever is necessary.

We also determine our records that should remain in the respective department and those records that will be forwarded to ourwarehouse for safekeeping.

How We Dispose Your Personal Data

Any records that have passed the useful life and no longer have any legal need to be retained must be safely andsystematically disposed. The Bank’s Records Management Unit (RMU) prompts the concerned department’s records managementofficer (RMO) on the files due for destruction.

Methods of Destruction:

1. Paper
   • Shredding
   • Pulping
2. Electronic records
   • Hard drives should be re-formatted when computers are disposed;
   • Deleted emails from inboxes, sent items and deleted items boxes, records may still be accessible onback-up servers;
   • Magnetic media such as magnetic tape, other computer storage mechanisms should be subjected to the forceof a strong magnetic field; and
   • Other machine-readable devices can be cut or shredded

Your Rights as Data Subjects

• Right to Be Informed: You have the right to be informed as stated under the Data Privacy Act of2012. In connection with this, we have this privacy statement posted at our website and privacy notices postedin every branch of the Bank;
• Right to Access: You have the right to access your personal data disclosed to us by reachingout to our Customer Experience Management Department through this e-mail addressmalalapitan.kaibigan@bankofmakati.com.ph in accordance with procedure prescribed by the Bank;
• Right to Object: You have the right to object if we process your personal data without lawful basis enumerated under Sections 12 and 13 of the Data Privacy Act of 2012;
• Right to Erase or Block: You have the right to request the erasure or blocking of personal information if we process your personal data without lawful basis under Sections 12 and 13 of the Data Privacy Act of 2012;
• Right to Correct or Rectify: You have the right to request correction of wrong personal information in our possession and we reserve the right to request proof or evidence to verify the correctness of your information;
• Right to File a Complaint and Right to Damages: If after you have raised a concern with us and we failed to address your concern, you have the right to file a complaint with the National Privacy Commission through their website privacy.gov.ph. If warranted, we will indemnify subject to what is due and ordered by the National Privacy Commission;
• In case your rights under the Data Privacy Act of 2012 are violated, you may send us an email through our privacy concern email address privacyconcern@bankofmakati.com.ph, and give us a chance to correct the possible violation.

How We Protect Your Personal Information

Our technology and information security framework, which undergoes continuous assessment to improve in securing your privacy, shall prevent unauthorized access to your information.

Our oversight risk management department, monitors the risk appetite of the Bank to ensure that we are in compliance with the regulators and does not violate the rights of clients.

Contact Our Data Protection Officer (DPO)

For any privacy concern, you may reach our Data Protection Officer through the following means:

Email: privacyconcern@bankofmakati.com.ph
Contact No: 8889-0000 loc. 1113 or 1601 09255-256683
Address: The Data Protection Officer – Bank of Makati (A Savings Bank), Inc. Bank of Makati Bldg. Ayala Ave Extension near cor Metropolitan Ave, Brgy. Bel-air, Makati City