Data Privacy Statement

We collect information about you, your transactions, your use of our products and services, and your relationships with Bank of the Philippine Islands (“BPI”) and all its subsidiaries or affiliates (“BPI Group of Companies”) when you apply for or avail of any product or service that our bank offers or when you interact with our employees.

These may include personal information (e.g., name, date of birth, residential address, history of residence, contact details, financial information, family information, and employment details) that come from:

• Customer Information Sheet (CIS) that you filled out and supporting documents (e.g., passport, visa, proof of address, etc.) that you provided, including information about payments you make or receive such as the date, amount, currency, details of the payee or payer, proof of source of funds, and purpose of transaction and accounts you hold with other providers; and
• Your interaction with us through e-mails, customer surveys, post, social media, and the way you use your account(s) such as your use of our bank premises (e.g., CCTV recordings), telephone facility (voice recordings), or online banking.

These may also include information you give us about other people (e.g., dependents, providers, employers or joint account holders) that we will use to provide services or, upon your request, to share it with third parties. In such cases, you need to confirm that you have gotten their permission or that you are authorised to give us these information.

We usually collect your information from you, but we may also collect them from third parties where we have a lawful basis to do so. These organisations may be -

• Credit reference agencies;
• Fraud prevention agencies;
• Other financial services companies;
• Government and law enforcement agencies; and
• Public information sources (e.g., country court judgements and electoral registers).

The information that you have provided or that we have collected from other sources is used to provide our products and services to you and to manage your account(s) for legitimate business purposes and in compliance with regulatory requirements.

We may use your information specifically to -

• Consider your application with us, including verifying your identity and that of your spouse/partner/provider or employer;
• Manage our relationship with you and operate your account(s), including updating your records with us;
• Improve our products and services to our customers;
• Carry out checks to fulfil our regulatory obligations and comply with any subsequent applicable laws;
• Detect and prevent financial crime and debt recovery including tracing;
• Protect ourselves against harm to our rights and property interests;
• Manage our internal operational requirements including audit and compliance, credit, risk management, and training; and
• Communicate with you about our products and services.

As a subsidiary of BPI, we may have to share your relevant personal and/or account information to the BPI Group of Companies, as part of the services and technological support provided to us, for any of the following purposes:

• To validate, consolidate, or update your customer information records and/or credit history; and
• To comply with a legal obligation to which BPI or the concerned subsidiary/ies or affiliate/s is subject to.

We have obtained your explicit consent and have the following lawful basis for collecting, processing, and using your information:

• To allow us to perform contractual obligations such as when we process your transactions and provide the banking services you need;
• To allow us to meet our regulatory and legal obligations such as when we obtain and use your identification details to combat financial crime; and
• To protect our legitimate interests such as when we verify your identity in order to protect our customers and our business.

If BPI Europe asks for your consent or permission to process your personal data, you can refuse, or withdraw your permission at any time by reaching out to us through our contact channels.

We may use systems to make automated decisions about you to ensure our decision-making is efficient, fair, and correct. These systems rely on information collected about you to arrive at a decision. These decisions may affect the products, services, or features we offer to you or allow you to avail.

• Account opening - When you apply to open an account with us, we may use automated systems to check that you meet our established conditions to open an account.
• Risk management - When you maintain a business relationship with us, we may use automated systems to continuously monitor your risk profile such as when we monitor your account for unusual activities related to fraud and other financial crimes.

These automated decisions may mean rejection of an account opening application or closure of an existing account.

You can object to an automated decision we have made and ask that another person reviews it.

We will keep the information we hold about you secure and confidential.  We may, however, have to share, transfer, or disclose your information to the following when we use it for the purposes discussed earlier:

• BPI Group of Companies and anybody who provides services to them or their agents, in which case information may be shared outside the UK;
• Our service providers and agents (including sub-contractors) for providing services to us such as updating your records, storing your data, processing your payments, and carrying out actions to comply with regulatory and legal requirements;
• Authorised financial institutions, trade associations, and credit and debt recovery agencies and agents;
• Law enforcement and fraud prevention agencies;
• Government bodies and agencies in the UK and overseas (e.g., HM Revenue & Customs who may in turn share it with relevant overseas tax authorities, and with regulators such as the Prudential Regulation Authority, the Financial Conduct Authority, Financial Services Compensation Scheme, and the Information Commissioner’s Office);
• Courts to comply with legal requirements and for the administration of justice;
• Persons acting on your behalf, payment recipients (e.g., utility companies when they need to apply the payment to you), beneficiaries, account nominees, intermediary, correspondent and agent banks, clearing houses, and clearing or settlement systems;
• Anyone else when you have requested and consented to do so; and
• Anyone to whom we transfer or may transfer our rights and duties in this agreement.

Outside the United Kingdom and European Economic Area

We store, share, or transfer your personal data with the parties mentioned earlier for the purposes described in this Privacy Statement. This may involve storing, sharing, and transferring your personal data across borders to other jurisdictions.

Where recipients are in jurisdictions outside the UK, and local laws may not have similar data protection laws as the UK, we will take all reasonable steps necessary to ensure that your personal data has an appropriate level of protection to comply with applicable laws. These may include imposing contractual obligations of adequacy or requiring the recipient to comply or be certified with an “international framework” of data protection.

You likewise consent to having your information transferred by us, or others processing on our behalf or their agents, to authorities in other countries if the disclosure is required by UK law and that of those countries.

Fraud prevention and immigration agencies

The personal information we have collected directly from you when you applied or at any stage will be shared with fraud prevention agencies that will use it to verify your identity and your right to stay in the UK, and to prevent financial crime. If fraud is detected, you could be refused certain services, financing, or employment in the future. In case of questions on your right to stay, we will refuse your application and we will have to submit your personal information to the Home Office. We can also search and use our own internal records for these purposes.

Credit reference checks

In cases where you apply for a credit product, we will perform credit and identity checks to process your application with one or more credit reference agencies. To do this, we will send your personal information including your name, birthday, and address to these credit reference agencies and they will give us information about you. Our search, whether or not your application is successful, may affect your ability to get credit elsewhere. We will likewise continue to exchange information (e.g., details of your account and how you manage it) with the credit reference agencies while our relationship is ongoing. If you do not repay any debt in full or on time, it will be recorded and this information will be shared to others performing similar checks for tracing and to recover your debts with us. For joint applicants, a financial association link will be created at the credit reference agencies to link your financial records to be taken into account in all of your future applications by either or both of you until either of you apply for a notice of disassociation with the credit reference agencies.

Marketing-related searches

For marketing of our products and services, we will send this out through phone, post, fax, e-mail, and other digital methods such as MMS (Multimedia Message Service) and SMS (Short Message Service). We will never pass your information through to a third party for them to use in their own direct marketing without your consent. You can ask us to stop or start sending you marketing messages at any time by reaching out to us through our contact channels.

We recognize the value of your personal information and strive to maintain its confidentiality, integrity, and availability. We employ physical, technological, and procedural controls to ensure your information is protected. Our employees are also trained to properly handle your information.

When we engage service providers, we ensure they handle your information in line with relevant laws, regulations, and our established internal standards.

The information we have about you will be kept secure for as long as it required by us (even if you close your account) to comply with legal and regulatory requirements, or for operational reasons such as dealing with any queries relating to your account. We normally keep your data for as long as you have a product or are using a service from us and for up to five (5) years after, unless we receive a notice from legal authorities to keep the data for a longer period. We will protect your data for the entire duration that we maintain it.

Your rights in relation to your personal information are as follows:

• The right to access the personal data we hold about you subject to restrictions applied to us by certain laws and regulations;
• The right to be informed about our processing of your personal data;
• The right to have your personal data rectified if it is inaccurate, out of date, or incomplete;
• The right to object to the processing of your personal data, including objecting to being subject to an automated decision-making process and processing of your personal data for direct marketing purposes;
• The right to restrict processing of your personal data by not sharing your personal information to companies that we have business with provided that such information is not critical nor required by applicable laws and regulations in maintaining the services that you have availed with us;
• The right to object to a decision made solely by an automated decision-making process;
• The right to have your personal data erased;
• The right to receive personal data you provided to us in a portable format or to provide it directly to a third party upon your request (i.e., “data portability”); and
• The right to change or withdraw your consent, at any time, to process your personal data.

To exercise any of your above rights, you may reach out to us by e-mailing bpinoy@bpieuropeplc.com.

For further details, you may reach out to us through our contact channels.