DATA PRIVACY STATEMENT

CENTER FOR AGRICULTURE AND RURAL DEVELOPMENT (CARD), INC. (A MICROFINANCE NGO)
DATA PRIVACY STATEMENT

GENERAL STATEMENT

Center for Agriculture and Rural Development (CARD), Inc. (A Microfinance NGO) (“CARD, Inc. (A Microfinance NGO”), including its affiliates and subsidiaries and all members of the CARD Mutually Reinforcing Institutions (“CARD MRI”), values the confidentiality of personal data and committed in maintaining the privacy of its clients. This Data Privacy Statement (“Statement”), details how CARD, Inc. (A Microfinance NGO) uses and protects personal data for the purpose of obtaining the
consent of data subject in accordance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, and its Implementing Rules and Regulations (“DPA”). This Statement also covers the privacy practices for our clients who apply for and obtain products and services from us, such as, but not limited to, deposits, loans, insurance, remittances, and other such products and services that CARD, Inc. (A Microfinance NGO) may offer from time to time.

OUR PRIVACY PRACTICES

The privacy practices described in this Statement are primarily intended for individuals in the Philippines and are designed to comply with the provisions of the DPA. When accessing our websites and/or availing of our services through our unit offices, you acknowledge and agree that your information may be collected, processed, and transferred within the Philippines following legal and regulatory standards for data protection that may differ from your current or home jurisdictions.

WHAT DATA DO WE COLLECT FROM YOU

To provide the client with CARD, Inc. (A Microfinance NGO)’s financial and non-financial products and services and/or to implement client-requested transactions, CARD, Inc. (A Microfinance NGO) shall collect personal information from the client which may include, but are not limited to:
• Name, Age, Date/Place of Birth, Gender, Civil Status, Nationality;
• Address and Contact Details (Home/Business);
• Educational Background;
• Employment History;
• Mother’s Maiden Name
• Financial Information (such as household income, expenses, balances, investments, tax,
insurance, financial and transaction history, etc.);
• Husband/Housewife Information (such as name, citizenship, date of birth, age, gender, place
of birth, occupation, source of income, educational attainment and contact number)
• Legal Dependents and Children’s Information (name, birthday, relationship to applicant,
gender, educational background
• No. of Household Members/Number of Children in School
• Specimen Signature;
• Permits, Licenses & Registrations
• Status of Pending Civil/Criminal Cases (if any)
• FB page conversation through our Customer Service Manager;
• CCTV footage for security purposes;
• Business Address
• Email address (if any)
• Religion
• Health/Disability
• Valid IDs and Photos
• Regulatory Numbers (HDMF/SSS/TIN/SSS/Philhealth)

HOW WE USE YOUR INFORMATION

CARD, Inc. (A Microfinance NGO) uses your personal information to provide the products and services that you have availed or intend to avail from CARD, Inc. (A Microfinance NGO), including and together with following purposes:
• Opening, maintaining, and/or closing of accounts;
• Ease of contacting/communicating with clients;
• Evaluate, approve, provide, or manage applications, financial and non-financial products and
services, and other transactions that the client has requested pursuant to Republic Act 8425
(Social Reform and Poverty Alleviation Act) and Republic Act 10693 (Microfinance NGOs Act);
• Comply with know-your-customer (KYC) information requirements as specified under the
Manual of Regulations for Non-Banking Financial Institutions and other applicable
regulations;
• Conduct of credit and background information checks and verification;
• Evaluate client’s eligibility for CARD, Inc. (A Microfinance NGO)’s products and services, such
as loan inventory and loan validation;
• Client’s segmentation according to age, religion, gender, etc.
• Perform risk profile and risk assessment;
• Perform Loan Utilization Check (LUC);
• Provide extensive and quality support to the client;
• For internal purposes, such as administrative, operational, audit, credit and risk
management;
• Offering and processing of insurance products for the CARD Mutual Benefits Association
• Comply with legal and regulatory requirements such as submission of data to credit bureaus,
credit information companies, the Credit Information Corporation (CIC), CISA, responding to
court orders and other instructions and requests from any local or foreign authorities
including regulatory, governmental, tax and law enforcement authorities or other similar
authorities;
• Perform other such activities permitted by law or with your consent.

WHEN DO WE COLLECT PERSONAL INFORMATION

CARD, Inc. (A Microfinance NGO) collects personal information through, but not limited to, any of the following:
• Face-to-face and/or telephone conversation with CARD, Inc. Customer Service
Representative;
• Accomplishment and/or signing of forms/documents (e.g. loan proposal, MBA Aplikasyon ng
Pagiging Kasapi and Client Information Form, Pre-exit Survey);
• Conducting Background and credit investigation and Loan Utilization Check
• Inquiries to the Credit Bureau such as CIC and MIDAS.

RECIPIENTS OF INFORMATION

We may share your personal information with our subsidiaries, affiliates and third parties, including members of CARD MRI, for the purposes above and with an obligation of confidentiality. Your personal information may similarly be disclosed to government agencies, supervisory bodies, tax authorities, or courts of competent jurisdictions for purposes of complying with SEC MNRC regulations, which CARD, Inc. (A Microfinance NGO) may be subject to such as Republic Act No. 9160 otherwise known as the Anti-Money Laundering Act of 2001 or Republic Act No. 9510 otherwise known as the Credit Information System Act (“CISA”), among others. If necessary, for the efficient delivery of CARD, Inc. (A Microfinance NGO)’s products and services, we may also outsource processing of your personal information to third-party service providers or CARD MRI, consistent with the terms of this Statement and the provisions of the DPA.

HOW WE SAFEGUARD PERSONAL INFORMATION

In accordance with the provisions of the DPA, Bangko Sentral ng Pilipinas (BSP), Securities and Exchange Commission (SEC)-Microfinance NGO Regulatory Council (MNRC), CARD, Inc. (A Microfinance NGO), its employees, agents and representatives, shall handle personal information with utmost care and adhere to the implemented organizational, physical, and technical security measures to maintain the confidentiality, integrity, security, and availability of all personal information under its custody.

HOW LONG DO WE KEEP YOUR INFORMATION

Documents containing your personal information will be retained in the records and systems of CARD, Inc. (A Microfinance NGO) for a period no longer than ten years from the date of the resignation/termination of your account or of the specific transaction with CARD, Inc. (A Microfinance NGO), unless CARD, Inc. (A Microfinance NGO) is required by law to retain the information for a longer period.

YOUR RIGHTS AS DATA SUBJECT

CARD, Inc. (A Microfinance NGO) respects your rights to:
1. Be informed;
2. Object to the processing of your personal data;
3. Have reasonable access to your personal data under the custody of CARD, Inc. (A
Microfinance NGO);
4. Require immediate correction of inaccurate or erroneous personal data under the custody
of CARD, Inc. (A Microfinance NGO);
5. Suspend, withdraw or order the blocking, removal or destruction of your personal data from
CARD, Inc. (A Microfinance NGO)’s records and/or system; and
6. Be indemnified in case of violation of your rights as data subject.

You may reach us for any questions, concerns or requests you may have on your personal data and exercising the above rights.

HOW TO CONTACT US

Should you need to get in touch with us for any data privacy concerns or requests or should you have any questions or clarifications regarding the Statement, you may reach our Data Protection Officer at the following contact information:
Email: cardincdpo@cardmri.com
Telephone Number: (049) 561-2214
Address: 20 ML Quezon St., City Subdivision, San Pablo City, Laguna
Alternatively, you may also e-mail us at ci.compliance@cardmri.com or visit our website at
www.cardmri.com/cardinc/.

CHANGES TO OUR PRIVACY STATEMENT

We may amend or modify the terms of this Statement from time to time to ensure relevance with
the relevant laws and regulations applicable to CARD, Inc. (A Microfinance NGO). Any relevant
modification will be posted on our website and distributed to all CARD, Inc. (A Microfinance NGO)
Centers, Units, Areas and Regions.