We collect your personal and business information through various interactions such as, but not limited to the following:

• When visiting and/or transacting at our stores/offices;
• When interacting with our employees, authorized representatives, agents and service providers;
• When inquiring about, applying for and availing of our products or services;
• When filling out the Bank’s application forms or other forms related to our products and services;
• When using the services of our digital and electronic banking and communication channels, such as, but not limited to, online and mobile banking, ATM banking, automated phone system, social media pages, messaging services among other technology platforms;
• When browsing or using our website for your inquiries and other concerns;
• When participating in any surveys, market research, studies and the like;
• When recording your voice and video conversations with us;
• When capturing your images via CCTV and other similar recording devices when visiting our stores or offices and/or when using our ATMs or other facilities;
• When interacting with our third-party service providers, accredited merchants and utility companies

We may collect personal and business information and data, such as, but not limited to the following:

• Your name and other particulars such as contact details, addresses, birthdate, business founding date, education
• Specimen signature
• Government-issued IDs and ID details (such as TIN, SSS, GSIS, Driver's license, Passport, etc.)
• Privately-issued IDs and ID details (such as company/employment ID, school ID, etc.)
• Business documents (such as certifications, license, registration documents etc.)
• Financial information (such as income, expenses, deposits, investments, credit cards, tax, insurance, financial and transaction history, relationships with other banks and/or financial institutions, business interests and assets, and the like)
• Employment details
• Voice and video recordings of our conversations with you
• Images captured via CCTV and other similar recording devices which may be observed when visiting our stores or offices and/or when using our ATMs or other facilities
• Information provided to our third-party service providers, accredited merchants and utility companies

When necessary, we may ask our third-party service provider or the Bank, its subsidiaries or affiliates, to directly verify with you the supplied information or request you to provide additional information in order to comply with the requirements of regulators, supervisory or administrative bodies of the government, tax authorities, or to comply with the order of courts of competent jurisdiction. When you access our website or use any of our electronic banking and communication platforms, we collect non-personal information such as those provided by the device you are using (e.g. your phone) which may include the IP address, operating system, type and version of browser and other machine-related identifiers.

We use the information collected to:

• Process, evaluate, facilitate and administer applications for our products and services, and transactions;
• Perform due diligence, including background investigation, credit investigation to verify your financial capacity, credit worthiness and the like;
• Provide you with information about our products or services;
• Manage your account and facilitate your transactions;
• Respond to your inquiries, requests, feedback and other concerns, and use these information to further improve our products and services;
• Communicate with you, by sending out welcome letters, statements, notifications, advisories, alerts, and other forms of communication, whether written or using electronic or digital platform, necessary for continued use of our products and services;
• Provide you information on our products and services, marketing and sales offers, promotions, rewards, other features and benefits, and information about third parties which we think you may find interesting, through personalized customer touchpoints like our stores, call center, telemarketing, direct mail, e-mail, messaging, and other channels;
• Perform customer profiling, behavioral and transactional analyses, to understand customer needs, preferences and market trends, improve and offer suitable products and services, and enhance customer relationship;
• Conduct surveys, market research, studies and the like to review, evaluate, develop, and improve our products, services, policies and processes;
• Evaluate the effectiveness of marketing and sales programs and offers;
• Establish safeguards to identify, investigate and protect you from any unlawful activity, actual or suspected fraud or threats to our systems;
• Manage the Bank's operations, business continuity planning, and safety and security;
• Comply with the Bank’s obligations under the law and as required by government organizations such as, but not limited to, BSP and AMLC, SEC, NPC, BIR, DOLE, HDMF, PhilHealth, SSS, as well as those of other jurisdictions including the United States Foreign Account Tax Compliance Act (FATCA);
• Establish, exercise and defend the Bank's legal rights;
• Comply with legal and regulatory requirements, such as data submission to credit bureaus, credit information companies, the Credit Information Corporation (CIC), and responding to court orders and other instructions and requests from any local or foreign authorities including regulatory, governmental, tax and law enforcement authorities or other similar authorities;
• Comply with the requirements of audit and privacy assessments/reviews;
• Comply with the required reporting disclosures under applicable laws and regulations; and
• Perform such other activities allowed by law or with your consent.

We take reasonable steps to enforce our privacy policy within the Bank and make sure that the personal and business information we collect shall be kept strictly confidential. However, in order to provide you with products and services suitable to your needs, with your prior consent, we may share your information with:

• various units, offices and stores of the Bank
• subsidiaries, affiliates, and companies of the EastWest Banking Corporation
• authorized/accredited agents, representatives and third-party service providers
• banking associations, merchants, and partners
• banks and financial institutions, credit agencies
• regulatory and government agencies as required or authorized by law

Your personal and business data may be transferred, stored or processed outside the Philippines by any of the parties above. We ensure that the cross-border arrangement complies with the requirements of the Data Privacy Act and shall use means to provide a comparable level of protection while the information is being processed by above said parties.

We will not sell, distribute or lease your personal and business information to third-parties unless we have your permission or are required by law to do so. Please refer to Annex A for the list of regulatory agencies/credit agencies to which we share your personal information with.

We are committed to ensuring that your information is secure. In order to prevent unauthorized access or disclosure, we have put in place suitable physical, electronic and operational procedures to safeguard and secure the information we collect.

• We keep and protect your personal and business data using a secured server behind a firewall, deploying encryption on computing devices and employing physical security controls.
• We restrict access to your personal and business data only to qualified and authorized personnel who hold your personal and business data with strict confidentiality.
• We are especially careful in our communications with minors and will not directly collect data from minors without the parents’ or guardian’s consent.

While the Bank is committed in protecting the security of your data, it is important for you to protect your account against unauthorized access by using a unique password and maintaining the security of your personal and business/corporate financial information by not sharing your password with anyone and by signing off when you have finished your digital and electronic banking transactions especially when using a shared computer. Our website may contain links to other websites of interest or other websites operated by third parties. The Bank does not have control over these links and does not endorse or approve of the operators or the information, graphics and material on those websites. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites. As such, sites are not governed by this Data Privacy Statement, it is important that you exercise caution and check into their own privacy statement. We use traffic log cookies to identify which pages are being used and use this information for statistical analysis. This helps us analyze data about web page traffic and improve our website to tailor it to customer needs and thereafter the data is removed from the system. A cookie is a small piece of information which a website stores on your web browser on your PC. A cookie is stored temporarily when you "Sign In" and is automatically destroyed when you close your browser. Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie does not give us access to your computer or any information about you other than the data you choose to share with us. You can choose to accept or decline cookies. If you choose to accept cookies, you will be able to take advantage of all the features of our website. Non-identifiable web traffic data for the collection of technical information from devices that you use may include:

• Your internet protocol (IP) address
• The search terms you used
• The pages and internal links accessed on our site
• Demographics
• The date and time you visited the site, including frequency of visits
• Geolocation
• Your operating system; and
• Web browser type

The Bank reserves the right to retain your personal and/or business information for as long as necessary for the fulfillment of the purposes for which the information was obtained or for the establishment, exercise or defense of legal claims or for legitimate purposes or as provided by law until such time that the information is no longer required nor necessary to keep to comply with legal, regulatory or internal requirements.

The Bank respects your right to privacy under the Data Privacy Act as follows:

• The right to be informed on the personal and/or business information that we collect and how it will be processed
• The right to object to the processing of your personal and/or business information including processing for direct marketing, automated processing or profiling and to withhold consent to the processing in case of changes or any amendment to the information supplied or declared
• The right to access or demand access to your personal and/or business information
• The right to rectification and to dispute any inaccuracy or error in your personal and/or business information
• The right to suspend, withdraw, order the blocking, removal or destruction of your information from the Bank’s system
• The right to damages and to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal and/or business information, taking into account any violation of your rights and freedom
• The right to portability, to obtain a copy of such information in an electronic or structured format that is commonly used
• The right to lodge a complaint before the National Privacy Commission