DATA PRIVACY POLICY

ORIX METRO GROUP PRIVACY POLICY

The ORIX METRO Group (ORIX METRO) is committed to protect the privacy rights of individuals pursuant to the provisions of the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR) in addition to its duties and responsibilities under the Bank Secrecy Law (R.A. No. 1405) and the confidentiality provisions of other related laws, regulatory rules and regulations.

TRANSPARENCY, LEGITIMATE PURPOSE AND PROPORTIONALITY

ORIX METRO is guided by the basic principles of DPA. We shall ensure that our clients and employees are aware of the nature, purpose and extent of processing of personal data. We shall keep your data private and confidential and shall only use them with your consent and only for purposes of fulfilling any agreement we may have entered with you. Only authorized personnel, including accredited third party providers/partners, will have access to your information. We shall not require data from you that will not be useful in the execution of our engagement.

In line with this, please see below information and use of the data for transactions that you may have with us:

TRANSACTION	INFORMATION COLLECTED	PURPOSE
Inquiry about our products and services	Personal details	To be able to contact and communicate with you
Availment of products and services	Personal details and sensitive personal information	To be able to communicate with you, to be able to assess your capacity to avail of the products and services and for validation of information
Enter into an agreement with us	Personal data and sensitive personal information	To be able to communicate with you, to be able to assess your capacity to avail of the products and services and for validation of information
Apply for a job	Personal data and sensitive personal information	To be able to communicate with you, for background checking, for records keeping and providing employee benefits
Provide us feedback	Personal data and sensitive personal information	To be able to communicate with you, investigate and work with you to resolve your concerns

We shall retain and store your personal data as long as you have an existing agreement with the ORIX METRO, or up to five (5) years from the date of closure of your account should the said agreement end or is pre-terminated, or until the final closure and termination of a case should your account be subject to any dispute but not limited to the requirements of the Anti-Money Laundering Act, as amended, and its IRR. Upon the end of the retention period, the documents containing the said information shall be destroyed or returned to you, at your option.

SECURITY MEASURES

ORIX METRO shall implement reasonable and appropriate organizational, physical and technical measures for the protection of your personal data. We aim to maintain the availability, integrity and confidentiality of personal data and protect them against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.

For any data breach, we shall notify our clients, customers or employees within 48 hours from identification and confirmation of the breach.

YOUR RIGHTS AS THE DATA SUBJECT

We, as a company, endeavor to uphold your rights as stated in the DPA. These include:

RIGHTS	WHAT DOES THIS MEAN
Right to be Informed	You have the right to know why, how and until when we will use your personal information.
Right to Access	You have the right to check and view your personal data being processed by our company.
Right to Object	You have the right to withhold consent and refuse processing of your personal data unless processing is required for legal obligation or necessary to perform a contract or agreement.
Right to Erasure or Blocking	You have the right to suspend or withdraw consent for processing or request removal of personal information if there is no need for it based on existing agreement with our company.
Right to Damages and File a Complaint	You have the right to be indemnified for damages that may be sustained for unauthorized processing of your personal data. You have the right to file a complaint if you have any concerns regarding the processing of your personal data.
Right to Rectification	You have the right to dispute any error on your personal data and have us correct it our database.
Right to Data Portability	You have the right to request for your electronically processed data from us for your own use.

For any data issues, concerns or requests, you may directly contact our Data Protection Officer as follows:

Data Protection Officer
24th Floor, GT Tower International
6831 Ayala Avenue cor. H.V. Dela Costa Street
Makati City 1227
Direct line: +63 2 8856-4351
Email address: dataprotection@orix.com.ph

NOTE: Due to the fast changing trends in technology, we may update this Privacy Policy from time to time. Any change shall become effective when we post the revised policy on our website.

Please see NPC Seal of Registration of OMLF, ORC, and OIA :

NPC Public Advisory: