1. INTRODUCTION

This Privacy Notice explains how Cebuana Lhuillier Services Corporation (CLSC) collects, uses, stores, shares, and otherwise processes your personal data when you access or use CebX (“CebX”), including all related services, features, and functionalities available through the platform.

CLSC is committed to protecting your personal data and ensuring that it is processed in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules and regulations, and applicable issuances of relevant regulatory authorities.

This Privacy Notice outlines the types of personal data we collect, the purposes for which such data is processed, how it is protected, and your rights as a data subject.

By accessing, registering for, or using CebX, you acknowledge that you have read and understood this Privacy Notice and consent to the collection and processing of your personal data in accordance with the terms set forth herein.

2. PERSONAL DATA WE COLLECT

CLSC may collect and process the following categories of personal data, depending on your use of CebX and the services you avail:

• Identification Information – includes your full name, date of birth, nationality, gender, and details from government-issued identification documents (e.g., ID number, issuing authority, and validity), as required for identity verification and regulatory compliance.
• Contact Information – includes your mobile number, email address, residential or mailing address, and other contact details used for communication, account-related notifications, and customer support.
• Account Information – includes your account number, profile details, and records of your activities within CebX and its affiliates, including login history, account preferences, 24k loyalty rewards and other applicable account information.
• Financial and Transaction Information – includes your eWallet balance, transaction history, remittance details, bills payment records, and other financial data necessary to process and document your transactions.
• Device and Technical Data – includes information about the device and systems you use to access CebX, such as device type, operating system, IP address, mobile network, and application usage data, which may be used for security, fraud detection, and system optimization.
• Communications and Support Data – includes information you provide when contacting customer support, submitting inquiries or complaints, or participating in surveys, promotions, or feedback mechanisms.

CLSC collects only the personal data that is necessary, relevant, and appropriate for the purposes stated in this Privacy Notice and in accordance with applicable laws and regulations.

3. PURPOSES OF PROCESSING

CLSC processes your personal data for legitimate and specific purposes in connection with your use of CebX, including but not limited to the following:

• Account Registration and KYC Verification – to establish and verify your identity, create and manage your account, and comply with customer due diligence requirements under applicable laws and regulations.
• Processing of Transactions and Delivery of Services – to facilitate and complete your financial and non-financial transactions, including eWallet services, remittances, bills payment, e-load, and other services available through CebX.
• Compliance with Legal and Regulatory Requirements – to comply with obligations under applicable laws and regulations, including those issued by the Bangko Sentral ng Pilipinas (BSP), Anti-Money Laundering Council (AMLC), and other government authorities.
• Fraud Prevention, Risk Management, and Security Monitoring – to detect, prevent, and investigate fraudulent, unauthorized, or suspicious activities, and to ensure the security and integrity of the CebX platform.
• Customer Support and Complaint Handling – to respond to inquiries, resolve complaints, conduct investigations, and provide assistance through official customer support channels.
• Service Improvement and System Enhancement – to analyze usage patterns, improve system performance, enhance user experience, and develop new products, features, and services.
• Marketing and Promotional Activities – to provide updates, offers, and information about CLSC’s products and services, subject to applicable laws and your consent where required.

All processing of personal data shall be conducted in accordance with the principles of transparency, legitimate purpose, and proportionality, and only to the extent necessary to achieve the purposes stated above.

4. LEGAL BASIS FOR PROCESSING

CLSC processes your personal data only when there is a valid legal basis under applicable data privacy laws. Such legal bases include:

• Consent – where you have freely given your consent to the processing of your personal data for specific purposes, such as registration, optional features, or marketing communications, subject to your right to withdraw consent at any time.
• Contractual Necessity – where processing is necessary to fulfill CLSC’s obligations in providing CebX services to you, including account creation, transaction processing, and customer support.
• Legal and Regulatory Obligations – where processing is required to comply with applicable laws, rules, and regulations, including those issued by the Bangko Sentral ng Pilipinas (BSP), Anti-Money Laundering Council (AMLC), and other competent authorities.
• Legitimate Interests – where processing is necessary for CLSC’s legitimate business interests, such as fraud prevention, risk management, system security, service improvement, and internal administration, provided that such interests are not overridden by your fundamental rights and freedoms.

CLSC ensures that all processing activities are conducted in accordance with the principles of transparency, legitimate purpose, and proportionality, and are limited to what is necessary for the purposes identified in this Privacy Notice.

5. DATA SHARING AND DISCLOSURE

CLSC may share your personal data with the following parties, only to the extent necessary for legitimate purposes and in accordance with applicable laws and regulations:

• Affiliates within the Cebuana Lhuillier Group – to support account management, service delivery, customer support, cross selling and marketing initiatives, and internal administration across related entities, subject to appropriate data protection controls.
• Authorized Partners, Agents, and Service Providers – including but not limited to billers, remittance partners, payment networks, systems and technology providers, and other accredited third parties, for the purpose of facilitating transactions, delivering services, and maintaining system operations.
• Regulatory and Government Authorities – such as the Bangko Sentral ng Pilipinas (BSP), Anti-Money Laundering Council (AMLC), and other competent authorities, where disclosure is required by law, regulation, legal process, or lawful order.
• Other Disclosures Permitted by Law – CLSC may also disclose personal data where necessary to protect its rights, enforce its Terms and Conditions, prevent fraud or illegal activities, or respond to claims and investigations.

All data sharing shall be carried out in accordance with the principles of transparency, legitimate purpose, and proportionality, and subject to appropriate contractual, organizational, and technical safeguards to ensure the confidentiality, integrity, and security of your personal data.

6. DATA PROTECTION AND SECURITY

CLSC implements appropriate organizational, physical, and technical security measures to protect your personal data against unauthorized access, disclosure, misuse, alteration, or loss, in accordance with applicable laws and industry standards.

• Organizational Measures – CLSC adopts internal policies, procedures, and controls to ensure that personal data is accessed and processed only by authorized personnel on a need-to-know basis, and in compliance with data privacy and information security requirements.
• Technical Measures – CLSC utilizes appropriate security technologies and safeguards, such as encryption, secure authentication mechanisms, system monitoring, and access controls, to protect personal data stored and processed within its systems.
• Physical Measures – CLSC implements safeguards to secure facilities, equipment, and storage systems where personal data is processed or stored, including restricted access and secure handling procedures.
• Third-Party Security – CLSC requires its partners, agents, and service providers to implement comparable security measures and to process personal data in accordance with contractual and regulatory requirements.
• Security Monitoring and Response – CLSC continuously monitors its systems for potential vulnerabilities, threats, or breaches, and implements appropriate incident response procedures to mitigate risks and address security incidents.

CLSC implements reasonable and appropriate organizational, physical, and technical security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction, in accordance with applicable laws and regulations. However, while such measures are designed to provide a high level of protection, no system can be guaranteed to be completely secure. Accordingly, Users are likewise encouraged to take appropriate steps to safeguard their personal information and access credentials.

7. DATA RETENTION

CLSC retains your personal data for five (5) years, in compliance with the applicable regulations of the Anti-Money Laundering Council (AMLC). Thereafter, personal data may be retained for a longer period, as necessary, to fulfill the purposes for which it was collected, or as required or permitted under applicable laws, regulations, or lawful orders, including for the establishment, exercise, or defense of legal claims and ongoing investigations.

Personal data may be retained for the following purposes:

• Fulfillment of Purpose – for as long as necessary to provide services, maintain your account, and carry out transactions and related activities through CebX.
• Legal and Regulatory Compliance – for such period as required under applicable laws, rules, and regulations, including those issued by the Bangko Sentral ng Pilipinas (BSP), Anti-Money Laundering Council (AMLC), and other relevant authorities.
• Legal Claims and Proceedings – for as long as necessary to establish, exercise, or defend legal rights, resolve disputes, or enforce agreements.
• Retention Standards – CLSC shall determine appropriate retention periods based on the nature of the data, the purpose of processing, and applicable legal or regulatory requirements.

Once personal data is no longer necessary for the purposes stated above, CLSC shall ensure that such data is securely deleted, disposed of, or anonymized, in accordance with applicable data protection and security standards.

8. YOUR RIGHTS

In accordance with the Data Privacy Act of 2012 and its implementing rules and regulations, you have the following rights as a data subject:

• Right to be Informed – You have the right to be informed about how your personal data is collected, used, processed, and shared, including the purposes of processing and the parties to whom your data may be disclosed.
• Right to Access – You may request access to your personal data held by CLSC, including information on how it has been processed, subject to applicable procedures and requirements.
• Right to Rectification – You have the right to request the correction or updating of any inaccurate, incomplete, or outdated personal data.
• Right to Object or Withdraw Consent – You may object to the processing of your personal data or withdraw your consent at any time, where processing is based on consent, subject to legal and contractual limitations.
• Right to Erasure or Blocking – You may request the deletion, blocking, or removal of your personal data, particularly where such data is no longer necessary for the purposes for which it was collected, subject to retention requirements under applicable laws and regulations.
• Right to Lodge a Complaint – You have the right to file a complaint with the appropriate regulatory authority, such as the National Privacy Commission (NPC), in case of any violation of your data privacy rights.

Requests to exercise these rights may be subject to verification of identity and applicable procedures, and CLSC may decline or limit such requests where allowed under applicable laws or regulations.

9. CONSEQUENCES OF REFUSAL

The provision of certain personal data is necessary for CLSC to fulfill its legal and contractual obligations in providing CebX services.

Failure or refusal to provide the required personal data, or withdrawal of consent where applicable, may result in:

• Inability to Register or Verify an Account – CLSC may be unable to create or activate your account or complete KYC verification as required by applicable laws and regulations;
• Account Suspension or Termination – CLSC may suspend, restrict, or terminate your account where continued processing of personal data is necessary for compliance with legal, regulatory, or security requirements.

Such consequences are necessary to ensure compliance with applicable laws, including those issued by the Bangko Sentral ng Pilipinas (BSP), Anti-Money Laundering Council (AMLC), and other relevant authorities.

10. COOKIES AND APP DATA

CebX may use cookies and similar technologies (such as device identifiers, analytics tools, and application data) to support the operation and security of the platform.

These technologies may be used for the following purposes:

• Improving User Experience – to remember your preferences, maintain session continuity, and enable smoother navigation within the application;
• Analyzing Usage and Performance – to collect information on how Users interact with CebX (e.g., features used, frequency of access), in order to monitor performance, identify issues, and improve system functionality;
• Enhancing Security – to help detect and prevent unauthorized access, fraudulent activities, and other security risks through device recognition and activity monitoring.

The data collected through these technologies may include device information, IP address, application usage data, and other technical information, but does not directly identify you unless combined with other personal data.

You may manage certain device or application settings to control the use of these technologies; however, disabling them may affect the functionality or availability of some features of CebX.

11. UPDATES TO THIS PRIVACY NOTICE

CLSC may update or revise this Privacy Notice from time to time to reflect changes in applicable laws and regulations, business operations, system enhancements, or data processing practices.

• Notification of Changes – Any updates to this Privacy Notice shall be communicated to Users through official channels, such as the CebX platform, website, email, SMS, or other appropriate means.
• Effectivity of Updates – Updates shall take effect upon the date indicated in the revised Privacy Notice, unless otherwise stated.
• User Responsibility – Users are encouraged to review this Privacy Notice periodically to stay informed of how their personal data is being processed.
• Continued Use as Acceptance – Continued use of CebX after the effectivity of the updated Privacy Notice shall constitute the User’s acknowledgment and acceptance of such changes.

12. CONTACT US

If you have any questions, concerns, requests, or complaints regarding this Privacy Notice or the processing of your personal data, you may contact CLSC through: [email protected].

You may contact us to:

• request access to or correction of your personal data;
• exercise your rights as a data subject;
• raise concerns or complaints regarding data privacy; or
• seek clarification on how your personal data is processed.

All requests and inquiries shall be subject to identity verification and applicable procedures, and CLSC shall endeavor to respond within a reasonable period in accordance with applicable laws and regulations.

If you are not satisfied with the resolution of your concern, you may escalate the matter to the National Privacy Commission (NPC), without prejudice to other legal remedies available under applicable laws.

13. ACCEPTANCE

By accessing, registering for, or using CebX, you acknowledge that you have read and understood this Privacy Notice and agree to the collection, use, and processing of your personal data in accordance with its terms.

Where required, your consent may be obtained through appropriate means (e.g., clicking “Agree” or similar actions within the application). Continued use of CebX constitutes your acceptance of this Privacy Notice.

If you do not agree with this Privacy Notice, you should discontinue your use of CebX.